Professional Documents
Culture Documents
Aaa Study Guide
Aaa Study Guide
Pdf_Folio:i
Published 2019 by John Wiley & Sons Australia, Ltd,
42 McDougall Street, Milton Qld 4064,
on behalf of CPA Australia Ltd,
ABN 64 008 392 452
First published January 2010, reprinted with amendments July 2010, Updated January 2011, reprinted July 2011, updated
January 2012, reprinted July 2012, Updated January 2013, reprinted July 2013, updated January 2014, reprinted July 2014,
Updated January 2015, updated January 2016
Second edition published November 2016
Third edition published January 2018
Fourth edition published January 2019
Fifth edition published November 2019
© 2010–2020 CPA Australia Ltd (ABN 64 008 392 452). All rights reserved. This material is owned or licensed by CPA
Australia and is protected under Australian and international law. Except for personal and educational use in the CPA
Program, this material may not be reproduced or used in any other manner whatsoever without the express written
permission of CPA Australia. All reproduction requests should be made in writing and addressed to: Legal, CPA Australia,
Level 20, 28 Freshwater Place, Southbank, VIC 3006, or [email protected].
Edited and designed by John Wiley & Sons Australia, Ltd
Printed by Blue Star Print
ISBN 9780730381877
Authors
Brian Clarke (Consultant)
David Gilchrist (Professor, Accounting and Finance (UWA Business School), University of Western Australia)
Dessalegn Mihret (Senior Lecturer, Faculty of Business and Law, Deakin University)
Roger Simnett (Scientia Professor, School of Accounting, University of New South Wales/ Chair and CEO of the Australian
Auditing and Assurance Standards Board)
Caroline Spencer (Managing Partner, Vista Advisory)
Tiffany Tan (CPA Australia)
Ken Trotman (Scientia Professor, School of Accounting, University of New South Wales)
Reviewers
Kirsty Meredith (University of the Sunshine Coast)
Prerana Agrawal (The University of Western Australia)
Advisory panel
Roger Simnett (AuASB, UNSW)
Peter Carey (Deakin University)
Claire Grayston (CPA Australia)
David Gowland (CPA Australia)
Brian Clarke (Independent Consultant)
Susan Fraser (Independent Consultant)
Dean Newlan (Independent Consultant)
Ram Nagarajan (CPA Australia)
Seng Thiem Teh (CPA Australia)
Kenny Yeoh (Baker Tilly Monteiro Heng, Kuala Lumpur, Malaysia)
Lee Li Tan, PwC (Kuala Lumpur, Malaysia)
Jessey Chin, PwC (Kuala Lumpur, Malaysia)
Pei Pei Chiam (Deloitte PLT, Kuala Lumpur, Malaysia)
Zulkifflee Bin Mohamed (Universati Tun Abdul Razak, Kuala Lumpur)
Uma Devi Uturaju (Sunway University Malaysia)
Foo Yin Fah (Sunway University Malaysia)
CPA Program team
Yvette Absalom Adam Moretti
Victoria Altomare Ram Nagarajan
David Baird Venkat Narayanan
Shubala Barclay Isha Nehru
Nicola Drury Shari Serjeant
Jeannette Dyet Paul Shantapriyan
Yani Gouw Alisa Stephens
Kristy Grady Zina Suyat
Geraldine Howley Tiffany Tan
Elise Literski Seng Thiam Teh
Julie McArthur
Pdf_Folio:ii
Helen Willoughby
ACKNOWLEDGEMENTS
The Advanced Audit and Assurance 2019 edition includes the International Code of Ethics for
Professional Accountants, 2018 Edition of the International Ethics Standards Board for Accountants
(IESBA), published by the International Federation of Accountants (IFAC) in July 2018 and is used with
permission of IFAC. Contact [email protected] for permission to reproduce, store or transmit, or to
make other similar uses of this document.
The International Code of Ethics for Professional Accountants, 2018 Edition of the International Ethics
Standards Board for Accountants (IESBA), published by the International Federation of Accountants
(IFAC) in July 2018, is used by CPA Australia with permission of IFAC. Such use of IFAC’s copyrighted
material in no way represents an endorsement or promotion by IFAC. Any views or opinions that may be
included in the Advanced Audit and Assurance 2019 edition are solely those of CPA Australia, and do not
express the views and opinions of IFAC or any independent standard setting board supported by IFAC.
MODULE 1
Tables 1.1–1.5, 1.7 and 1.7; Figures 1.10 and 1.11: © CPA Australia; Figure 1.9: © Adapted from Rozario,
A.M., 2019. Three essays on audit innovation: using social media information and disruptive technologies
to enhance audit quality (Doctoral dissertation, Rutgers University-Graduate School-Newark). Figure
1.2: © Auditing and Assurance Standards Board, 2016; Table 1.2: © CPA Australia; Figure 1.9: ©
Adapted from Rozario A M, 2019. ‘Three essays on audit innovation: using social media information
and disruptive technologies to enhance audit quality’ (Doctoral dissertation, Rutgers University-Graduate
School-Newark); Figures 1.2 and 1.4: © Auditing and Assurance Standards Board, 2016; Extract: © Audit
Office of New South Wales; Extracts: © External Reporting Board 2019; Extract: © Ernst & Young;
Extracts: © John Wiley & Sons Australia Ltd.
MODULE 2
Extract: © Association of Chartered Certified Accountants; Tables 2.5, 2.8 and 2.9; Figures 2.14 and 2.15:
© CPA Australia; Figures 2.26 and 2.27: © CPA Canada; Figures 2.1, 2.5, 2.8, 2.10, 2.13, 2.22, 2.23, 2.24,
2.25, 2.28; Table 2.5; Extracts: © John Wiley & Sons Australia Ltd; Table 2.7: © Adapted from Knechel,
W R & Salterio, S 2017, Auditing: Assurance and Risk, 4th edn, Taylor & Francis, New York, pp. 163–5.
MODULE 3
Figure 3.5; Tables 3.3, 3.5 and 3.6: CPA Australia; Table 3.4, Figures 3.4 and 3.10; Extracts: © John Wiley
& Sons Australia Ltd; Extract: © Adapted from Shabbir, M 2019, ‘Computer Assisted Audit Techniques
(CAATs) © Modern Audit Tool’, Mayur Batra Group.
MODULE 4
Extract: © Australian Securities & Investments Commission. Reproduced with permission; Extract: ©
AusGroup Ltd; Table 4.1; Figure 4.5: © CPA Australia; Extracts: © John Wiley and Sons Australia Ltd;
Extract: © Qantas; Extract: © Simavita Ltd.
MODULE 5
Figure 5.1; Table 5.2; Extracts: © Auditing and Assurance Standards Board, 2016; Figure 5.4; Extract:
Internal Control—Integrated Framework © 2013, Committee of Sponsoring Organizations of the
Treadway Commission 2013; Figures 5.5, 5.6, 5.11, 5.12: © CPA Australia; Figure 5.8; Extracts:
© Commonwealth of Australia 2019; Extract: Copyright © by The Institute of Internal Auditors, Inc.
All rights reserved; Extracts: © John Wiley and Sons Australia Ltd; Figure 5.3: © KPMG
Pdf_Folio:iii
ACKNOWLEDGEMENTS iii
BRIEF CONTENTS
Subject Outline vii
Glossary 374
Westerways Case Study 381
Suggested Answers 421
Index 489
Pdf_Folio:iv
CONTENTS
Subject Outline vii 2.2 Terms of engagements 83
Preconditions 83
MODULE 1 Engagement terms and letter of
The Auditing and Assurance engagement 84
Changes to terms 84
Framework 1 2.3 Audit planning procedures 86
Preview 4 Guidance materials for planning an audit
1.1 Assurance environment 4 of SMEs 86
The internationalisation of auditing 5 Overall audit strategy 87
Regulation of auditing in Australia 7 The audit plan 88
Regulation of auditing in New Zealand 10 Financial statement assertions 91
1.2 Assurance engagement framework 11 Documentation 94
Ethical principles 11 Materiality 95
Quality control standards 18 Application of materiality concepts 96
Description of assurance Phases of an audit 99
engagements 25 2.4 Understanding the entity and its
Attestation and direct engagements 25 environment 102
Reasonable and limited assurance The entity’s industry, regulatory and other
engagements 26 external factors 102
Scope of the framework 27 Nature of the entity 103
Elements of an assurance The entity’s selection and application of
engagement 28 accounting policies 105
1.3 Types of assurance engagements 39 The entity’s objectives, strategies and
Audits of financial statements 40 related business risks 105
Audits of specialised areas 41 Measurement and review of the entity’s
Review engagements 41 financial performance 108
Historical non-financial reports 2.5 The entity’s internal controls 109
assurance 41 Components of internal control 110
Future-oriented information assurance 42 Internal controls in SMEs 112
Assurance on systems and processes 42 Controls in an IT environment 113
Assurance on aspects of behaviour 43 2.6 Risk assessments for specific matters 121
Performance of an activity 44 Fraud risk 121
1.4 Application of standards 45 Auditing accounting estimates 126
Application of ISAs 45 Related-party risk 128
Application of ISREs 51 Going concern risk 129
Application of ISAEs 51 Climate-related risk 130
Application of ISRSs 52 Non-compliance with laws and regulations
Australian perspective 52 (NOCLAR) 131
1.5 Changing environment 53 2.7 Risk assessment procedures 134
Evolving business models 54 Methods used for risk assessment 134
Climate-risk disclosure 54 2.8 Responding to assessed risks 159
Technological innovations 55 Overall audit strategy 160
Review 62 Approaches to assuring SMEs 163
References 64 Review 165
References 166
MODULE 2
MODULE 3
Planning the Audit of
Historical Financial Performing the Audit of
Information 66 Historical Financial
Preview 68 Information 169
2.1 Objectives of an audit of financial Preview 171
statements 69 3.1 Key principles 171
Overarching purpose 69
Pdf_Folio:v
Sufficient appropriate audit evidence 171
Legal, regulatory, professional and ethical Financial statement assertions 172
requirements 72 Audit procedures 173
3.2 Tests of controls 174 Litigation and claims 231
Objectives of tests of controls 175 Going concern 232
Tests of controls procedures 176 Management representation letter 235
Using CAATs for tests of controls 178 Subsequent events 236
Sampling techniques for testing Performing analytical procedures 239
controls 184 4.2 Final review 242
3.3 Substantive audit procedures 186 Final evaluation of materiality and
Substantive analytical procedures 186 audit risk 243
Relationship between substantive analytical Final review of working papers 245
procedures and other audit Engagement quality control review 247
procedures 190 Final checklist 248
Tests of details 191 4.3 Preparing the audit report 251
Using CAATs for substantive testing 197 Unmodified auditor’s report 251
Advanced audit data analytic Modified auditor’s report 262
techniques 200 4.4 Communication and reporting
Sampling techniques in substantive responsibilities 277
procedures 201 Communicating with the entity 277
3.4 Evidence-gathering in an e-commerce Reporting responsibilities 280
environment 204 Review 285
Tests of controls in an e-commerce References 287
environment 204
Substantive testing in an e-commerce MODULE 5
environment 205
Other Assurance
Using CAATs in an e-commerce
environment 205 Engagements 288
Advanced audit data analytic techniques Preview 291
and continuous audit in an e-commerce 5.1 Audits of specialised areas 291
environment 205 Special purpose financial statements 291
3.5 Advanced evidence-gathering issues 207 Single financial statements and specific
Audit procedures for related parties 207 financial statement components 293
3.6 Using the work of other auditors Summary financial statements 293
and experts 210 5.2 Review engagements 295
Component auditors 210 Review of interim financial information
Internal auditors 211 performed by the auditor of the
Using the work of an auditor’s expert 213 entity 296
Using the work of management’s Review where the assurance practitioner is
experts 213 not the auditor of the entity 298
3.7 Audit documentation 215 Review of financial information for SMEs 298
Security and confidentiality of Review of other historical financial
client data 215 information — an Australian
Audit file organisation 215 perspective 299
Examples of audit working papers 216 5.3 Other assurance engagements — part 1 300
3.8 Evaluation of audit evidence 219 Overarching standard 300
Misstatements identified during Historical non-financial reports 303
the audit 219 Future-orientated information 311
Sufficiency and appropriateness 5.4 Other assurance engagements — part 2 315
of evidence 221 Systems and processes 315
Review 222 Aspects of behaviour 327
References 223 5.5 Other assurance engagements — part 3 333
Performance of activity 333
MODULE 4
5.6 Non-assurance services 366
Conclusions and Reporting Agreed-upon procedures 366
Compilation engagements 368
Responsibilities for an Audit Review 370
of Historical Financial References 371
Information 225 Glossary 374
Preview 228 Westerways Case Study 381
4.1 Completing the fieldwork 228 Suggested Answers 421
Index 489
Pdf_Folio:vi
vi CONTENTS
SUBJECT OUTLINE
INTRODUCTION
The purpose of this subject outline is to:
• provide important information to assist you in your studies
• define the aims, content and structure of the subject
• outline the learning materials and resources provided to support learning
• provide information about the exam and its structure.
