Acca p7 Aaa Technical Articles
Acca p7 Aaa Technical Articles
ACCA
ADVANCE AUDIT AND ASSURANCE
TECHINICAL ARTICLES
PAGE
EXAM TECHNIQUE FOR ADVANCED AUDIT AND ASSURANCE 3
AUDITOR REPORTING 46
PROFESSIONAL SCEPTICISM 78
ACCOUNTING ISSUES 90
FORENSIC ACCOUNTING
94
AUDITOR LIABILITY 99
GOING CONCERN
149
FORENSIC AUDITING
173
will be tested on the IAASA’s Ethical Standard for Auditors (Ireland) 2016, and
SGP candidates should also refer to the ISCA Code of Professional Conduct and
Ethics (Revised November 2015).
You will be familiar with ACCA’s Code of Ethics from the Audit and Assurance
exam. This mirrors the IESBA’s Code of Ethics so you will be familiar with the
five basic principles of Integrity, Objectivity, Professional Competence and Due
Care, Confidentiality, and Professional Behaviour. You will also be familiar with
the general areas of threat to the fundamental principles of Self Review, Self
Interest, Advocacy, Familiarity, and Intimidation.
The situations you will be appraising at this level will usually involve an
assessment of those same principles within scenarios given in the question. In
addition, you may be expected to identify situations where the auditor is at risk of
assuming a management responsibility with respect to providing additional
services to audit clients or appreciate the differences between listed (or other
public interest entities) and non-listed clients when it comes to applying these
principles.
With regards to objectivity and independence, the general conceptual approach
in the codes is as follows:
(a) Identify threats to independence
(b) Evaluate the significance of the threats identified, and
(c) Apply safeguards, when necessary, to eliminate the threats or reduce
them
to an acceptable level.
When the professional accountant determines that appropriate safeguards
are not available or cannot be applied to eliminate the threats or reduce
them to an acceptable level, the professional accountant shall eliminate the
circumstance or relationship creating the threats or decline or terminate
the audit engagement.
HOW TO APPLY THE KNOWLEDGE
When addressing ethical situations in the exam, you will usually have to
demonstrate these skills:
that you can identify an ethical threat
that you understand how it arises and the implication of the threat,
and
that you can relate the guidance to the specific scenario to
determine the safeguards or course of action required.
Each of these skills can be illustrated through the examples below (note that the
answers provided here are focusing on the ethical issues arising and do not
cover the professional or other issues you might also need to discuss arising
from the scenarios). These answers are not fully comprehensive and give an
example of the content which could be produced in an exam. There are further
points in each case that could be developed and additional outcomes available
within the ethical codes; however, they do represent a well-developed answer a
candidate could use to attain the full marks available.
Example 1
The audit committee of, Mumbai Co, has asked the partner to consider whether it
would be possible for the audit team to perform a review of the company’s internal
control system. A number of recent incidents have raised concerns amongst the
management team that controls have deteriorated and that this has increased the
risk of fraud, as well as inefficient commercial practices. The auditor’s report for the
audit of the financial statements of Mumbai Co for the year ended 31 March 2016
was signed a few weeks ago. Mumbai Co is a listed company.
Required:Comment on the ethical issues raised and the actions your firm should
take in response to the client’s request.
(6 marks)
Providing a review of the company’s system and controls gives rise to a self-review
threat as these controls will then be reviewed by the firm when determining our
audit strategy. The firm may be reluctant to highlight errors or adopt a
substantive approach during the audit as this may highlight deficiencies in the firm’s
work on the additional service. (1 mark)
Apply the guidance to the scenario – evaluate the significance and suggest
safeguards
However, this answer could score three marks, it is likely that more marks are
available. From an exam technique point of view, you should be looking for
additional points to make. At this stage, don’t start speculating about relative fee
size; try to focus on the information the examiner has given you. Here, the
company is flagged as listed, so there must be further development available on
this area. Think about how you’ve seen management responsibility issues
overcome during your studies and past question practice. It is these points that
you can use to attract further marks.
Conclude
Example 2
Your firm’s advisory department has been carrying out a due diligence assignment
on a potential acquisition target of an audit client, Blue Co. The management team
of Blue Co has also approached White & Co to ask whether representatives of the
firm would be available to attend a meeting with the company’s bankers, who they
are hoping will finance the acquisition of Red Co, to support the management team
in conveying the suitability of the acquisition of Red Co. For the meeting the bank
requires the most up-to-date interim accounts of Red Co with the accompanying
auditor’s independent interim review report. Your firm is due to complete the interim
review shortly and the management team of Red Co has requested that the interim
review is completed quickly so that it does not hold up negotiations with the bank,
stating that if it does, it may affect the outcome of the next audit tender, which is
due to take place after the completion of this year’s audit.
Required:Comment on the ethical issues raised and recommend any actions your
firm should take in response to the client’s requests.
(8 marks)
Demonstrating you understand the threats, how they arise and the implication
Attending a meeting with the bank would give rise to an advocacy threat as we
would be perceived as promoting the interests of our client and confirming the
client’s assertions in negotiations. (1 mark)
In addition, this may give rise to legal proximity exposing the firm to potential
litigation. (1 mark)
Attending the meeting may result in the firm being perceived to support the
acquisition of Red Co. As these are decisions which should be taken by
management we could be perceived as taking on a management role.
(1 mark)
Self-review threats may also arise when we later audit the finance and acquisition
in the financial statements of the group as we may be reluctant to highlight
errors or are less sceptical about the values in the subsidiary as we have
provided the due diligence work. (1 mark)
Further, an intimidation threat exists as the client has threatened that if the interim
report is delayed it would affect the outcome of the tender for audit in the future
and there is a risk that quality is reduced in order to meet the client’s
demands. (1 mark)
Apply the guidance to the scenario – evaluate the significance and suggest
safeguards and concludeHere, there are different directions that the answer
could take – for example, discussing in depth the exact nature of the assignment
and meeting attendance; however, it is possible to attract marks without such
detail in your answer as follows:
Note that, in this instance, a separate team for the due diligence and audit
assignments was not suggested as the scenario already told us that a different
department had been carrying out the due diligence work.
CONCLUSION
The above two examples aim to cover a range of issues and illustrate how
candidates can attract strong marks when answering ethics questions. As with
most areas of the Advanced Audit and Assurance exam, it is the application of
knowledge to a scenario rather than the knowledge itself that will attract marks.
This means that when preparing for this exam, a good grasp of the knowledge
underpinning the syllabus is important but practising questions and developing
the skills of applying that knowledge is key to passing.
Written by a member of the P7 examining team
Part 2 – Risk
/ Element: Page Intro Block: Text
Risk is examined in several ways within the Advanced Audit and Assurance
syllabus and understanding the difference between these can be key to scoring
good marks in the exam. Quite often, risk forms part of a planning question but it
is also examined with respect to financial reporting issues elsewhere in the
exam.
The key to attaining good marks for risk comes from understanding the types of
risk you are looking for and explaining them in the correct context. As with many
areas of the exam, good exam technique can be used to increase the marks
attained without having to rote learn much additional information. It is application
and understanding that is important at the Professional level.
This article will demonstrate how to maximise marks on these areas using
effective exam technique. It is, however, specific to the context of auditing and
assurance and will therefore have a different focus and application to the way
risks are examined in other areas of the ACCA Qualification.
What you need to know
The three main types of risk you might be asked to evaluate in the exam are
business risk, risk of material misstatement and audit risk. These are defined as
follows:
Business risk A risk resulting from significant conditions, events, circumstances,
actions or inactions that could adversely affect an entity’s ability to achieve its
objectives and execute its strategies, or from the setting of inappropriate
objectives and strategies (ISA 315)
Risk of material misstatement (RoMM) ‘The risk that a material misstatement
exists in figures or disclosures within the financial statements prior to audit’
(IAASB – glossary of terms)
Audit risk ‘The risk that the auditor expresses an inappropriate audit opinion
when the financial statements are materially misstated. Audit risk is a function of
material misstatement and detection risk’ (IAASB – glossary of terms)
How they interact You should know from your study of Audit and Assurance that
the audit risk model is comprised of:
Audit risk = RoMM x detection risk
For a risk of misstatement to occur there must be an inherent risk of an item
being misstated and a risk that the client’s controls did not identify and correct
this misstatement. When you are asked to evaluate RoMM in an exam, the
examiner is looking for those inherent and control risks and, in many cases,
these arise from underlying business risks.
For something to be an audit risk, there must be either a RoMM or a detection
risk, the risk that the auditor’s procedures do not identify a material misstatement
in the financial statements.
How to apply the knowledge
Knowing these definitions will help you to remember which type of risk is which or
to categorise risks into these sub types but it is not something you will be
awarded direct credit for in an Advanced Audit and Assurance exam.
Remember that you are often being asked to prepare an answer for the attention
of the audit engagement partner, who will certainly not need these terms
explained. Therefore, these definitions are so that you know what type of risk you
are looking for in a question but the marks will be awarded for your evaluation of
these risks.
Let’s consider an example of information that may be provided in the exam and
how your answer would differ for each of the risk types you might be asked to
evaluate. The following is an extract from the published September/December
Block: Text
Business risk For the purpose of the exam, these risks can usually be thought
of in terms of conditions that may prevent a business from meeting its objectives
and might include risks to achieving future profits or cashflows or to business
survival. This is a simplified explanation, but will help you describe the
implications of most risks you come across in the exam. There will be some risks
whose explanation is more involved and you can find examples of these in past
exams.
In general, you are looking for risks in the information that the examiner has
presented to you within the scenario. You will be asked to evaluate those risks.
At this level you will not be credited for defining business risk, nor will you
receive credit for describing what a client could do to mitigate those business
risks.
As set out in the ISAs, the focus of business risk evaluation as part of the audit
process is identifying matters that could impact on audit planning, in particular
matters that could give risk to risks of material misstatement or audit risks.
The focus in the Advanced Audit and Assurance exam is therefore quite different
from other strategic level exams where you might be expected to consider risks
from a business perspective and to describe methods the business may use to
manage those risks. If you stray into risk mitigation from a business perspective
rather than an auditor’s perspective you are wasting valuable time on making
points that cannot score marks.
As such, you need to consider how to frame the information which is provided as
10
a business risk. As a general rule, marks for business risks will be awarded along
the following lines:
For identifying only without meaningful explanation, ½ mark
For a briefly explained business risk, 1 mark will be awarded, and
Full marks will only be awarded where a well explained business
risk is presented.
Marks will not be awarded for points that are purely speculative – ie not based on
specific information provided in the question scenario – nor will marks be
awarded for business risks that do not impact on the audit.
Let’s now apply that logic to the example provided above:
11
Block: Text
It is also possible that a risk can have other implications or alternative
descriptions that are valid and, if the answer was developed in one of these
directions, that would still attract credit. For example, the following would also be
an appropriate way to fully explain the same risk:
Block: Text
In an exam such as this, it’s reasonable to assume that the examiner has given
you each piece of information for a reason. It is likely to be relevant to one of the
requirements and the examiner will often flag if there are areas which you should
not consider. A good technique is to try and identify risks in each paragraph –
there could be more than one but there is unlikely to be a section of text that
does not flag something relevant for at least one requirement.
Another thing to watch for is describing risks that are speculative or insignificant
in the context of the scenario you are given. There will be sufficient risk areas
described in the scenario to score maximum credit if they are well described. If
you find yourself hypothesising about potential issues that may affect the client,
but you don’t have enough information to know if it’s a risk or not, then you are
likely to be making irrelevant or marginal points. While it is true that valid risks –
beyond those on the marking guide – can attract credit, it is much easier and less
risky to use those that are flagged by the examiner.
Risks of Material Misstatement (RoMM) RoMM often follow from business risks
and are the impact that those risks might have on the financial statements. It can
be good practice during preparation for the exam to try and think of how a
business risk might affect the financial statements every time you are analysing
them. You are looking to convert that business risk into an impact on the
calculation or disclosure of items within the financial statements.
When describing RoMMs, an effective approach is to use the following steps to
construct your answer
Calculate and conclude on the materiality of the issue where sufficient
information is available – a mark will be given for a correct and relevant
calculation of materiality with an appropriate conclusion – this will only be
awarded once per issue and materiality marks may be capped in an exam
12
question.
Briefly describe the relevant financial reporting requirement – note that no
credit is awarded for the accounting standard names or numbers, only the
accounting treatment.
Relate the risk in the scenario to the accounting treatment.
Illustrate the impact of the risk on the financial statements
In general, there will be credit available for each of these processes and you
should recall this approach every time you tackle a question requirement on
evaluating RoMM.
Let’s consider the business risk we looked at above. The issue of bespoke
machinery with an upfront payment can affect the financial statements in terms of
revenue recognition, when dealing with the upfront payments, and inventory
valuation. For the purposes of the exam, these two accounting issues are likely
to be assessed as two separate RoMMs.
Applying this to the scenario we have above, the following illustrates a possible
answer that could be written under exam conditions and would score full marks
for each of the addressed risks.
Work in progress is valued at the lower of cost and NRV where cost
includes all the costs of purchase and conversion including
overheads of getting the item to its present location and condition.
13
Block: Text
Audit risks Where you are asked to evaluate audit risks in an exam, much of
your answer would be the same as for a requirement asking for risks of material
misstatements as these form the major part of audit risk. The difference here is
that detection risk is now also relevant. Examples of detection risk could include
a recent appointment as the auditor, inexperience in a client’s new market or time
pressure for the audit.
If the information provided in the example we have been using included the
following information:
You are the audit manager of Dali Co, a new audit client of your firm.
The partner has asked you to plan the audit for 31 December 2015 and
has provided you with the following information after a discussion with
the client.
Block: Text
Then, in addition to the RoMMs we have discussed, there would be an additional
audit risk.
We are newly appointed auditors of the client and, as such, do not have
the same level of understanding of the client’s business and controls as
we would for an existing client. As such, we may fail to recognise certain
RoMMs or may apply inappropriate procedures due to this lack of
understanding
Block: Text
There are two common errors candidates make in the exam around the issue of
a new client. First, some candidates consider that a new auditor is a business
risk or gives rise to a RoMM. This is incorrect. The underlying business is the
same regardless and it is only detection risk that alters.
The second is to assume that a new manager on an assignment is the same as
having a new client. The audit partner and the knowledge of the client within the
14
15
You are the manager responsible for the audit of Osier Co, a jewellery
manufacturer and retailer. The final audit for the year ended 31 March
2017 is nearing completion and you are reviewing the audit working
papers. The draft financial statements recognise total assets of $1,919
million (2016 – $1,889 million), revenue of $1,052 million (2016 – $997
million) and profit before tax of $107 million (2016 – $110 million).
16
In this question you can open with the materiality of the impairment. The
impairment loss of $9m represents 0.47% of total assets and 8.41% of
profit before tax and is material to the statement of profit or loss (1 mark
for an appropriate calculation and conclusion).
You should then state the underlying rule that an indicator of impairment
triggers an impairment review and define impairment and recoverable
amount. (1 mark)
Block: Text
Most of the credit will be available for determining and explaining the risks arising
and applying the accounting treatment to the information you have available.
We’re told that
Carrying value is $137m
Net realisable value is $125m - £1.5m = $123.5m (you will
generally receive ½ mark for calculating this figure)
Value in use is estimated at $128m
Recoverable amount is therefore $128m based on management’s
calculations
Impairment write off was based on value in use and has been pro-
rated against assets based on the original carrying value of the assets in
each unit.
17
As auditors we need to look for risks in the process and treatment. Based on the
information you can conclude that the carrying value is relatively low risk – we
audited last year’s figures and it’s not an inherently risky area in general so in the
absence of other information to the contrary you need to focus on the more risky
areas.
The net realisable value carries some risk – external offers though are a good
source of evidence and while not set in stone there have been several parties
interested so it’s likely that the company would be able to sell the retail outlets for
that price.
So what are the key risk areas and the matters which should be
considered?
Risk 2 – The value in use is the major source of risk. The calculation is
complex and judgemental and so is inherently risky. It has been
calculated by management who may be biased to keep the impairment
loss as low as possible. The calculation was based on historic cash
flows with 1% annual growth which appears unrealistic given that retail
sales have fallen not grown at 1%.
If the forecast used is overly optimistic then the impairment write off is
insufficient and therefore assets are overstated and profit is overstated
(as expenses are understated).
Block: Text
The matters part of this question as illustrated within the boxes above and
answer points which focussed on these risk areas would attract maximum credit
for that part of the question.
As this was a matters and evidence question remember that you also need to go
on to explain evidence you would expect to find on the audit file. The requirement
is for the evidence to be explained in these questions so listing sources of
evidence is not sufficient. Your answer points must also explain what they are
providing evidence of in order to attract high marks. If you write out evidence as a
list of described procedures then this will be acceptable and well described,
relevant procedures will generally receive a mark each.
18
Example 2 – Intangibles
Intangible assets are non-monetary assets without physical substance such as
patents, trademarks, customer lists, quotas, brands, franchise agreements etc
A summary of the key financial reporting principles from IAS 38 Intangible Assets
is provided below:
Intangible assets must be - identifiable (capable of being separated
and sold/transferred and arise from contractual or other legal rights) -
controlled - provide future economic benefits
In order to be recognised as an asset there must be a probable
future economic benefit arising from the asset and the cost must be
capable of reliable measurement. If this is not possible then expenditure
on the asset must be recognised as an expense. This is why internally
generated brands and customer lists are not allowed to be recognised but
purchased ones can be (including those purchased as part of the
acquisition of another company)
Subsequent treatment of intangible assets will be either on a
historical cost basis or under a fair value model if it is possible that fair
value can be determined by reference to an active market (eg production
quotas, taxi licences).
Exam focus
Block: Text
Intangible assets will either have a finite life (a limited period of
benefit to the company over which the asset will be amortised with the
amortisation expense being charged to profit and loss) or an indefinite life
(where no foreseeable limit to the period of economic benefits exist –
hence no amortisation is charged)
Where an asset is deemed to have an indefinite life it is not
amortised but the useful life should be reviewed every reporting period to
determine whether events continue to support an indefinite life and
additionally, the asset should be assessed for impairment each reporting
period.
All intangible assets are subject to an impairment review where
there is an indicator of impairment.
Recent example – Sample March/June, Question 1
This is an extract from a planning question which asked candidates to evaluate
risks of material misstatement arising from a scenario where the Group holds
several purchased brand names for products.
19
Acquired brand names are held at cost and not amortised on the
grounds that the assets have an indefinite life. Annual impairment
reviews are conducted on all brand names. In December 2016, the
Chico brand name was determined to be impaired by $30 million due to
allegations made in the press and by customers that some ingredients
used in the Chico perfume range can cause skin irritations and more
serious health problems. The Chico products have been withdrawn from
sale.
Block: Text
How this should be written up in a risk question has been illustrated in the
second article in this series.
Here, the company has decided to hold brands at cost as they deem them to
have an indefinite life – this is an acceptable treatment under IAS 38 however the
important part of the standard which we need to consider is that this should only
be done if there is no foreseeable limit to the periods of benefit. There’s also a
requirement that this assumption should be reviewed annually and additionally
an impairment review performed. The scenario tells us that an impairment review
has been performed but not that a review of the indefinite life has occurred hence
there is a risk that this may not have been done
That decision to hold the brands with an indefinite life is a judgement call on
behalf of management – judgements are subjective and therefore are a source of
inherent risk. Quite often the justification for such a decision would be linked back
to expenditure on the brand and marketing efforts along with market research.
These costs cannot be capitalised but do provide evidence to support an
indefinite life.
Similarly, impairment reviews for a brand would be looking at value in use based
20
on the discounted value of future expected cash flows which is complex and
judgemental.
In the exam you need to communicate these risk areas arising above- an
example of a description for each that would be sufficient in an exam is shown
below:
Risk 2 – Management may not have reviewed the useful life of the
brands in the reporting period to ensure that the assumption of indefinite
life is still correct
Block: Text
The scenario goes on to describe the impairment of the Chico brand after
allegations made about the products. The products have been withdrawn from
sale. This brings in the impairment consideration in more detail. Here there has
been a specific indicator of impairment for both the brand and inventory relating
to Chico and therefore poses more risks.
Risk 4 – The impairment of the Chico Brand may not be sufficient (we
can’t tell if it has been fully written down IAS 36)
Exam focus
21
Block: Text
Conclusion
The above examples aim to demonstrate how candidates can effectively apply
their accounting knowledge in the Advanced Audit and Assurance exam in order
to maximise their marks in a variety of questions including those which cover
planning and matters and evidence considerations. As with most areas of the
Advanced Audit and Assurance exam, it is the application of that accounting
knowledge to a scenario rather than the knowledge itself which will attract marks.
This means that when preparing for this exam, a good grasp of the accounting
knowledge underpinning the syllabus is important but practising questions and
developing the skills of applying that knowledge is the key to passing.
Written by a member of the P7 examining team
22
Note that these learning outcomes require candidates to design or describe audit
procedures not simply provide a list of sources of evidence or a verb with no
purpose such as review. When audit procedures are required as part of the exam
it is expected that for credit to be awarded, candidates will describe the
procedure in sufficient detail to demonstrate that they understand what it is trying
to corroborate and what underlying piece of evidence will assist with that
process. A good rule of thumb is to ask, if you gave your list of procedures to a
new trainee auditor, would they know what to do, how to do it and why they are
doing it? If there is a specific source of information and an action that is aimed at
a specific purpose, then the answer is more likely to be complete and
understandable.
Structuring procedures
In the AAA exam, procedures are often examined in planning questions where
you may be required to plan audit procedures over a specific area of risk, or later
in the audit, when reviewing the evidence you would expect to find on the audit
file when it is reviewed by the manager or partner. For both requirements, the
basic principle is the same. The marking guides in published questions state 'up
to 1 mark for each well described audit procedure' hence a poorly described
procedure will not obtain 1 mark, it will obtain at most ½ mark.
Simple example (note this is for illustration and is not indicative of an AAA
scenario)
The client has purchased a new machine for use in production of widgets.
Design the principle audit procedures to be performed in respect of the new
machine.
A good start to answering the question would be to consider what assertions
need to be covered. Here the auditor will want to know whether the machine is
owned by the company, its existence, and its valuation.
We can address valuation and ownership at the same time for an outright
purchase using the invoice in most cases. This should be an easy mark in the
exam and everyone should be aiming for a full mark for this procedure. Consider
the answers below
Strong answer
Obtain the purchase invoice for the machine and confirm the purchase value to
the non-current asset register and ownership of the machine - 1 mark
Weak answers
Review purchase invoice – this would score ½ mark- this does not state what
the invoice is being reviewed for or what assertion is being targeted.
Purchase invoice – this would score no marks – this is a source of evidence
but without an action is not a procedure.
Review the relevant document- this would score no marks – there is no
detailed action or purpose and no identifiable source.
For the existence of the machine, we could physically examine it
Strong answer
Physically examine (or inspect) the asset to confirm it exists - 1 mark
Weak answers
Physically examine machine - this would score ½ mark – not tied to an
23
24
Block: Text
This example relates to a decommissioning provision for an event which is
occurring the future. This means that the exact amounts will be unknown and that
a level of estimation and judgement is inherently part of the amount. This
illustration will focus on only the amount (completeness and accuracy) of the
provision (ignoring for this illustration the need to establish that the obligation
exists to decommission the facilities). The provision should be measured at the
best estimate of future costs discounted to present value. When the provision is
created the debit is to PPE but changes in estimates thereafter affect the profit
for the year. In order to assess that the amount is appropriate certain issues must
be evaluated:
The estimate of useful life and timing of the predicted
decommissioning costs (most will be used between 2025 and 2040 but
some as far ahead of 2046)
The discount factor used to calculate the provision (it’s gone up
which will decrease the present values of the cash flows)
The estimates of the cost of decommissioning (based on
information available today)
The process of the calculation of the provision amount
(management has previously used an external expert but have calculated
the figures themselves this year and the provision has reduced so
management might be using the release of the provision to increase
profits)
From a testing point of view each of these elements should be considered and
the appropriateness of them assessed. Before that can happen, we need to
obtain the calculation we are performing work on. The table below shows a range
of procedures to answer this question which would score full marks and
examples of weaker answers with how many marks they would obtain shown
against each.
Block: Text
25
26
Block: Text
There are a few things to note about this table. Firstly, the testing has been
tailored to the information which was available in the question – the change in
interest rates, the change in how the estimate is prepared (management vs
external expert). Secondly the procedures must be specific to obtain credit – try
to use an action, (it can be useful to refer to the testing techniques in ISA 500,
Audit Evidence – for example, inspect, recalculate etc), a source and a purpose.
Without these you are not describing enough detail at this level of exam. And
thirdly, the final three answers in the weak answer section are not obtaining
27
credit here. This third point is a common area where candidates use rote learnt
points without considering their appropriateness and relevance to the scenario
and each is considered further below.