The CPA Program is designed around five overarching learning objectives to produce future CPAs who
will:
• be technically skilled and solution driven
• be strategic leaders and business partners in a global environment
• be aware of the social impacts of accounting
• be adaptable to change
• be able to communicate and collaborate effectively.
SUBJECT DESCRIPTION
Advanced Audit and Assurance
The Advanced Audit and Assurance subject provides a body of knowledge for you to understand the nature
and diversity of audit and assurance engagements. The subject provides an insight on audit and assurance
processes, methodologies and procedures. It also examines the objectives of assurance engagements and
current and future developments in assurance engagements. The environment within which the auditor
or assurance practitioner operates and the respective roles of the private and public sector auditors and
internal audit are also discussed.
In the CPA Program, the professional responsibilities of accountants are discussed in the Ethics and
Governance subject. However, this subject emphasises the ethical and professional conduct of auditors.
The strategic business analysis techniques in the Advanced Audit and Assurance subject are further
discussed in the Strategic Management Accounting and Global Strategy and Leadership subjects in their
respective context. This subject and the Contemporary Business Issues subject also cover sustainability
reporting and assurance with an emphasis on businesses. Advanced topics in financial reporting that
complement the accounting knowledge of audit professionals are covered in the Financial Reporting
subject, and accounting for financial instruments is discussed in the Financial Risk Management subject.
This subject will introduce you to international pronouncements including the international standards
for audit, review and assurance engagements, the standard on quality control for audit firms and the code
of ethics. You will be taken through case studies to illustrate the strategic approach in audit engagements.
Contemporary developments in assurance engagements are discussed in this subject in the context of future
practice management opportunities.
Subject Aims
The aims of the subject are to address concepts related to:
• the foundational knowledge required to understand the nature and diversity of assurance engagements
• audit planning, including understanding the entity, assessing risk, developing the overall audit strategy,
developing the audit plan and application of information technology to planning of audit engagements
• performing the audit, including gathering and evaluating evidence, and application of information
technology to performance of audit engagements
• the audit conclusions and auditor’s reporting responsibilities and application of information technology
to concluding and reporting on audit engagements
• engagements other than audits of historical financial information and application of information
technology to other assurance engagements.
Pdf_Folio:vii
STUDY GUIDE
Module Descriptions
The subject is divided into five modules. A brief outline of each module is provided below.
Module 1: The Auditing and Assurance Framework
This module starts by providing an overview of the current assurance environment and outlining the
structure of the Framework that shapes auditing and other assurance engagements. The key matters
pertaining to an assurance engagement are introduced and the importance of professional scepticism
and professional judgment in collecting and evaluating evidence is emphasised. The various types of
assurance engagements are discussed and include references to the application of the relevant standards
to these engagements for different types of entities, including private sector, public sector, and small- and
medium-sized entities. This module concludes by outlining the impact a changing environment is having
on auditing due to evolving business models, enhanced disclosure requirements related to climate risks
and the incorporation of technological innovations,
Module 2: Planning the Audit of Historical Financial Information
This module outlines the general principles governing an audit of financial statements and discusses the
responsibility of personnel within the audit firm for the quality control of audits. The terms of audit
engagements and audit planning procedures are discussed including the overall audit strategy, financial
statement assertions, materiality and audit documentation. The focus then turns to the audit planning
procedures such as understanding the entity and its environment including the entity’s internal controls.
Given the increased emphasis by the profession on the detection of fraud, the auditor’s responsibility
to consider fraud in an audit of financial statements is discussed in some detail. Other risk assessments
for specific matters that have the potential to be significant risks are discussed, along with a variety of
techniques commonly used for conducting strategic analyses and analytical procedures to better understand
business risk and the audit implications. This discussion includes an overview of contemporary tools such
as data analytics and visualisations. The module concludes with a brief outline of how auditors may respond
to the assessed risks identified during the planning stage of the audit, depending on the overall audit strategy
determined by the auditor.
Module 3: Performing the Audit of Historical Financial Information
Module 3 considers the general principles underlying the evidence-gathering procedures in an audit.
Emphasis is placed on the need for auditors to obtain sufficient appropriate audit evidence on which to base
their opinion. Both tests of controls and substantive procedures are examined in detail. Examples are also
provided to demonstrate the application of the international auditing standards covering different aspects
of performing the audit to gather evidence. The use of audit data analytic techniques is also considered
as is the need to maintain audit documentation in relation to the conduct of the audit. In addition, the
Pdf_Folio:viii
Recommended
proportion
Module of study time (%) Weighting (%)
Pdf_Folio:ix
SUBJECT OUTLINE ix
Exam Structure
The Advanced Audit and Assurance exam is comprised of multiple-choice questions. Multiple-choice
questions include knowledge, application and problem-solving questions that are designed to assess
understanding of Audit and Assurance principles.
LEARNING MATERIALS
Module Structure
These study materials form your central reference in the Advanced Audit and Assurance subject. Where
advised, relevant sections of the CPA Australia Members’ Handbook and legislation are also examinable.
Module Map
A module map is at the beginning of each module. The module map outlines the topics covered in each
module and how this relates to the other modules.
Learning Objectives
A set of learning objectives is included for each module in the study guide. These learning objectives
provide a framework for the learning materials and identify the main focus of the module.
The objectives also describe what candidates should be able to do after completing the module.
Relevant Standards and Guidance Materials
The relevant standards and guidance materials table is at the beginning of each module and details both
the International and Australian Standards covered in each module.
Preview
The preview outlines what will be covered in the module and how it relates to other modules in the subject.
Study Material
The study material is divided into sections that will help you conceptualise the content and study it in
manageable portions. It is also important to appreciate the cumulative nature of the subject and to follow
the given sequence as closely as possible.
Examples
Examples are included throughout the study materials to demonstrate how concepts are applied to real-
world scenarios.
Study Material Activities
Question activities are included throughout the study materials to provide you with the opportunity, as you
progress through the subject, to assess your understanding of significant points and to stimulate further
thinking on particular issues. These questions are an integral part of your study and they should be fully
utilised to support your learning of the module content throughout the semester.
Completing the question activities should also form one part of your revision for the exam. It is evident
that candidates who achieve good results in the program and in their careers are those who are able to
think, review and analyse situations, and solve problems. The question activities will assist you to develop
these skills.
The question activities in the study materials are numbered and require you to prepare answers and
to compare those answers with the suggested answers at the end of the study guide. They test your
comprehension of specific sections of a module and provide immediate feedback on your performance
in comprehending the materials covered. Your answers to these questions do not contribute to your final
result, and you are not required to submit your answers for marking.
Key Points
The key points feature provides a summary of the main learning objectives covered in the part and details
the relevant content in this regard.
Review
The review section places the module in context of the other modules studied and summarises the main
points.
References
The reference list details all sources cited in the study guide. You are not expected to follow up this source
material.
Pdf_Folio:x
x SUBJECT OUTLINE
Suggested Answers
These are located at the end of the Study Guide and provide important feedback on the questions, examples
and case study activities included in the module learning materials. Consider them as model answers for
your reference. To assess how well you have understood and applied the material supplied in the text, it is
important to write your answer before you compare it with the suggested answer.
Pdf_Folio:xi
SUBJECT OUTLINE xi
P
df_Folio:xii
MODULE 1
• Ethical principles
• Quality control standards
Assurance engagement framework • Description of an assurance engagement
• Scope of the Framework
• Elements of an assurance engagement
• Audits
• Reviews
• Historical non-financial reports
Types of assurance engagements • Future-oriented information
• Systems and process
• Aspects of behaviour
• Performance of an activity
P df_Folio:1
LEARNING OBJECTIVES
IESBA International Code of Ethics for Professional APES 110 Code of Ethics for Professional Accountants
Accountants (including International Independence (including Independence Standards)
Standards)
ISA 200 Overall Objectives of the Independent ASA 200 Overall Objectives of the Independent Auditor
Auditor and the Conduct of an Audit in Accordance and the Conduct of an Audit in Accordance with
with International Standards on Auditing Australian Auditing Standards (Compiled)
ISA 220 Quality Control for an Audit of Financial ASA 220 Quality Control for an Audit of a Financial Report
Statements and Other Historical Financial Information (Compiled)
ISA 300 Planning an Audit of Financial Statements ASA 300 Planning an Audit of a Financial Report
(Compiled)
ISA 315 (Revised) Identifying and Assessing ASA 315 Identifying and Assessing the Risks of Material
the Risks of Material Misstatement through Misstatement through Understanding the Entity and Its
Understanding the Entity and Its Environment Environment (Compiled)
ISA 402 Audit Considerations Relating to an Entity ASA 402 Audit Considerations Relating to an Entity Using
Using a Service Organization a Service Organisation (Compiled)
ISA 510 Initial Audit Engagements — Opening ASA 510 Initial Audit Engagements — Opening Balances
Balances (Compiled)
ISA 540 (Revised) Auditing Accounting Estimates, ASA 540 Auditing Accounting Estimates and Related
and Related Disclosures Disclosures
ISA 600 Special Considerations — Audits of Group ASA 600 Special Considerations — Audits of a Group
Financial Statements (including the Work of Financial Report (Compiled)
Component Auditors)
ISA 610 (Revised) Using the Work of Internal ASA 610 Using the Work of Internal Auditors
Auditors
ISA 800 (Revised) Special Considerations—Audits of ASA 800 Special Considerations — Audits of Financial
Financial Statements Prepared in Accordance with Reports Prepared in Accordance with Special Purpose
Special Purpose Frameworks Frameworks (Compiled)
ISA 805 (Revised) Special Considerations — Audits ASA 805 Special Considerations — Audits of Single
of Single Financial Statements and Specific Financial Statements and Specific Elements, Accounts
Elements, Accounts or Items of a Financial or Items of a Financial Statement (Compiled)
Statement
ISA 810 (Revised) Engagements to Report on ASA 810 Engagements to Report on Summary Financial
Summary Financial Statements Statements
ISQC 1 Quality Control for Firms that Perform Audits ASQC 1 Quality Control for Firms that Perform Audits
and Reviews of Financial Statements, and Other and Reviews of Financial Reports and Other Financial
Assurance and Related Services Engagements Information, Other Assurance Engagements and Related
Pdf_Folio:2
Services Engagements
ISRE 2410 Review of Interim Financial Information ASRE 2410 Review of a Financial Report Performed by
Performed by the Independent Auditor of the the Independent Auditor of the Entity (Compiled)
Entity
ISAE 3000 (Revised) Assurance Engagements ASAE 3000 Assurance Engagements Other than Audits or
Other than Audits or Reviews of Historical Financial Reviews of Historical Financial Information
Information
ISAE 3402 Assurance Reports on Controls at a ASAE 3402 Assurance Reports on Controls at a Service
Service Organization Organisation
ISAE 3410 Assurance Engagements on Greenhouse ASAE 3410 Assurance Engagements on Greenhouse Gas
Gas Statements Statements
ISAE 3420 Assurance Engagements to Report on ASAE 3420 Assurance Engagements to Report on the
the Compilation of Pro Forma Financial Information Compilation Of Pro Forma Financial Information Included
Included in a Prospectus in a Prospectus
ISRS 4400 Engagements to Perform Agreed-Upon ASRS 4400 Agreed-Upon Procedures Engagements to
Procedures Regarding Financial Information Report Factual Findings
P df_Folio:3
Types of information
Auditing and assurance are governed by two separate but closely related sets of standards: auditing
standards that are concerned with audits of historical financial information; and assurance standards that
are concerned with all other types of assurance engagements. Both the International Standards on Auditing
and International Standards on Review Engagements continually evolve to keep pace with changes in
business and social expectations.
The demand for assurance services continues to grow and so does the range of assurance services offered
by public accountants. As a result, the role of regulators and regulation in maintaining the quality of the
assurance services is pivotal. Assurance engagement providers operate in a complex environment that is
subject to a number of important influences, such as the internationalisation of auditing and regulation.
This section will explain these influences on the provision of assurance services.
Related Services
Source: International Auditing and Assurance Standards Board (IAASB) 2018, Handbook of International Quality Control,
Auditing, Review, Other Assurance, and Related Services Pronouncements, 2018 ed., vol. 1, p. 4, accessed July 2019,
https://www.ifac.org/publications-resources/2018-handbook-international-quality-control-auditing-review-other-assurance
Research and
consider issue
International Australian
stakeholders
Source: AUASB 2019, The Standard-Setting Process’, accessed August 2019, https://www.auasb.gov.au/About-the-AUASB/The-
standard-setting-process.aspx
Pdf_Folio:8
ISQC ASQC
ISA ASA
ISRE ASRE
ISAE ASAE
QUESTION 1.1
Several private and public sector organisations are associated with the public accounting profes-
sion. The following are functions pertaining to these organisations.
1. Hear applications from ASIC to determine whether auditors have breached the Corporations
Act.
2. Oversee the accounting standards-setting process.
3. Formulate auditing standards and audit guidance statements.
4. Regulate the distribution and trading of securities offered for public sale.
5. Establish a code of professional ethics.
6. Oversee the Australian Auditing and Assurance Standards Board.
7. Issue auditing standards.
8. Take punitive action against an independent auditor.
9. Establish quality control standards for audit work.
10. Undertake investigation of perceived breaches of the Corporations Act.
Indicate the organisation associated with each activity.
The XRB consists of the New Zealand Accounting Standards Board (NZASB) and the New Zealand
Auditing and Assurance Standards Board (NZAuASB). The auditing and assurance standards issued by
the NZAuASB consist of four suites of standards:
1. Professional and Ethical Standards: these are the professional and ethical standards applying to assurance
practitioners issued by the XRB Board/NZAuASB.
2. International Standards on Auditing (NZ): apply to the conduct of audit engagements (reasonable
assurance) undertaken by assurance practitioners.
3. Review Engagement Standards: apply to the conduct of review engagements (limited assurance)
undertaken by assurance practitioners (XRB 2019c).
4. Other Assurance Engagement Standards: apply to the conduct of assurance engagements (other than on
df_Folio:10
P
historical financial information) undertaken by assurance practitioners.
The equivalent of the Australian regulator (ASIC) in New Zealand is the Financial Markets Author-
ity (FMA), which is an independent Crown authority responsible for ensuring public confidence in
New Zealand financial markets. Its responsibilities include:
• the licensing of New Zealand and overseas auditors and audit firms
• monitoring the audit firm performance
• performing quality reviews of New Zealand audit firms and auditors
• overseeing and monitoring accredited bodies to make sure they carry out their statutory duties.
Further details of the FMA’s role can be obtained from the Auditor Regulation and Oversight Plan
2019–2022 (FMA 2019).
The key points covered in this part, and the learning objectives they align to, are below.
KEY POINTS
1.1 Apply the International Framework for Assurance Engagements (the Framework) and the
related standards and other guidance to assurance engagements.
• The International Framework for Assurance Engagements distinguishes assurance engagements
from other engagements and provides a hierarchy of standards applicable to different engagements.
1.2 Apply the Code of Ethics for Professional Accountants to assurance engagements.
• All professional accountants have to comply with the fundamental ethical principles set out in
the Code.
ETHICAL PRINCIPLES
The Framework specifies that firms that perform assurance engagements must comply with the fun-
damental ethical principles outlined in IESBA’s Code. The Code’s conceptual framework (the Code,
s. 120) outlines circumstances in which threats to compliance with the fundamental principles may occur.
Pdf_Folio:11
This obligation requires continuing awareness of relevant technical, professional and business devel-
opments, which can be obtained through continuing professional development (the Code, para. 113.1
A2). The Code explains that ‘diligence encompasses the responsibility to act in accordance with the
requirements of an assignment, carefully, thoroughly and on a timely basis’ (the Code, para. 113.1 A3).
Professional accountants are required to decline a job unless they possess the necessary skills to perform
it properly.
Pdf_Folio:12
Brenda Jones is a newly qualified accountant who is carrying out her first audit as the in-charge
auditor for a construction company client that is engaged in a range of long-term contracts. Brenda
has little experience of these types of clients and the accounting requirements in relation to long-
term contracts. John Bull is the CFO of the client — he is a busy man and has a notorious reputation
for being unfriendly to auditors. It has become apparent that Brenda has not fully understood the
accounting issues involved and has avoided asking the necessary questions of John Bull to gain
an understanding of the company’s transactions and the necessary audit work required to obtain
evidence on the long-term contract transactions.
As Brenda’s supervisor, how would you explain to her the importance of professionalism, using
the International Code of Ethics for Professional Accountants (including International Indepen-
dence Standards) and particularly referring to its guidance on competence? What advice would
you give as to how she should proceed?
Confidentiality
A professional accountant must respect the confidentiality of information acquired as a result of
professional and business relationships. They must not:
• use the information for the personal advantage of themselves or third parties
• disclose any such information to third parties without proper and specific authority, unless there
are responsibilities under law, regulation or relevant ethical requirements to disclose (the Code,
para. R114.1).
Circumstances where disclosure of confidential information may be required or appropriate (the Code,
para. 114.1 A1) include:
(a) Disclosure is required by law, for example:
(i) Production of documents or other provision of evidence in the course of legal proceedings; or
(ii) Disclosure to the appropriate public authorities of infringements of the law that come to light;
(b) Disclosure is permitted by law and is authorized by the client or the employing organization;
(c) There is a professional duty or right to disclose, when not prohibited by law:
(i) To comply with the quality review of a professional body;
(ii) To respond to an inquiry or investigation by a professional or regulatory body;
(iii) To protect the professional interests of a professional accountant in legal proceedings; or
(iv) To comply with technical and professional standards, including ethics requirements (the Code,
para. 114.1 A1).
Professional Behaviour
An accountant must demonstrate professional behaviour by complying with relevant laws and regulations
and avoid any conduct that discredits the profession (the Code, para. R115.1). They must act in a way that
promotes the good reputation of the profession.
Threats and Safeguards
Using the conceptual framework approach recommended by the Code, members must identify any threats
to compliance with the fundamental principles, evaluate those threats and address threats to compliance
with the fundamental principles in section 110 of the Code. Where the threats are significant, members
must apply safeguards to eliminate them or reduce them to an acceptable level (i.e. so that compliance
with the fundamental principles is no longer compromised). If members cannot implement appropriate
safeguards, they must either decline or discontinue the specific professional service, or consider resigning
from the client or employer.
Compliance with the fundamental ethical principles can be jeopardised by a range of threats.
• Self-interest threat may occur as a result of the financial or other interests of a professional accountant.
• Self-review threat may occur when the assurance team needs to form an opinion on their work or work
performed by others in their firm.
• Advocacy may occur when an auditor is asked to promote or represent their client in some particular
way. This could happen when a client asks the auditor to promote their shares on the stock exchange,
argue their client’s position on a proposed accounting disclosure or represent them in a court case. The
auditor’s objectivity may be impaired. Further, the auditor’s independence of mind and in appearance
could be compromised.
• Familiarity may occur when, because of a long or close relationship with a client, a professional
accountant becomes too sympathetic to their interests or too accepting of their work.
Pdf_Folio:13
Second Opinions
In accounting, an intimidation threat arises when a client succeeds in obtaining a second opinion favourable
to their position — for example, an opinion on the use of particular accounting policies — and uses this to
apply pressure on the existing accountant. The fundamental principle threatened is objectivity. Safeguards
include the accountant who is asked to provide the second opinion seeking client permission to contact the
existing accountant, as well as providing the existing accountant with a copy of the second opinion (the
Code, para. 321.3 A3).
Additionally, contingent fees may create a threat to compliance with the principle of objectivity. Having
an appropriate reviewer review the work performed or obtaining a written agreement with the client on
the basis of remuneration prior to commencement of work may address such self-interest risks (the Code,
para. 330.4 A3).
A self-interest threat ‘with the principles of objectivity and professional competence and due care is
created if a professional accountant pays or receives a referral fee or commission relating to a client’ (the
Code, para. 330.5 A1). Such self-interest threats can be addressed by having the client outline commission
arrangements prior to commencing work or ‘disclosing to clients any referral fees or commission
arrangements’ with other professional accountants (the Code, para. 330.5 A2).
Inducements — Gifts and Hospitality
Professional accountants may find themselves in situations where they, or their immediate or close family
members, are offered inducements to influence their behaviour, such as:
• gifts
• hospitality
• entertainment
• political or charitable donations
• appeals to friendship and loyalty
• employment or other commercial opportunities
• preferential treatment, rights or privileges (the Code, para. 340.4 A1).
Pdf_Folio:15
QUESTION 1.3
Independence
Independence is generally considered to be the cornerstone of the auditing and assurance profession. The
definition of independence in the Code stresses that the accountant must be independent both of mind and
in appearance (refer also Glossary, APES 110). Accordingly, the accountant must act with integrity, and
exercise objectivity, professional judgment and professional scepticism.
In addition, the accountant must remain alert for new information, changes in facts and circumstances
and avoid circumstances that a reasonable and informed third party might think indicate that a member’s
integrity, objectivity or professional scepticism has been compromised. The reasonable person must
df_Folio:16
P
EXAMPLE 1.1
EXAMPLE 1.2
P df_Folio:17
Leadership Responsibility
Leadership culture underpins all other elements of QC, so it is important for a firm to have a strong QC
culture established by the leadership of the firm and the examples it sets. Operational responsibility for the
firm’s QC system must rest with a person with appropriate experience and ability, as well as the necessary
authority. In all likelihood, this will be one of the most senior partners.
An assurance firm should develop, document and implement appropriate QC procedures and a formal
code of conduct. Perhaps most challengingly, its leadership should demonstrate the firm’s overriding
commitment to quality above commercial considerations. This means that the work done in an assurance
Pdf_Folio:18
Ethical Requirements
The assurance firm should develop, document and implement policies and procedures to guide and
reinforce ethical behaviour. These include independence policies describing permitted and prohibited
behaviour reflecting the advice in the Code, and independence consultations that allow staff and partners
to refer independence threats to relevant partners so that timely action can be taken. Systems that support
ethical behaviour include databases to match staff disclosures with a prohibited securities list, and (in
Australia) tracking the firm’s management of the auditor rotation requirements of the Corporations Act.
Read ISQC 1, paragraphs 20–25 for discussions on these responsibilities.
ISA 220 explains the ethical requirements, including independence, of the engagement team in relation
to audit engagements. In particular, the engagement partner shall consider whether members of the
engagement team have complied with relevant ethical requirements relating to audit engagements. The
engagement partner must remain alert for evidence of non-compliance with the ethical requirements
relating to the audit engagement. With respect to independence, it is mandatory that the engagement
partner:
(a) obtain relevant information from the firm and, where applicable, network firms, to identify and evaluate
circumstances and relationships that create threats to independence;
(b) evaluate information on identified breaches, if any, of the firm’s independence policies and procedures
to determine whether they create a threat to independence for the audit engagement; and
(c) take appropriate action to eliminate such threats or reduce them to an acceptable level by applying
safeguards … The engagement partner shall promptly report to the firm any inability to resolve the
matter for appropriate action (ISA 220, para. 11).
Non-compliance can be at the firm level (e.g. the control system to monitor employee ownership of
shares in listed companies is not adequate) or at the individual client level (e.g. the audit manager and the
CFO are related). In most firms, senior personnel (e.g. risk management partners) will be assigned to look
after these issues at the firm level. However, individual partners are responsible at the engagement level.
ASIC’s 2019 audit inspection report discusses compliance with these independence requirements. It
states that most firms have established policies and processes to facilitate compliance with the auditor
independence requirements of the Corporations Act and professional standards. However, there were some
instances of non-compliance.
• Three larger firms provided non-audit services to audit clients that compromised the appearance of
independence.