Written representations from management
Written representations from management are used to support other audit
evidence relevant to the financial statements or one or more specific assertions
in the financial statements. They are often requested where management’s
intentions can affect the validity of a judgement. They should not be used as the
only audit evidence to support an assertion, and should not be used if it is
possible to obtain the evidence without need of a written representation. In the
previous example, obtaining a written representation that management’s
judgement of the discount factor is correct is not wholly appropriate. The auditor
can assess the discount factor with respect to external factors and actual rates
incurred by the company, so there are other more relevant and reliable sources
of evidence
If the scenario focuses on management’s intentions, written representations
could be appropriate, for example the intent to sell a building, or to close down a
division. There would still be a requirement however to obtain corroborative
evidence. If candidates use a written representation from management as a
procedure in the exam then it must be appropriate and the specific content and
purpose of the representation should be described. An example of the
appropriate use of a written representation and the contents is illustrated below:
March/June 2018 Q2b procedures to be performed on a profit forecast to be
used to obtain bank funding
Obtain written representation from management regarding the
completeness of significant assumptions AND accepting their
responsibility for the forecast (this is required by ISA 3400, The Exam of
Prospective Financial Information and therefore is appropriate), or
Obtain written representation from management the bank overdraft
will be repaid by 1 September 2019 (note this is management’s intention
and can be part of the evidence for justifying that it is appropriate that
there is no overdraft interest in the forecast after that date)
A final point on written representations from management, is that where
management are not believed to be reliable, for example they have been
showing signs of earnings management and inappropriate judgements, then
written representations are not likely to be a reliable form of evidence.
Review board minutes
Often candidates include this as part of every answer to every requirement
without considering whether it is likely to be discussed at board level or in what
detail. This procedure might be relevant when supporting management’s
intentions regarding strategy or approval regarding major decisions such as
acquisitions, but it is not likely to be the case that the board of directors approve
every individual asset purchase (rather than the capex budget as a whole) or
every allowance for slow paying customers. If it isn’t something the board discuss
then candidates won’t be credited for this as a procedure. In addition, the
purpose of reviewing the board minutes will need to be stated in order for any
28
credit to be awarded.
Strong answer
Confirm that the acquisition of the new subsidiary was approved by the board
through review of board minutes - 1 mark
Weak answers
Review board minutes for approval (½ mark – not stated approval of what)
Review board minutes for acquisition (½ mark - does not state what information
regarding the acquisition is being obtained from the board minutes)
Review board minutes (would score no marks – this will not receive credit as it
is not specific to the scenario at all)
Agree to the financial statements
This is another area where candidates appear to make a general statement that
is often not appropriate. For example, in the March/June 2018 Q4 candidates
testing the elimination of the intercompany balances often stated to check the
elimination of a single transaction between two of the group companies to the
financial statements. By their nature financial statements are aggregate figures
and do not show every transaction. The elimination would be something that
could be agreed to a consolidation schedules but will not be visible in the
financial statements issued by a company. The distinction between detailed
management accounts, breakdowns of the figures in the financial statements,
consolidation schedules and the financial statements themselves should be
something that candidates at this level appreciate. To obtain marks for agreeing
something to the financial statements it will be necessary that the item can be
seen in the financial statements or the notes and that the specific detail of what is
being agreed is stated.
Strong answer – for example, for an acquisition in the year
Confirm disclosures in the financial statements include the date of acquisition,
the fair value of consideration and the fair value of the net assets acquired (1
mark – note this isn’t everything that IFRS® 3 Business Combinations requires
to be disclosed but it does give some specific details that shows understanding
of the sorts of disclosures required)
Weak answers
Agree to financial statements – this would score no marks – no detail of what
is being agreed
Agree the amounts for the acquisition have been disclosed in the financial
statements – this would score ½ marks – no specific detail of the items to be
disclosed
Conclusion
As can be seen from the discussion above, a good structure for presenting
procedures (action- source-purpose) is key to obtaining strong marks on this
section of the exam. For a candidate to score well they will need to be able to
adapt the procedures to the details given in a scenario and question whether the
source is appropriate. Past question practice is a good start for expanding the
range of procedures in a candidate’s toolkit and the ability to tailor answers to the
specific circumstances in the exam they are sitting.
29
30
Common error in the exam – candidates often state that the first of
these opinions is incorrect and that the report should state the
financial statements are true and fair – this is not the case, either
wording is allowed by the standard.
Block: Text
Modified opinions
The next thing a candidate needs to have clear in their mind are the possible
modifications for opinions. These arise if the auditor
is not able to obtain sufficient appropriate audit evidence
determines uncorrected material misstatements exist, or
has concluded that the financial statements are NOT prepared, in
all material respects, in accordance with the requirements of the
applicable financial reporting framework which includes consideration of
the qualitative aspects of the entity’s accounting practices, including
indicators of possible bias in management’s judgments.
Where this is the case the auditor will need to assess whether the issues
considered are material or material and pervasive.
ISA 705 (revised), Modifications to The Opinion in The Independent Auditor’s
Report identifies three types of modified opinion:
Qualified opinion – where the auditors concludes either that the
misstatements in the financial statements are material but not pervasive
(qualified on the basis of material misstatement) or the auditor is
unable to obtain sufficient appropriate audit evidence on which to base the
opinion but conclude the possible effects on the financial statements of
undetected misstatements would be material but not pervasive (qualified
on the basis of an inability to obtain sufficient audit evidence).
Qualified opinions are given in the form of 'except for' opinions and
examples of the wording for such opinions can be found in ISA 705
(revised) para 17
adverse opinion – where the auditor concludes that the material
misstatements in the financial statements are pervasive (therefore they do
not present fairly/are not true and fair) and,
a disclaimer of opinion where the auditor concludes that there is
insufficient evidence on which to base an opinion and the possible effects
of undetected misstatements are material and pervasive
In order to distinguish between these types of modified opinion a candidate must
determine two things
Is there a material misstatement or is there insufficient evidence to
know whether there is a material misstatement, and
Is the effect material or material and pervasive?
In determining whether a misstatement is pervasive ISA 705 (revised) gives the
following definition:
31
Block: Text
Basis for opinion paragraph
The auditor’s report contains a paragraph after the opinion paragraph describing
the basis on which auditors form their opinion. Where a modified audit opinion is
given the details of the misstatements or the inability to obtain sufficient
appropriate audit evidence will be provided.
Block: Text
Block: Text
Other modifications to the auditor’s report
In a requirement that asks candidates to consider the effect on the auditor’s
report rather than the effect on only the audit opinion, there are other
modifications which should be considered.
Emphasis of matter (EoM) – used by auditors where they consider that there is
a matter correctly presented or disclosed in the financial statements that the
auditor deems to be of fundamental importance to a user’s understanding of the
financial statements. This paragraph is used to draw attention to the matter being
emphasised by referring to where it is presented and disclosed in the financial
statements. This paragraph is not used for going concern uncertainties.
Block: Text
32
Block: Text
Other matter (OM) – used by auditors where they consider it necessary to
communicate a matter other than those presented or disclosed in the financial
statements that is relevant for a user’s understanding of the audit, auditor’s
responsibilities or the auditor’s report.
Other information
ISA 720 (Revised), The Auditor’s Responsibilities Relating to Other Information
also requires the inclusion of an Other Information paragraph which includes:
A statement that management is responsible for the other
information
An identification of:
other information, if any, obtained by the auditor prior to the
date of the auditor’s report, and
for an audit of financial statements of a listed entity, other
information, if any, expected to be obtained after the date of the
auditor’s report
A statement that the auditor’s opinion does not cover the other
information and Accordingly that the auditor does not express (or will not
express) an audit opinion or any form of assurance conclusion thereon
A description of the auditor’s responsibilities relating to reading,
considering and reporting on other information as required by this ISA,
and
When other information has been obtained prior to the date of the
auditor’s report, either:
a statement that the auditor has nothing to report, or
if the auditor has concluded that there is an uncorrected
material misstatement of the other information, a statement that
describes the uncorrected material misstatement of the other
information
Block: Text
33
Block: Text
Material Uncertainty Related to Going Concern – ISA 570 (revised) Going
Concern requires auditors to include a paragraph drawing attention to
uncertainties relating to going concern which are adequately disclosed in the
financial statements by reference to those disclosures.
Block: Text
Block: Text
Note that all three of these modifications do not result in a qualified opinion. They
modify only the report. None of these is an alternative to a qualification of the
audit opinion.
Key audit matters
For listed companies, auditors are required to include a Key Audit Matters (KAM)
section within the auditor’s report ISA 701 Communicating Key Audit Matters in
the Independent Auditor’s Report defines key audit matters as —those matters
that, in the auditor’s professional judgment, were of most significance in the audit
of the financial statements of the current period. Key audit matters are selected
from matters communicated with Those Charged with Governance. They are
areas of high risk, high levels of management judgement or significant events or
transactions arising within the period. The auditor is required to explain why
each matter was deemed important and how it was addressed during the audit.
This section cannot be used to avoid giving a qualified opinion.
Exam focus
Auditor reporting is covered by many ISAs and it is often hard to visualise how an
auditor’s report should look. Many candidates in the exam still refer to outdated
auditing standards or do not seem to understand how the auditor’s report flows.
Listed companies generally publish their annual report online and these can be
accessed freely. Candidates should take time to read the auditor’s reports for
34
several real companies to appreciate this fundamental part of the syllabus. The
profession revolves around the auditor’s report, the audit process and the ethics
and professional issues that surround it all lead to this crucial document that is
the output of the audit. View an example of a real auditor’s report
Exam questions on reporting can take different forms. Here’s some examples
from past questions and common misstates that have been seen in candidate
answers. The links below can be used to see the scenario details relating to the
question:
March/June 2018, Q5
Scenario summary
Candidates were presented with an extract from a proposed auditor’s report for a
listed company, comprising KAM, qualified opinion and EoM paragraphs.
Requirement
Critically appraise the extract from the auditor’s report on the consolidated
financial statements of the Blackmore Group for the year ended 31 March 2018.
Exam focus
To critically appraise candidates should consider each piece of information and
assess whether it is correct or incorrect, describing why and how to amend it as
necessary.
Commons mistakes in the exam
stating the qualification matter should have been an EoM
stating the financial statements should be prepared on a break up
basis because of a potential breach of funding covenants (it’s an
uncertainty over going concern but the company is not about to
commence winding up)
stating that the auditor should not disclose the potential uncertainty
regarding going concern because it hasn’t happened yet (the uncertainty
exists therefore it will impact the auditor’s report)
not identifying that the uncertainty discussion did not refer to
adequate disclosures in the accounts (these are needed if the opinion will
not be qualified)
not identifying that the EoM paragraph should have been a Material
Uncertainty Relating to Going Concern paragraph
saying the report was missing a title and signature – this was an
extract not a complete report
35
September/December 2016
Scenario summary
Candidates were presented with two unresolved issues arising from the audit of a
non-listed company. The first was an imposed limitation in scope arising from a
confidentiality agreement signed by the client and the second was a significant
event properly disclosed in the financial statements.
Requirement
In respect of each of the matters described above, discuss the implications for
the auditor’s report and recommend any further actions necessary.
Note this requirement covers the auditor’s report not simply the opinion and is for
a non-listed company.
Commons mistakes in the exam
ignoring the requirement for further actions in addition to the
auditor’s report implications – this includes trying to resolve the limitation
of scope with management and the requirement to communicate the
matter to TCWG
recommending an EoM paragraph for the limitation of scope – this
has to give rise to a qualified opinion
omitting the description of the effect on the basis for opinion
paragraph or stating it should be placed before the audit opinion
not stating that an EoM paragraph needs to draw attention to the
significant event disclosure in the notes to the financial statements or that
this matter does not modify the audit opinion
Key points for exam technique
In summary, candidates should expect to answer a question on auditor reporting
in exams under the new syllabus. To perform well in this area candidates must:
Have an understanding of the types of audit opinion available
Understand the different additional components of the auditor’s
report
Read the requirements carefully to identify the correct areas to
cover and whether:
the company is listed,
the question asks for more than effects on the auditor’s
report such as actions to be taken
the response is relating to the audit opinion only or the wider
36
res
IAASB EXPOSURE DRAFT – PROPOSED INTERNATIONAL STANDARD
ON AUDITING 540 (REVISED) AUDITING ACCOUNTING ESTIMATES
AND RELATED DISCLOSURES
37
38
39
40
41
estimates.
At the time of writing, the IAASB is in the process of completing its deliberations
in response to the feedback received before finalising its revision of ISA 540 on a
timely basis for the audit of financial statements prepared under IFRS 9.
Written by a member of the Advanced Audit and Assurance examining
team
The completion stage of the audit is when the auditor reviews the work
performed and considers the implications for the auditor’s report. A crucial part of
this review is the evaluation of misstatements found during the audit. This article
describes and discusses the requirements of ISA 450, Evaluation of
Misstatements Identified during the Audit and provides some examples of the
application of the ISA in the context of the Advanced Audit and Assurance exam.
ISA 450 – Objectives and definitions
According to ISA 450, the objectives of the auditor are to evaluate:
The effect of identified misstatements on the audit, and
The effect of uncorrected misstatements, if any, on the financial
statements
A misstatement occurs when something has not been treated correctly in the
financial statements, meaning that the applicable financial reporting framework,
namely IFRS, has not been properly applied. Examples of misstatement, which
can arise due to error or fraud, could include:
An incorrect amount has been recognised – for example, an asset
is not valued in accordance with the relevant IFRS requirement.
An item is classified incorrectly – for example, finance cost is
included within cost of sales in the statement of profit or loss.
Presentation is not appropriate – for example, the results of
discontinued operations are not separately presented.
Disclosure is not correct or misleading disclosure has been
included as a result of management bias – for example, a contingent
liability disclosure is missing or inadequately described in the notes to the
financial statements.
Specific requirements and application of ISA 450
ISA 450 requires that ‘the auditor shall accumulate misstatements identified
during the audit, other than those that are clearly trivial’.
The auditor should set a monetary benchmark below which misstatements are
considered to be clearly trivial and would not need to be accumulated because
the auditor expects that the accumulation of such amounts clearly would not
have a material effect on the financial statements. The application notes to ISA
450 make it clear that ‘clearly trivial’ is not another expression for ‘not material.’
The auditor will need to use judgement to decide whether matters are clearly
trivial, and this may be affected by a range of issues including but not limited to
the monetary size of the matter, for example, the level of audit risk being applied
in the situation.
ISA 450 also requires that ‘The auditor shall communicate on a timely basis all
misstatements accumulated during the audit with the appropriate level of
management, unless prohibited by law or regulation. The auditor shall request
42
43
44
45
46
47
and appropriate actions in order to resolve the situation, to deter possible non-
compliance or to disclose the matter to an appropriate authority where it is
required by law or regulation or it is considered necessary in the public interest.
The auditor must also ensure their own compliance with laws and regulations
together with the requirements under auditing standards. With respect to auditing
standards, the auditor should have particular regard to those relating to:
Identifying and responding to non-compliance, including fraud.
Communicating with those charged with governance.
Considering the implications of the non-compliance or suspected
non-compliance for the auditor’s report.
Communication with respect to groups In the context of a group audit, the
auditor should consider their responsibilities to report instances of non-
compliance or suspected non-compliance to the group engagement partner
unless prohibited from doing so by law or regulation.
Determining whether further action is needed The auditor should assess the
appropriateness and effectiveness of the response of management and TCWG
to the matter, including the timeliness of the response and the extent of
investigation and remedial action, and in the light of this response, the auditor
must determine objectively if further action is needed in the public interest. This
will involve the exercise of professional judgement and the auditor must take into
account whether a reasonable and informed third party would, after weighing all
of the specific facts and circumstances, be likely to conclude that the auditor has
acted appropriately in the public interest.
Where the auditor decides that further action is necessary, it might include, for
example, disclosing the matter directly to the appropriate authority and
withdrawing from the engagement and client relationship. In response to the
concerns that auditors were simply resigning from client relationships as a result
of suspected or identified NOCLAR without the matter being appropriately
addressed, however, the guidance clarifies that withdrawing from an engagement
should not be a substitute for taking other actions which may be needed to
achieve the auditor’s objectives. The standard does though recognise in this
regard that in some jurisdictions there may be limitations on the further actions
which the auditor is able to take and acknowledges that withdrawal may be the
only available course of action. Following withdrawal, the outgoing auditor is
required to co-operate with the proposed successor auditor and on request, to
provide all of the facts and information concerning the identified or suspected
non-compliance which the latter needs to be aware of.
Determining whether to disclose the matter to an appropriate authority The
determination of whether to disclose the identified or suspected non-compliance
to an appropriate authority, assuming such disclosure is not precluded by law or
regulation, depends on the nature and extent of the actual or potential harm
which might be caused to investors, creditors, employees or the general public.
The guidance gives examples of indicative situations where disclosure might be
appropriate and of external factors to consider. These examples include
references to an entity being involved in bribery and tax evasion or to breaches
of regulation which might impact adversely on operating licences, financial
48
markets or public health and safety. The standard also clarifies that in
exceptional circumstances where the auditor believes there may be an imminent
breach of a law or regulation, they may need to disclose the matter immediately.
The decision to disclose will always be a matter for the auditor’s judgement and
where the disclosure is made in good faith, it will not constitute a breach of the
duty of confidentiality under Section 140 of the Code. This latter clarification, in
particular, should serve to increase the auditor’s confidence in their ability to
breach the principle of confidentiality where they deem it to be necessary under
the NOCLAR guidance. This should also help to resolve the potential conflict for
the auditor between their ethical duty of confidentiality and their professional duty
of disclosure in the public interest.
Documentation The auditor is required to document the process of compliance
with the NOCLAR guidance including the response of management and those
charged with governance, the courses of action considered, the judgements
made and the decisions taken.
The need for support
The IESBA acknowledges that the accountancy and auditing profession will not
resolve the NOCLAR issue in isolation and that it requires the support and co-
operation of other professions together with governments, legislators and
regulators. In particular it is hoped that governments will introduce and
strengthen legislation addressing NOCLAR and will provide protection for whistle
blowers and to auditors and other PAs who implement the standard. The ultimate
success of the project is also dependent on governmental authorities acting
appropriately in response to the NOCLAR reports which they will receive under
the requirements of the standard.
Conclusion
In practice auditors will often have to deal with instances of non-compliance with
laws and regulations and the IESBA’s NOCLAR standard provides important
additional guidance and clarification of their duties and responsibilities in this key
area. In the context of the P7 Advanced Audit and Assurance exam, candidates
need to be prepared to discuss the recent developments outlined in this article as
well as to consider the new guidance in their answer points to scenario based
exam questions.
Written by a member of the P7 examining team
AUDITOR REPORTING
An update for P7 students on Key Audit Matters (P7 INT) and the
Extended Auditor’s Report (P7 UK)
Candidates preparing for P7, Advanced Audit and Assurance will be aware that
the auditor’s report is the key output of the audit process, used to communicate
primarily with the shareholders of the audited entity, as well as other
stakeholders.
Recently, there have been some considerable changes in the requirements
relating to auditor’s reports, with the regulatory bodies issuing new and revised
International Standards on Auditing and other supplementary guidance.
The objective of this article is to outline the key changes, focusing on the new
49
50
audit profession.
Key Audit Matters
ISA 701, Communicating Key Audit Matters in the Independent Auditor’s Report
is a new standard that is required to be applied to the audit of all listed entities.
According to ISA 701, the purpose of communicating key audit matters (KAM) is
‘to enhance the communicative value of the auditor’s report by providing greater
transparency about the audit that was performed. Communicating key audit
matters provides additional information to intended users of the financial
statements to assist them in understanding those matters that, in the auditor’s
professional judgment, were of most significance in the audit of the financial
statements of the current period. Communicating key audit matters may also
assist intended users in understanding the entity and areas of significant
management judgment in the audited financial statements’.
It may be helpful to review the definition of KAM from ISA 701: ‘Those matters
that, in the auditor’s professional judgment, were of most significance in the audit
of the financial statements of the current period. Key audit matters are selected
from matters communicated with those charged with governance’.
Determining Key Audit Matters
ISA 701 requires the auditor to include in the KAM paragraph those matters that
required the most significant auditor attention in performing the audit. Thus, when
preparing an auditor’s report for listed entities, the auditor will need to carefully
select the matters that should be communicated in the KAM paragraph. This is
likely to require the use of significant judgement in order for the auditor’s report to
contain information on the matters that are most relevant to the intended users of
the report, while avoiding information overload, which could obscure the
important messages contained in the KAM paragraph.
There are three types of matter, according to ISA 701, which should be
considered when determining key audit matters. All of these should have been
communicated to those charged with governance as part of the audit process.
Areas of higher assessed risk of material misstatement, or significant risks
identified. During the audit, especially at the planning stage, the auditor
will identify risks of material misstatement. A significant risk as an
identified and assessed risk of material misstatement that, in the auditor’s
judgment, requires special audit consideration. Significant risks, including
areas of management judgement and significant unusual transactions are
often areas that require significant auditor attention, and thus should be
considered for inclusion in the KAM paragraph.
Significant auditor judgments relating to areas in the financial statements that
involved significant management judgment, including accounting
estimates that have been identified as having high estimation uncertainty.
Critical accounting estimates and related disclosures are likely to be areas
of significant auditor attention and may be identified as significant risks.
This could include, for example, fair value estimates in relation to financial
instruments, estimates relating to the measurement of provisions,
impairment and the recoverability of assets.
The effect on the audit of significant events or transactions that occurred
51
during the period. This could include a one-off transaction or event within
the reporting entity that has required significant auditor attention, for
example the acquisition of a significant subsidiary within a group. In
addition, significant economic, accounting, regulatory, industry, or other
developments that affected management’s assumptions or judgments may
also affect the auditor’s overall approach to the audit and result in a matter
requiring significant auditor attention.
Given the multitude of matters that can arise during the audit process, the auditor
may find that there are many matters that potentially could be included in the
KAM paragraph. The auditor may need to prioritise the matters in order to ensure
that, as required by ISA 701, it is the matters of most significance that are
reported as KAM. ISA 701 explains that the concept of matters of most
significance is applicable in the specific context of the entity and the audit that
was performed. As such, the auditor’s determination and communication of key
audit matters should identify matters specific to the audit and to involve making a
judgment about their importance relative to other matters in the audit.
Specificity is therefore a key issue, and vague or boiler-plate disclosures are not
in keeping with the requirements or spirit of the standard.
ISA 701 therefore gives further guidance on determining significance and
whether a matter should be reported as a key audit matter:
The importance of the matter to intended users’ understanding of
the financial statements as a whole, and in particular, its materiality to the
financial statements.
The nature of the underlying accounting policy relating to the matter
or the complexity or subjectivity involved in management’s selection of an
appropriate policy compared to other entities within its industry.
The nature and materiality, quantitatively or qualitatively, of
corrected and accumulated uncorrected misstatements due to fraud or
error related to the matter, if any.
The nature and extent of audit effort needed to address the matter,
including the extent of specialized skill or knowledge needed to apply audit
procedures to address the matter or evaluate the results of those
procedures, if any.
The nature of consultations outside the engagement team
regarding the matter.
The nature and severity of difficulties in applying audit procedures,
evaluating the results of those procedures, and obtaining relevant and
reliable evidence on which to base the auditor’s opinion, in particular as
the auditor’s judgments become more subjective.
The severity of any control deficiencies identified in relation to the
matter.
Whether the matter involved a number of separate, but related,
auditing considerations. For example, long-term contracts may involve
significant auditor attention with respect to revenue recognition, litigation
or other contingencies, and may have an effect on other accounting
estimates.
52
ISA 701 does not state a particular number of key audit matters that should be
communicated, discussing that the volume of disclosure will be affected by the
size and complexity of the entity, the nature of its business and environment, and
the facts and circumstances of the audit engagement. The standard is very clear
in stating that ‘lengthy lists of key audit matters may be contrary to the notion of
such matters being those of most significance in the audit’, requiring the use of
professional judgement in prioritisation of matters to be communicated within the
KAM paragraph.
Communicating Key Audit Matters
ISA 701 requires that the description of each key audit matter in the auditor’s
report shall include a reference to the related disclosure(s), if any, in the financial
statements and shall address:
why the matter was considered to be one of most significance in
the audit and therefore determined to be a key audit matter, and
how the matter was addressed in the audit.
Though there is not a specific requirement in terms of placement of the KAM
paragraph within the auditor’s report, ISA 701 does comment that placement of
the KAM paragraph ‘in close proximity to the auditor’s opinion may give
prominence to such information and acknowledge the perceived value of
engagement-specific information to intended users’. Thus, the auditor may need
to use judgement in deciding on the best position of the KAM paragraph.
The ordering of items within the KAM paragraph itself is also a matter of
professional judgement. ISA 701 suggests that the information may be organized
in order of relative importance, based on the auditor’s judgment, or may
correspond to the manner in which matters are disclosed in the financial
statements.
In deciding the amount and nature of description of each item within the KAM
paragraph, the auditor is required to use their professional judgement, in order to
ensure that each matter is adequately described in an understandable way.
The description of each key audit matter should be a succinct and balanced
explanation to enable intended users to understand why the matter was one of
most significance in the audit and how the matter was addressed in the audit.
ISA 701 suggests that technical jargon should be avoided, stating that ‘limiting
the use of highly technical auditing terms also helps to enable intended users
who do not have a reasonable knowledge of auditing to understand the basis for
the auditor’s focus on particular matters during the audit’.
It is likely that many key audit matters will have been discussed in the financial
statements. For example, information in relation to a significant estimated value
for a provision should have been disclosed in the notes to the financial
statements in accordance with the relevant IFRS requirement. ISA 701 suggests
that the description of a key audit matter should not be a duplicate of information
that is already disclosed in the financial statements. However, a reference to any
related disclosures should be included to enable intended users of the auditor’s
report to further understand how management has addressed the matter in
preparing the financial statements.