• One small firm failed to send partners and staff an annual independence questionnaire to confirm
compliance with independence (ASIC 2019, p. 40).
Examples such as these can undermine actual or apparent independence of auditors.
QUESTION 1.4
List four factors that may indicate additional client evaluation procedures are necessary when
evaluating the continuance of an audit client.
Human Resources
An assurance firm’s human resource policies must apply at both the staff and partner levels. Important
personnel issues include:
1. recruitment
2. performance evaluation
3. capabilities, including time to perform assignments
4. competence
5. career development
6. promotion
7. compensation
8. the estimation of personnel needs (ISQC 1, para. A24).
‘Effective recruitment processes and procedures help the firm select individuals of integrity who have the
capacity to … perform competently’ (ISQC 1, para. A24). Human resources policies should demonstrate
that adherence to QC policies and ethical principles are criteria for promotion and remuneration decisions.
Non-compliance should result in disciplinary action (including financial penalties) and other follow-up
procedures such as training. For audit firms, it is also important that partner evaluations and promotions
are documented and that the documentation covers quality controls and independence.
Assignment of Engagement Teams
A firm should establish policies and procedures to assign appropriate personnel with the necessary
competence and capabilities to an engagement (ISQC 1, para. 31). The firm should have systems in place to
monitor the workload and availability of engagement partners. This will ensure that engagement partners
assigned to an engagement ‘have sufficient time to adequately discharge their responsibilities’ (ISQC 1,
para. A30).
ISA 220 requires an engagement partner to be satisfied that the engagement team collectively has the
appropriate capabilities and competence to perform the audit engagement (ISA 220, para. 14). Note that
these requirements apply to the engagement team as a whole. Therefore, it is possible to put a staff member
on an audit without all of the required capabilities and competencies, provided there is adequate supervision
and review. In most firms these issues will be handled through staff training and on-the-job training.
Knowledge of relevant industries can sometimes provide additional challenges and require using resources
from outside the firm. If the auditor becomes particularly aware of specific risk areas or areas requiring
specialist skills, the engagement partner may include more senior staff and specialists on the audit and
carry out additional reviews of the work done.
Engagement Performance
Engagement performance means completing assurance engagements in accordance with professional
standards, and legal and regulatory requirements.
df_Folio:20
P
Consultation
Consultation is an important responsibility of the engagement partner. This includes the requirements to:
(a) take responsibility for the engagement team undertaking appropriate consultation on difficult or
contentious matters;
(b) be satisfied that members of the engagement team have undertaken appropriate consultation during the
course of the engagement, both within the engagement team and between the engagement team and
others at the appropriate level within or outside the firm;
(c) be satisfied that the nature and scope of, and conclusions resulting from, such consultations are agreed
with the party consulted; and
(d) determine that conclusions resulting from such consultations have been implemented (ISQC 1,
para. 34; ISA 220, para. 18).
Pdf_Folio:21
Read ISQC 1, paragraphs 34 and A36–A40 for further details of the consultation processes.
Engagement Quality Control Review
On completion of the audit of listed entities and other public interest entities, assurance firms must
perform an engagement quality control review (EQCR). The EQCR provides an objective and independent
evaluation of the significant judgments made and the conclusions reached by the audit team and the audit
partner. The EQCR is in addition to the ongoing ‘review of audit working papers’ (see module 4) performed
by the engagement team and the engagement partner, discussed in the previous section, ‘Supervision and
review’.
EQCR reviewers are experienced audit partners who are not otherwise involved in the audit engagement.
They carry out a second (or concurring) independent review of the engagement, including the quality of
the work performed and the appropriateness of the auditor’s opinion.
An EQCR policy should identify:
• the nature, timing and extent of an EQCR
• criteria for eligibility of an EQCR reviewer
• documentation required of an EQCR
• how differences of opinion are to be resolved.
Read ISQC 1, paragraphs 35–42 for further details on engagement quality control reviews.
QUESTION 1.5
What are the main attributes of an effective audit quality review program (i.e. quality review
processes within audit firms) in an audit engagement?
Monitoring
‘Monitoring’ refers to the ongoing examination of QC systems and procedures to ensure that they are
appropriate and are carried out consistently and properly. Monitoring systems should ensure that any
identified problems are communicated to the partner responsible for the firm’s QC and that appropriate
responses to problems are implemented. These responses might include additional training, counselling or
disciplinary action for individuals, or a revision of the firm’s QC policy.
ASIC (2019) continues to emphasise that effective firm quality review processes are important for
improving audit quality. Such monitoring of audit quality involves regular reviews within firms of a sample
of completed audits. These reviews are usually carried out by senior staff from a different location
(e.g. interstate).
ASIC also released Information Sheet 222 ‘Improving and maintaining audit quality’ (INFO 222)
in June 2017 to outline considerations for auditors to improve and maintain audit quality. Some of the
considerations raised in INFO 222 for effective audit firm quality reviews include:
• suitability of reviewers
• review coverage
• review and reporting
• remedial action.
For more details, read INFO 222 at https://asic.gov.au/regulatory-resources/financial-reporting-and-
audit/auditors/improving-and-maintaining-audit-quality.
df_Folio:22
P
ASIC stated that its findings did not necessarily mean the financial reports audited were materially
misstated, but rather that the auditor did not have a sufficient basis to support its opinion on the financial
report. It also noted that the level and nature of the findings were consistent with those found by inspectors
in other countries.
As further evidence of monitoring, in 2013, Australia mandated the preparation and release of
transparency reports by the larger audit firms of significant entities, with a focus on the disclosure of
their internal governance systems. Under section 322 of the Corporations Act, all audit firms must publish
a transparency report on their website if they have conducted audits under the Corporations Act of ten or
more significant entities. Just over 20 audit firms in Australia are required to publish such reports. The
information to be published includes:
• a description of the firm or company’s legal structure and ownership
• a description of the auditor’s governance structure and internal quality control system
• a statement by the management body on the effectiveness of the functioning of the internal quality
control system
• information concerning the basis for remuneration of the audit firm’s partners or the authorised audit
company’s directors.
The KPMG Auditor Transparency Report 2018 can be viewed at https://home.kpmg/au/en/home/
insights/2018/10/transparency-report.html.
QUESTION 1.6
Outline procedures that a firm could implement to demonstrate its commitment to quality above
commercial considerations.
Contextual factors
Bus
ing ine
ort com ss p
l rep e me rac
ia l
nc tab rci tice
ina time al
law s an
F
d
La finan
Those
t
ws cia
en
an l rep
with
dr
ing
governance
egu orting
act
Attr
latio
ns
Audit
quality
environment
na
ewor
Management Inputs Outputs Users
Litig
k
ms
Au
ste
dit
sy
re
gu
n
Auditor
tio
tio
la
n a
rm
fo
In
Bro
ade nce
r cu
ltura overna
eg
l factors Corporat
Source: International Auditing and Assurance Standards Board (IAASB) 2014, A Framework for Audit Quality: Key Elements
That Create an Environment for Audit Quality, in Handbook of International Quality Control, Auditing, Review, Other Assurance,
and Related Services Pronouncements, 2018 ed., vol. 3, p. 6, accessed August 2019, available from: https://www.ifac.org/
publications-resources/2018-handbook-international-quality-control-auditing-review-other-assurance
QUESTION 1.7
For a report on internal controls, select whether the following are attestation or direct engagements.
(a) Management provides an assessment of the effectiveness of the internal control system and
the practitioner provides a conclusion on that assertion.
(b) The practitioner evaluates and measures the internal control system and reports their findings
to the intended users of the assurance report.
QUESTION 1.8
Explain in detail the extent to which reasonable and limited assurance engagements differ from one
another.
QUESTION 1.9
Criteria
Assurance
report
Practitioner
Intended
users
Source: International Auditing and Assurance Standards Board (IAASB) 2018, ISAE 3000 (Revised) Assurance Engagements
Other than Audits or Reviews of Historical Financial Information, in Handbook of International Quality Control, Auditing, Review,
Other Assurance, and Related Services Pronouncements, 2018 ed, vol. 2, p. 204, accessed July 2019, available from:
https://www.ifac.org/publications-resources/2018-handbook-international-quality-control-auditing-review-other-assurance
The difference between the elements illustrated in figure 1.4 for a generic assurance engagement and a
financial statement audit are depicted in table 1.4.
Comparison of the elements of a generic assurance
TABLE 1.4 engagement and a financial statement audit
Practitioner Auditor
Pdf_Folio:28
Source: CPA Australia 2019.
Three-Party Relationship
The three-party relationship involves the practitioner (professional accountant), the responsible party
(the person(s) responsible for the underlying subject matter) and the intended users of the report.
Practitioner
The practitioner is the assurance practitioner. For example, the auditor is the practitioner in a financial
statement audit. The practitioner is responsible for determining the nature, timing and extent of procedures,
and must judge the fair presentation of the subject matter information.
Responsible Party
The responsible party is the party responsible for the underlying subject matter. For example, for a financial
statement audit, the responsible party is normally the board of directors as they are responsible for the
conduct of the business — the underlying subject matter. Their responsibility for the financial statements is
evidenced by their signature on the Directors’ Statement. Employees who prepare the financial statements
(the subject matter information) are usually headed by the company accountant/chief financial officer. The
engaging party is usually the audit committee, which is a subcommittee of the board of directors.
The responsible party may or may not be the party who engages the practitioner. For example, parliament
may engage the Auditor-General to carry out a performance audit of a government program. In this case,
the management of the public sector organisation responsible for the program is the responsible party, and
the program is the underlying subject matter.
Intended Users
The intended users are the people or groups expected to read the assurance report. The aim of the assurance
report is to increase users’ confidence in the subject matter information. Of course, the users of the report
are also the users of the subject matter information. Table 1.5 provides examples of different types of
engagements and their intended users.
Financial statement audit Suppliers of capital, such as existing shareholders, potential shareholders,
creditors and financiers
Assurance engagement that Management and the board of directors, audit committees
evaluates internal controls
Sustainability assurance May include a broad range of intended users. For example, a local
engagement community may be interested in water usage, or a local conservation group
may be interested in impacts on animal habitats.
Sometimes, an assurance engagement is performed for a specific purpose and there is only one user. For
example:
• a purchaser of a motorway may be interested in assurance regarding the number of cars that use the
motorway each day
• a bank may be interested in assurance on the cash budgets of a creditor
• a board of directors may want assurance on the information provided to them by management.
Pdf_Folio:29
QUESTION 1.10
Determine the responsible party and the intended users for each of the following engagements.
1. A financial statement audit.
2. An assurance report on the internal controls over sales required by the board of directors.
3. An assurance report on controls at a company that provides cloud-based accounting services
to customers.
* This type of assurance has become particularly important. Since 2002, US companies and their international subsidiaries have been
required to have their internal control systems audited.
Source: CPA Australia 2019.
Criteria
Criteria are the standards, rules or benchmarks used to prepare and evaluate the subject matter information
of an assurance engagement.
Criteria can be formal, for example in the preparation of financial statements, the criteria may be
International Financial Reporting Standards or International Public Sector Accounting Standards; when
reporting on the operating effectiveness of internal controls, the criteria may be based on an established
internal control framework or individual control objectives specifically designed for the purpose; and when
reporting on compliance, the criteria may be the applicable law, regulation or contract. Examples of less
formal criteria are an internally developed code of conduct or an agreed level of performance (such as the
df_Folio:30
P
number of times a particular committee is expected to meet in a year) (IAASB Framework, para. 42).
Source: Adapted from International Auditing and Assurance Standards Board (IAASB) 2018 International Framework for
Assurance Engagements, para. 43, in Handbook of International Quality Control, Auditing, Review, Other Assurance, and
Related Services Pronouncements, 2018–19 ed., vol. 3, pp. 79-80, accessed July 2019, https://www.ifac.org/publications-
resources/2018-handbook-international-quality-control-auditing-review-other-assurance
Table 1.7 explains the characteristics of suitable criteria and provides an example for each.
Relevance Relevant criteria help For a performance audit on a state rail corporation, relevant
intended users make criteria could include the on-time running of trains.
decisions. Intended users are more likely to be concerned with the
number of trains more than five minutes late rather than one
minute late.
Completeness Criteria are sufficiently For the rail network, including on-time running but omitting
complete when all the number of times trains miss their station would result in
significant and relevant criteria that are incomplete.
factors that could affect People want to know that the trains arrive on time and stop at
the conclusions of users their intended stations.
are present.
Reliability Reliable criteria Measuring the number of trains that run late every day gives a
allow reasonably more reliable measure than taking a sample of one day every
consistent evaluation three months.
or measurement of the
subject matter.
(continued)
Pdf_Folio:31
Neutrality Neutral criteria help draw In many cases, management has an incentive to overstate
conclusions that are free performance because improved performance may lead to
from bias. rewards (e.g. bonuses or promotion).
Evidence provided by independent parties is more likely to be
neutral than information provided by management.
Understandability Understandable criteria Criteria must be available to the intended users to allow them
help draw conclusions to understand how the subject matter has been evaluated
that are clear and not or measured.
subject to significantly
different interpretations.
Source: Adapted from International Auditing and Assurance Standards Board (IAASB) 2018, International Framework for
Assurance Engagements, para. 44, in Handbook of International Quality Control, Auditing, Review, Other Assurance, and Related
Services Pronouncements, 2018–19 ed., vol. 3, p. 80, accessed July 2019, https://www.ifac.org/publications-resources/2018-
handbook-international-quality-control-auditing-review-other-assurance
Many standard-setting organisations have created frameworks to guide preparers and assurers of reports,
which may form suitable criteria for an assurance engagement. For example, there are frameworks for
financial reporting, sustainability reporting, internal control system design and water accounting. However,
for some data, especially qualitative data, suitable criteria may be difficult to identify. It may also be
difficult for all three parties to agree on criteria, and this becomes even more difficult where the range and
identity of potential users is unclear.
Table 1.8 lists some types of engagement with examples of suitable criteria.
Financial statement audit International financial reporting standards; international public sector accounting
standards
Assurance report on Internal Control — Integrated Framework (COSO 2013); this document is an
internal control accepted standard for the design of an internal control system
Risk management Enterprise Risk Management — Integrated Framework (COSO 2004); this
document is an accepted standard for the design of a risk management system
Evidence
The practitioner has to gather evidence that is both sufficient and appropriate to form an opinion about the
subject matter’s compliance with the relevant criteria. ‘Sufficiency’ refers to the quantity of evidence and
‘appropriateness’ to its quality. High-quality evidence is both relevant and reliable. In situations of high
risk, the practitioner is expected to gather a greater amount of evidence and to seek out evidence that is
highly relevant and reliable.
For example, in an examination of a year-end cash balance, statements obtained directly from the
bank are considered more reliable than bank statements provided by management (which may have been
altered). Similarly, a bank statement covering the year-end is more relevant than one for a previous month.
Sufficient appropriate evidence for subject matter information can sometimes be difficult to obtain. For
example, information can be proprietary and hence may not be shared by third parties with the practitioner.
Sometimes, lack of market data makes it difficult to corroborate information. Internal controls over the
preparation of non-financial information are generally not as strong as those for financial information
preparation.
According to the Framework, an assurance practitioner has to exercise professional scepticism in
obtaining sufficient appropriate evidence before reaching conclusions on the assurance engagement against
the criteria. In addition, the practitioner needs to exercise professional judgment ‘in considering materiality,
Pdf_Folio:32
In its 2019 ASIC inspection report, ASIC notes that, ‘auditors should deliver professional, high quality
audits through a strong internal culture focused on quality audits and professional scepticism’ (ASIC 2019,
p. 17). ASIC emphasises that it is important for firms to focus on professional scepticism, along with the
sufficiency and appropriateness of audit evidence obtained and the appropriate use of the work of experts
and other auditors (ASIC 2019, p. 10).
Example 1.3 demonstrates the importance of professional scepticism in collecting and evaluating
evidence. Review this example now.
EXAMPLE 1.3
Toe Ltd
Toe Ltd is a long-term audit client. The auditor has the highest regard for management integrity and
honesty. Management has a long history of open communication with the auditor and willingness to accept
all audit adjustments.
In auditing the financial statements of Toe Ltd, the auditor has sent confirmation letters to debtors as
part of the tests of existence for trade debtors. Most responses are mailed back and many have small
changes noted on the invoices, which are all immaterial. However, three responses are handed to the
P df_Folio:33
Various bodies have provided descriptions and information to clarify and define what is meant by
professional scepticism and how it should be applied in practice. For example, the Center for Audit Quality
(CAQ) (2010) suggests that exercising professional scepticism includes:
• evaluating and challenging audit evidence
• remaining alert for information that suggests a material misstatement
• considering the risk that management may override internal controls.
Figure 1.6 describes six characteristics of scepticism as outlined by the CAQ (2010), Hurtt (2010) and
IAASB 2015.
• Resist persuasion
Questioning • Enquire, maintaining
• Challenge assumptions Self esteem
mind a sense of doubt
• Challenge conclusions
Autonomy • Withhold
• Decide for • Self-direction judgment until
• Moral Professional Suspension of
oneself appropriate
independence scepticism judgment
• Do not simply evidence is
accept the • Conviction obtained
claims of others
In 2015, the IAASB released an invitation to comment around enhancing audit quality in the public
interest with a focus on professional scepticism, quality control and group audits (IAASB 2015). It lists
seven key issues, with the first two focused on scepticism:
1. Fostering an appropriately independent and challenging skeptical mindset of the auditor — professional
skepticism is a fundamental concept and core to audit quality. Can we better articulate how we and
others expect auditors, especially engagement partners, to appropriately apply professional skepticism?
Can the concept be reinforced more within the ISAs, or through other activities by us or others?
2. Enhancing documentation of the auditor’s judgments — how might an audit file more appropriately
demonstrate the auditor’s decision-making processes, essential interactions and communications, in
order to support the auditor’s judgments and the audit opinion overall? How can the application of
professional skepticism be better evidenced? (IAASB 2015, p. 7).
df_Folio:34
P
With these changes in technology, the auditor is continually facing new challenges as well as being
provided with new tools. It is, therefore, necessary that auditors adjust how they apply professional
scepticism to the changing environment.
QUESTION 1.11
How does the use of digital information by companies and the ‘feeding into the information systems
for financial and broader corporate reporting’ (IAASB 2015, p. 9) affect an auditor’s professional
scepticism?
QUESTION 1.12
How could audit firms play an important role in cultivating a sceptical mindset in auditors?
Professional Judgment
Professional judgment involves the assurance practitioner applying their training, knowledge and
experience to make appropriate decisions and reach conclusions. The Framework (para. 56) explains
that ‘professional judgment is essential to the proper conduct of an assurance engagement’. Professional
judgment is needed to interpret ethical requirements and relevant Assurance Standards in order to make
informed decisions throughout the engagement.
Professional judgment is required to be exercised throughout an assurance engagement but must not
be used to justify decisions unless it is ‘supported by the facts and circumstances of the engagement or
sufficient appropriate evidence’ (the Framework, para. 60).
International auditing standards are replete with the term ‘judgment’. The need for the auditor to make
professional judgments is paramount. The audit manuals of large audit firms note that the single most
important element in applying firm procedures in an audit is the exercise of informed judgment. A report
by KPMG emphasises this point:
[Judgment] can be consequential to the continued viability of organizations, the livelihoods of the people
employed by them, and the investors who rely on them not to mention the effectiveness and efficiency of
our capital markets. Audit judgments both big and small matter (KPMG 2011, p. ii).
ASIC’s latest review of 98 audit files undertaken in 18 months to 30 June 2018 continues to reveal
instances when auditors did not obtain sufficient appropriate audit evidence, adequately question manage-
ment’s basis for valuation or challenge the work of experts, particularly in areas of impairment testing and
investments and financial instruments (ASIC 2019). ASIC further notes that audit firms should continue
to focus on ‘the audit of asset values … especially challenging the reasonableness of any forecasts, key
assumptions, and the basis of the valuation’ (ASIC 2019, p. 10). These shortcomings indicate the auditors’
professional judgment is inadequate.
Pdf_Folio:35
Audit reporting • Whether a modified audit report is appropriate, and if so, which one
• Whether an emphasis of matter paragraph is appropriate
• Qualified, disclaimer, adverse opinions
• What key audit matters (KAMs) to include in the audit report, if any
• Whether a going concern basis is appropriate
• The wording of other assurance reports
Both professional scepticism and professional judgment are essential to the proper conduct of
an assurance engagement. Explain how auditors use professional scepticism and professional
judgment in the context of an assurance engagement.
Materiality
As mentioned earlier, judgments pertaining to evidence collection and evaluation are made within the
context of materiality. In respect of accounting information, an omission, misstatement or non-disclosure
is material if it could adversely affect user’s decisions based on the financial statements. Materiality is
relevant when the practitioner:
• plans the engagement
• determines their procedures for gathering evidence
• assesses whether the subject matter information is free of misstatement.
Materiality judgments must take into account both quantitative (numerical and measurable) and
qualitative (other than numerical; subjective) factors. Materiality is discussed in more detail in
module 2.
Engagement Risk
The subject matter presented to the assurance practitioner may fail to meet the requirements of the
relevant criteria and, hence, may be materially misstated. Assurance engagement risk is the risk that the
practitioner reports that the subject matter information is fairly presented when, in fact, it is materially
misstated. In other words, it is the risk that the practitioner’s conclusion is wrong. When an audit is
undertaken, this is referred to as audit risk.
A key requirement of a quality assurance engagement is to keep the engagement risk at an acceptably
low level (some firms don’t use the ‘low’ category e.g. use numbers instead). Consequently, an assurance
provider assesses the engagement risk during the planning stage of the engagement by assessing three
components.
1. Inherent risk is defined as the susceptibility of the subject matter information to a material misstate-
ment and is therefore determined by the underlying subject matter. For example, in the case of a financial
statement audit of a business, inherent risk is determined by the riskiness of both the business and the
economic environment. Normally, it would be expected that higher inherent risk exists for small as
opposed to large businesses, and during periods of recession as opposed to periods of economic growth.
Many considerations affect the assessment of inherent risk.
2. Control risk is defined as the risk that a material misstatement will not be prevented, or detected
and corrected, by the internal control system. A well-designed and implemented control system
can reduce control risk, but some level of control risk always exists because of the limitations of
control systems. For example, an important control over cash is the bank reconciliation, so if a bank
reconciliation is not performed, control risk increases. That is, the risk that the bank account will be
misstated, and that the control system will fail to prevent the error, or fail to detect and correct the error,
is increased.
3. Detection risk is the risk that the assurance practitioner’s evidence-gathering procedures will not detect
a material misstatement. Detection risk is affected by the quantity, reliability and relevance of evidence.
For example, assume that to determine the existence of the inventory, an auditor counts ten items of
inventory. Detection risk would be reduced if the practitioner were to increase the sample size for testing
to 20 items.
Inherent risk and control risk are commonly combined and are referred to as the risks of material
misstatement. In the Glossary of Terms provided by IAASB, audit risk is described as ‘a function of the
risks of material misstatement and detection risk’.
The degree to which the practitioner considers each of the components of audit risk is affected by the
engagement circumstances and whether a reasonable assurance or a limited assurance engagement is being
performed.
Example 1.4 illustrates the use of professional judgment in planning the audit for Galaxy Ltd. Review
this example now.
Pdf_Folio:37
Galaxy Ltd
Galaxy Ltd (Galaxy) is a large, well-established computer-parts manufacturer that sells parts to computer
stores. Changing technology makes the industry very competitive, and Galaxy has made only small profits
for the last couple of years. Its bank loan depends on it continuing to earn a profit.
Because of the competitive pressures, Galaxy recently relocated the manufacture of some of its com-
puter parts from Perth, in Australia, and Hong Kong to southern China. This has reduced manufacturing
costs, but occasional quality problems have resulted in some lost orders.
Sales staff have previously been paid a fixed salary based on the number of years they have been with
the company. However, a new commission scheme is being introduced this year by which staff will be paid
a lower fixed salary but will receive a 4% commission if their individual sales targets are met or exceeded.
Galaxy plans to upgrade its general ledger reporting with a new software package. The conversion is
planned for just before year-end so that it will be ready for next year. The new computer system will provide
detailed information on sales, gross margins and inventory levels by product line.
............................................................................................................................................................................
What factors will affect the planning of the audit for Galaxy?
Check your response against the suggested answer at the end of the book.