The amount of detail to be provided in the auditor’s report to describe how a key
53
audit matter was addressed in the audit is also a matter of professional judgment.
The auditor may choose to describe:
aspects of the auditor’s response or approach that were most
relevant to the matter or specific to the assessed risk of material
misstatement
a brief overview of procedures performed
an indication of the outcome of the auditor’s procedures, or
key observations with respect to the matter.
In summary, the introduction of ISA 701 will require auditors to exercise
significant judgement in preparing the KAM section of the auditor’s report. To
help with implementation of the standard, the IAASB has published a range of
supplementary guidance to assist auditors of listed entities.
Note than the KAM paragraph is therefore not a substitute for expressing a
modified opinion or reporting on going concern issues in accordance with the
requirements of the relevant ISA. The interaction between ISA 701 and ISA 705
is explained in the article ‘The new auditor's report’ (see 'Related links'), which is
relevant for both F8 and P7 students.
The Extended Auditor’s Report
Note – this section is relevant to candidates attempting the UK and Irish P7
adapted papers only. The FRC document Extended auditor’s reports – A
review of experience in the first year is an examinable document for UK
and Irish students.
The UK Financial Reporting Council has issued additional requirements that form
part of revised ISA 700 (UK and Ireland) The independent auditor’s report on
financial statements. ISA 700 requires the auditor’s report issued in relation to
the financial statements of entities adopting the UK Corporate Governance Code
to include information that addresses similar issue to those seen in respect of
Key Audit Matters discussed in the previous section of this article. The objectives
are to provide more information about key issues that arose during the audit, how
they affected the audit process, and to allow better understanding of areas where
the auditor used judgement, particularly in relation to materiality.
Specifically, ISA 700 requires the auditor’s report of companies that apply the UK
Corporate Governance Code to include:
a description of those assessed risks of material misstatement that
were identified by the auditor and that had the greatest effect on the
overall strategy; the allocation of resources in the audit; and directing the
efforts of the engagement team
an explanation of how the auditor applied the concept of materiality,
and
a summary of the audit scope, including an explanation of how the
scope was responsive to the assessed risks of material misstatement and
the concept of materiality as described above.
Similar to the issues discussed above in respect of Key Audit Matters, when UK
and Irish auditors are applying these requirements of ISA 700, they will need to
use judgement to decide which risks of material misstatement should be
described, and in deciding how much information to provide in relation to each
54
55
shareholders and other stakeholders, and the effects on corporate strategy and
performance. Corporate governance is important because it looks at how these
decision makers act, how they can or should be monitored, and how they can be
held to account for their decisions and actions.
The published audited financial statements and related information are therefore
of key importance. They will usually be the main information set to which
shareholders and other stakeholders have access and this is why having credible
financial statements supported by the auditor’s opinion is crucial.
Many regulatory authorities, including the UK, use a code of best practice, often
termed a ‘comply or explain’ approach to corporate governance. Under this
approach the regulatory authority issues a set of principles with which company
directors of listed companies are expected to comply. In many jurisdictions
disclosures are required in the financial statements to demonstrate compliance.
Non-compliance is not expected, but in its event, the facts of the non-compliance
must be clearly disclosed and explained.
In some jurisdictions, such as the US, a more prescriptive approach is used,
whereby corporate governance requirements are set by legislation. Both the
principles and the legislative approaches are broadly similar in the matters they
address. They both deal with the importance of the board of directors having a
balanced structure, emphasising the need for non-executive directors, and for
robust procedures in relation to the appointment of board members, and their
remuneration. They both describe the merits of audit committees and the need to
monitor the effectiveness of internal controls. They both demand disclosure
about these and other matters in the annual report.
The main principles of the UK Corporate Governance Code
The content of the UK and Singapore Corporate Governance Codes are very
similar and for the purpose of this article the principles and provisions of the UK
Code will be used to highlight some of the key areas that the board should
consider when assessing their system of corporate governance.
The Code comprises five sections, each containing main principles:
Leadership
Every company should be headed by an effective board which is collectively
responsible for the long-term success of the company, and should lead and
control the company’s operations.
There should be a clear division of responsibilities at the head of the company,
which will ensure a balance of power and authority, such that no one individual
has unfettered powers of decision.
Non-executive directors should constructively challenge and help develop
proposals on strategy. The board should include a balance of executive and non-
executive directors such that no individual or small group of individuals can
dominate the board’s decision taking.
Effectiveness
The board and its committees should have the appropriate balance of skills,
experience, independence and knowledge of the company to enable them to
discharge their respective duties and responsibilities effectively.
There should be a formal, rigorous and transparent procedure for the
56
appointment of new directors to the board. All directors should receive induction
on joining the board and should regularly update and refresh their skills and
knowledge.
All directors should be submitted for re-election at regular intervals, subject to
continued satisfactory performance.
Accountability
The board should present a balanced and understandable assessment of the
company’s position and prospects. For UK companies, this is also required by
the Companies Act 2006, which requires that the directors disclose a business
review as part of the directors’ report to be included in the financial statements.
The board should maintain sound risk management and internal control systems.
The board should establish formal and transparent arrangements for considering
how they should apply the corporate reporting and risk management and internal
control principles and for maintaining an appropriate relationship with the
company’s auditor.
Remuneration
Levels of remuneration should be sufficient to attract, retain and motivate
directors of the quality required to run the company successfully, but a company
should avoid paying more than is necessary for this purpose. A significant
proportion of executive directors’ remuneration should be structured so as to link
rewards to corporate and individual performance.
Relations with shareholders
There should be a dialogue with shareholders based on the mutual
understanding of objectives. The board as a whole has responsibility for ensuring
that a satisfactory dialogue with shareholders takes place. The board should use
the Annual General Meeting to communicate with investors and to encourage
their participation.
The role of audit committees
The audit committee is such an important part of corporate governance that it is
the subject of its own guidance document in the UK, the Financial Reporting
Council’s Guidance on Audit Committees. The audit committee should be made
up of at least three independent non-executive directors, one of whom should
have recent and relevant financial experience. The committee has many roles,
including several that are specifically related to the external auditor, which are
discussed below.
Review of published financial information
The audit committee should monitor the integrity of the company’s financial
statements and any formal announcements relating to the company’s
performance. Significant financial reporting judgements should be specifically
reviewed. This means that committee members should scrutinise all published
financial information, and question and be ready to challenge the finance director
and external auditors on any contentious matters arising.
Systems and controls
The audit committee members have responsibility to review the company’s
internal financial controls and systems, and the risk management systems,
unless there is a separate risk committee.
57
Most large companies have an internal audit function, in which case the audit
committee should extend its monitoring role to include that function, including the
evaluation of the effectiveness of that function.
Where there is no internal audit function, the audit committee should consider
annually whether there is a need for internal audit and make a recommendation
to the board, and the reasons for the absence of such a function should be
explained in the relevant section of the annual report.
Fraud prevention and detection
Finally, the audit committee plays a part in fraud prevention and detection in that
whistleblowing arrangements should be made so that staff of the company may
raise concerns about possible improprieties in respect of financial reporting
matters.
External auditors – general principles
The audit committee has specific responsibilities in respect of the external
auditors, including recommending the appointment, reappointment and removal
of the external auditor, approving fees paid for audit and non-audit services, and
agreeing on the terms of engagement with the external auditor. A point specific to
the UK adapted paper is that following a revision to the UK Corporate
Governance Code in 2012, there is now a requirement for FTSE 350 companies
to put the external audit out to tender every 10 years.
One of the key issues is that the audit committee should annually assess the
independence, objectivity and effectiveness of the external audit process,
considering of the ethical framework applicable in the jurisdiction in which the
organisation is operating. The audit committee should report annually to the
board on their assessment with a recommendation on whether to propose to the
shareholders that the external auditor be reappointed. The audit committee
section of the annual report should also discuss the annual assessment of the
external audit process by the audit committee and also include information on the
length of tenure of the current audit firm, when a tender was last conducted, and
any contractual obligations that acted to restrict the audit committee’s choice of
external auditors.
In relation to potential threats to objectivity, the audit committee should seek
reassurance that the auditors and their staff have no financial, business,
employment or family and other personal relationship with the company which
could adversely affect the auditor’s independence and objectivity. The audit
committee should seek from the audit firm, on an annual basis, information about
policies and processes for maintaining independence and monitoring compliance
with relevant requirements, including current requirements regarding the rotation
of audit partners and staff.
External auditors – the annual audit cycle
The audit committee should be involved at all stages of the audit, to obtain
comfort that a quality audit will be performed. The Guidance on Audit
Committee specifically requires the following to take place:
At the start of each annual audit cycle, the audit committee should ensure that
appropriate plans are in place for the audit. This includes consideration of
planned levels of materiality, and the proposed resources to execute the plan,
58
having regard also to the seniority, expertise and experience of the audit team. In
practice this means that before any audit fieldwork takes place, the audit firm
should meet with the audit committee to discuss the audit strategy and audit
plan, demonstrating that auditing standards and quality control principles have
been adhered to in their development.
The audit committee should review, with the external auditors, the findings of
their work. In the course of its review, the audit committee should discuss with
the external auditor major issues that arose during the course of the audit and
have subsequently been resolved and those issues that have been left
unresolved; review key accounting and audit judgements; and review levels of
errors identified during the audit, obtaining explanations from management and,
where necessary, the external auditors as to why certain errors might remain
unadjusted. The audit committee should review and monitor management’s
responsiveness to the external auditor’s findings and recommendations. Thus, all
key audit findings should be shared with the audit committee and discussed with
them as the audit progresses.
At the end of the annual audit cycle, the audit committee should assess the
effectiveness of the audit process, by:
reviewing whether the auditor has met the agreed audit plan and
understand the reasons for any changes, including changes in perceived
audit risks and the work undertaken by the external auditors to address
those risks
considering the robustness and perceptiveness of the auditors in
their handling of the key accounting and audit judgements identified and in
responding to questions from the audit committee
obtaining feedback about the conduct of the audit from key people
involved, for example the finance director and the head of internal audit
reviewing and monitoring the content of the external auditor’s
management letter (report to those charged with governance), in order to
assess whether it is based on a good understanding of the company’s
business and establish whether recommendations have been acted upon
and, if not, the reasons why they have not been acted upon, and
reporting to the board on the effectiveness of the external audit
process.
In summary, the audit committee carefully monitors the conduct of the audit, and
plays an important part in ensuring the quality and rigour of the external audit of
the financial statements.
External auditors – provision of non-audit services
Specifically, the audit committee should develop and implement a policy on the
engagement of the external auditor to supply non-audit services, taking into
account the relevant ethical principles and requirements. The audit committee’s
objective should be to ensure that the provision of such services does not impair
the external auditor’s independence or objectivity. The audit committee should
consider:
whether the skills and experience of the audit firm make it the most
suitable supplier of the non-audit service
59
60
with the other reporting standards (ISA 705 and 706); and the reporting
requirements in ISA 570 (Revised), Going Concern.
Candidates often find auditor’s reports a challenging part of the syllabus and in
preparation for exams it is imperative that candidates can:
describe the different elements of the auditor’s report (particularly
relevant for AA candidates)
determine the most appropriate type of audit opinion in a given
scenario, often through an explanation of why a certain opinion is
appropriate which will test the application of the candidate’s knowledge
understand the issues that may arise during the course of an audit
that could require an Emphasis of Matter or Other Matter paragraph to be
included in the auditor’s report, and
identify Key Audit Matters (KAM) that are required to be disclosed
in an auditor’s report.
Candidates will not be expected to draft an auditor’s report in either AA or AAA,
but may be asked to present reasons for an unmodified or a modified opinion, or
the inclusion of an Emphasis of Matter paragraph. Candidates attempting AA
may be required to identify and describe the elements of the auditor’s report and
therefore candidates should ensure that they have a sound understanding of ISA
700, Forming an Opinion and Reporting on Financial Statements. AAA questions
may require a candidate to determine whether a transaction, or a series of
transactions and events or other issues arising during the audit, gives rise to a
KAM and should also be prepared to critique the content of a KAM section of an
auditor’s report. AA candidates should be able to discuss what should be
included in the KAM section to ensure the auditor’s report is compliant with ISA
701.
Candidates may also be presented with extracts from an auditor’s report and be
asked to critically appraise the extracts, or challenge the proposed audit opinion.
Candidates are therefore reminded to ensure they have a sound understanding
of the relevant Syllabus and Study Guide and ensure the revision phase in the
lead-up to the examination includes plenty of exam-standard question practise,
particularly if this is an area of the syllabus which a candidate finds challenging.
Key Audit Matters (KAM)
In January 2015 the IAASB issued ISA 701, Communicating Key Audit Matters in
the Independent Auditor’s Report. This standard is required to be applied to the
audit of all listed entities. The objectives of ISA 701 are for the auditor to:
determine those matters which are to be regarded as KAM; and
communicate those matters in the auditor’s report.
The term ‘key audit matters’ is defined in ISA 701 as:
‘Those matters that, in the auditor’s professional judgment, were of most
significance in the audit of the financial statements of the current period. Key
audit matters are selected from matters communicated with those charged with
governance.’ (1)
Determination of KAM
The definition in paragraph 8 of ISA 701 states that KAM are selected from
matters which are communicated with those charged with governance. Matters
61
which are discussed with those charged with governance are then evaluated by
the auditor who then determines those matters which required significant auditor
attention during the course of the audit. There are three matters which the ISA
requires the auditor to take into account when making this determination:
Areas which were considered to be susceptible to higher risks of material
misstatement or which were deemed to be ‘significant risks’ in accordance
with ISA 315 (Revised), Identifying and Assessing the Risks of Material
Misstatement through Understanding the Entity and Its Environment.
Significant auditor judgments in relation to areas of the financial statements
that involved significant management judgment. This might include
accounting estimates which have been identified by the auditor as having
a high degree of estimation uncertainty.
The effect on the audit of significant events or transactions that have taken
place during the period.
The auditor must determine which matters are of most significance in the audit of
the financial statements and these will be regarded as KAM.
Communicating KAM
Once the auditor has determined which matters will be included as KAM, the
auditor must ensure that each matter is appropriately described in the auditor’s
report including a description of:
Why the matter was determined to be one of most significance and therefore a
key audit matter, and
How the matter was addressed in the audit (which may include a description of
the auditor’s approach, a brief overview of procedures performed with an
indication of their outcome and any other key observations in respect of
the matter).
Reporting in line with ISA 570, Going concern
Exam questions might ask the candidate to recognise indicators that an entity
may not be a going concern, or require candidates to arrive at an appropriate
audit opinion depending on the circumstances presented in the scenario. It may
be the case that candidates are presented with a situation where the auditor has
concluded that there are material uncertainties relating to going concern and the
directors have made appropriate disclosures in relation to going concern and
candidates must understand the auditor reporting requirements in this respect.
The auditor’s work in relation to going concern has been enhanced in ISA 570
(Revised), Going Concern and the ISA includes additional guidance relating to
the appropriateness of disclosures when a material uncertainty exists.
Under ISA 570 (Revised), if the use of the going concern basis of accounting is
appropriate but a material uncertainty exists and management have included
adequate disclosures relating to the material uncertainties the auditor will
continue to express an unmodified opinion, but the auditor must include a
separate section under the heading ‘Material Uncertainty Related to Going
Concern’ and:
draw attention to the note in the financial statements that discloses
the matters giving rise to the material uncertainty, and
state that these events or conditions indicate that a material
62
uncertainty exists which may cast significant doubt on the entity’s ability to
continue as a going concern and that the auditor’s opinion is not modified
in respect of the matter.
The section headed ‘Material Uncertainty Related to Going Concern’ is included
immediately after the Basis for Opinion paragraph but before the KAM section. It
should be noted that where the uncertainty is not adequately disclosed in the
financial statements the auditor would continue to modify the opinion in line with
ISA 705, Modifications to the Opinion in the Independent Auditor’s Report.
Over and above the reporting requirements under ISA 570, candidates need to
understand how issues identified regarding going concern interact with the
requirements of ISA 701. By their very nature, issues identified relating to going
concern are likely to be considered a key audit matter and hence need to be
communicated in the auditor’s report. Where the auditor has identified conditions
which cast doubt over going concern, but audit evidence confirms that no
material uncertainty exists, this ‘close call’ can be disclosed in line with ISA 701.
This is because while the auditor may conclude that no material uncertainty
exists, they may determine that one, or more, matters relating to this conclusion
are key audit matters. Examples include substantial operating losses, available
borrowing facilities and possible debt refinancing, or non-compliance with loan
agreements and related mitigating factors.
In summary if a confirmed material uncertainty exists it must be disclosed in
accordance with ISA 570 and where there is a ‘close call’ over going concern
which has been determined by the auditor to be a KAM it will be disclosed in line
with ISA 701. This is illustrated in the following example:
63
opinion.
Key audit mattersKey audit matters are those matters that, in our
professional judgment, were of most significance in our audit of the
financial statements of the current period. These matters were
addressed in the context of our audit of the financial statements as a
whole, and in forming our opinion thereon, and we do not provide a
separate opinion on these matters. In addition to the matter described in
the Material Uncertainty Related to Going Concern section, we have
determined the matters described below to be the key audit matters to
be communicated in our report.
Block: Text
Application of ISA 701 when a Qualified or Adverse Opinion is
issued
ISA 705 (Revised), Modifications to the Opinion in the Independent Auditor’s
Report outlines the requirements when the auditor concludes that the audit
opinion should be modified. ISA 705 (Revised) requires that the auditor includes
a Basis for Qualified/Adverse Opinion section in the auditor’s report. When the
auditor expresses a qualified or adverse opinion, the requirement to
communicate other KAM is still relevant and hence will still apply.
When the auditor issues an adverse opinion it means that the financial
statements do not give a true and fair view (or present fairly) because the auditor
has concluded that misstatements, individually and in aggregate, are both
material and pervasive to the financial statements.
Depending on the significance of the matter(s) which has resulted in the auditor
expressing an adverse audit opinion, the auditor might determine that no other
matters are KAM. In this situation, the auditor will deal with the matter(s) in
accordance with applicable ISAs and include a reference to the Basis for
Qualified/Adverse Opinion or the Material Uncertainty Related to Going Concern
section(s) in the KAM section of the report as illustrated below.
64
The auditor has concluded that there are no KAM which require to be
communicated in the audit report. The KAM section of the report will
therefore be as follows:
Key audit mattersExcept for the matter described in the Basis for
Qualified Opinion section, we have determined that there are no key
audit matters to communicate in our report.
Block: Text
When the auditor has expressed an adverse opinion on the financial statements
and communicates KAM, it is important that the descriptions of such KAM do not
imply that the financial statements as a whole are more credible in light of the
adverse opinion.
Disclaimer of Opinion issued
A disclaimer of opinion is issued when the auditor is unable to form an opinion on
the financial statements. ISA 705 states that when the auditor expresses a
disclaimer of opinion then the auditor’s report should not include a KAM section.
Emphasis of Matter and Other Matter paragraphs
Emphasis of Matter and Other Matter paragraphs are still retained in ISA 706
(Revised), Emphasis of Matter Paragraphs and Other Matter Paragraphs in the
Independent Auditor’s Report and the concepts involved have not been
overridden by the ISA 701 requirements. The IAASB have noted that in some
cases, matters which the auditor considers to be KAM will relate to issues that
are presented and/or disclosed in the financial statements. Therefore,
communicating these as KAM under ISA 701 will serve as the most useful and
meaningful mechanism for highlighting the importance of the matter.
Candidates should appreciate that when the auditor communicates matters as
KAM, the intention is to provide additional information beyond that which would
be included in an Emphasis of Matter paragraph. In recognition of this ISA 706
(Revised) states:
The auditor is prohibited from using an Emphasis of Matter
paragraph or an Other Matter paragraph when the matter has been
determined to be a KAM. To that end, the IAASB has emphasised that the
65
66
67
critical accounting judgement has been exercised, and rationale for any
changes in accounting policies.
Confirmation that the going concern assumption is appropriate, or
discussion of significant doubt over going concern.
Information on related parties, and related party transactions.
Explanation of impairment losses recognised in the year.
Discussion of areas of risk, for example those relating to financial
instruments.
A key driver for the IAASB’s consultation and the exposure draft, Addressing
Disclosures in the Audit of Financial Statements, issued in May 2014, is that in
recent years, IFRS requirements in relation to disclosures in the notes to financial
statements have become more onerous. The exposure draft states that ‘over the
past decade, financial reporting disclosure requirements and practices have
evolved. They now provide more extensive decision-useful information that is
more detailed and often deals with matters that are subjective such as
assumptions, models, alternative measurement bases and sources of estimation
uncertainty. As these financial reporting disclosures continue to evolve,
challenges have arisen for preparers and auditors in addressing new types of
quantitative and non-quantitative information’.
The challenges for auditors
Risk of irrelevant disclosures and determining materiality
The IAASB is concerned that in some financial statements excessive disclosure
is being provided, sometimes of immaterial matters that do not need to be
disclosed. This makes it difficult for the reader of the financial statements to focus
on the important matters due to the ‘information overload’. This is a difficult area
for the auditor because often judgement is needed to decide whether or not a
matter should be disclosed. Companies might prefer to provide too much
information rather than too little, in the aim of full transparency, but end up
providing irrelevant or unnecessary disclosures which obscure the rest of the
information included.
Linked to the point above, it can be very difficult to apply materiality to
disclosures, especially those of a quantitative nature. The IAASB has considered
whether additional guidance should be given to auditors to help them to
determine whether qualitative disclosures are material or not by making a
preliminary determination at the planning stage of the audit of those disclosures
that could reasonably be expected to influence the economic decisions of users.
This would help the auditor to better identify disclosures material by their nature
or their monetary value, and to plan appropriate audit procedures.
Sources of information
A key concern of the IAASB is that the information included in the notes to the
financial statements, whether quantitative or qualitative in nature is derived from
systems and processes that are not part of the general ledger system. Examples
could include, forward looking statements, descriptions of models used in fair
value measurements, descriptions of risk exposures and other narrative
disclosures. This gives rise to several potential problems to the auditor, and
respondents involved in the IAASB’s consultations noted that this issue poses
68
69
70
and universities, the police force and organisations responsible for public
transport and the road network. In some cases, such as the UK university sector,
organisations do charge for services provided but still rely on government funding
to support their activities.
The government as well as other stakeholders will pay close attention to the
performance of these organisations to evaluate whether public funds are being
used appropriately. The organisations should aim to demonstrate that public
monies allocated to them are being used effectively, that specific targets are
being met, and that appropriate decisions are being made in respect of long term
planning. Essentially the management and those charged with governance of a
public sector organisation need to show that the organisation is meeting its
objectives and performing its role in society, and performance information is likely
to be required in order for this to be demonstrated. If a public sector organisation
is not performing well then its funding may be cut and its management may be
replaced; in extreme situations the organisation may even be shut down.
This is supported by guidance issued by the public sector board of IFAC which
notes that the primary function of governments and most public sector entities is
to provide services to constituents. Consequently, their financial results need to
be assessed in the context of the achievement of service delivery objectives.
Reporting non-financial as well as financial information about service delivery
activities, achievements and/or outcomes during the reporting period is
necessary for a government or other public sector entity to discharge its
obligation to be accountable.
An example of how this is implemented is given below, taken from the UK’s
National Health Service (NHS) website:
Block: Text
Measuring performance information
71
Candidates will be familiar with the concept of Key Performance Indicators (KPIs)
which are widely used by private sector organisations in relation to non-financial
information such as social and environmental reporting; there have been several
examination requirements in past P7 exams focussing on this syllabus area. In
the public sector the same principles apply in that target KPIs will be established
as a performance objective and the organisation’s performance against the target
KPIs will be measured.
Performance measures should be measurable and relevant if they are to be
effective. Measurability means trying to ensure that there is consistency in how
performance information is captured and reported. The measures should be
clearly defined and unambiguous, but measurability is sometimes difficult where
the subject matter of the performance information is subjective in nature. For
example for an ambulance service it would be quite easy to measure the average
time taken for an ambulance to respond to an emergency as this is quantifiable,
but more difficult to measure the patient’s satisfaction with the service provided
as this is based on the patient’s opinion.
An issue linked to measurability is the existence of data to generate the
performance information. Much of the work involved in setting up a good system
for reporting on performance information is focussed on ensuring the
completeness and accuracy of supporting information and that the information is
sufficiently robust to withstand scrutiny.
Relevance means that the performance information addresses a valid concern
and public sector organisations should consider the specific needs of their
stakeholders in developing relevant performance measures. Continuing to using
the UK’s NHS as an example, identified stakeholders who regularly review the
NHS performance information include:
The government department responsible for health services
Medical staff
NHS management team and non-executive committee members
Patients
Private companies who supply to the NHS
Academics and students researching the NHS
The NHS therefore has to produce a range of performance measures relevant to
the needs of this wide range of stakeholders. Different stakeholders have
different needs, for example patients may focus on the effectiveness of a certain
medical procedure, whereas management may focus on the cost of providing
that procedure. Therefore a very wide range of performance information may be
required yet it would be pointless to set targets and produce performance
information on an issue which is not relevant to any stakeholder.
The audit of performance information
It is worth reiterating the difference between the audit of performance information
and performance auditing as both are likely to occur in the public sector.