QUESTION 1.14
Assurance Report
A practitioner provides a written assurance report containing a clearly expressed conclusion about the
subject matter information. The determination of the level of assurance that can be provided involves
df_Folio:38
P
QUESTION 1.15
Does an engagement to perform an audit of financial statements include the provision of assurance
on internal controls?
The key points covered in this part, and the learning objectives they align to, are below.
KEY POINTS
1.1 Apply the International Framework for Assurance Engagements (the Framework) and the
related standards and other guidance to assurance engagements.
• The Framework is not a standard. It provides a frame of reference for assurance practitioners and
others involved in assurance engagements.
• The Framework distinguishes direct engagements from attestation engagements and reasonable
assurance engagements from limited assurance engagements.
• The Framework sets out preconditions for an assurance practitioner to accept an assurance
engagement.
• The Framework identifies five elements that assurance engagements exhibit and how they vary in
different assurance engagements.
• The Framework discusses assurance practitioner’s responsibilities towards the use of professional
scepticism and the application of professional judgment in obtaining sufficient appropriate evidence
to support the assurance practitioner’s conclusion.
1.2 Apply the Code of Ethics for Professional Accountants to assurance engagements.
• The Code sets out fundamental principles of ethics for all professional accountants. These prin-
ciples establish the standard of behaviour expected of a professional accountant.
• The Code provides a conceptual framework that members are required to apply in order to identify,
evaluate and address threats to compliance with fundamental principles.
• The Code also sets independence standards for audits and other assurance engagements.
Limitations of an Audit
A financial statements audit is conducted to enhance the reliability and credibility of the information
included in a financial report. Yet it is not a guarantee that the financial report is free from error or fraud.
The limitations of an audit stem from the nature of financial reporting, the nature of audit procedures
and the need for the audit to be conducted within a reasonable period of time and at a reasonable cost
(ISA 200).
The nature of financial reporting refers to the use of judgment when preparing financial reports due to
the subjectivity required when arriving at accounting estimates. Judgment is also required when selecting
and applying accounting methods.
The nature of audit procedures refers to the reliance on evidence provided by the client and its
management. If an auditor does not have access to all the information relevant to the audit, there is a
limitation in the scope of their audit. If the auditor is unaware of this situation, they may arrive at an
inappropriate conclusion based on incomplete facts. Evidence may be withheld or modified by perpetrators
of fraud. It can be difficult for an auditor to determine whether a fraud has occurred and documents altered
as those committing a fraud generally hide evidence. Sampling is used when testing transactions and
Pdf_Folio:40
REVIEW ENGAGEMENTS
An assurance practitioner may be engaged to perform a review of a financial report rather than an audit,
and this review may be conducted by a practitioner who has no other dealings with the company or may
be conducted by the company’s independent auditor. Specific requirements exist for reviews of financial
statements which are distinct from those requirements that relate to the reviews of other historical financial
information.
A review of interim financial statements enables the auditor to express a conclusion whether, on the
basis of the review, anything has come to light to cause the auditor to believe that the interim financial
report is not prepared in accordance with an applicable financial reporting framework. A review differs
significantly from an audit in that it does not provide a basis for an opinion to be formed regarding whether
the financial report gives a true and fair view, or is presented fairly, in all material aspects, in accordance
with the applicable financial reporting framework. A review is not designed to obtain reasonable assurance
that the interim financial report is free from material misstatement.
Reviews of historical financial information that are other than a complete financial report include reviews
of specific components, elements, accounts or items of a financial report, other information or schedules
that can be derived from financial records, or financial statements that are prepared in accordance with a
financial reporting framework that is not designed to achieve fair presentation, such as condensed financial
statements and an entity’s internal management accounts.
QUESTION 1.16
You have been approached by a prospective client, who is unsure about the applicability of the
financial reporting requirements. They are unclear about the difference between an audit and a
review. Prepare notes for a meeting to help the prospective client understand the differences
between an audit and a review, including differences in the level of assurance, form of the opinion
and types of procedures that could be performed.
Internal Audits
Internal audits are conducted to provide assurance about various aspects of an organisation’s activities.
The internal audit function is typically conducted by employees of the organisation being audited but can
be outsourced to an external audit firm. As such, the function of internal audit is determined by those
Pdf_Folio:42
Continuous Auditing
The electronic revolution has created a demand for more timely assurance on a broader range of
information than that provided by the annual audit of historical financial statements. Companies now
release information via their websites to interested parties over a short time frame, and continuous auditing
allows auditors’ reports on that information to be provided almost immediately. A continuous audit is a
process or method that enables independent auditors to provide written assurance on subject matter using
a series of auditors’ reports issued simultaneously with, or a short time after, the occurrence of events
underlying the subject matter. It is conducted on continuous financial and non-financial information made
available to users in formats defined by management.
Auditors could be asked to continuously audit and report on:
• financial statements available on demand via a website
• specific financial information in conjunction with a debt covenant agreement
• compliance with published policies and practices regarding e-commerce transactions (e.g. reliance on
secure encrypted systems for credit card processing)
• the effectiveness of controls operating in key systems or processes.
A continuous audit presents a number of auditing issues. There is little time for the auditor to gather audit
evidence for verifying and substantiating the subject matter concerned. The auditor cannot rely on normal
audit procedures, such as obtaining independent confirmations and checking material misstatements, so
a reliable and well-controlled application system is vital. The auditor must use fully automated audit
software such as IDEA or ACL to read, manipulate and generate the information required. Other conditions
necessary for ensuring a successful continuous audit are:
• effective communication and technology between the client and the auditor
• agreement as to the form, content and scope of the audit
• a sound knowledge by the auditor of the systems used by the client.
Continuous auditing is more relevant in an online environment where strategies and business processes
are used to provide value-added performance information to interested parties.
Compliance Engagements
Organisations may have obligations to follow requirements imposed by law or regulation, by contract
or internally imposed through accounting policies and procedures. Compliance engagements provide
assurance that regulations, contractual obligations or other requirements have been complied with. An
example of this is reporting on whether an entity has complied with certain aspects of a bank loan agreement
relating to interest payments and maintenance of predetermined financial ratios.
The level of work that the auditor needs to carry out will be dependent upon whether the engagement
is a reasonable assurance engagement or limited assurance engagement, and specific procedures need
to be designed accordingly. Given the variety of possible engagements that could arise, it is important
that the auditor ensures that the overall aspects of compliance relate to matters within their scope of
professional competence. One of the most significant issues in these engagements is ensuring the suitability
Pdf_Folio:43
PERFORMANCE OF AN ACTIVITY
Performance engagements are concerned with the economy, efficiency and effectiveness of an organ-
isation’s activities (ASAE 3500 Performance Engagements, para. 7). Economy refers to the cost of
inputs, including wages and materials. Efficiency refers to the relationship between inputs and outputs.
Specifically, efficiency refers to the use of the minimum amount of inputs to achieve a given output.
Finally, effectiveness refers to the achievement of certain goals or the production of a certain level of
outputs. From an organisation’s perspective it is important to perform well across all three dimensions and
not allow one to dominate. For example, if buying cheap inputs results in an inefficient production process,
efficiency may be seen to be sacrificed to achieve economic goals.
QUESTION 1.17
The key points covered in this part, and the learning objectives they align to, are below.
KEY POINTS
1.1 Apply the International Framework for Assurance Engagements (the Framework) and the
related standards and other guidance to assurance engagements.
• Standards on Assurance Engagements establish requirements and provide application and other
explanatory material for a range of assurance engagements other than audit or review of financial
information.
• ASAEs on a specific subject matter are read and applied in conjunction with ASAE 3000.
• According to ISA 200 Overall Objectives of the Independent Auditor and the Conduct of an Audit in
Accordance with International Standards on Auditing, the objective of a financial statements audit
is for the auditor ‘to express an opinion about whether the financial report is prepared in all material
respects in accordance with a financial reporting framework’.
• ISAE 3000 (Revised) Assurance Engagements Other than Audits or Reviews of Historical Financial
Information is an umbrella standard for ‘other’ assurance engagements.
df_Folio:44
P
APPLICATION OF ISAs
The ISAs are developed by the International Auditing and Assurance Standards Board (IAASB). The
following points are noteworthy.
• The ISAs are written in the context of an audit of historical financial statements.
• The ISAs apply to all members of the accounting profession and are applicable to both the private and
public sectors.
• The ISAs apply to audits of all sizes and complexity. The argument is that it is in the public interest
that users of audited financial statements have confidence that the audits have been performed at a high
standard. This applies regardless of whether the entities are large or small, complex or simple (IAASB
2009).
Figure 1.7 provides an overview of the categories of auditing standards, as well as the ISA number
sequence used for each category, and shows the number of standards in each category. As can be seen
from figure 1.7, the standards provide a guide that takes the auditor through the whole audit process. Not
surprisingly, many standards are in the category of ‘audit evidence’ because obtaining evidence to support
an opinion is crucial to the auditor’s work. The standards are designed to be applicable to the whole audit
process. Specific standards are not written for particular classes of transactions or balances.
These ISAs cover the following.
• Audits of annual general purpose financial statements (covered by ISA series 200 to 700)
– covered in modules 2–4
• Other audits of historical financial information (covered by ISA series 800) and discussed in module 5
includes:
– financial statements prepared in accordance with special purpose frameworks
– single financial statements and specific elements, accounts or items of a financial statement
– summary financial information.
The authority of ISAs is set out in ISA 200. ISA 200:
• creates an obligation for auditors to comply with ethical requirements and the ISAs
• sets out the overall objectives of the independent auditor
• explains the nature and scope of an audit that will enable the independent auditor to meet these objectives
• explains the scope, authority and structure of relevant ISAs that shall assist an independent auditor in
planning and performing the audit (ISA 200, paras 1 and 21).
Pdf_Folio:45
• Audit evidence
ISA 500 series
(covered by 11 standards)
• Specialised areas
ISA 800 series
(covered by 3 standards)
Digital content, such as videos and interactive activities in the e-text, support this module. You can
access this content on My Online Learning.
SME Perspective
Applying ISAs Proportionately with the Size and Complexity of an Entity (IAASB 2009) provides questions
and answers relating to the audits of small and medium-sized entities (SMEs). So while the requirements
of all relevant ISAs apply to SMEs and the auditor’s objectives are the same regardless of size or
complexity, some important issues are raised in IAASB (2009) as to the conduct of an audit of an
SME compared to a larger entity. Not all audits are planned and performed in the same way. Specific
audit procedures to comply with ISAs may vary considerably depending on the size and complexity of
the entity.
The work effort for the audit of an SME may differ from that in a larger audit because it will generally
involve much simpler transactions and, therefore, be more straightforward. For example, the requirement
to understand the entity and its environment (ISA 315 (Revised) Identifying and Assessing the Risks of
Material Misstatement through Understanding the Entity and Its Environment) will be much easier to
carry out for an SME. Similarly, internal controls in an SME are usually simpler; while the auditor is still
required to obtain an understanding of internal control, the auditor can usually obtain and document that
understanding more quickly.
Pdf_Folio:46
1. Standard audit programs or checklists … drawn up on the assumption of few relevant control activities
… may be used provided that they are tailored to the circumstances of the engagement, including the
auditor’s risk assessments (ISA 300 Planning an Audit of Financial Statements, para. A21).
2. Some smaller entities may not have interim or monthly financial information that can be used for
purposes of analytical procedures. In these circumstances … the auditor may need to plan to perform
analytical procedures to identify and assess the risks of material misstatement when an early draft of the
entity’s financial statements is available (ISA 315 (Revised), para. A17).
3. Audit evidence for elements of the control environment in smaller entities may not be available
in documentary form … Consequently, the attitudes, awareness, and actions of management or the
owner-manager are of particular importance to the auditor’s understanding of a smaller entity’s control
environment (ISA 315 (Revised), paras A86–A87).
While an auditor of an SME must comply with all relevant ISAs (ISA 200, paras 18–20), a number of
ISAs are likely to be less relevant to an SME. Examples include:
• ISA 300 Planning an Audit of Financial Statements — if a one-person audit team is used, the
requirements related to the direction, supervision and review of team members is not relevant
• ISA 402 Audit Considerations Relating to an Entity Using a Service Organization — if the SME does
not use a service organisation
• ISA 510 Initial Audit Engagements — Opening Balances — if the SME audit is a continuing engagement
and not an initial engagement
• ISA 600 Special Considerations — Audits of Group Financial Statements (Including the Work of
Component Auditors) — if the SME audit engagement is not a group audit
• ISA 610 (Revised) Using the Work of Internal Auditors — if the SME has no internal audit function
• ISA 800 (Revised) Special Considerations — Audits of Financial Statements Prepared in Accordance
with Special Purpose Frameworks, ISA 805 (Revised) Special Considerations — Audits of Single
Financial Statements and Specific Elements, Accounts or Items of a Financial Statement and ISA 810
(Revised) Engagements to Report on Summary Financial Statements — if the SME audit engagement
is to report on general purpose financial statements.