Candidates are reminded that the audit of performance information is concerned
with the audit of reported performance information against predetermined
objectives. The auditor’s role here is usually to report on the credibility,
usefulness and accuracy of the reported performance. Performance auditing is
72
related to the evaluation of how the public sector body is utilising resources and
often focuses on determining how the public sector body is achieving economy,
efficiency and effectiveness, sometimes referred to as value for money auditing.
It is the former that is the focus of this area of the P7 syllabus.
In some jurisdictions it is part of the audit requirement for public sector
organisations that the auditor should report on performance information. In
jurisdictions where this is not a requirement, the auditor may be asked to perform
a separate engagement to the financial statement audit, the objective of which is
to report specifically on the performance information. In either case, the auditor
will need to plan procedures in much the same way as in a conventional audit
scenario. Candidates are therefore encouraged to apply their existing knowledge
of audit planning (risk assessment) and evidence gathering techniques to this
type of information. The auditor is still looking to ultimately report on the validity
of the information included in this respect. The auditor may find the principles of
ISAE 3000 Assurance Engagements other than Audits or Reviews of Historical
Financial Information provide a useful framework for planning and performing the
work on performance information.
As with any engagement to provide assurance, this would likely start with an
understanding of the entity to ensure knowledge of the predetermined
performance measures, an evaluation of the systems and controls used to derive
and capture the performance information and also performing substantive
procedures on the reported measures. The auditor will also need to understand
the rationale behind the measures that are being reported on, considering the
relevance and suitability of them in terms of the objectives of the public sector
organisation in order to help assess the usefulness of the information being
provided.
Audit procedures may include:
Tests of controls on the systems used to generate performance
information
Performing analytical review to evaluate trends and gauge the
consistency of the information
Discussion with management and other relevant individuals, for
example those responsible for the reporting process
Review of minutes of meetings where performance information has
been discussed
Confirmation of performance information to source documentation;
this may be performed on a sample basis
Recalculation of quantitative performance information measures
Of course, the procedures must be specifically tailored to the performance
information subject to the audit. Further as in any audit, the working papers must
contain a summary of findings and clear conclusions on the procedures that have
been performed.
Reporting on performance information
There is no specific format or wording that is prescribed by international
regulations for reporting on public sector performance information, though in
some jurisdictions the national regulators may issue country-specific
73
requirements.
Generally, the auditor will provide a conclusion on whether the public sector
entity has achieved its objectives as shown by the reported performance
information and concludes on the information itself. This conclusion may be in
the form of a reasonable assurance conclusion – ie an opinion is expressed, or
may be in the form of a negative assurance conclusion – ie no opinion is
expressed. Essentially, in the absence of any jurisdiction specific requirements,
the auditor will agree the type of conclusion with the public sector organisation
and usually its regulating body.
Often the performance information will be provided as part of the public sector
organisation’s integrated report, in which case the auditor’s conclusion will be
included within the integrated report.
Conclusion
The audit of performance information in public sector organisations can be
approached in a similar way to the audit of KPIs in private sector organisations,
and conventional audit techniques can be employed, though they will need to be
tailored to the specific measures that are subject to audit. In approaching
scenarios based on this syllabus area, candidates are encouraged to apply their
understanding of audit techniques to the specific information in the question and
to avoid vague and unfocussed remarks.
Written by a member of the P7 examining team
74
75
regulations. For example, when auditing the payroll the auditor will be concerned
with gathering sufficient and appropriate audit evidence to ensure that tax
legislation has been correctly applied by the entity because if it has not (as in
Question 1(c) in the December 2011 F8 exam), there is risk that the entity could
be fined for non-compliance and the fines could be material, either in isolation or
when aggregated with other misstatements. In addition, amounts within the
financial statements may also be misstated as a result of the non-compliance
with laws and regulations.
For those laws and regulations that have an indirect effect on the financial
statements, the auditor will undertake procedures with the objective of identifying
non-compliance with such laws and regulations. ISA 250 gives examples in
paragraph 6(b) of:
compliance with the terms of an operating license
compliance with regulatory solvency requirements, or
compliance with environmental regulations.
When designing procedures to help to identify non-compliance with laws and
regulations, ISA 315, Identifying and Assessing the Risks of Material
Misstatement through Understanding the Entity and Its Environment requires an
auditor to obtain a general understanding of:
the applicable legal and regulatory framework, and
how the entity complies with that framework.
Identifying non-compliance with laws and regulations can be tricky for auditors,
particularly where fraud and/or money laundering is concerned (see later in the
article). It is for this reason that the auditor must maintain a degree of
professional scepticism and remain alert to the possibility that other audit
procedures applied may bring instances of non-compliance or suspected non-
compliance with laws and regulations to the auditor’s attention, and such
procedures could include:
reading minutes of board meetings
enquiring of management and/or legal advisers concerning litigation
or claims brought against the entity, and
undertaking substantive tests on classes of transactions, account
balances or disclosures.
Reporting identified or suspected non-compliance with laws
and regulations
Where the auditor discovers non-compliance with laws and regulations, the
auditor must notify those charged with governance. However, care must be taken
by the auditor because if the auditor suspects that those charged with
governance are involved, the auditor must then communicate with the next
highest level of authority, which may include the audit committee. If a higher level
of authority does not exist, the auditor will then consider the need to obtain legal
advice.
The auditor must also consider whether the non-compliance has a material effect
on the financial statements and, in turn, the impact the non-compliance will have
on their report.
If the auditor identifies or suspects non-compliance, the auditor will need to
76
consider whether law, regulation and ethical requirements either require the
auditor to report to an appropriate authority outside the entity, or establish
responsibilities under which this may be appropriate.
There may be occasions when the auditor’s duty of confidentiality may be
overridden by law or statute. This can be the case when the auditor discovers
non-compliance with legislation such as drug trafficking or money laundering.
Money laundering
The Study Guide to AAA covers the issue of money laundering separately to that
of laws and regulations in A2(a) to (g). ACCA’s Code of Ethics and Conduct
defines ‘money laundering’ as:
‘...the process by which criminals attempt to conceal the true origin and
ownership of the proceeds of their criminal activity, allowing them to maintain
control over the proceeds and, ultimately, providing a legitimate cover for their
sources of income.’
Auditors need to be particularly careful where money laundering issues are
concerned – especially for a business that is predominantly cash-based because
the scope for money laundering in such businesses is wide. There are usually
three stages in money laundering:
Placement – which is the introduction or ‘placement’ of illegal funds
into a financial system.
Layering – which is where the money is passed through a large
number of transactions. This is done so that it makes it difficult to trace the
money to its original source.
Integration – which is where the ‘dirty’ money becomes ‘clean’ as it
passes back into a legitimate economy.
Money laundering offences can include:
concealing criminal property
acquiring, using or possessing criminal property
becoming involved in arrangement which is known, or suspected, of
facilitating the acquisition of criminal property.
There are many countries in which money laundering is a criminal offence and,
where an accountant or an auditor discovers a situation which may give rise to
money laundering, the accountant or auditor must report such suspicions to a
‘money laundering reporting officer’ (MLRO) whose responsibility it is to report
such suspicions to an enforcement agency (in the UK, this enforcement agency
is the National Crime Agency (NCA)).
It is an offence to fail to report suspicions of money laundering to NCA or the
MLRO as soon as practicable, and it is also an offence if the MLRO fails to pass
on a report to the NCA. Where the entity is actively involved in money laundering,
the signs are likely to be similar to those where there is a risk of fraud, and can
include:
complex corporate structure where complexity does not seem to be
warranted
transactions not in the ordinary course of business
many large cash transactions when not expected
transactions where there is a lack of information or explanations, or
77
78
audits performed are not always of high quality, despite this being in the best
interest of the audit firm. The objective of this article is to provide some insight
into why audit firms sometimes compromise audit quality, giving examples of how
this happens, and the implications of compromising on audit quality for the
profession.
This issue is relevant to P7 in that the Syllabus and Study Guide contains a
specific section, C1, which contains a number of learning outcomes in relation to
quality control in the context of practice management. In particular, learning
outcome C 1 (d) states the following capability: ‘Assess whether an engagement
has been planned and performed in accordance with professional standards and
whether reports issued are appropriate in the circumstances.’ This requires
candidates to apply their knowledge of quality control to a given scenario and a
requirement of this nature has appeared several times in past papers.
A reminder of the sources of requirements in relation to
quality control
The International Auditing and Assurance Standards Board (IAASB) has issued
two documents relating to quality control. ISQC 1, Quality Control for Firms that
Perform Audits and Reviews of Financial Statements, and Other Assurance and
Related Services Engagements applies to all firms of professional accountants in
respect of audits and reviews of financial statements, and other assurance and
related services engagements. It should therefore also be applied to non-audit
engagements such as reviews of prospective financial information and
engagements to perform agreed upon procedures.
ISA 220, Quality Control for an Audit of Financial Statements is specific to audit
engagements and contains specific requirements that should be adhered to in
the performance of any audit. ISA 220 contains requirements in relation to:
Leadership responsibilities for quality on audits
Relevant ethical requirements, in particular independence
Acceptance and continuance of client relationships and audit
engagements
Assignment of engagement teams
Engagement performance, meaning the direction, supervision and
review of an audit, including consultation and engagement quality control
reviews
Monitoring and documentation
A detailed review of all of the requirements is outside the scope of this article,
and candidates are encouraged to ensure that they are familiar with the contents
of ISA 220 so that they can apply this knowledge to a given scenario and
comment on whether an audit has been performed in accordance with the
requirements of the ISA.
Recent developments in relation to quality control
The IAASB makes specific reference to the issue of audit quality in its latest
annual report published in June 2014. The IAASB chairman, Arnold Schlider, in
his chairman’s statement, discusses audit quality as a key issue that the IAASB
is focussing on. He refers to the IAASB publication entitled A Framework for
Audit Quality, the objective of which is to raise awareness of the key elements of
79
80
there is a clear impact on the quality of work performed. For example, the IAASB
comments in its 2015–16 Work Plan that audit inspections have found instances
where the person selected to perform engagement quality control reviews was
not competent to do so. Given that engagement quality reviews are conducted
for high risk audit engagements using inexperienced auditors to perform such
reviews can create a potentially serious hazard for the audit firm in that it is much
more likely that an inappropriate opinion could be issued.
Ethical dilemmas – a common example is where the audit firm provides non-audit
services to the audited entity. Audit firms should be familiar with the concept that
providing non-audit services creates a threat to objectivity, in particular a self-
review threat, and audit firms also should be accustomed to assessing the
significance of the risk and responding with the use of appropriate safeguards or
by not providing the non-audit service. However there may be circumstances
where the threat is overlooked, so compromising audit quality. For example, if an
audited entity changes status and becomes listed (a public interest entity) then
while it may previously have been acceptable to provide a non-audit service with
the appropriate safeguards, the provision of the non-audit service may not be
acceptable given the new status of the audited entity. This issue was picked up
by the FRC in its 2014 round of audit quality inspections.
Extensive use of judgment – this is very much linked to professional scepticism
(see ‘Related links’ for further reading). Audit inspectors often comment that the
audit of judgmental balances such as fair values and impairment is lacking in
quality. The FRC’s 2014 Annual Report on Audit Quality Inspections states that
‘Limited evidence that [audit] firms have robustly challenged management
particularly in respect of the appropriateness of key assumptions and other
judgments was a key concern. Firms, with the assistance of audit committees,
should ensure they appropriately challenge management.’ The report comments
that audit firms often fail to challenge the feasibility of business plans prepared by
management, as well as assumptions relating to fair value, impairment and the
valuation of tangible and intangible assets.
These are just some examples of instances where audit quality has been
compromised, as identified by audit inspections. The objective of the inspections
is to highlight the weaknesses in audit quality and to recommend improvements.
It is up to the audit firm whether or not they respond to the recommendations, but
it is in their interest to do so, and there are calls by the IAASB to formalise the
means by which audit firms demonstrate that they have taken such
recommendations on board.
Conclusion
By emphasising the issue of audit quality in its current Work Plan, the IAASB is
making it clear that audit quality is something to be taken seriously. Higher
quality audits and public confidence in audit reports issued should reduce the
‘expectation gap’. However with audit firms coming under pressure to cut fees,
produce competitive tender documents and provide ‘added value’ to the audit in
the form of non-audit services, it is easy to see why audit quality is often
compromised. Future changes to make the requirements of ISQC1 and ISA 220
more robust could help, as will promoting the use of professional scepticism in
81
PROFESSIONAL SCEPTICISM
In recent years regulatory bodies including the International Auditing and
Assurance Standards Board (IAASB) and the UK Financial Reporting Council
(FRC) have issued documents highlighting the importance of professional
scepticism in an audit of financial statements. The objective of this article is to
explain the importance of professional scepticism as an essential part of the
auditor’s mindset, and to consider the reasons why approaching an audit with an
attitude of professional scepticism is becoming increasingly important.
What is professional scepticism?
The glossary of terms contained in the IAASB’s Handbook of International
Quality Control, Auditing, Review, Other Assurance, and Related Services
Pronouncements contains the following definition of the term ‘professional
scepticism’:
An attitude that includes a questioning mind, being alert to conditions which may
indicate possible misstatement due to error or fraud, and a critical assessment of
evidence.
ISA 200, Overall Objectives of the Independent Auditor and the Conduct of an
Audit in Accordance with International Standards on Auditing, contains more
guidance on how and why the auditor should act with an attitude of professional
scepticism. ISA 200 contains a specific requirement in relation to professional
scepticism:
The auditor shall plan and perform an audit with professional scepticism
recognising that circumstances may exist that cause the financial statements to
be materially misstated.
This overall objective is the fundamental driver for the relevant learning outcomes
within the Paper P7 syllabus, namely:
To discuss the importance of professional scepticism in planning
and performing an audit (B1e), and
To assess whether an engagement has been planned and
performed with an attitude of professional scepticism, and evaluate the
implications (B1f).
The application paragraphs of ISA 200 contain more guidance on what is meant
by applying professional scepticism when conducting an audit: Professional
scepticism includes being alert to, for example:
Audit evidence that contradicts other audit evidence obtained.
Information that brings into question the reliability of documents
and responses to inquiries to be used as audit evidence.
Conditions that may indicate possible fraud.
Circumstances that suggest the need for audit procedures in
addition to those required by the ISAs. (ISA 200 A.18).
Essentially, ISA 200 requires the use of professional scepticism as a means of
82
83
84
85
of matters relevant to the preparation of the financial statements and the IAASB
and national bodies such as the FRC are keen to support auditors in the
application of professional scepticism. This, they believe, is an essential element
of quality control, and in safeguarding the credibility of the audit opinion.
Written by a member of the Paper P7 examining team
86
Where such use is not prohibited by law or regulation, the ISA provides a robust
framework to ensure that direct assistance is obtained only in appropriate
circumstances, that the external auditor considers the relevant limitations and
safeguards, and that the auditor’s responsibilities are clearly set out.
Guidance on determining if it is appropriate for internal auditors to provide
direct assistance
When can internal auditors be used to provide direct assistance?
The external auditor, in the course of discharging their responsibilities must
decide if it is appropriate in the circumstances to use internal audit to provide
direct assistance. The ISA identifies a number of steps that the external auditor
should work through when determining to what extent, if any, direct assistance
can be provided.
Block: Text
Click to enlarge image
Step 1: Prohibition by law or regulation The external auditor may be
prohibited by law or regulation from obtaining direct assistance from internal
auditors; therefore, the first task is to understand the law or regulation of the
jurisdiction in which the auditor is operating. In the United Kingdom for example,
the Financial Reporting Council (FRC) prohibits external auditors from using
internal auditors as ‘direct assistance’ members of the audit team in order to
enhance the principle of auditor independence. Consequently the guidelines in
relation to direct assistance are irrelevant to audits conducted in accordance with
ISAs (UK).
Step 2A: Evaluation of the existence and significance of threats to objectivity of
the internal auditors This is considered as an important element in the external
auditor’s judgment as to whether internal auditors can provide direct assistance.
Objectivity is regarded as the ability to perform the tasks without allowing bias,
87
Block: Text
Click to enlarge image
It should be noted that the main purpose here is to evaluate threats to
objectivity. Take the first factor as an example – if evidence shows that the
internal audit function’s organisational status supports the objectivity of the
internal auditors, the external auditor will feel more comfortable using direct
assistance from the internal auditors. The following situations are likely to support
the objectivity of the internal auditors:
The internal audit function reports to those charged with
governance (eg the audit committee) rather than solely to management
(eg the chief finance officer)
The internal audit function does not have managerial or operational
duties that are outside of the internal audit function
The internal auditors are members of relevant professional bodies
obligating their compliance with relevant professional standards relating to
objectivity.
Step 2B: Evaluation of the level of competence of the internal auditors
Competence of the internal audit function is likely to be deemed satisfactory
where it can be evidenced that the function as a whole operates at the level
required to (i) enable assigned tasks to be performed diligently and (ii) in
accordance with applicable professional standards. To make such evaluation, the
external auditor can take into consideration the following factors:
Whether there are established policies for hiring, training and
88
89
Block: Text
Click to enlarge image
The external auditor should have performed the assessment of the first two
factors when determining whether the internal auditors can provide direct
assistance in the first instance. The less persuasive the evidence regarding the
internal auditors’ objectivity and competency, the more restrictive the nature and
extent of work that can be assigned.
As a starting point the external auditor should consider the amount of judgment
needed in (i) planning and performing relevant audit procedures and (ii)
evaluating audit evidence gathered. The greater the level of judgment required,
the narrower the scope of work that can be assigned to internal auditors. The
following activities are deemed to involve significant judgment and therefore are
not expected to be assigned to internal auditors providing direct assistance:
Assessing risks of material misstatements
Evaluating the sufficiency of tests performed
Evaluating significant accounting estimates, and
Evaluating the adequacy of disclosures in the financial statements
and other matters affecting the auditor’s report.
For any particular account balance, class of transaction or disclosure, the
external auditor has to take into consideration the assessed risk of material
misstatement when determining the nature and extent of work that they propose
to assign to internal auditors. The higher the assessed risk, the more
restricted the nature and extent of work that should be assigned to internal
auditors. If the risk of material misstatement is considered to be anything other
than low, the more judgment that has to be involved and the more persuasive the
audit evidence required. Therefore, in these circumstances, in order to reduce
90
audit risk to an acceptably low level it is expected that the external auditor has to
perform more procedures directly and place less reliance on assistance provided
by internal auditors when collecting sufficient appropriate evidence. The ISA
provides some specific examples of areas where reliance should be restricted.
ISA 610 (Revised 2013) states that internal auditors cannot carry out procedures
when providing direct assistance that:
Involve making significant judgment in the audit
Relate to higher assessed risks of material misstatements where
the judgment required in performing the relevant audit procedures or
evaluating the audit evidence gathering is more than limited
Relate to decisions the external auditor makes in accordance with
ISA 610 (Revised 2013) regarding the internal audit function and the use
of its work or direct assistance
Relate to work with which the internal auditors have been involved
and which has already been or will be reported to management (or those
charged with governance) by the internal audit function. This restriction
intends to minimise self-review threats.
ISA 610 (Revised 2013) also states that the following should not be assigned to
or involve internal auditors providing direct assistance:
(i) discussion of fraud risks (ii) determination of unannounced (or unpredictable)
audit procedures as addressed in ISA 240, The Auditor’s Responsibilities
Relating to Fraud in an Audit of Financial Statements, and (iii) maintaining control
over external confirmation requests and evaluation of results of external
confirmation procedures.
Responsibilities of the external auditor using internal auditors to provide
direct assistance
The external auditor should note the following responsibilities at different stages
of the audit when using internal auditors to provide direct assistance:
(1) After determining the use of internal auditors to provide direct assistance The
external auditor has to:
Communicate the nature and extent of the planned use of internal
auditors with those charged with governance (in accordance with ISA 260,
Communication with Those Charged with Governance) so as to reach a
mutual understanding that such use is not excessive in the
circumstances of the engagement. This communication not only dispels
any perception that the external auditor’s independence might be
compromised by the use of direct assistance but also facilitates
appropriate dialogue with those charged with governance.
Evaluate whether the external auditor is still sufficiently involved in
the audit.
(2) Prior to the use of internal auditors to provide direct assistance The external
auditor has to obtain written agreement from two parties:
From an authorised representative of the entity stating that: (i) the
internal auditors will be allowed to follow the external auditor’s instructions,
and (ii) the entity will not intervene in the work the internal auditor
performs for the external auditors.
91
From internal auditors stating that they will: (i) keep confidential
specific matters as instructed by the external auditor and (ii) inform the
external auditor of any threat to their objectivity.
(3) During the audit The external auditor has to:
Direct, supervise and review the work performed by internal
auditors on the engagement, bearing in mind that the internal auditors
are not independent of the entity. It is therefore expected that such
supervision and review will be of a different nature and more extensive
than if members of the audit engagement team perform the work.
Remind the internal auditors to bring accounting and auditing
issues identified during the audit to the attention of the external auditors.
Check back to the underlying audit evidence for some of the work
performed by the internal auditors.
Make sure the internal auditors have obtained sufficient appropriate
audit evidence to support the conclusions based on that work.
(4) Documenting the audit evidence The documentation requirements evidencing
the application of the important safeguards in ISA 610 (Revised 2013) have been
expanded when the external auditor uses the internal auditors to provide direct
assistance. The external auditor should document the following in the working
papers:
Evaluation of the existence and significance of the threats to the
objectivity of the internal auditors and the level of competence of the
internal auditors used to provide direct assistance
The basis for the decision regarding the nature and extent of the
work performed by the internal auditors
Who reviewed the work performed and the date and extent of
that review in accordance with ISA 230, Audit Documentation
The written agreements obtained from an authorised
representative of the entity and the internal auditors
The working papers prepared by the internal auditors providing
direct assistance on the audit engagement.
Conclusion
The external auditor has to exercise professional judgment when determining
whether the internal auditors, subject to law and regulation, can be used to
provide direct assistance in the financial statement audit of an entity. Candidates
are expected to understand (i) how the external auditor makes such evaluations
and (ii) for which processes or tasks the internal auditors can provide direct
assistance to the external auditor. The most important principle is, in any
circumstances, the external auditor should be sufficiently involved in the audit
as the external auditor has the sole responsibility for the audit opinion
expressed.
Eric YW Leung, CUHK Business School, The Chinese University of Hong
Kong, FCCA
Reference ISA 610 (Revised 2013), Using the Work of Internal Auditors,
together with its Basis for Conclusions
92
ACCOUNTING ISSUES
A very common theme in Paper P7 questions is to present you with information
that embodies an accounting issue. Sometimes the information is presented as a
standalone requirement but is often, for example, included in a set of notes of a
conversation with an audit client’s finance director.
For example:
December 2012 Question 1 contains: Work has recently started on a new
production line which will ensure that Grohl Co meets new regulatory
requirements prohibiting the use of certain chemicals, which come into force in
March 2013. In July 2012, a loan of $30m with an interest rate of 4% was
negotiated with Grohl Co’s bank, the main purpose of the loan being to fund the
capital expenditure necessary for the new production line.
June 2012 Question 1 contains: Starling Co received a grant of $35m on 1 March
2012 in relation to redevelopment of its main manufacturing site. The government
is providing grants to companies for capital expenditure on environmentally
friendly assets. Starling Co has spent $25m of the amount received on solar
panels which generate electricity, and intends to spend the remaining $10m on
upgrading its production and packaging lines.
December 2011 Question 1 contains: On 1 July 2011, Oak Co entered into a
lease which has been accounted for as a finance lease and capitalised at $5m.
The leased property is used as the head office for Oak Co’s new website
development and sales division. The lease term is for five years and the fair
value of the property at the inception of the lease was $20m.
Typically the question requirements will then be something along the lines of:
Evaluate the business risks faced by X Co.
Identify and explain the risks of material misstatement to be
considered in planning the audit of X Co.
In respect of the risks of material misstatement, suggest suitable
audit procedures.
Business risks
Remember that when you are describing business risks, you should say nothing
about potential misstatements in the financial statements. Business risks exist
quite independently of the financial statements and they do not depend on audit
procedures. Business risk is where the directors make wrong decisions or where
events have occurred which threaten the business’s future. Business risks are
often classified as:
Strategic risks (for example, investing in out-of date technology).
Operational risks (for example, manufacturing products which have
faults).
Regulatory risks (for example, the fines and damages that might be
payable as a consequence of breaching health and safety regulations).
Financial risks (for example, an inability to pay interest or rent
because of poor cash flow).
Although drafting financial statements does not affect the business risks,
understanding the business risks can give insights into where the financial
93
94
95
Block: Text
However, by no means all procedures covered by ISAs and candidates must be
able to suggest procedures that will help in the collection of appropriate audit
evidence for both the treatment of items in accordance with the accounting
standards and for their amounts.
So, procedures relevant to collecting evidence about the receipt of a government
grant (Q1 from June 2012):
Treatment:
Inspect the grant application and subsequent correspondence with
the government department to verify the amount and purpose of the grant
(ie to ensure it is a grant relating to non-current assets).
Trace the credit entry in respect of the grant either to a deferred
income account or to the credit of the appropriate non-current asset
96
FORENSIC ACCOUNTING
With at least one requirement relating to forensic accounting in three out of five
Paper P7 exams between December 2011 and December 2013, this is an area
of the syllabus that students cannot afford to overlook. This article explores some
of the issues relevant to forensic accounting. Forensic accounting has been a
regular feature in the Paper P7 exam in recent sittings but the examiner has
commented that it is an inadequately understood part of the syllabus.