Even when an ISA is relevant to an SME, not all requirements of every ISA will be relevant when
performing an audit of an SME (ISA 300, para. A17). Similarly, the form, content and extent of
documentation can vary with the size and complexity of the entity (ISA 230 Audit Documentation,
para. A2). Also, documentation for an SME is generally less extensive than for a large entity (ISA 230,
para. A16), and it may be helpful and efficient to record various aspects of the audit in a single document.
Audit Requirements
The audit requirements of small businesses and incorporated associations can vary considerably. In
Australia, unincorporated businesses and sole traders are not subject to the audit requirements of the
relevant regulations such as the Corporations Act (Cwlth). Many small businesses, however, choose to
adopt the small proprietary company as a business form in order to obtain the benefits of limited liability.
Under the Corporations Act, Australian small businesses may choose between including key financial data
in their annual returns to ASIC or having the company’s accounts audited, in which case this information
is not required to be submitted. Often, small businesses choose to have their accounts audited in order to
maintain the privacy of their financial affairs and to deny competitors access to confidential trade-related
financial information.
Associations, clubs, community groups and charities have long been, and remain, an important part of
society. Such an association does not have to be incorporated, but incorporation means that it becomes
a legal entity in its own right, separate from the individual members. It is therefore considered at law to
have a distinct identity that continues regardless of changes to the membership. In Australia, there are
a number of ways associations can incorporate — under the Corporations Act, associations, charitable
or not-for-profit organisations will generally be registered as companies that are limited by guarantee.
In each of the Australian states and territories, there are various Association Incorporation Acts, which
contain differential accounting and audit requirements. CPA Australia has summarised these various
requirements in its guide Companies limited by Guarantee and Incorporated Associations: Reporting and
Auditing/Review Obligations.
Pdf_Folio:47
Tier 3 Revenue of $1m or more Audit must be completed by a registered company auditor
Tier 2 Revenue of $250 000 to less than $1m Can elect to have their financial report either reviewed
or audited
Future Developments
The scalability and proportionality of the ISAs has been one of the key environmental drivers that shaped
the IAASB’s Proposed Strategy for 2020–2023 and Work Plan for 2020–2021. To gather information on its
strategic theme ‘Develop ways to address complexity, while maintaining scalability and proportionality’,
IAASB published a Discussion Paper, Audit of Less Complex Entities — Exploring possible options to
address the challenges in applying the ISAs in April 2019 for public consultation. Feedback from the
Discussion paper will assist IAASB to further understand the challenges of using ISAs in audit and less
complex entities and views about possible actions to address these challenges.
Although the discussion about the challenges of applying the ISAs has historically been around the
difficulties experienced in audits of smaller entities as outlined in the Chairman’s Foreword, we are of the
view that it is appropriate to focus on the complexity of the entity rather than its size. This is because in
today’s environment, it is not only about size — there may be entities that are smaller but may be considered
complex, and there may be other entities that would not be considered smaller, but would be considered
less complex (Discussion Paper, p. 4).
Further information on the project ‘Audits of less complex entities’ and the Discussion paper can be
found at https://www.iaasb.org/projects/audits-less-complex-entities.
As a stakeholder, IFAC recently launched an Audits of Less Complex Entities Survey to obtain a
deeper understanding of the specific challenges in applying ISAs in audits of less complex entities
and capture views on the possible options to address these challenges to help inform the IAASB
deliberations. In addition, IFAC provides practical support to small- and medium-sized practices in relation
to implementation of ISAs while auditing SMEs through its publication, ‘Guide to Using International
Standards on Auditing in the Audits of Small- and Medium-Sized Entities’.
You may refer to the fourth edition (released in 2018) of the Guide at https://www.ifac.org/publications-
resources/guide-using-international-standards-auditing-audits-small-and-medium-sized-18.
Differential Reporting
The International Accounting Standards Board (IASB) in 2009 issued an International Financial Reporting
Standard (IFRS) for SMEs. The IFRS for SMEs is a self-contained accounting standard tailored to suit the
needs and capabilities of smaller businesses. Many of the principles in full IFRSs for recognising and
measuring assets, liabilities, income and expenses have been simplified, topics not relevant to SMEs have
been omitted, and the number of required disclosures has been significantly reduced. To reduce further the
reporting burden for SMEs, revisions to the IFRS will be limited to once every three years.
In Australia, the Australian Accounting Standards Board (AASB) introduced a differential reporting
framework for the types of organisations that need to issue general purpose financial statements (GPFSs).
The reduced disclosure requirements were introduced as a second tier of reporting requirements for
preparing general purpose financial statements. The aim is to reduce reporting needs of entities that
previously were required to apply full IFRSs but found the disclosures under full IFRSs burdensome.
Pdf_Folio:48
Performance audits
Performance audits provide information to the New South Wales Parliament and public about how well
government programs and services are delivered. Ultimately, they aim to improve public administration.
Performance audits examine whether programs and services are delivered efficiently, effectively, econom-
ically and in accordance with the law.
Special reports
Special audits are sometimes conducted to confirm that specific legislation, directions and regulations have
been adhered to.
Source: Audit Office of New South Wales, ‘Our work’, accessed July 2019, https://www.audit.nsw.gov.au/our-work
© Audit Office of New South Wales 2019.
Hong Kong
In Hong Kong, the equivalent of the ANAO is the Audit Commission. The Audit Commission was
established on 1 July 1997 pursuant to the ‘Basic Law of the Hong Kong Special Administrative Region
of the People’s Republic of China’ (Audit Commission 2019a).
The head of the Audit Commission is the Director of Audit. The duties and powers of the Director of
Audit are set out in the ‘Audit Ordinance’ (Cap. 122) (Audit Commission 2019b). The Director of Audit:
1. is the external auditor of the accounts of the Government of Hong Kong Special Administrative Region;
has wide powers of access to the records of departments;
2. can require any public officer to give an explanation and to furnish such information as he thinks fit to
enable him to discharge his duties; and
3. is not subject to the direction or control of any other person or authority in performing his duties and
when exercising his powers under the Ordinance (Audit Commission 2019b).
Example 1.5 deals with public sector audits. Complete the example now.
EXAMPLE 1.5
df_Folio:50
P
APPLICATION OF ISAEs
The overarching standard to be applied to all assurance engagements other than audits or reviews of
historical financial information is ISAE 3000 (Revised) Assurance Engagements Other than Audits or
Reviews of Historical Financial Information. In addition, there are four international subject specific
standards for these assurance engagements. They are:
1. ISAE 3400 The Examination of Prospective Financial Information
2. ISAE 3402 Assurance Reports on Controls at a Service Organisation
3. ISAE 3410 Assurance Engagements on Greenhouse Gas Statements
4. ISAE 3420 Assurance Engagements to Report on the Compilation of Pro Forma Financial Information
Included in a Prospectus.
The subject matters which can be assured under these types of engagements range widely. Some are
required by regulation and others are reported on a voluntary basis. There are five core types of other
assurance engagements that can be conducted either as reasonable or limited assurance engagements. The
five types of engagements and their specific international standards in addition to ISAE 3000 are as follows.
1. Historical non-financial reports — ISAE 3410.
– Includes: Performance engagements on use of resources or value for money (e.g. greenhouse gas
statements; sustainability reports; KPIs; statement on effective use of resources; statement on value
for money; corporate social responsibility reporting and integrated reports).
2. Future-oriented information — ISAE 3400 and 3420.
– Includes: Performance engagements (e.g. forecast/projected cash flow); Position engagements (e.g.
forecast/projected financial position); Performance engagements on use of resources or value for
money (e.g. expected emissions reductions attributable to a new technology, greenhouse gases to be
captured by planting trees, or statement that a proposed action will provide value for money).
3. Systems and processes — ISAE 3402.
– Includes: Description engagements (e.g. the description of a system of internal control); Design
engagements (e.g. the design of controls at a service organisation or the design of proposed controls
for a forthcoming production process); Operation/Performance engagements (e.g. the operating
effectiveness of procedures for hiring and training staff).
4. Aspects of behaviour.
– Includes: Compliance engagements; Human behaviour (e.g. evaluation of audit committee effective-
ness) and Other (e.g. fitness for purpose of a software package).
Pdf_Folio:51
APPLICATION OF ISRSs
ISRSs apply to non-assurance engagements involving related services such as the following.
• Agreed-upon procedures — ISRS 4400 Engagements to Perform Agreed-Upon Procedures Regarding
Financial Information
– engagements where the auditor is engaged to issue a report of findings based on procedures agreed
upon with specified parties
– these procedures are potentially broad ranging and can be in any area where the client and user
perceive it to be beneficial to have a report on a matter using audit-related skills.
• Compilation engagements — ISRS 4410 (Revised) Compilation Engagements
– involve the use of accounting expertise, as opposed to auditing expertise, to collect, classify and/or
summarise financial information
– usually entails preparing financial statements from transaction and other information, without the
requirement to test the accuracy of that information
– commonly used for SMEs in circumstances where there is no requirement for the entity to have an
assurance report provided on their financial statements.
These non-assurance engagements will be discussed further in module 5.
AUSTRALIAN PERSPECTIVE
In Australia, Auditing standards ASA 100 Preamble to AUASB Standards, ASA 101 Preamble to
Australian Auditing Standards and ASA 102 Compliance with Ethical Requirements when Performing
Audits, Reviews and Other Assurance Engagements require assurance practitioners to comply with all
AUASB standards, Auditing standards and Ethical requirements respectively. ASA 101 is an Australia-
only standard that outlines how the AUASB intends the Australian standards to be understood, interpreted
and applied. An important aspect of this standard is the distinction made between ‘auditing standards’ and
‘auditing and assurance standards for other purposes’, which is significant for enforcement purposes.
In Australia, the AUASB drafts Australian Auditing Standards (ASAs) equivalent to ISAs (see
ASA 101). The following points are noteworthy.
• Only Australian auditing standards have the ‘force of law’ — that is, they are legally enforceable.
• The ASAs are written in the context of an audit of a ‘financial report’.
• Where the ASAs diverge from the ISAs, these are identified by a paragraph reference ‘Aus x.x’ in the
Australian standards.
The ASAs also include some standards that do not exist at the international level, for example:
– ASRE 2415 Review of a Financial Report: Company Limited by Guarantee or an Entity Reporting
under the ACNC Act or Other Applicable Legislation or Regulation (discussed below)
– ASAE 3100 Compliance Engagements
– ASAE 3150 Assurance Engagements on Controls
– ASAE 3450 Assurance Engagements involving Corporate Fundraisings and/or Prospective Finan-
cial Information
– ASAE 3500 Performance Engagements
– ASAE 3610/AWAS 2 Assurance Engagements on General Purpose Water Accounting Reports
– APES 310 Client Monies
– ASRS 4450 Comfort Letter Engagements.
These standards will be discussed further in module 5.
In Australia, changes to the Corporations Act led to the issue of ASRE 2415 which applies to:
• companies limited by guarantee
• an entity reporting under the Australian Charities and Not-for-Profit Commission Act 2012
(Cwlth) (ACNC Act)
• entities required to report under other applicable legislation or regulation.
Under the changes in legislation, there is a three-tiered differential reporting framework for such entities
(mainly not-for-profit entities). Entities in the first tier are exempt from preparing a financial report and are,
therefore, not required to have the annual report audited. Entities in the second tier (with annual revenue
between $250 000 and $1 million or with revenue below $250 000 and that are a deductible gift recipient)
Pdf_Folio:52
QUESTION 1.18
Providers of corporate sustainability assurance reports often state that the work was performed
in accordance with ISAE 3000 (Revised). Obtain a copy of each of these documents. Explain why
ISAE 3000 would be useful in CSR assurance.
The key points covered in this part, and the learning objectives they align to, are below.