Terminology
The syllabus requires an understanding of three key terms: ‘forensic accounting’,
‘forensic investigation’ and ‘forensic audit’. Recent exam sittings have shown that
students have rote-learnt the definitions or meaning of these terms, but do not
necessarily understand them.
The terms are not strictly defined in regulatory guidance and the meaning of
forensic accounting is quite broad: it is the application of accountancy skills and
knowledge in circumstances that have legal consequences. There are many
circumstances with legal consequences in which accountancy might be required;
the most well known of which is investigating alleged fraudulent activity.
Forensic accounting is the term used to describe the type of engagement. It is
the whole process of carrying out a forensic investigation, including preparing an
expert’s report or witness statement, and potentially acting as an expert witness
in legal proceedings.
97
98
99
100
the hearing where they do not agree. The decision maker must decide which
evidence they ‘prefer’ – the credibility of the witness is often the primary factor on
which they can base that decision and the credibility of an accountant is reliant
on their compliance with the fundamental ethical principles.
In the exam, you will also need to note whether the client requesting the forensic
accounting service is an audit client, if so, this will present an additional and
particularly important threat to objectivity; a self-review threat. The investigation
is likely to involve the quantification of an amount, which will then be reviewed as
part of the financial statements audit. The significance of the threat will be
affected by the materiality of the amount and the subjectivity involved in
quantifying it, eg if for loss of profits following business interruption this will be
more subjective than quantification of the value of stolen inventory.
Remember that the decision to prosecute is a matter for the client. Often, clients
do not want to prosecute for fear of damaging their reputation. The forensic
accountant can provide the client with an analysis of all of the facts, but must not
make the decision to prosecute (a management threat to objectivity). The
forensic accountant has a duty of confidentiality, unless it is in the public interest
to do so, they must not disclose the fraud to any third party including the police,
without client permission.
A final note
Remember that a forensic accountant is just that; an accountant! Their role is to
provide an accountant’s expert opinion or analysis of the facts. They are not the
law-enforcer, prosecutor or judge. Be careful in the exam not to detract from an
otherwise professional answer by getting carried away with suggestions such as
taking fingerprints or DNA evidence or blood samples, or catching and punishing
the culprit – that is not the role of an accountant.
Check your understanding
Question: Which of the following would be a valid procedure in a forensic
engagement to determine the amount of insurance to be claimed in respect of
lost profits during a business interruption following a flood?
Obtain a written confirmation from the insurance provider to verify the amount
of the loss.
Recalculate management’s assessment of the loss to verify mathematical
accuracy.
Obtain the profit forecast for the period covered by insurance, and cast for
mathematical accuracy.
Answer: The assurance provider’s role is to independently quantify the loss in
order to determine the amount to be claimed; therefore 1 and 2 are not relevant.
They would review the profit forecast in comparison with the actual outturn to
determine the amount of profit lost and the first step would be to ensure that it
adds up correctly. (Answer 3) Question: Which of the following would be a valid
statement to include in a witness statement from an expert witness, but not a
professional witness?
The company’s purchases daybook recorded 15 sales invoices made out in the
name of the allegedly fictitious supplier.
The majority of the transactions recorded in the sales day-book do not appear
101
to be commercial in nature.
75% of customers breached the credit limits set by the company during the
period.
Answer: 1 and 3 are a matter of fact, 2 is a matter of opinion. Only an expert
witness can give their opinion. A professional witness is a witness of fact who
can only comment on what they did, saw or heard. A professional accountancy
witness could review a company’s records and comment on what they saw
during that review. (Answer 2)
Helen Barrett is a forensic accountant and a freelance lecturer
AUDITOR LIABILITY
Auditor liability: ‘fair and reasonable’ punishment?
/ Element: Page Intro Block: Text
The issue of auditor’s liability is included in the syllabus for Paper P7, Advanced
Audit and Assurance. Candidates need to understand and apply the principles of
establishing liability in a particular situation, as well as being able to discuss the
ways in which liability may be limited. The specific learning outcomes can be
found in the Syllabus and Study Guide.
This article focuses on the issue of auditor’s liability in the UK, and therefore
contains references to the UK Companies Act 2006, as well as UK-specific legal
cases. Candidates other than those attempting the UK adapted paper are not
expected to have UK-specific knowledge. The concepts discussed in this article
however are broadly relevant and will help candidates to understand why this is
an important issue within the auditing profession.
Over the past two decades the bill for litigation settlements of Big Four audit firms
alone has run into billions of dollars. Examples include Deloitte’s 2005 settlement
of $250m regarding its audit of insurance company Fortress Re and PwC’s
$229m settlement in the lawsuit brought by the shareholders of audit client Tyco
in 2007.
Auditor liability is increasingly concerning, both in terms of audit quality and the
reputation of the profession but also in terms of the cost to the industry and the
barriers this creates to competition within the audit market.
This article considers the current legal position of auditors in the UK. It also
discusses the impact on the competitiveness of the audit market and some of the
methods available to limit exposure to expensive litigation.
Types of liability
Auditors are potentially liable for both criminal and civil offences. The former
occur when individuals or organisations breach a government imposed law; in
other words criminal law governs relationships between entities and the state.
Civil law, in contrast, deals with disputes between individuals and/or
organisations.
Criminal offences Like any individual or organisation auditors are bound by the
laws in the countries in which they operate. So under current criminal law
auditors could be prosecuted for acts such as fraud and insider trading.
Audit is also subject to legislation prescribed by the Companies Act 2006. This
102
includes many sections governing who can be an auditor, how auditors are
appointed and removed and the functions of auditors.
One noteworthy offence from the Companies Act is that of ‘knowingly, or
recklessly causing a report under section 495 (auditor’s report on company’s
annual accounts) to include any matter that is misleading, false or deceptive in a
material particular’ (s.507).
This means that auditors could be prosecuted in a criminal court for either
knowingly or recklessly issuing an inappropriate audit opinion.
Civil offences
There are two pieces of civil law of particular significance to the audit profession;
contract law and the law of tort. These establish the principles for auditor liability
to clients and to third parties, respectively.
Under contract law parties can seek remedy for a breach of contractual
obligations. Therefore shareholders can seek remedy from an auditor if they fail
to comply with the terms of an engagement letter. For example; an auditor could
be sued by the shareholders, which was the case in the PwC settlement to Tyco
shareholders referred to above.
Under the law of tort auditors can be sued for negligence if they breach a duty of
care towards a third party who consequently suffers some form of loss.
Case history
The application of the law of tort in the auditing profession, and the way in which
auditors seek to limit their exposure to the ensuing liabilities, has been shaped by
a number of recent landmark cases. The most notable of these are Caparo
Industries Plc (Caparo) v Dickman (1990) and Royal Bank of Scotland (RBS) vs
Bannerman Johnstone MacLay (Bannerman) (2002).
In the first case Caparo pursued the firm Touche Ross (who later merged to form
Deloitte & Touche) following a series of share purchases of a company called
Fidelity plc. Caparo alleges that the purchase decisions were based upon
inaccurate accounts that overvalued the company. They also claimed that, as
auditors of Fidelity, Touche Ross owed potential investors a duty of care. The
claim was unsuccessful; the House of Lords concluded that the accounts were
prepared for the existing shareholders as a class for the purposes of exercising
their class rights and that the auditor had no reasonable knowledge of the
purpose that the accounts would be put to by Caparo.
It was this case that provided the current guidance for when duty of care between
an auditor and a third party exists. Under the ruling this occurs when:
the loss suffered is a reasonably foreseeable consequence of the
defendant’s conduct
there is sufficient ‘proximity’ of relationship between the defendant
and the pursuer, and
it is 'fair, just and reasonable' to impose a liability on the defendant.
In the second case RBS alleged to have lost over £13m in unpaid overdraft
facilities to insolvent client APC Ltd. They claimed that Bannerman had been
negligent in failing to detect a fraudulent and material misstatement in the
accounts of APC. The banking facility was provided on the basis of receiving
audited financial statements each year.
103
104
against the Big Four have topped $300m, one large negligence case could easily
bankrupt a mid-tier firm.
Managing exposure to liability
Audit quality
There are a number of ways in which audit firms can manage their exposure to
claims of negligence. Perhaps the most obvious is not being negligent in the first
place. In practical terms this means rigorously applying International Standards
on Auditing and the Code of Ethics for Professional Accountants and paying
close attention to the terms and conditions agreed upon in the engagement letter.
Of course, improvements in quality controls in comparison to current levels would
not happen without investment from the audit firms. With pressure to reduce
audit fees it is unlikely that firms will want to commit to further increases in cost
unless it is perceived that such action will lead to long-term reductions in legal
and insurance costs.
Disclaimers of liability
One of the outcomes of the Bannerman case was the potential exposure of
auditors to litigation from third parties to whom they have not disclaimed liability.
As a result it became common to include a disclaimer of liability to third parties in
the wording of the audit report.
Disclaimers may not entirely eliminate liability to third parties but they do reduce
the scope for courts to assume liability to them. It should be noted that whilst this
should reduce the threat of litigation in the UK, this protection may not extend
overseas because the disclaimer is based on a ruling from a UK court case. It
also provides no protection from the threat of litigation from clients under contract
law.
There are also critics of the ‘Bannerman Paragraph,’ who believe that its
presence devalues the audit report. They argue that the disclaimer acts as a
barrier to litigation, which reduces the pressure to perform good quality audits in
the first place. It is plausible that this reduces the credibility of the audit report in
the eyes of the reader.
Liability Limitation Agreements
Since 2008 auditors have been permitted, under the terms of the Companies Act,
to use Liability Limitation Agreements (LLAs) to reduce the threat of litigation
from clients. LLAs are clauses built into the terms of an engagement that impose
a cap on the amount of compensation that can be sought from the auditor. These
must be approved by shareholders annually and be upheld by judges as ‘fair and
reasonable’ when cases arise.
Whilst this may sound straightforward it has created problems, including how to
define the cap (ie as a fixed monetary amount, a multiple of the fee,
proportionate liability on a case by case basis). It is also difficult to decide what is
fair and reasonable when setting the terms of the engagement because this is
done before any potential litigation, or the scale of potential litigation, is known to
the auditor and the client. This is therefore open to the interpretation of the
courts. At which point the level of compensation may as well lie at the discretion
of the courts in the first place.
Another problem lies with the shareholders; what motivation do they have for
105
agreeing to terms that could potentially reduce their ability to recover any losses
they incur due to the negligence of other parties? Once again this may be
perceived as a barrier to litigation that audit firms can hide behind, reducing the
pressure to perform good quality audits.
Current position
All the methods described contribute to the management of auditor liability but it
seems none of them have provided the protection the profession needs to
become truly competitive. Remember, the profession is not asking for exemption
from litigation, rather that it does not shoulder the entire burden of litigation where
others may also be to blame.
In June 2008, the European Commission recommended that member states find
a way to limit auditor liability to try and encourage competition in the audit of
listed companies and to protect EU capital markets. Given the different legal
systems involved the recommendation leaves it to member states to determine
an appropriate method but suggests that the solution:
should not apply in cases of misconduct
would be ineffective if it did not extend to third parties, and
should ensure fair compensation of damaged parties.
Whilst no firm decision has been reached in the UK there are an increasing
number of advocates for a ‘proportional’ system of liability replacing the current
‘joint and several’ one. Under this proposal the audit firm would accept their
proportion of the blame in a negligence case and would pay that proportion of the
compensation. This system, as introduced in Australia in 2004, would ensure a
fair outcome for the plaintiff without placing the entire financial burden upon the
audit profession. It would also meet the EC recommendations listed above.
At the time of writing no solution has been agreed upon in the UK and the debate
continues.
Conclusions
There is an increasing trend of litigation that is costing the audit profession
billions of pounds. The potential costs and risks of auditing large, listed
businesses may now be prohibitive for any firm of willing auditors outside of the
Big Four.
Auditors can reduce their exposure to litigation but there is a rising groundswell
of opinion that the audit profession has, for too long, borne the brunt of penalties
for misdemeanours shared by other culpable parties. These penalties are
prohibitive to competition, which may be damaging to capital markets.
There is widespread agreement that this situation must change. Unfortunately,
any decision on the nature and timing of such a change appears to be a long way
off. Until such time the audit profession will simply have to bear the burden of
liability. Simon Finley is a teaching fellow at the Aston University
Accounting Group Reference 1 Auditing: Commission Issues Recommendation
on Limiting Audit Firms’ Liability, European Commission, 6 June 2008
106
107
108
the extent of internal control in the company and in assessing its effectiveness.
4 Management’s philosophy and operating style A company’s board of
directors will comprise of individuals each with a different mind – set as to
philosophy and operating style, manifested in characteristics such as their:
approach to taking and managing business risk
attitudes and actions toward financial reporting
attitudes toward information processing and accounting and
functions personnel.
Each of the above characteristics underlie a company’s control environment and
it is crucial for an auditor to have an understanding of them. Dealing with each in
turn:
Approach to taking and managing business risk. Business risk is the risk inherent
in a company as a consequence of its day-to-day operations and it comprises
several components. The first of these is financial risk – for example, the risk that
the company may have insufficient cash flow to continue in operation. The
second component is operational risk – for example, the risk that the company’s
product lines may decline in popularity leading to a sharp decline in sales and
profitability. The final component of business risk is compliance risk – for
example, the risk that the company may be in breach of health and safety
regulations, leading to the possibility of hefty fines or even the closedown of
operational activity.
Candidates should be aware that a risk-based approach to an audit requires the
identification and assessment of inherent risk factors and then of the control risk
pertaining to these, in order to determine the risk of material misstatement, prior
to carrying out substantive procedures. By adopting a top-down approach to the
audit and first identifying business risks, auditors should be able to identify the
associated inherent risks arising. They can then progress through the audit using
the audit risk model (audit risk = the risk of material misstatement x detection
risk) to determine the amount of detailed testing required in each area of the
financial statements. To illustrate this approach, referring to the compliance risk
example above, an inherent risk arising from the risk of a breach of health and
safety regulations. As a consequence, there is a risk that the company’s liabilities
may be understated due to the omission of a provision required in the financial
statements, in respect of a fine for a non-compliance.
The directors’ approach to taking and managing business risk has obvious
ramifications on a company’s financial statements, and the auditor should be
aware of the various factors that influence directors in this area, and of applicable
controls in place. It is often the case that a newly established company with
young entrepreneurial directors and a flat management structure will have a
more liberal approach to taking and managing business risk than a well-
established company with more experienced directors, and a steep hierarchical
management structure. Consequently, it is likely that there would be a lower level
of a risk of material misstatement in the financial statements of the latter
company.
Attitude and actions toward financial reporting. Financial Reporting Standards
exist to help facilitate fairness, consistency and transparency of financial
109
110
111
for an exit interview so that the reason for the termination can be
confirmed or clarified, all emoluments due to the employee can be settled
and arrangements can be made for the return of all company assets prior
to the termination date.
While each of the above measures will have a positive impact on the internal
control of a company, to some extent they all have the effect of reducing the risk
of material misstatement in the financial statements. For example, the existence
of fair and robust grievance and disciplinary procedures reduce the possibility of
a successful claim against the company for constructive or unfair dismissal, and
the absence of a material provision in this respect. Significantly, the existence of
human resources policies and practices that are the same or similar to those
above should leave a favourable impression with the auditor, as to the directors’
attitude toward their company’s workforce. It is likely that such an attitude would
foster good working relationships with employees, leading to an increased
likelihood that individuals would reciprocate by carrying out their tasks diligently
with integrity in the best interests of the company – resulting in a reduced risk of
material misstatement.
Summary As indicated at the beginning of this article, the purpose of it is to
provide candidates with a more detailed appreciation of matters pertinent to an
auditor, when evaluating the control environment of a limited liability/limited
company. When asked to explain what is meant by the term ‘control
environment’, they typically comment that it is a component of a company’s
internal control and that it centres around how a company is operated by its
management, reflecting such matters as their philosophy and operating style.
While there is some merit in this answer, having now read the above
commentary, candidates should be aware that the term has much more meaning
than that.
Written by a member of the audit examining team
112
113
Block: Text
The approach required by ISAE 3000, and the work undertaken with an
assurance engagement, may be similar in many respects to an audit
engagement, although the context is different. For each of the assurance
engagements on other information, the guidance from ISAE 3000 will apply, with
the exception of Prospective Financial Information (PFI) work, where separate
guidance is given in ISAE 3400, which is summarised later in this article.
Listed below are the most relevant areas where assurance engagements on
other information will typically arise:
Internal controls and systems reviews
Due diligence reviews
Prospective financial information.
Internal control and systems reviews The type of assurance work arising here
is very similar to the work that auditors have been doing for a long time as part of
the audit approach required when evaluating the effectiveness of internal control
systems. Control and systems review work is tested in Paper F8 and, as such,
needs little further coverage in this article.
Key performance indicators Developments in performance measurement have
led to many companies publishing a selection of key performance indicators
(KPIs) in the annual financial statements. KPIs represent a set of measures
focusing on those aspects of performance that are most crucial for the continued
success of an organisation. Many companies are increasingly opting for
114
voluntary disclosure of KPIs, which can be financial (such as ratios based on the
financial statements) or non-financial (such as targets on social and
environmental matters). The increased tendency to disclose such data is often in
response to shareholder expectations. The assurance approach towards KPIs
requires careful consideration of how the KPI has been defined, the KPI
calculation method, and the purpose of reporting the KPI, and the nature of
evidence that would be available on the source of the underlying data.
Problems facing assurance providers in relation to KPI assessment may include
the lack of precise definitions of KPI targets, lack of developed systems to
capture KPI data, and the potential for KPIs, as disclosed, to be manipulated to
achieve a desired result. However, an assurance report provided on the KPIs
should add credibility to the published data if sufficient evidence is available to
the assurance provider.
Due diligence reviews There is little specific guidance on due diligence reviews,
despite this being an increasingly common form of assurance. Normally, the
assurance provider is engaged by the potential acquirer of a company, who
seeks to discover information about the target organisation. The assurance
provider will attempt to verify any representations made by the management of
the target company, and may also offer practical recommendations regarding the
acquisition process.
Prospective financial information Procedures by assurance firms on
prospective financial information (PFI) are well established, and separate
guidance is given by the IAASB in ISAE 3400, The Examination of Prospective
Financial Information, which again is very practical in nature. The standard
defines PFI as ‘financial information based about events that may occur in the
future and possible actions by an entity’.
The standard recognises that, because PFI relates to events and actions that
have not yet occurred and may not occur, PFI work is highly subjective in its
nature, and its preparation requires the exercise of considerable judgment.
ISAE 3400 requires that before accepting a PFI engagement, the terms of the
engagement should be agreed on and sufficient knowledge of the business
should be obtained. The period of time covered by the PFI should be clarified,
which could be a forecast (usually a period of up to 12 months) and/or a
projection (usually up to five years).
ISAE 3400 also requires that written representations should be requested from
management regarding the intended use of the PFI, the completeness of
significant management assumptions, and also management’s acceptance of its
responsibility for the PFI. The assurance report should make it clear that
management is responsible for the PFI and also the assumptions on which it is
based. Given the subjective and speculative nature of the PFI, an opinion cannot
be given on whether the results shown in the report will be achieved, so only
negative assurance can be given.
Non-assurance engagements
Non-assurance engagements are more likely to arise with small companies, and
only a general awareness will be required of the guidance given by the IAASB for
each of these three areas. Each of the three so-called non-assurance areas is
115
116
117
Block: Text
Control environment
The control environment consists of the governance and management functions
and the attitudes, awareness and actions of the management about the internal
control. Auditors may obtain an understanding of the control environments
through the following elements.
1. Communication and enforcement of integrity and ethical values It is important
for the management to create and maintain honest, legal and ethical culture, and
to communicate the entity’s ethical and behavioural standards to its employees
through policy statements and codes of conduct, etc.
2. Commitment to competence It is important that the management recruits
competent staff who possess the required knowledge and skills at competent
level to accomplish tasks.
3. Participation by those charged with governance An entity’s control
consciousness is influenced significantly by those charged with governance;
therefore, their independence from management, experience and stature, extent
of their involvement, as well as the appropriateness of their actions are extremely
important.
4. Management’s philosophy and operating style Management’s philosophy and
operating style consists of a broad range of characteristics, such as
management’s attitude to response to business risks, financial reporting,
information processing, and accounting functions and personnel, etc. For
example, does the targeted earning realistic? Does the management apply
aggressive approach where alternative accounting principles or estimates are
available? These management’s philosophy and operating style provide a
picture to auditors about the management’s attitude about the internal control.
5. Organisational structure The organisational structure provides the framework
on how the entity’s activities are planned, implemented, controlled and reviewed.
6. Assignment of authority and responsibility With the established organisational
structure or framework, key areas of authority and reporting lines should then be
defined. The assignment of authority and responsibility include the personnel that
make appropriate policies and assign resources to staff to carry out the duties.
Auditors may perceive the implementation of internal controls through the
understanding of the organisational structure and the reporting relationships.
7. Human resources policies and practices Human resources policies and
practices generally refer to recruitment, orientation, training, evaluation,
counselling, promotion, compensation and remedial actions. For example, an
118
119
the audit in order to assess the risks of material misstatement at the assertion
level, and to design further audit procedures to respond to those risks. Control
activities, such as proper authorisation of transactions and activities,
performance reviews, information processing, physical control over assets and
records, and segregation of duties, are policies and procedures that address the
risks to achieve the management directives are carried out.
Monitoring of controls
In addition, auditors should obtain an understanding of major types of activities
that the entity uses to monitor internal controls relevant to financial reporting and
how the entity initiates corrective actions to its controls. For instance, auditors
should obtain an understanding of the sources and reliability of the information
that the entity used in monitoring the activities. Sources of information include
internal auditor report, and report from regulators.
Limitations of internal control systems
Effective internal control systems can only provide reasonable, not absolute,
assurance to achieve the entity’s financial reporting objective due to the inherent
limitations of internal control – for example, management override of internal
controls. Therefore, auditors should identify and assess the risks of material
misstatement at the financial statement level and assertion level for classes of
transactions, account balances and disclosures.
Conclusion
As internal auditors have better understanding of the organisation and expertise
in its risk and control, the proposed requirement for the external auditors to make
enquiries of internal audit function in ISA 315 (Revised) will enhance the
effectiveness and efficiency of audit engagements. External auditors should pay
attention to the components of internal control mentioned above in order to make
effective and efficient enquiries. An increase in the work of internal audit
functions is also expected because of such proposed requirement.
Raymond Wong, School of Accountancy, The Chinese University of Hong
Kong, and Dr Helen Wong, Hong Kong Community College, Hong Kong
Polytechnic University
Reference ISA 315 (Revised), Identifying and Assessing the Risks of Material
Misstatement Through Understanding the Entity and Its Environment
120
However, according to ISA 300, planning should not be seen as a discrete and
separate part of the overall audit. Planning often begins shortly after, or in
connection with, the completion of the previous audit, for example, with a review
of issues that were discussed with management, such as control deficiencies or
unadjusted errors. Such matters are relevant to the next year’s audit and need to
be considered when planning. Similarly, the audit plan may be revised as the
audit progresses, and should not be viewed as being fixed in place once the
main planning phase has ended. For example, a significant event may take place
as the audit is in progress, meaning that the audit plan needs to be changed. The
nature and extent of planning activities depends on the size and complexity of
the audit client, previous experience of the audit firm with the client, and any
changes in circumstance that may occur during the audit. Preliminary activities
ISA 300 contains a requirement that the auditor shall undertake the following
activities at the beginning of the current audit engagement:
Performing procedures regarding the continuance of the client
relationship and the specific audit engagement.
Evaluating compliance with relevant ethical requirements, including
independence.
Establishing an understanding of the terms of the engagement.
These requirements are also contained in and ISA 220, Quality Control for an
Audit of Financial Statements and ISA 210, Agreeing the Terms of Audit
Engagements and remind us that planning is a wider activity than just obtaining
understanding of the business and performing risk assessment. Audit strategy
and audit plan ISA 300 states that audit planning activities should:
establish the overall audit strategy for the engagement
develop an audit plan.
Audit strategy The audit strategy sets out in general terms how the audit is to be
conducted and sets the scope, timing and direction of the audit. The audit
strategy then guides the development of the audit plan, which contains the
detailed responses to the auditor’s risk assessment. An underpinning principle of
audit planning under the Clarified ISAs is that the audit plan should contain
detailed responses to the specific risks identified from obtaining an
understanding of the audited entity. ISA 300 requires the auditor to consider
specific matters when establishing the audit strategy, and provides a list of typical
matters to be considered in its appendix. These matters are discussed below.
Identify the characteristics o f the engagement that define its scope Some
audit engagements have specific characteristics that mean the audit has a wider
scope than the audit of other entities. For example, a group audit engagement or
the audit of a multinational company will both have wider scopes than an audit of
a small, owner-managed entity. Matters such as the ability to use the work of
internal auditors, the need to liaise with external service organisations, and the
effect of IT on audit procedures are also relevant. The scope is also affected by
the applicable financial reporting framework, the nature of the audited entity’s
business and whether it operates business segments, the business activities
conducted, and the availability of client personnel and data. Ascertain the
reporting objectives of the engagement to plan the timing of the audit and
121
122
123
124
125
issued with the financial statements for consistency with the financial statements.
This is important as inconsistencies may have implications for the auditor’s
report. Specific items of other information are subject to specific regulation in
some jurisdictions – for example, in the UK and Ireland the auditor’s report must
state whether the Directors’ Report is consistent with the financial statements.
Subsequent events and going concern procedures
There are two ISAs that are particularly relevant near the end of the audit. The
first is ISA 560, Subsequent Events, which requires the auditor to perform audit
procedures to obtain sufficient appropriate audit evidence that all events
occurring between the date of the financial statements and the auditor’s report
that require adjustment of, or disclosure in, the financial statements have been
identified. Typically, the auditor will follow a specific work programme dealing
with subsequent events, including procedures such as reviewing internal
accounting records and minutes of management meetings since the year-end
and discussing subsequent events with management – particularly the extent to
which management has established procedures adequate to identify relevant
subsequent events. It is important that procedures dealing with subsequent
events are performed up to the date of the auditor’s report. If they are performed
too early and not updated close to the date of the auditor’s report, then a
significant event may not be identified by the auditor. Secondly, ISA 570, Going
Concern states that the auditor shall remain alert throughout the audit for audit
evidence of events or conditions that may cast doubt on the entity’s ability to
continue as a going concern. Therefore, the auditor will conclude on going
concern matters near the end of the audit having reviewed all evidence obtained
and after reviewing the final version of the financial statements.
Written representations and communication with those
charged with governance
Towards the end of the audit, the auditor must consider the matters to be
included in management’s written representation, according to ISA 580, Written
Representations . This is a matter to be de alt with towards the conclusion of the
audit because it is a requirement of ISA 580 that the date of the written
representation shall be as near as possible to, but not after, the date of the
auditor’s report. Written representations are necessary audit evidence, and
therefore the auditor’s opinion cannot be expressed and the auditor’s report
cannot be dated before the date of the written representations. Significant
subsequent events may come to light very late in the audit, and therefore the
written representations should cover all of the subsequent events period, right up
to the date at which the audit report is dated. Important outputs of the audit are
the matters to be communicated in accordance with ISA 260, Communication
with Those Charged with Governance. The matters to be communicated include
significant findings from the audit and matters relating to auditor’s independence.
In addition, the auditor must also consider whether the two-way communication
between the auditor and those charged with governance has been adequate for
an effective audit, and have taken appropriate action if not.
Audit clearance meeting
At the conclusion of the audit, a meeting will usually be held between the auditor
126
and management and/or those charged with governance of the client. At this
clearance meeting the audit or will explain the various matters that have been
discussed in this article, and any other matters to be discussed in respect of the
financial statements and the audit. Typically, at the clearance meeting the
following matters may be discussed:
The adequacy of the entity’s internal controls and process of
preparing the financial statements,
any proposed adjustments to the financial statements
any difficulties encountered during the audit process
the details of ethical matters that may need to be clarified with the
client
confirmation of the matters to be included in management’s written
representations
an update on changes in financial reporting or other regulations that
may impact the client’s financial statements, and
confirmation that the client’s accounting policies are appropriate.
The audit clearance meeting is not a requirement of ISAs, but is often used as a
means to ensure that there are no misunderstandings regarding the financial
statements, the auditor’s report and any of the other matters discussed.
Conclusion
The completion stage of the audit must be carefully planned to ensure that the
requirements of the many relevant ISAs are adhered to. If the completion stage is
not adequately performed, there is a risk that an inappropriate opinion is given on
the financial statements.
Written by a member of the Paper P7 examining team
127
128
may not involve a court order. A company, its directors or one or more creditors
(payables) can apply to the court for the appointment of an administrator. The
court will grant an administration order only if it is satisfied that the company is –
or is likely to become insolvent, and that the administration process is likely to
achieve its purpose of rescuing the company as a going concern. It is also
possible for an administrator to be appointed without a court order, either by a
floating chargeholder, or by the company or its directors. Administration usually
lasts for 12 months, after which time the administrator automatically vacates
office, though the period of administration can – in some cases – be extended
subject to approval from creditors (payables). On the other hand, administration
may not last for the full 12-month period, and may end early if the administration
has been successful.
Liquidation
If the company cannot be saved, then liquidation or ‘winding up’ is likely to be
initiated. The company will cease to trade, assets are sold, liabilities are paid (to
the extent allowed by the proceeds from the sale of assets and by applying the
rules for allocation of assets described below), and eventually the company will
be dissolved. Once liquidation proceedings are under way share dealings must
stop, and the directors lose their power to manage the company. The procedures
involved in placing a company into liquidation are complicated by the fact that
there are different ways that the process is initiated – compulsory liquidation,
members’ voluntary liquidation, and creditors’ voluntary liquidation. Compulsory
liquidation is usually initiated by one or more creditors, who apply to the court
and must demonstrate that the company is unable to pay its debts. A creditor
who is owed more than £750, and who has served the company with a written
demand for payment that has not been settled, has grounds to apply to the court
for compulsory liquidation. In less common circumstances, a member
(shareholder) who is dissatisfied with the directors’ management of the company
may petition the court for the company to be wound up on the just and equitable
ground. For this to be successful, the member had to demonstrate to the court
that winding up is the only remedy available. Voluntary liquidation can occur
through two different routes – a member’s voluntary liquidation, or a creditors’
voluntary liquidation. The former is used where the company is solvent, and can
only take place when the directors have made a declaration of solvency.
Creditors have no involvement with this type of liquidation, as the declaration of
solvency means that they will be paid in full and therefore have no risk exposure.
Shareholders pass a resolution to wind up the company and appoint a liquidator,
who is responsible for closing down the company. In contrast, in a creditors’
voluntary liquidation the creditors are heavily involved with proceedings, as in this
case the company is not solvent, and therefore creditors face the risk that they
will not be paid the full amount owing to them. The process is started by a
shareholders’ meeting where a resolution is passed to agree that the company
should be wound up, but subsequently, the creditors’ wishes over the
appointment of the liquidator and the process of winding up will override the
wishes of the shareholders.
Allocating company assets
129
GROUP AUDITING
This article reviews the most significant elements of group audits and
changes to ISA 600 that were introduced as a result of the recent Clarity
project
In March 2008, the Paper P7 examiner wrote an article about auditing groups
and joint audits.
This article is a reminder of some of the most significant elements of group
audits, which feature frequently in the Paper P7 exam. The significant changes to
ISA 600, Special Considerations – Audits of Group Financial Statements
(Including the Work of Component Auditors) that were introduced as a result of
the recent Clarity project are likely to make group auditing even more
130
131
Each
Group Parent
component
Financial
Group Group Component
statements
auditor auditor auditor
materiality
Materiality for
the
Group Group
consolidation Group auditor
auditor auditor
package as a
whole
132
materiality for
sensitive
figures
Block: Text
Performance materiality is the figure below that any errors in the financial
statements may be considered trivial. The component auditor will be required to
communicate to the group auditor a summary of all unadjusted errors in the
consolidation package.
It is common in larger group audits for the financial statements to be prepared
using a consolidation package of information that is sent to the parent company
by each component company. This will omit many of the disclosures that will be
in the eventual entity financial statements. The component auditor may,
therefore, be required to issue a special audit opinion on the truth and fairness of
the consolidation package. This opinion is likely to be addressed to the directors
of the component company, or may be addressed to the group auditor directly.
In order to minimise the risk of several accidental or deliberate errors in the
financial statements together exceeding group materiality, component materiality
figures will normally be significantly lower than the group materiality figure, even
for the largest component companies.
Example 1
Imagine that financial statements materiality is taken to be 10% of profit or loss
for each entity within a group and performance materiality is set at 0.5% of profit.
Imagine that a group has a parent company and two components, one of which
is profit making and one of which is loss making:
Component
materiality @ 200 1,200 800 600
10%
133
Performance
materiality @ 10 60 40 30
0.5%
Block: Text
If subsidiary 1 were audited by another firm using the same materiality
calculation method as the parent, an unadjusted error of $10m would correctly
result in issuance of an unmodified audit opinion on the financial statements of
that individual company. However, the effect of losses elsewhere in the group
would mean that although this error would not be material at the component
level, it would be material at the group level. Since it is only likely to be the parent
auditor who has this overview of the group, the group engagement team must
communicate materiality figures to component auditors in advance of audit work
commencing. In this example, the maximum component materiality figure that the
group auditor could communicate to the component auditors would be 600, but it
would be wise to select a lower figure than this, in order to reduce to a tolerable
level the risk of errors in both component companies together exceeding 600.
In the exam, if you are given extracts from draft financial statements, it’s often a
good start to recommend and briefly explain a figure for materiality.
Communication between auditors
ISA 600 in its revised form contains extensive new requirements on the
communication between parent and component auditor. In addition to practical
matters such as materiality, the required format of the consolidation package,
deadlines and contact details, the group auditor must communicate a number of
matters at the planning to the component auditor, including:
related party relationships known anywhere around the group
identified significant risks, whether due to error or fraud
methodology to be used for impairment testing of goodwill. Audit of
estimates is subjective and so it’s essential that the group auditor’s
preferred method is used throughout the group. Be prepared to explain
this in Paper P7.
Matters that the component auditor must communicate to the group auditor will
include:
any known related party relationships and related party transactions
134
separately
any known events after the reporting date.
Audit of the consolidation process
Once the group engagement partner is satisfied that the individual financial
statements within the group are free from material misstatement, attention can
now shift to audit of the consolidation process.
The good news for exam purposes is that this stage of the audit is very similar
regardless of the specific company, so good marks can be obtained largely by
memorising the risks and responses below.
Principal risks arising in the consolidation process include errors or omissions
arising during:
transcription of figures from individual financial statements to
consolidation workings
classification of components (eg associate, subsidiary)
cancellation of intra-group trading, cancellation of intra-group
balances and allowance for unrealised profit on intra-group transfers
recognition of impairment of purchased positive goodwill
determination of fair values being used on acquisition
arithmetical inaccuracy in the consolidation process
identification and disclosure of related party relationships and
transactions
foreign currency translation from functional currency of components
to reporting currency of the group.
The most reliable evidence on completeness and accuracy of consolidation
adjustments in a large group is likely to be determining whether the client’s
accounting systems adequately flags transactions with fellow group companies.
The process is still likely to be highly substantive in nature and will probably
include these tests of detail:
line-by-line agreement of all items from audited component financial
statements (or consolidation packages submitted to head office) to the
consolidation schedules
detailed discussion with management on the reason for
classification of each component
sample testing of known intra-group transactions to ensure that
they have been eliminated in the client’s consolidation
recalculation of all significant workings, such as goodwill, non-
controlling interests and foreign currency translation.
Final review of financial statements
The group audit opinion may be signed on some date on or after the audit
opinions on material components are signed. Once the component auditor has
issued their opinion, their responsibility for reporting on the impact on events
after the reporting date is greatly diminished, yet there may be material events
that could be material in the group financial statements. The group engagement
team will normally agree in advance with the auditor of significant components
that an update on events is given by the component auditor to the group
engagement partner immediately before the group audit opinion is signed. It is
135
the responsibility of the group engagement team to ensure that material events
are reported.
Reporting to management and the board
In addition to the usual requirements for reporting to those charged with
governance (the ‘management letter’), ISA 600:49 requires the group
engagement partner also to report to management on any concerns that they
had about possible fraud anywhere in the group, any restrictions on information
made available by component management and any concerns that they had
about the quality of work performed by any component auditor.
In addition to the audit report to shareholders, the group auditor is required by
ISA 600 to report on a group-wide basis to group management and separately to
those charged with governance at a group level, such as the audit committee of
the board. This split communication echoes the requirements of ISA 260
Communication with Those Charged with Governance to produce different letters
to different levels of management.
The report to management will include details of all observed instances of
non-trivial fraud and all non-trivial deficiencies in internal controls around the
group.
The report to those charged with governance, most probably the audit
committee, will include:
an overview of the audit approach insofar as it affects component
auditors
any doubts that the group auditor may have about the quality of
work performed by the component auditor, giving the group auditor a
potentially awkward need to publicly question the skills of a fellow
professional.
any limitations on audit scope anywhere within the group
any suspected fraud where management is suspected of
involvement.
Summary
ISA 600 represents a significant extension of the responsibilities of both group
auditor and component auditor compared with the previous ISA. It is likely to be a
controversial standard in practice, and it is therefore likely to be in many Paper
P7 exams.
Understanding and memorising the key points of the standard is a very good use
of study time when preparing for the Paper P7 exam.
Graham Fairclough is group technical director at the ExP Group
136
137
of fee dependence. On the other hand, if asked to perform the audit of a small
owner-managed company, fee dependence is less likely to be an issue, but
threats potentially created by the auditor appearing to make management
decisions could be significant. In answering requirements on client and
engagement acceptance, candidates are warned that their comments must be
made specific to the scenario presented to them in order to pass the
requirement. Commercially, an engagement should be profitable to make it
worthwhile for the firm. But the firm must take care that commercial
considerations do not outweigh other matters to be considered. IFAC’s Code
makes it clear that acceptance decisions are not to be treated as a one-off
matter. The Code states: ‘It is recommended that a professional accountant in
public practice periodically review acceptance decisions for recurring client
engagements.’ Changes in the circumstances of either the client, or the audit firm
may mean that an engagement ceases to be ethically or professionally
acceptable or creates a heightened level of risk exposure. Therefore, client
continuance assessments are important and should be fully documented.
Preconditions for an audit
Once a firm has decided to go ahead with an audit engagement, it must comply
with the requirements of ISA 210, Agreeing the Terms of Audit Engagements.
ISA 210 was revised as part of the International Auditing and Assurance
Standards Board’s Clarity Project, with new requirements to perform specific
procedures in order to establish whether the preconditions for an audit are
present. ISA 210 defines preconditions for an audit as follows: ‘The use by
management of an acceptable financial reporting framework in the preparation of
the financial statements and the agreement of management and, where
appropriate, those charged with governance to the premise on which an audit is
conducted’. This means that the auditor must do two things. First, the auditor
must determine the acceptability of the financial reporting framework to be
applied in the preparation of the financial statements. This includes evaluating
whether law or regulation prescribes the applicable financial reporting framework,
considering the purpose of the financial statements, and the nature of the
reporting entity (for example, whether a listed company or a public sector entity).
In most cases this will simply be a matter of confirming with the client that the
financial statements will be prepared under International Financial Reporting
Standards, or other national reporting framework. Second, the auditor must
obtain the agreement of management that it acknowledges and understands its
responsibility:
For the preparation of the financial statements in accordance with
the applicable financial reporting framework.
For internal controls to enable the preparation of financial
statements which are free from material misstatement, whether due to
fraud or error.
To provide the auditor with access to all information necessary for
the purpose of the audit.
In relation to the final bullet point, if management impose a limitation on the
scope of the auditor’s work in the terms of a proposed audit engagement, the
138
auditor should decline the audit engagement if the limitation could result in the
auditor having to disclaim the opinion on the financial statements. The
engagement should also be declined if the financial reporting framework is
unacceptable, or if management fail to provide the agreement outlined above.
(ISA 580, Written Representations also requires that management provide
written representations regarding its responsibilities in relation to the preparation
of financial statements.)
Accepting non-audit assignments
It is very common for audit clients to approach their auditor for the provision of
additional services, ranging from audit related services such as tax planning and
bookkeeping, to other engagements such as due diligence and forensic
investigations. The audit firm must again carefully consider whether it is ethically
and professionally acceptable to take on the additional service. The main ethical
threat created by the provision of non-audit services is the threat to objectivity.
The threats created are most often self-review, self-interest and advocacy threats
and if a threat is created that cannot be reduced to an acceptable level by the
application of safeguards, the non-audit service shall not be provided. The UK
Auditing Practices Board’s (APB) Ethical Standard 5, Non-audit services
provided to audit clients contains similar principles, and emphasises the
‘management threat’ which exists when the audit firm makes decisions and
judgments that are properly the responsibility of management. Both the Code
and ES 5 outline a principles-based approach to determining the acceptability of
a non-audit service to an audit client. With a few exceptions, if safeguards can
reduce threats to an acceptable level then the service may be provided.
Safeguards could include using separate teams to provide the various services to
the client, and the use of second partner review or Engagement Quality Control
Review. ES 5 specifies that it is the audit engagement partner who should
evaluate the level of threat, the effectiveness of safeguards, and is ultimately
responsible for the documentation of the acceptance decision. The provision of
non-audit services to audit clients continues to be debated by the profession.
Many argue in favour of outright prohibition as being the only measure which can
totally safeguard auditor’s objectivity. However, it is accepted that audit firms are
best placed to provide audit clients with additional services due to the knowledge
of the business which they already possess, leading to a lower cost and higher
quality service than that would be provided by a different firm. In 2010 the APB
issued a feedback and consultation paper The provision of non-audit services by
auditors , which prompted continued discussion of these issues and
recommended a number of measures to:
Increase the rigour with which auditors assess threats to their
independence
Introduce a new non-audit services disclosure regime and
Increase the role of Audit Committees in overseeing the retention of
a company’s auditors to undertake non-audit services.
The final bullet point is important as it links to corporate governance. Under many
codes of corporate governance, including the UK Corporate Governance Code ,
the client’s audit committee should be involved with any decision as to whether
139
the audit firm can be engaged to provide a non-audit service. Therefore, when
approached to provide a non-audit service to an audit client, there should be full
discussion with those charged with governance, including the audit committee,
with a view to seeking approval for the engagement to go ahead. As well as
considering independence and objectivity, audit firms should remember that the
fundamental ethical principles apply to non-audit services, just as they apply to
audits. Therefore, when considering whether to provide a non-audit service, the
firm should evaluate its competency to perform the work, whether confidentiality
is an issue, and that it is able to comply with all relevant laws and regulations. As
discussed above, in answering requirements to do with non-audit services,
candidates’ answers must apply knowledge to the specific scenario provided in
order to score well.
Conclusion
The evaluation of new engagements is a crucial part of successful practice
management. The current debate over the acceptability of auditors providing
non-audit services to their audit clients indicates that ethical matters will continue
to play an important part in acceptance decisions. Written by a member of the
Paper P7 examining team
140
and output stages of the computer processing cycle and over standing data
contained in master files. Application controls need to be ascertained, recorded
and evaluated by the auditor as part of the process of determining the risk of
material misstatement in the audit client’s financial statements.
Input controls
Control activities designed to ensure that input is authorised, complete, accurate
and timely are referred to as input controls. Dependent on the complexity of the
application program in question, such controls will vary in terms of quantity and
sophistication. Factors to be considered in determining these variables include
cost considerations, and confidentiality requirements with regard to the data
input. Input controls common to most effective application programs include on-
screen prompt facilities (for example, a request for an authorised user to ‘log-in’)
and a facility to produce an audit trail allowing a user to trace a transaction from
its origin to disposition in the system.
Specific input validation checks may include:
Format checks These ensure that information is input in the correct form. For
example, the requirement that the date of a sales in voice be input in numeric
format only – not numeric and alphanumeric.
Range checks These ensure that information input is reasonable in line with
expectations. For example, where an entity rarely, if ever, makes bulk-buy
purchases with a value in excess of $50,000, a purchase invoice with an input
value in excess of $50,000 is rejected for review and follow-up.
Compatibility checks These ensure that data input from two or more fields is
compatible. For example, a sales invoice value should be compatible with the
amount of sales tax charged on the invoice.
Validity checks These ensure that the data input is valid. For example, where an
entity operates a job costing system – costs input to a previously completed job
should be rejected as invalid.
Exception checks These ensure that an exception report is produced highlighting
unusual situations that have arisen following the input of a specific item. For
example, the carry forward of a negative value for inventory held.
Sequence checks These facilitate completeness of processing by ensuring that
documents processed out of sequence are reject ed. For example, where pre-
numbered goods received notes are issued to ac knowledge the receipt of goods
into physical inventory, any input of notes out of sequence should be rejected.
Control totals These also facilitate completeness of processing by ensure that
pre-input, manually prepared control totals are compared to control totals input.
For example, non-matching totals of a ‘batch’ of purchase invoices should result
in an on-screen user prompt, or the production of an exception report for follow-
up. The use of control totals in this way are also commonly referred to as output
controls (see below).
Check digit verification This process uses algorithms to ensure that data input is
accurate. For example, internally generated valid supplier numerical reference
codes, should be formatted in such a way that any purchase invoices input with
an incorrect code will be automatically rejected.
Processing controls
141
Processing controls exist to ensure that all data input is processed correctly and
that data files are appropriately updated accurately in a timely manner. The
processing controls for a specified application program should be designed and
then tested prior to ‘live’ running with real data. These may typically include the
use of run-to-run controls, which ensure the integrity of cumulative totals
contained in the accounting records is maintained from one data processing run
to the next. For example, the balance carried forward on the bank account in a
company’s general (nominal) ledger. Other processing controls should include
the subsequent processing of data rejected at the point of input, for example:
A computer produced print-out of rejected items.
Formal written instructions notifying data processing personnel of
the procedures to follow with regard to rejected items.
Appropriate investigation/follow up with regard to rejected items.
Evidence that rejected errors have been corrected and re-input.
Output controls
Output controls exist to en sure that all data is processed and that output is
distributed only to prescribed authorised users. While the degree of output
controls will vary from one organisation to another (dependent on the
confidentiality of the information and size of the organisation), common controls
comprise:
Use of batch control totals, as described above (see ‘input
controls’).
Appropriate review and follow up of exception report information to
ensure that there are no permanently outstanding exception items.
Careful scheduling of the processing of data to help facilitate the
distribution of information to end users on a timely basis.
Formal written instructions notifying data processing personnel of
prescribed distribution procedures.
Ongoing monitoring by a responsible official, of the distribution of
output, to ensure it is distributed in accordance with authorised policy.
Master file controls
The purpose of master file controls is to ensure the ongoing integrity of the
standing data contained in the master files. It is vitally important that stringent
‘security’ controls should be exercised over all master files.
These include:
appropriate use of passwords, to restrict access to master file data
the establishment of adequate procedures over the amendment of
data, comprising appropriate segregation of duties, and authority to
amend being restricted to appropriate responsible individuals
regular checking of master file data to authorised data, by an
independent responsible official
processing controls over the updating of master files, including the
use of record counts and control totals.
Computer Assisted Audit Techniques (CAATs)
The nature of computer-based accounting systems is such that auditors may use
the audit client company’s computer, or their own, as an audit tool, to assist them
142
in their audit procedures. The extent to which an auditor may choose between
using CAATs and manual techniques on a specific audit engagement depends
on the following factors:
the practicality of carrying out manual testing
the cost effectiveness of using CAATs
the availability of audit time
the availability of the audit client’s computer facility
the level of audit experience and expertise in using a specified
CAAT
the level of CAATs carried out by the audit client’s internal audit
function and the extent to which the extern al auditor can rely on this work.
There are three classifications of CAATs – namely:
Audit software
Test data
Other techniques
Dealing with each of the above in turn:
Audit software
Audit software is a generic term used to describe computer programs designed
to carry out tests of control and/or substantive procedures. Such programs may
be classified as:
Packaged programs These consist of pre-prepared generalised programs used
by auditors and are not ‘client specific’. They may be used to carry out numerous
audit tasks, for example, to select a sample, either statistically or judgementally,
during arithmetic calculations and checking for gaps in the processing of
sequences.
Purpose written programs These programs are usually ‘client specific ’ and may
be used to carry out tests of control or substantive procedures. Audit software
may be bought or developed, but in any event the audit firm’s audit plan should
ensure that provision is made to ensure that specified programs are appropriate
for a client’s system and the needs of the audit. Typically, they may be used to
re-perform computerised control procedures (for example, cost of sales
calculations) or perhaps to carry out an aged analysis of trade receivable (debtor)
balances.
Enquiry programs These programs are integral to the client’s accounting system;
however they may be adapted for audit purposes. For example, where a system
provides for the routine reporting on a ‘monthly’ basis of employee starters and
leavers, this facility may be utilised by the auditor when auditing salaries and
wages in the client’s financial statements. Similarly, a facility to report trade
payable (creditor) long outstanding balances could be used by an auditor when
verifying the reported value of creditors.
Test data
Audit test data Audit test data is used to test the existence and effectiveness of
controls built into an application program used by an audit client. As such,
dummy transactions are processed through the client’s computerised system.
The results of processing are then compared to the auditor’s expected results to
determine whether controls are operating efficiently and systems’ objectiveness
143
are being achieved. For example, two dummy bank payment transactions (one
inside and one outside authorised parameters) may be processed with the
expectation that only the transaction processed within the parameters is
‘accepted’ by the system. Clearly, if dummy transactions processed do not
produce the expected results in output, the auditor will need to consider the need
for increased substantive procedures in the area being reviewed.
Integrated test facilities To avoid the risk of corrupting a client’s account system,
by processing test data with the client’s other ‘live’ data, auditors may instigate
special ‘test data only’ processing runs for audit test data. The major
disadvantage of this is that the auditor does not have total assurance that the test
data is being processed in a similar fashion to the client’s live data. To address
this issue, the auditor may therefore seek permission from the client to establish
an integrated test facility within the accounting system. This entails the
establishment of a dummy unit, for example, a dummy supplier account against
which the auditor’s test data is processed during normal processing runs.
Other techniques This section contains useful background information to
enhance your overall understanding.
Other CAATs include:
Embedded audit facilities (EAFs) This technique requires the auditor’s own
program code to be embedded (incorporated) into the client’s application
software, such that verification procedures can be carried out as required on data
being processed. For example, tests of control may include the reperformance of
specific input validation checks (see input controls above) – selected transactions
may be ‘tagged’ and followed through the system to ascertain whether stated
controls and processes have been applied to those transactions by the computer
system. The EAFs should ensure that the results of testing are recorded in a
special secure file for subsequent review by the auditor, who should be able to
conclude on the integrity of the processing controls generally, from the results of
testing. A further EAF, of ten overlooked by students, is that of an analytical
review program enabling concurrent performance of analytical review procedures
on client data as it is being processed through the automated system.
Application program examination When determining the extent to which they may
rely on application controls, auditors need to consider the extent to which
specified controls have been implemented correctly. For example, where system
amendments have occurred during an accounting period, the auditor would need
assurance as to the existence of necessary controls both before and after the
amendment. The auditor may seek to obtain such assurance by using a software
program to compare the controls in place prior to, and subsequent to, the
amendment date.
Summary
The key objectives of an audit do not change irrespective of whether the audit
engagement is carried out in a manual or a computer-based environment. The
audit approach, planning considerations and techniques used to obtain sufficient
appropriate audit evidence do of course change. Students are encouraged to
read further to augment their knowledge of auditing in a computer-based
environment and to practise their ability to answer exam questions on the topic
144
145
146
147
that they comply with the appropriate rules of the GAAP system used.
Investigation of outcomes of the uncertainties after the year-end but
before the audit opinion is issued. If the uncertainty has been settled
before the audit opinion has been issued, the uncertainty has effectively
been disposed of.
Comparison of historical accuracy of management estimates
compared with actual outcomes. The greater the variance between
estimates and eventual outcomes, the greater the risk of error; either by
high estimation uncertainty or weak control by management of the process
of determining estimates.
Verification of any underlying data used by management (eg debt
default rates by age of debt) to external evidence.
The auditor’s response is graded depending on whether a risk
identified is a normal risk or a significant risk. A significant risk is one that
the auditor judges to have high estimation uncertainty. The size of the item
in the draft financial statements may give a misleading view of its potential
significance. If an item is estimated to have a low value, but is subject to
high estimation uncertainty then that figure may well be significantly
understated when compared with the eventual outcome of the estimate.
Hence ISA 540 directs the auditor’s work from a starting point of
uncertainty rather than the materiality of the draft figure in the financial
statements. The greater the estimation uncertainty, rather than the size of
the draft figure, the greater the amount of evidence that the auditor will
need to obtain.
The auditor must develop their own point estimate, or range of
estimates if a point estimate is not achievable. A point estimate is the
auditor’s own assessment of the single most likely value. A range of
estimates is the range over which the auditor believes an estimate would
be reasonable.
For significant risks, the auditor must assess if management
considered alternative means for determining estimates.
Significant risks may arise as a result of valuation being largely
linked to management intentions (eg the intended future use of an asset
may affect its recoverable value and so impairment loss under IAS 36,
Impairment of Assets). ISA 540 requires the auditor to document an
assessment of viability of management’s intentions wherever these
intentions are part of the estimated fair value of an item subject to
significant risks.
The auditor must assess for signs of management bias. The
existence of management bias does not necessarily mean that
management is incapable of producing a neutral estimate, but the
chances of an estimate not being neutral are increased.
A change in method of estimation by management should be
treated with scepticism. Changing the methodology used to make an
estimate has much the same effect on the financial statements as
changing an accounting policy, so the auditor should require evidence that
148
ANALYTICAL PROCEDURES
To obtain audit evidence, the auditor performs one – or a combination – of
the following procedures:
inspection
observation
external confirmation
inquiry
reperformance
recalculation
analytical procedures.
149
It is mandatory that the auditor should perform risk assessment for the
identification and assessment of risks of material misstatement at the financial
statement and assertion level, and the risk assessment procedures should
include analytical procedures (ISA 315). It is also mandatory that the auditor
should perform analytical procedures near the end of the audit that assess
whether the financial statements are consistent with the auditor’s understanding
of the entity (ISA 520). Analytical procedures are also commonly used in non-
audit and assurance engagements, such as reviews of prospective financial
information, and non-audit reviews of historical financial information. While the
use of analytical procedures in such engagements is not covered in the ISAs, the
principals regarding their use are relevant.
Definition of analytical procedures
Analytical procedures consist of ‘evaluations of financial information through
analysis of plausible relationships among both financial and non-financial data’.
They also encompass ‘such investigation as is necessary of identified
fluctuations or relationships that are inconsistent with other relevant information
or that differ from expected values by a significant amount’ (ISA 520). A basic
premise underlying the application of analytical procedures is that plausible
relationships among data may reasonably be expected to exist and continue in
the absence of conditions to the contrary.
Purposes of analytical procedures
Analytical procedures are used throughout the audit process and are conducted
for three primary purposes:
Preliminary analytical review – risk assessment (required by ISA 315)
Preliminary analytical reviews are performed to obtain an understanding of
the business and its environment (eg financial performance relative to
prior years and relevant industry and comparison groups), to help assess
the risk of material misstatement in order to determine the nature, timing
and extent of audit procedures, ie to help the auditor develop the audit
strategy and programme.
Substantive analytical procedures Analytical procedures are used as
substantive procedures when the auditor considers that the use of
analytical procedures can be more effective or efficient than tests of
details in reducing the risk of material misstatements at the assertion level
to an acceptably low level.
Final analytical review (required by ISA 520) Analytical procedures are
performed as an overall review of the financial statements at the end of
the audit to assess whether they are consistent with the auditor’s
understanding of the entity. Final analytical procedures are not conducted
to obtain additional substantive assurance. If irregularities are found, risk
assessment should be performed again to consider any additional audit
procedures are necessary.
Use of substantive analytical procedures
One of the objectives of ISA 520 is that relevant and reliable audit evidence is
obtained when using substantive analytical procedures. The primary purpose of
substantive analytical procedures is to obtain assurance, in combination with
150
other audit testing (such as tests of controls and substantive tests of details), with
respect to financial statement assertions for one or more audit areas. Substantive
analytical procedures are generally more applicable to large volumes of
transactions that tend to be more predictable over time. The application of
substantive analytical procedures is based on the expectation that relationships
among data exist and continue in the absence of known conditions to the
contrary. The presence of these relationships provides audit evidence as to the
completeness, accuracy and occurrence of transactions. Due to their nature,
substantive analytical procedures can often provide evidence for multiple
assertions, identify audit issues that may not be apparent from more detailed
work, and direct the auditor’s attention to areas requiring further investigation.
Furthermore, the auditor may identify risks or deficiencies in internal control that
had not previously been identified, which may cause the auditor to re-evaluate
his planned audit approach and require the auditor to obtain more assurance
from other substantive testing than originally planned. To derive the most benefit
from substantive analytical procedures, the auditor should perform substantive
analytical procedures before other substantive tests because results of
substantive analytical procedures often impact the nature and extent of detailed
testing. Substantive analytical procedures might direct attention to areas of
increased risk, and the assurance obtained from effective substantive analytical
procedures will reduce the amount of assurance needed from other tests. There
are four elements that comprise distinct steps that are inherent in the process to
using substantial analytical procedures: STEP 1: Develop an independent
expectation The development of an appropriately precise, objective expectation
is the most important step in effectively using substantive analytical procedures.
An expectation is a prediction of a recorded amount or ratio. The prediction can
be a specific number, a percentage, a direction or an approximation, depending
on the desired precision. The auditor should have an independent expectation
whenever s/he uses substantive analytical procedures (ISA 520). The auditor
develops expectations by identifying plausible relationships (eg between store
square footage and retail sales, market trends and client revenues) that are
reasonably expected to exist based on his knowledge of the business, industry,
trends, or other accounts. STEP 2: Define a significant difference (or
threshold) While designing and performing substantive analytical procedures the
auditor should consider the amount of difference from the expectation that can be
accepted without further investigation (ISA 520). The maximum acceptable
difference is commonly called the ‘threshold’. Thresholds may be defined either
as numerical values or as percentages of the items being tested. Establishing an
appropriate threshold is particularly critical to the effective use of substantive
analytical procedures. To prevent bias in judgment, the auditor should determine
the threshold while planning the substantive analytical procedures, ie before Step
3, in which the difference between the expectation and the recorded amount are
computed. The threshold is the acceptable amount of potential misstatement and
therefore should not exceed planning materiality and must be sufficiently small to
enable the auditor to identify misstatements that could be material either
individually or when aggregated with misstatements in other disaggregated
151
152
GOING CONCERN
The Paper P7 examiner describes the additional guidance given for ISA
153
154
Identification of this heightened risk at this initial stage in the audit cycle means
that additional audit procedures can be planned as a response to the specific
risks identified.
All of this means that the auditor must gain a detailed understanding of the
economic environment in which a company is operating, and more specifically,
an understanding of the particular market conditions affecting its operations.
Risks can arise from many factors, including reduced demand for goods and
services, customers' inability to pay for goods and services already provided, and
an inability to raise necessary finance. Such factors must be assessed for their
specific impact on a company's operations. It is important to remember that
difficult economic or market conditions do not necessarily mean that a material
uncertainty exists about a company's ability to continue as a going concern.
The evaluation of business risks should lead to the assessment of specific
financial statement risks. For a company facing going concern difficulties, the
fundamental financial statement risk is whether the financial statements have
been prepared under the correct assumption, or whether any significant
uncertainties have been disclosed in the financial statements. However, there are
more specific financial statement risks including:
potential overstatement of non-current assets if impairments
caused by reduced market value or value in use have not been
recognised
potential overstatement of inventory if net realisable value has
fallen due to reduced demand
potential overstatement of receivables if bad debts not provided for
incorrect measurement and recognition of gains or losses on
financial instruments due to inactive markets
incorrect measurement and disclosure of assets held for sale or
discontinued operations
incorrect measurement or disclosure of provisions or contingent
liabilities caused by restructuring of operations.
Designing, performing and evaluating audit procedures
Where risks, such as the ones mentioned above, have been identified, the
auditor must respond to the risks by designing and performing appropriate audit
procedures. Clearly the procedures should address the specific risks identified,
and so extra procedures may be needed on many balances and transactions
such as the ones outlined above.
More generally, audit procedures are necessary in order to evaluate how the key
management personnel have satisfied themselves that it is appropriate to adopt
the going concern basis in preparing the financial statements. Procedures should
include:
analysing and discussing cash flow, profit and other relevant
forecasts with management
reviewing the terms of loan agreements and determining whether
they have been breached
reading minutes of board meetings and relevant committees for any
discussion of financing difficulties
155
156
AUDIT RISK
This article outlines and explains the concept of audit risk, making
reference to the key auditing standards which give guidance to auditors
about risk assessment
Identifying and assessing audit risk is a key part of the audit process, and ISA
315, Identifying and Assessing the Risks of Material Misstatement Through
Understanding the Entity and Its Environment, gives extensive guidance to
auditors about audit risk assessment. The purpose of this article is to give
summary guidance to FAU, F8 and P7 students about the concept of audit risk.
157
All subsequent references in this article to the standard will be stated simply as
ISA 315, although ISA 315 is a ‘redrafted’ standard, in accordance with the
International Auditing and Assurance Standards Board (IAASB) Clarity Project.
For further details on the IAASB Clarity Project, read the article 'The IAASB
Clarity Project' (see 'Related links').
What is audit risk?
According to the IAASB Glossary of Terms (1), audit risk is defined as follows:
‘The risk that the auditor expresses an inappropriate audit opinion when the
financial statements are materially misstated. Audit risk is a function of material
misstatement and detection risk.’
Why is audit risk so important to auditors?
Audit risk is fundamental to the audit process because auditors cannot and do
not attempt to check all transactions. Students should refer to any published
accounts of large companies and think about the vast number of transactions in a
statement of comprehensive income and a statement of financial position. It
would be impossible to check all of these transactions, and no one would be
prepared to pay for the auditors to do so, hence the importance of the risk-based
approach toward auditing. Traditionally, auditors have used a risk-based
approach in order to minimise the chance of giving an inappropriate audit
opinion, and audits conducted in accordance with ISAs must follow the
risk-based approach, which should also help to ensure that audit work is carried
out efficiently, using the most effective tests based on the audit risk assessment.
Auditors should direct audit work to the key risks (sometimes also described as
significant risks), where it is more likely that errors in transactions and balances
will lead to a material misstatement in the financial statements. It would be
inefficient to address insignificant risks in a high level of detail, and whether a risk
is classified as a key risk or not is a matter of judgment for the auditor.
Relevant ISAs
There are many references throughout the ISAs to audit risk, but perhaps the two
most important audit risk-related ISAs are as follows:
ISA 200, Overall Objectives of the Independent Auditor and the Conduct of
an Audit in Accordance with ISAs ISA 200 sets out the overall objectives of the
auditor, and the standard explains the nature and scope of an audit designed to
enable an auditor to meet those objectives. References to audit risk are
frequently made by ISA 200, and the standard also requires that the auditor shall
plan and perform an audit with professional scepticism, recognising that
circumstances might exist that may cause the financial statements to be
materially misstated. Professional scepticism is defined as an attitude that
includes a questioning mind and a critical assessment of evidence.
ISA 315, Identifying and Assessing the Risks of Material Misstatement
Through Understanding the Entity and Its Environment ISA 315 deals with
the auditor’s responsibility to identify and assess the risks of material
misstatement in the financial statements through an understanding of the entity
and its environment, including the entity’s internal controls and risk assessment
process. The first version of ISA 315 was originally published in 2003 after a joint
audit risk project had been carried out between the IAASB, and the United States
158
Auditing Standards Board. Changes in the audit risk standards have arguably
been the single biggest change in auditing standards in recent years, so the
significance of ISA 315, and the topic of audit risk, should not be underestimated
by auditing students.
The requirements of ISA 315 are summarised in the following table.
Block: Text
Let us consider each of these four stages in more detail.
1. Risk assessment procedures ISA 315 gives an overview of the procedures
that the auditor should follow in order to obtain an understanding sufficient to
assess audit risks, and these risks must then be considered when designing the
audit plan. ISA 315 goes on to require that the auditor shall perform risk
assessment procedures to provide a basis for the identification and assessment
of risks of material misstatement at the financial statement and assertion levels.
ISA 315 goes on to identify the following three risk assessment procedures:
Making inquiries of management and others within the entity Auditors must
have discussions with the client’s management about its objectives and
expectations, and its plans for achieving those goals.
Analytical procedures Analytical procedures performed as risk assessment
procedures should help the auditor in identifying unusual transactions or
positions. They may identify aspects of the entity of which the auditor was
unaware, and may assist in assessing the risks of material misstatement in order
to provide a basis for designing and implementing responses to the assessed
risks.
Observation and inspection Observation and inspection may also provide
information about the entity and its environment. Examples of such audit
procedures can potentially cover a very broad area, including observation or
inspection of the entity’s operations, documents, and reports prepared by
management, and also of the entity’s premises and plant facilities.
ISA 315 requires that risk assessment procedures should, at a minimum,
comprise a combination of the above three procedures, and the standard also
159
requires that the engagement partner and other key engagement team members
should discuss the susceptibility of the entity’s financial statements to material
misstatement. Key risks can be identified at any stage of the audit process, and
ISA 315 requires that the engagement partner should also determine which
matters are to be communicated to those engagement team members not
involved in the discussion.
2. Understanding an entity ISA 315 gives detailed guidance about the
understanding required of the entity and its environment by auditors, including
the entity’s internal control systems. Understanding of the entity and its
environment is important for the auditor in order to help identify the risks of
material misstatement, to provide a basis for designing and implementing
responses to assessed risk (see reference below to ISA 330, The Auditor’s
Responses to Assessed Risks), and to ensure that sufficient appropriate audit
evidence is collected. Given that the focus of this article is audit risk, however,
students should ensure that they also make themselves familiar with the concept
of internal control, and the components of internal control systems.
3. Identification and assessment of significant risks and the risks of
material misstatement In exercising judgement as to which risks are significant
risks, the auditor is required to consider the following:
Whether the risk is a risk of fraud.
Whether the risk is related to recent significant economic,
accounting or other developments, and therefore requires specific
attention.
The complexity of transactions.
Whether the risk involves significant transactions with related
parties.
The degree of subjectivity in the measurement of financial
information related to the risk, especially those measurements involving a
wide range of measurement uncertainty.
Whether the risk involves significant transactions that are outside
the normal course of business for the entity, or that otherwise appear to be
unusual.
4. ISA 330 and responses to assessed risks The requirements of ISA 330,
The Auditor’s Responses to Assessed Risks, will be covered in a future article,
but essentially ISA 330 gives guidance about the nature and extent of the testing
required, based on the risk assessment findings.
Audit risk and business risk
For the purposes of the F8 exam, it is important to make a distinction between
audit risk and business risk (which is not examinable in F8), even though ISA 315
itself does not make such a distinction clear. ISA 315(2) defines business risk as
follows:
‘A risk resulting from significant conditions, events, circumstances, actions or
inactions that could adversely affect an entity’s ability to achieve its objectives
and execute its strategies, or from the setting of inappropriate objectives and
strategies.’
Hence, business risk is a much broader concept than audit risk. Students are
160
reminded that business risk is excluded from the FAU and F8 syllabus, although
it is examinable in P7.
The audit risk model
Finally, it is important to make reference to the so called traditional audit risk
model, which pre-dates ISA 315, but continues to remain important to the audit
process. The audit risk model breaks audit risk down into the following three
components:
Inherent risk This is the susceptibility of an assertion about a class of
transaction, account balance, or disclosure to a misstatement that could be
material, either individually or when aggregated with other misstatements, before
consideration of any related controls.
Control risk This is the risk that a misstatement could occur in an assertion
about a class of transaction, account balance or disclosure, and that the
misstatement could be material, either individually or when aggregated with other
misstatements, and will not be prevented or detected and corrected, on a timely
basis, by the entity’s internal control.
Detection risk This is the risk that the procedures performed by the auditor to
reduce audit risk to an acceptably low level will not detect a misstatement that
exists and that could be material, either individually or when aggregated with
other misstatements. The interrelationship of the three components of audit risk
is outside the scope of this current article. F8 students, however, will typically be
expected to have a good understanding of the concept of audit risk, and to be
able to apply this understanding to questions in order to identify and describe
appropriate risk assessment procedures.
The UK and Ireland perspective
The UK Auditing Practices Board announced in March 2009 that it would update
its auditing standards according to the clarified ISAs, and that these standards
would apply for audits of accounting periods ending on or after 15 December
2010. UK and Irish students should note that there are no significant differences
on audit risk between ISA 315 and the UK and Ireland version of the standard.
Conclusions
The concept of audit risk is of key importance to the audit process and F8
students are required to have a good understanding of what audit risk is, and
why it is so important. For the purposes of the F8 exam, it is important to
understand that audit risk is a very practical topic and is therefore examined in a
very practical context. Any definition or explanation of the audit risk model itself
will usually only be allocated a small number of marks, but many students still
include such definitions in answers to case study and scenario questions which
require a practical application of audit risk assessment procedures. Students
must also be prepared to apply their understanding of audit risk to questions and
come up with appropriate risk assessment procedures.
Written by a member of the F8 examining team
References
161
P7 (Int and UK) The accounting systems of many companies, large and
small, are computer-based; questions in all ACCA audit papers reflect this
situation. Students need to ensure they have a complete understanding of the
controls in a computer-based environment, how these impact on the auditor’s
assessment of risk, and the subsequent audit procedures. These procedures will
often involve the use of computer-assisted audit techniques (CAATs). The aim of
this article is to help students improve their understanding of this topic by giving
practical illustrations of computer-based controls and computer-assisted
techniques and the way they may feature in exam questions. Relevant auditing
standards References will be made throughout this article to the most recent
guidance in standards:
ISA 300 (Redrafted) Planning an Audit of Financial Statements
ISA 315 (Redrafted) Identifying and Assessing the Risks of Material
Misstatement Through Understanding the Entity and Its Environment
ISA 330 (Redrafted) The Auditor’s Responses to Assessed Risks.
Internal controls in a computer environment The two main categories are
application controls and general controls. Application controls These are
manual or automated procedures that typically operate at a business process
level and apply to the processing of transactions by individual applications.
Application controls can be preventative or detective in nature and are designed
to ensure the integrity of the accounting records. Accordingly, application controls
relate to procedures used to initiate, record, process and report transactions or
other financial data. These controls help ensure that transactions occurred, are
authorised and are completely and accurately recorded and processed (ISA 315
(Redrafted)). Application controls apply to data processing tasks such as sales,
purchases and wages procedures and are normally divided into the following
categories: (i) Input controls Examples include batch control totals and document
counts, as well as manual scrutiny of documents to ensure they have been
authorised. An example of the operation of batch controls using accounting
software would be the checking of a manually produced figure for the total gross
value of purchase invoices against that produced on screen when the batch-
processing option is used to input the invoices. This total could also be printed
out to confirm the totals agree. The most common example of programmed
controls over the accuracy and completeness of input are edit (data validation)
checks when the software checks that data fields included on transactions by
performing:
reasonableness check, eg net wage to gross wage
existence check, eg that a supplier account exists
character check, eg that there are no alphabetical characters in a
sales invoice number field
range check, eg no employee’s weekly wage is more than $2,000
check digit, eg an extra character added to the account reference
field on a purchase invoice to detect mistakes such as transposition errors
during input.
When data is input via a keyboard, the software will often display a screen
message if any of the above checks reveal an anomaly, eg ‘Supplier account
162
163
164
The auditor needs to determine which of these functions they wish to use, and
the selection criteria. Exam focus Sometimes, questions will present students
with a scenario and ask how CAATs might be employed by the auditor. Question
4 in the December 2007 Paper F8 exam required students to explain how audit
software could be used to audit receivables balances. To answer this type of
question, you need to link the functions listed above to the normal audit work on
receivables. Students should refer to the model answer to this question. The
following is an example of how this could be applied to the audit of wages:
Select a random sample of employees from the payroll master file;
the auditor could then trace the sample back to contracts of employment
in the HR department to confirm existence
Report all employees earning more than $1,000 per week
Compare the wages master file at the start and end of the year to
identify starters and leavers during the year; the auditor would then trace
the items identified back to evidence, such as starters’ and leavers’ forms
(in the HR department) to ensure they were valid employees and had
been added or deleted from the payroll at the appropriate time (the auditor
would need to request that the client retain a copy of the master file at the
start of the year to perform this test)
Check that the total of gross wages minus deductions equates to
net pay.
(ii) Test data Test data consists of data submitted by the auditor for processing
by the client’s computer system. The principle objective is to test the operation of
application controls. For this reason, the auditor will arrange for dummy data to
be processed that includes many error conditions, to ensure that the client’s
application controls can identify particular problems. Examples of errors that
might be included:
supplier account codes that do not exist
employees earning in excess of a certain limit
sales invoices that contain addition errors
submitting data with incorrect batch control totals.
Data without errors will also be included to ensure ‘correct’ transactions are
processed properly. Test data can be used ‘live’, ie during the client’s normal
production run. The obvious disadvantage with this choice is the danger of
corrupting the client’s master files. To avoid this, an integrated test facility will be
used (see other techniques below). The alternative (dead test data) is to perform
a special run outside normal processing, using copies of the client’s master files.
In this case, the danger of corrupting the client’s files is avoided – but there is
less assurance that the normal production programs have been used. (iii)
Other techniques There are increasing numbers of other techniques that can be
used; the main two are:
Integrated test facility – used when test data is run live; involves the
establishment of dummy records, such as departments or customer
accounts to which the dummy data can be processed. They can then be
ignored when client records are printed out, and reversed out later.
Embedded audit facilities (embedded audit monitor) – also known
165
166
assisted audit tests. ‘Round the machine (computer)’ v ‘through the machine
(computer)’ approaches to testing Many students will have no experience of
the use of CAATs, as auditors of clients using small computer systems will often
audit ‘round the machine’. This means that the auditor reconciles input to output
and hopes that the processing of transactions was error-free. The reason for the
popularity of this approach used to be the lack of audit software that was suitable
for use on smaller computers. However, this is no longer true, and audit software
is available that enables the auditor to interrogate copies of client files that have
been downloaded on to a PC or laptop. However, cost considerations still appear
to be a stumbling block. In the ‘through the machine’ approach, the auditor uses
CAATs to ensure that computer - based application controls are operating
satisfactorily. Conclusion The key objectives of an audit do not change in a
computer environment. The auditor still needs to obtain an understanding of the
system in order to assess control risk and plan audit work to minimise detection
risk. The level of audit testing will depend on the assessment of key controls. If
these are programmed controls, the auditor will need to ‘audit through the
computer’ and use CAATs to ensure controls are operating effectively. In small
computer-based systems, ‘auditing round the computer’ may suffice if sufficient
audit evidence can be obtained by testing input and output. Written by a
member of the Paper F8 examining team
167
168
169
170
171
172
173
174
Revenue recognition.
Related party transactions.
Events after the reporting date.
Business combinations – particularly the cost of investment and
calculation of goodwill, and determination of the status of an investment.
Likely to be examined in less detail
Inventory and receivables valuations.
Cash flow statements.
Reporting operating (segmental) information.
Earnings per share.
Financial instruments – hedging and derivatives.
Changes in accounting policy.
Government grants and assistance.
Construction contracts.
Marks will be available on the marking scheme for reference to relevant financial
reporting standards, though the amount of marks for simply referring to the name
and number of relevant standard will be restricted. Most marks will be for
demonstrating an understanding of a financial reporting issue, and its relevance
to the audit. What are the impacts of financial reporting issues for the
auditor? The auditor should consider financial reporting issues throughout an
audit. Therefore, question scenarios involving these matters could be based in
the planning phase, the evidence gathering period, or during the completion
stage when the audit opinion is being evaluated. Each of these stages of the
audit is discussed in turn below. The planning phase At this initial stage of the
audit, the auditor will use risk assessment techniques to assess the client’s
business and financial statements for potential problem areas. One type of risk
that the auditor will assess is financial statement risk. Financial statement risk is
the risk that components of the financial statements could be misstated, through
inaccurate or incomplete recording of transactions or disclosure. Financial
statement risks, therefore, represent potential errors or deliberate misstatements
in the published accounts of a business. Financial statement risks could lead to a
balance being over or understated in value, or could result in an item being
recognised when it should not be, or vice versa, the non-recognition of an item
which should be recognised. In addition, financial statement risk could lead to an
item being recognised at an inappropriate time, or in incorrect presentation or
disclosure of a matter. Clearly, the auditor must understand financial reporting
standard requirements in order to assess the risk of an item being recognised,
measured, or disclosed incorrectly. For an example of how this issue could be
tested see Paper P7 June 2008 Q1 (bii) which requires an assessment of
financial statement risks in relation to potential litigation and demolition of
property, plant and equipment. Gathering evidence The second type of question
that could feature financial reporting standards deals with the stage of the audit
when the auditor is gathering evidence. Auditors need to gather sufficient,
appropriate evidence regarding financial reporting issues. Of course, one of the
matters for which the auditor needs to gather evidence is in relation to
compliance with financial reporting standards. A common question requirement
175
176
FORENSIC AUDITING
Relevant to ACCA Qualification Paper P7 This article explores some of the
issues relevant to forensic investigations. ‘Forensic auditing’ covers a broad
spectrum of activities, with terminology not strictly defined in regulatory guidance.
Generally, the term ‘forensic accounting’ is used to describe the wide range of
investigative work which accountants in practice could be asked to perform. The
work would normally involve an investigation into the financial affairs of an entity
and is often associated with investigations into alleged fraudulent activity.
Forensic accounting refers to the whole process of investigating a financial
matter, including potentially acting as an expert witness if the fraud comes to trial.
Although this article focuses on investigations into alleged frauds, it is important
to be aware that forensic accountants could be asked to look into non-fraud
situations, such as the settling of monetary disputes in relation to a business
closure or matrimonial disputes under insurance claims. The process of forensic
accounting as described above includes the ‘forensic investigation’ itself, which
refers to the practical steps that the forensic accountant takes in order to gather
evidence relevant to the alleged fraudulent activity. The investigation is likely to
be similar in many ways to an audit of financial information, in that it will include a
planning stage, a period when evidence is gathered, a review process, and a
report to the client. The purpose of the investigation, in the case of an alleged
fraud, would be to discover if a fraud had actually taken place, to identify those
involved, to quantify the monetary amount of the fraud (ie the financial loss
177
suffered by the client), and to ultimately present findings to the client and
potentially to court. Finally, ‘forensic auditing’ refers to the specific procedures
carried out in order to produce evidence. Audit techniques are used to identify
and to gather evidence to prove, for example, how long the fraud has been
carried out, and how it was conducted and concealed by the perpetrators.
Evidence may also be gathered to support other issues which would be relevant
in the event of a court case. Such issues could include:
the suspect’s motive and opportunity to commit fraud
whether the fraud involved collusion between several suspects any
physical evidence at the scene of the crime or contained in documents
comments made by the suspect during interviews and/or at the time
of arrest
attempts to destroy evidence.
TYPES OF INVESTIGATION The forensic accountant could be asked to
investigate many different types of fraud. It is useful to categorise these types
into three groups to provide an overview of the wide range of investigations that
could be carried out. The three categories of frauds are corruption, asset
misappropriation and financial statement fraud. Corruption There are three
types of corruption fraud: conflicts of interest, bribery, and extortion. Research
shows that corruption is involved in around one third of all frauds.
In a conflict of interest fraud, the fraudster exerts their influence to
achieve a personal gain which detrimentally affects the company. The
fraudster may not benefit financially, but rather receives an undisclosed
personal benefit as a result of the situation. For example, a manager may
approve the expenses of an employee who is also a personal friend in
order to maintain that friendship, even if the expenses are inaccurate.
Bribery is when money (or something else of value) is offered in
order to influence a situation.
Extortion is the opposite of bribery, and happens when money is
demanded (rather than offered) in order to secure a particular outcome.
Asset misappropriation By far the most common frauds are those involving
asset misappropriation, and there are many different types of fraud which fall into
this category. The common feature is the theft of cash or other assets from the
company, for example:
Cash theft – the stealing of physical cash, for example petty cash,
from the premises of a company.
Fraudulent disbursements – company funds being used to make
fraudulent payments. Common examples include billing schemes, where
payments are made to a fictitious supplier, and payroll schemes, where
payments are made to fictitious employees (often known as ‘ghost
employees’).
Inventory frauds – the theft of inventory from the company.
Misuse of assets – employees using company assets for their own
personal interest.
Financial statement fraud This is also known as fraudulent financial reporting,
and is a type of fraud that causes a material misstatement in the financial
178
179
180
181
182
183
company. In other words, if the other auditor has concluded that the financial
statements of the component are free from material misstatement, the group
auditor should not just rely on this opinion and assume that the figures taken
from the company’s financial statements into the consolidated financial
statements are correct. A material misstatement in the financial statements of a
company could become a material misstatement in the financial statements of
the group.
For all companies within the group, regardless of materiality, the group auditor
should review a report of work done by the component auditor. This report of
work done could be in the form of an executive summary, or a memorandum of
audit issues arising from the audit of the company. Alternatively, the group
auditor may issue a questionnaire, to be completed by the component auditor,
which would highlight key issues arising from the audit of the component.
Following this review, the group auditor will need to decide on the extent of any
further actions which need to be taken, or any further work which needs to be
carried out, in order to ensure that the financial statements are free from material
misstatement. Such actions could include:
a review of the component auditor’s overall audit strategy
performing a risk assessment at the company level
participating in closing meetings with the component auditor and
the management of the company
a review of relevant parts of the component auditor’s audit working
papers.
Where a company is material to the group financial statements, the group auditor
should carry out further actions, including:
discussing with the component auditor, and/or the management of
the company, the business activities that are significant to the group
discussing with the component auditor the susceptibility of the
company’s financial statements to material error or deliberate
misstatement
reviewing the component auditor’s documentation of identified
significant risks, and the conclusions reached on these risks.
It may be the case that, having performed the actions outlined above, the group
auditor concludes that further audit work is required on the financial statements
of a company, or that a memorandum of audit issues arising from the audit of the
company is needed. For example, the group auditor may consider that an
element of the financial statements of the company could be materially
misstated, and that further audit evidence is necessary. The group auditor should
determine the nature of the work necessary, and whether the work should be
carried out by the group auditor or the component auditor. Having taken the
actions outlined above, the group auditor should now have obtained sufficient
evidence to show that the individual company financial statements are free from
material misstatement, and are a sound basis for the preparation of the
consolidated financial statements.
Stage two – auditing the consolidation
The consolidation process
184
The group auditor must plan the audit procedures to be performed on the
consolidation process. For some groups, the consolidation will be complex and is
likely to involve some areas of judgement, and so there is a high degree of audit
risk. Thorough planning will be essential to ensure that audit risk is minimised.
The types of audit procedures that could be performed include:
checking that figures taken into the consolidation have been
accurately extracted from the financial statements of the components
evaluating the classifications of the components of the group – for
example, whether the components have been correctly identified and
treated as subsidiaries, associates, or joint ventures
reviewing the disclosures necessary in the group financial
statements, such as related party transactions and minority interests
investigating the treatment of any components which have a
different financial year end from that of the rest of the group
gathering evidence appropriate to the specific consolidation
adjustments made necessary by financial reporting standards, including,
for example: – the calculation of goodwill and its impairment review –
cancellation of inter-company balances and transactions – provision for
unrealised profits as a result of inter-company transactions – fair value
adjustments needed for assets and liabilities held by the component – re-
translation of financial statements of components denominated in a foreign
currency.
Some of the evidence required to meet the above objectives will be gathered by
the component auditor, and it is the group auditor’s responsibility to communicate
to the component auditor the evidence that they are expected to gather. This
communication ideally occurs at the audit planning stage. The group auditor must
have a sound knowledge of the relevant financial reporting standards, which
include:
IFRS 3, Business Combinations
IAS 28, Investments in Associates
IAS 31, Interests in Joint Ventures
IAS 32, Financial Instruments: Presentation
IAS 39, Financial Instruments: Recognition and Measurement.
Candidates are advised that, for the purposes of study for Paper P7, they must
be very familiar with the above financial reporting standards. Particularly
important are the accounting regulations relating to subsidiaries regarding
goodwill, inter-company transactions, and fair value adjustments, as well as the
financial reporting implications on the acquisition and disposal of a subsidiary.
Candidates must also be aware of the principles of accounting for associates,
joint ventures, and foreign subsidiaries. It is also important to remember that the
parent company’s individual financial statements will contain balances and
transactions pertinent to the components of the group. The parent company’s
statement of financial position (balance sheet) will carry the investments as non-
current assets, and the statement of comprehensive income is likely to contain
dividend receipts and other group transactions. The auditor expressing an
opinion on the parent company’s individual financial statements must gather
185
186
EXAMINING EVIDENCE
Relevant to Professional Scheme Papers 2.6 and 3.1 and new ACCA
Qualification Papers F8 and P7 Questions in auditing exams on audit
procedures are very common. This article considers the difference between
audit procedures and audit evidence and techniques for deciding on
relevant audit evidence in a variety of circumstances.
Audit procedures versus audit evidence
Audit procedures are actions that auditors carry out during the audit. Paper 2.6
questions typically ask candidates to describe audit procedures, also known as
‘audit tests’ or ‘audit work’.
Audit evidence is obtained by the auditor as a result of the audit procedure. For
example, ‘performing a circularisation of receivables/debtors’ is an audit
procedure, whereas ‘replies from customers’ is audit evidence. It is very
important to be aware of the difference. If a question asks for audit evidence and
candidates state audit procedures, then the question hasn’t been answered, and
gains no marks.
Which of the following are procedures and which are evidence?
Inspecting non-current/fixed assets for signs of obsolescence
An item of inventory/stock that is present at the inventory/stock count
A bank statement
Counting petty cash
A working paper showing a re-calculation of depreciation
A sales invoice
Attending a wages pay out.
Answer
Items 1, 4 and 7 are procedures (because procedures are actions, notice the use
of verbs such as ‘inspecting’, ‘counting’, and ‘attending’). The other items are
187
188
189
poor it could affect going concern, if stores are to be sold they may need
to be re-categorised as assets held for sale)
a schedule comparing the carrying value of the assets with the
recoverable amount, annotated to show that carrying value has been
agreed to the non-current/fixed assets register, and that any allocation of
central assets and goodwill was reasonable
a completed audit programme for non-current/fixed assets (as the
appropriateness of the value of the assets has already been checked
during the audit of non-current/fixed assets, there is no need to check it
again)
a calculation of value in use, annotated to show that the cash flows
have been compared with budgets for 2007 and beyond, and with actual
cash flows (to see if they are reasonable).
(b) (The obvious accounting issue is provisions, but issues which are not
mentioned – but which are potentially relevant – include assets held for sale and
discontinued operations.) I would expect to see:
a copy of the announcement of the restructuring (has to be before
the year end in order for a provision to be made)
a working paper detailing whether redundancy payments are being
made in accordance with contractual, statutory, or constructive
obligations, and how the constructive obligations, if any, have been
derived (in some countries, companies are required under statute to pay
certain levels of compensation to redundant employees)
a schedule detailing the amount to be paid to each redundant
employee. This schedule should be annotated to show that all relevant
employees have been included and that the calculations have been
checked for a sample of employees, including agreement of their
pay/service to their contracts where relevant
a point in the management representation letter as to any other
costs to be provided for in closing the factory (eg penalties for cancellation
of leases) a point in the management representation letter detailing
whether the factory is to be sold or abandoned (if a decision is made to
sell, then assets are valued as assets held for sale, but not if it is to be
abandoned)
a copy of the invitation to tender for the outsourcing contract, and
notes of discussions with management as to how the manufacturer was
selected and how quality is to be assured.
(c) (Candidates need to focus on checking whether the leaseback is really an
operating lease rather than a finance lease.) I would expect to see:
a copy of the leasing contract
a schedule comparing the present value of the minimum lease
payments with the fair value of the leased assets
a note comparing the length of the lease with the estimated useful
life of the assets, and stating whether Yummy Mummy Co. is responsible
for maintenance and insurance
a schedule calculating the amounts that should appear in the
190
191
192
Before deciding to prepare a particular audit working paper, the auditor should be
satisfied that it is:
necessary either because it will serve an essential or useful
purpose in support of the auditor’s report, or because it will provide
information needed for tax or other client-related statutory/regulatory
purposes
not practicable for the client staff to prepare the working paper, or
for the auditor to make copies of papers that the client staff (including
internal auditors) have prepared as part of their normal regular duties.
Content
Typically each audit working paper must be headed with the following
information:
The name of the client
The period covered by the audit
The subject matter
The file reference (3)
The initials (signature) of the member of staff who prepared the
working paper, and the date on which it was prepared
In the case of audit papers prepared by client staff, the date the
working papers were received, and the initials of the audit team member
who carried out the audit work
The initials of the member of staff who reviewed the working papers
and the date on which the review was carried out
Each audit paper should meet the characteristics of a good working
paper, as detailed later in this article.
Papers prepared by client
Certain working papers required by the auditor may have already been prepared
by client staff. The auditor should make arrangements, whenever possible, for
copies of these to be made available to the audit team. If client staff prepare
working papers which are to be retained by the auditor, the auditor should agree
the form of the working papers with client staff at an early stage in the audit, and
include this information in the audit timetable.
When arranging for working papers to be prepared, the auditor should take care
to ensure that the working papers will give all the information required. All such
working papers should normally be clearly identified as having been prepared by
the client. The member of audit staff directly responsible for an audit area in
which working papers prepared by client staff are included should sign those
papers – this will show that they have been checked and that they can be
reviewed by the manager and the partner, and by subsequent reviewers. The
signature of the audit team member indicates that the working paper (prepared
by client staff) has been ‘audited’.
Some characteristics of a good working paper
On the basis of the discussion above, a good working paper should meet the
requirements of ISA 230 by displaying the following characteristics:
It should state a clear audit objective, usually in terms of an audit
assertion (for example, ‘to ensure the completeness of trade payables’).
193
194
reconciliation.
195
will include wider issues, so candidates might be expected to deal with ethical
matters which arise when planning an audit, or issues such as accepting a new
audit client.
At each sitting, candidates should also be prepared to tackle requirements
relating to obtaining audit evidence. Requirements are likely to focus on specific
financial statement balances or transactions, for which candidates will be asked
to design the relevant audit procedures. Candidates should ensure that when
asked to ‘design’ procedures that they provide the source and purpose for each
relevant procedure.
When asked to comment on the 'matters to consider' in the completion phase of
an audit, candidates should be aware that one of the key matters to consider is
whether the relevant accounting standard has been adhered to, as well as the
materiality of the matter, and to consider and explain the audit evidence which
should have been obtained in relation to the issue.
Auditor’s reports and reporting to those charged with governance are both
important areas. There have been changes in the last few years in relation to
auditor’s reports, and it is important that candidates familiarise themselves with
the most up to date requirements. It is essential that candidates are confident
answering questions on this topic as Syllabus section E will form one of the
Section B questions every session.
Ethics and related professional issues are likely to feature in every session,
either in Section A or Section B. It is important to appreciate that ethics is not just
about independence but also covers ethical issues such as conflicts of interest
and confidentiality, as well as fraud and error, and professional liability. Matters
such as audit quality and professional scepticism are also important syllabus
areas, and candidates should be prepared to evaluate whether an audit has been
conducted suitably, including whether the auditor has applied an appropriate
level of professional scepticism in a specific situation.
In respect of current issues, candidates should be ready to discuss a current
issues topic in the context of the client scenario provided. As current issues can
impact on any stage of an audit or assurance engagement, a current issues
requirement could feature in either Section A or Section B of the exam.
Candidates should appreciate that they are expected to read around current
issues and not rely on manuals from tuition providers. Good quality newspapers,
professional journals, as well as ACCA's website, provide sources of information
on current developments in audit and assurance. Candidates must not rote learn
a provided piece of information on a current issue and then proceed to
regurgitate this information verbatim as an answer to an exam requirement. By
the time candidates have reached this stage in their professional studies they
should take responsibility for developing their own opinion on a current issue,
and be able to reach their own conclusion.
Syllabus changes
As part of the transition to AAA, the syllabus has been amended. However, no
significant syllabus amendments or additions have been made; the syllabus has
just been restructured to allow for the proposed coverage as discussed above.
Some learning outcomes have been reworded streamline the study guide and
196
197
Requirement Meaning
198
Block: Text
Candidates should familiarise themselves with exam terminology and tailor their
answers accordingly. Taking time to consider the exact wording of the
requirement will result in a focused answer which satisfies the question set.
Note that very few marks will be available in Paper P7 for rote-learning and the
listing of facts, rules, or pieces of information. Instead, the application of
knowledge to the specific scenario provided will score well. For example, a
requirement may ask for the identification and explanation of matters (such as
business or financial statement risks). As a general rule, a maximum of one-third
of the available marks would be available for identification; the remaining two-
thirds would be for the explanation of the matter. It is therefore not possible to
pass the question requirement without application to the question scenario.
Professional marks
The ACCA Qualification features a core theme of ‘ethics and professionalism’,
and all Professional level exams will contain some marks on this topic. In Paper
P7, the professional marks will be allocated between the two Section A
questions, with a maximum of five marks being available across the two
questions. The requirements will clearly state how many marks are available and
which question requirement they relate to.
It is likely that Section A requirements containing professional marks will ask for
the answer in a particular format, such as a report or briefing notes. The
199
200
The case study questions will contain at least three discrete requirements. Time
must be allocated between the requirements to ensure that each is addressed in
sufficient depth. Failing to deal with a requirement obviously reduces the overall
mark available for a question, but it also detracts from the quality of the answer
as a whole. Remember, within each requirement there will be some relatively
easy marks to gain, so by not attempting a requirement these marks are lost.
Is it worthwhile planning the answer? The simple answer is yes, as long as the
plan is not too detailed and is then followed. A brief plan of the main points to be
covered will keep the focus on the key elements of the requirements, and should
avoid digressions into irrelevant matters. A good plan should prioritise the most
significant issues. This is important, because if time runs short, key issues will
still have been covered. A good plan will also draw out links between different
pieces of information provided in the scenario. However, a plan is only worth
doing if it enhances the answer. Spending too long on a very detailed plan,
resulting in a lack of time to deal with the question requirements in detail, is not a
good use of time in the exam. Plans should be very brief, no more than bullet
points, and clearly labelled so they can not be confused with the actual answer.
A general comment on time allocation: a common error is to spend too long on
the first two questions, leaving very little time for the remaining questions. It is
imperative that each question is properly attempted, and that sufficient time is left
towards the end of the exam to attempt the final question. Candidates are
advised that the quality of the overall script will be reviewed, and students are
reminded to attempt the correct number of questions.
Take time to think
This may sound obvious, but it is important to take time to think about the
requirements, the scenario, and how to answer the question. Rushing to put pen
to paper without sitting back to think an answer through is a frequent mistake in
exams. The following are common examples of errors caused by not thinking
about the facts in the scenario or the question requirement.
Failing to properly read and understand the question requirements could result
in:
not thinking properly about the actual question requirement and
then proceeding to answer the requirement inappropriately. Not answering
the question set is a major reason for failure. Linked to this, it is apparent
that a question requirement is often only read briefly, and that the
candidate then goes on to assume that the requirement is identical to
requirements from previous exam questions. This will mean failing to
answer the specific question set.
making comments that belong to a different question requirement is
a mistake which comes from not looking at the question requirements in
their entirety. It is important to look at how the requirements relate to each
other to ensure that an answer is logical and comments made do not refer
to the wrong answer requirement.
Failing to read the scenario carefully, or failing to think it through, could result in:
making inappropriate suggestions, as a result of not thinking clearly
and professionally about the relationship between the audit/assurance
201
202
203
acceptance issues.
Stage 2 – reading the scenario
When reading through the detail of the scenario, you should now be alert to
information relevant to this requirement. Highlight important points that you think
are relevant to the scenario and remember to focus on issues that could affect
your acceptance of a potential assurance assignment.
Now read the following extract from the scenario and highlight the salient points –
remember to look out for any factors relevant to the ethical, professional, and
other issues described above.
Extract: You are a senior manager in Dyke & Co, a small firm of Chartered
Certified Accountants, which specialises in providing audits and financial
statement reviews for small to medium-sized companies. You are responsible for
evaluating potential assurance engagements, and for producing a brief report on
each prospective piece of work to be used by the partners in your firm when
deciding whether to accept or decline the engagement. Dyke & Co is keen to
expand the assurance services offered, as a replacement for revenue lost from
the many small-company clients choosing not to have a statutory audit in recent
years. It is currently May 2007.
Petsupply Co has been an audit client of Dyke & Co for the past three years. The
company owns and operates a chain of retail outlets selling pet supplies. The
finance director of Petsupply Co recently communicated with your firm to enquire
about the provision of an assurance report on data provided in the Environmental
Report published on the company’s website. The following is an extract from the
e-mail sent to your firm from the finance director of Petsupply Co:
‘At the last board meeting, my fellow directors discussed the content of the
Environmental Report. They are keen to ensure that the data contained in the
report is credible, and they have asked whether your firm would be willing to
provide some kind of opinion verifying the disclosures made. Petsupply Co is
strongly committed to disclosing environmental data, and information gathered
from our website indicates that our customers are very interested in
environmental matters. It is therefore important to us that Petsupply Co reports
positive information which should help to retain existing customers, and to attract
new customers. I am keen to hear your views on this matter at your earliest
convenience. We would like verification of the data as soon as possible.’
You have looked at Petsupply Co’s Environmental Report on the company
website, and found a great deal of numerical data provided, some of which is
shown below in Table 1.
Table 1: Petsupply Co's environmental report – numerical data
204
indicator
(KPI)/target
Petsupply Co has
doubled the
To increase the amount of waste
50 tonnes of 25 tonnes of
amount of waste recycled due to
waste waste
recycled by 10% installation of
recycled recycled
per annum recycling bins at
all
stores
Customers
complete surveys
To ensure that at
in store to rate
least 90% of our
our policies; data
customers are
95% ‘very 70% ‘very shows that
‘very happy’ with
happy’ happy’ customers are
Petsupply Co’s
extremely happy
environmental
with our progress
policies
on environmental
matters
Block: Text
Stage 3 – take time to think about the requirement and the
scenario
As discussed in the previous article, you must take time and not rush to answer.
When evaluating this particular scenario try to think widely about the information
provided. Your answer should cover a broad range of issues rather than
concentrating on one or two. Your comments must be tailored to the scenario. It
is pointless, for example, to write about a general acceptance issue which is not
specifically related to Petsupply Co.
It is important to appreciate that few marks will be available for stating the issue.
205
The higher-level skill marks in this question will be awarded for a discussion of
why the issue is relevant to the decision about whether or not to provide the
assurance service to Petsupply Co. The requirement is to evaluate the scenario
and therefore it is crucial to demonstrate an appreciation that there may be two
conflicting sides to the discussion.
Table 2 shows an example of a thought process which identifies the issues and
explains why each issue is relevant to the requirement; the issues are shown in
the order in which they appear in the question.
Table 2: Example of a thought process which identifies issues
and shows relevance to the requirement
Issue from
the Why relevant to the requirement
scenario
206
207
provided.
Block: Text
Table 2 is not an answer, it is a thought process. This is what you should be
thinking about after reading through the scenario. The previous article stressed
the importance of thinking through the scenario. It may help to jot these ideas
down in an answer plan before making a start on your written answer, as this will
help you to prioritise the points and give the report a logical flow.
Stage 4 – writing the report
The requirement states that two professional marks are available. As discussed
in the previous article, these marks are not for the technical content of the
answer, but for the way the relevant points are communicated. The report will be
evaluated on the following:
Use of a report format – a brief introduction, clear separate sections
each discussing a different point, and a final conclusion.
Style of writing – the report is addressed to the partner and so
language should be appropriate. You do not need to explain things that
would be obvious to a partner, and you must be tactful.
Clarity of explanation – make sure that each point is explained
simply and precisely, and avoid ambiguity.
Evaluation skills – demonstrate that each point may have a positive
and a negative side.
Remember, when answering any question requirement it is quality not quantity
that counts. You should make each point succinctly and remain focused on the
208
209