KEY POINTS
1.1 Apply the International Framework for Assurance Engagements (the Framework) and the
related standards and other guidance to assurance engagements.
• Different standards are applicable to different types of assurance engagements.
• ISAs are applicable to all audit engagements. However, for smaller entities and less complex
entities, applicability of ISAs is different.
• The role and objectives of auditors are different for private sector and public sector audits.
• The overarching standard to be applied to all assurance engagements other than audits or reviews
of historical financial information is ISAE 3000 (Revised) Assurance Engagements Other than Audits
or Reviews of Historical Financial Information.
• International Standards on Auditing (ISAs) are to be applied in the audit of historical financial
information.
• International Standards on Review Engagements (ISREs) are to be applied in the review of historical
financial information.
• International Standards on Assurance Engagements (ISAEs) are to be applied in assurance
engagements other than audits or reviews of historical financial information.
• International Standards on Related Services (ISRSs) are to be applied to compilation engagements,
agreed upon procedures and other related service engagements.
• ISRE 2410 covers reviews of interim and other financial information performed by the independent
auditor of the entity, e.g. reviewing quarterly or half-yearly interim financial statements.
• ISRE 2400 (Revised) covers engagements to review financial statements performed by an assur-
ance practitioner who is not the auditor of the entity.
• ISAE 3410 Assurance Engagements on Greenhouse Gas Statements is specific to the assurance
of greenhouse gas statements.
• ISAE 3400 The Examination of Prospective Financial Information provides guidance on performing
assurance engagements related to prospective financial information.
• ISAE 3420 Assurance Engagements to Report on the Compilation of Pro Forma Financial Infor-
mation Included in a Prospectus provides guidance on performing assurance engagements on
future-oriented information related to pro forma financial information included in a prospectus.
• ISAE 3402 Assurance Reports on Controls at a Service Organization covers assurance engage-
ments on controls.
• ASAE 3500 Performance Engagements covers assurance engagements related to the performance
of an activity.
• ISRS 4400 Engagements to Perform Agreed-Upon Procedures Regarding Financial Information
covers engagements where the auditor is engaged to issue a report of findings based on procedures
agreed upon with specified parties.
• ISRS 4410 (Revised) Compilation Engagements provides guidance on compilation engagements
involving the use of accounting expertise, as opposed to auditing expertise, to collect, classify
and/or summarise financial information.
CLIMATE-RISK DISCLOSURE
Many entities in the Australian market, across a range of different industries, face risks due to climate
change. The Task Force on Climate-related Financial Disclosures (TCFD), established in 2016 by the
G20 Financial Stability Board, has made recommendations on the type of information that entities should
disclose to provide stakeholders with a better understanding of the entity’s climate-related risk exposure.
In doing so, the TCFD identified two main categories of climate-related risks.
1. Transition risks — transitioning to a lower-carbon economy may entail extensive policy, legal,
technology and market changes to address mitigation and adaption requirements related to climate
change.
2. Physical risks — physical risks resulting from climate change can be acute or chronic. Acute physical
risks refer to those that are event-driven, including increased severity of extreme weather events, such as
cyclones or floods. Chronic physical risks refer to longer-term shifts in climate patterns (e.g. sustained
higher temperatures) that may cause sea level rises or chronic heat waves (ASIC 2018, p. 5).
The TCFD released its final report in June 2017, setting out a framework for voluntary, consistent
climate-related financial disclosures. Also in 2017, the Senate Economics References Committee released
a report acknowledging that climate change presented material risks to Australian businesses. In their
report, they set out a number of recommendations around climate change, highlighting the importance of
adequate climate-risk disclosure.
To date, the majority of climate change and climate-risk-related disclosure has been provided outside
of statutory disclosure on a voluntary basis. Examples of voluntary disclosures include:
• disclosure under the TCFD recommendations
• the Carbon Disclosure Project (CDP)
• environmental, social and governance (ESG) sustainability policies.
Pdf_Folio:54
TECHNOLOGICAL INNOVATIONS
We live in a fast-moving global economy. There is much more complexity in the ways that businesses
operate, and big data now provides huge amounts of information that conventional auditors with a historical
snapshot approach may miss.
Developments in artificial intelligence (AI) have provided the opportunity to increasingly embed
technology into the audit approach. For example, EY are developing a process of automation that provides
the information needed to conduct the audit. This dramatically reduces the time clients spend supporting
an audit, as well as the administrative time staff spend gathering the information. Instead, the auditors
begin the process at the point they need to start applying judgment, thereby enhancing audit quality.
What this example indicates is that the auditing profession is definitely ripe for disruption. The
profession has no choice but to adapt, and to do so quickly if it is to remain relevant and survive.
Entities are increasingly using disruptive technologies and big data to improve business practices. These
technological innovations have the potential to fundamentally transform the financial reporting process
and the way financial statements are audited. These innovations are illustrated in figure 1.8 as an audit
innovation continuum. The fundamental characteristics of this continuum are continuous auditing, full
population testing and audit by exception (Rozario 2019).
As the use of technology-based data analytics becomes more prominent in financial statement audits,
it is not difficult to imagine the potential use of more advanced innovation techniques in the conduct of
audits. On one side of the continuum is basic innovation, which is the use of existing technologies and
non-traditional sources of information. Data analytic tools such as CaseWare IDEA are used to perform
audit procedures (discussed further in module 2).
In the central section of the continuum, new technologies, such as robotic process automation (RPA)
and drones are used to modify the audit (discussed further later in this section). These tools are ideally
suited to rules-based tasks and can achieve near end-to-end process automation.
On the opposite side of the continuum is advanced innovation, which includes the use of new
technologies to redesign the audit. These technologies include blockchain and artificial intelligence, which
are also discussed later in this section. These innovative technologies have the potential to substantially
transform the audit process by executing unstructured, rules-based tasks, and storing audit information on
a secure and distributed ledger.
These innovations have the potential to change the nature, timing and extent of audit procedures which
is expected to improve audit quality.
Pdf_Folio:55
C
on ll e ex
tin po stin ce
Fu
uo pu g pt
Au
us la
di
au tion
t
tb
di
y
tin
g
io
n
In this section, we discuss how these innovative technologies are disrupting the business environment
and impacting on the preparation and audit of financial statements.
Automation
Robotic process automation is a relatively simple and cheap approach to automating routine business
processes. More ambitious automation projects, projects that involve re-engineering how processes work,
or enterprise-wide automation projects may instead be built on artificial intelligence platforms and will
often use application program interface (API) based automation to integrate with other systems.
In accounting, software such as Xero, QuickBooks and Sage have APIs that allow third parties to connect
their own applications to those accounting platforms. For example, an entity’s application for storing
scanned documents can connect with QuickBooks via an API to provide the data from the documents
to the records in QuickBooks. This avoids needing to export (or manually retype) data from the scanned
documents and then uploading it to the accounting software.
Examples of APIs in business are integrations with banking software, credit control applications,
automated bookkeeping systems and online payments.
Auditing is a mix of mechanical, rules-based tasks and professional judgment. Vasarhelyi and Rozario
(2018) have provided an example of how the rules-based tasks could be implemented using robotic process
automation (figure 1.9). They point out that by automating these types of tasks, auditors can spend more
time using their professional judgment to analyse the difference and anomaly reports generated by the RPA
software, resulting in an overall improvement in audit quality.
An RPA revenue audit could remotely log into a client’s systems to retrieve relevant data, such as current
and prior year sales and the trial balance, total the sales and compare against the trial balance, then compare
whether the total revenue amounts are materially different. If the difference exceeds a predetermined
threshold, the system will generate an alert so the auditors can investigate further. Similar RPA can access
and compare orders, shipping documents and invoices (Vasarhelyi & Rozario 2018).
An implementation of RPA involves understanding and defining each process, standardising data records
so the system can compare data from different sources, and finally implementing RPA to run the processes
on the data and generate alerts and on-demand reports (Vasarhelyi & Rozario 2018).
Pdf_Folio:56
implementation
Analyse, document,
program and test tasks
RPA
Testing
and processes for RPA
(once only)
Investigate issues
Investigate issues
P df_Folio:57
Investigate issues
EXAMPLE 1.6
EXAMPLE 1.7
Big Data
One of the weaknesses of traditional auditing is the reliance on investigating only a sample of documenta-
tion and transactions. It is quite possible for an audit — although performed professionally and diligently —
to fail to detect errors and fraudulent transactions amidst the mass of data available.
Big data refers to structured or unstructured data sets that are commonly described according to the
four Vs.
• Volume — data sets are too large for traditional tools to analyse.
• Variety — different data formats such as quantitative, images, video, text-based etc.
• Velocity — frequency at which new data become rapidly available.
• Veracity — quality and relevance of the data changes dramatically over time (Gepp et al. 2018).
The auditing profession has access to a large and growing volume of data available in real time, much
of which is automatically generated and captured by online processes and transactions.
Big data encompasses the techniques and technology used to draw inferences from the data. Often these
techniques seek to infer relationships and causal effects from sparse data. Computer scientists approach big
data as a method of uncovering patterns using algorithms to analyse all the data whereas statisticians treat
data as observations of an underlying process and extract information using sampling to make inferences
about the underlying process (Gepp et al. 2018). Insights into patterns and relationships will not only allow
auditors to provide a bird eye view of the financials but also a thorough view of the accounting records.
Focus on detecting fraudulent activities will also increase as auditors can now identify every transaction
that deviates from the expected norm. However, research by Gepp et al. (2018) found that the use of big
data techniques in auditing lagged behind its use in financial distress modelling, financial fraud modelling
and stock market prediction. Some leading auditing firms have started adopting big data techniques in
practice, but others are reluctant to adopt technologies that are yet to be adopted by their audit clients.
Challenges in adopting the technical advancements persist. More flexible models are used in big data
as traditional structured regression models are unlikely to fit big data well. Algorithms used to analyse big
data enable patterns to be identified that would not be possible using traditional statistical methods. Big
data offers limited value unless it is processed and analysed so that meaningful conclusions can be drawn.
Data analytics is the process of analysing data.
Data Analytics
Given the evolving environment, the Big Four firms in particular are investing in technology, especially
data analytics, as a means of making the audit more effective and efficient. In a major study, The future of
assurance: how technology is transforming the audit, the professional services firm Ernst & Young (EY)
has made a number of predictions. The report highlights the following points.
• Technical advances in high-performance computing mean that audit teams can gain access to more client
data than was ever before available to support the audit process.
• Advanced analytics and visualisation tools can enable auditors to concentrate their resources on high
risk areas where more judgment is required.
Pdf_Folio:59
Overall, big data and analytics is providing opportunities to rethink how an audit is performed. In some
ways, the audit does not change. The auditor must still audit the same assertions, must still understand the
business and industry, and must still understand an entity’s system of internal control. However, technology
allows the auditor to rethink how risks are assessed and how audit tests are performed. However, simply
utilising a small team of data analysts is not recommended when attempting to utilise data analytics on
a large scale and in new ways. Individuals with data analytics skills need to be fully integrated with the
rest of the audit team so new opportunities for risk analysis and substantive testing can be identified and
utilised. An understanding of what data analytics techniques can offer audit firms is essential for every
member of the audit firm that influences the audit.
Blockchain
Blockchain is a type of distributed ledger technology that some say has the potential to disrupt and
transform entire industries. Blockchain technology uses the concept of peer consensus on a computer
network to create an immutable, decentralised public ledger without the need for a central trusted authority.
The blockchain functions as an open ledger that can record transactions in a way that is efficient, veri-
fiable and permanent. This sharply differentiates blockchain technology from other database technologies
and from the separate private ledgers maintained within business entities.
Implementing blockchain provides entities with the opportunity to write their transactions directly
into a joint register. This could replace separate records based on transaction receipts and would create
an interlocking system of enduring accounting records. Since all entries in a blockchain are distributed
and cryptographically sealed, falsifying or destroying them is practically impossible. It is similar to the
transaction being verified by a notary — only in an electronic and automatic way (figure 1.10 ) (Andersen
2016).
Standardisation would allow auditors to verify a large portion — or even all — of the most important data
behind the financial statements automatically and at any point in time, or even continuously, rather than
periodically as currently occurs. The cost and time necessary to conduct an audit — including the need to
involve a company’s accountants for long periods — would decline considerably. Machine learning could
also be used to interrogate transactions in real time in order to alert auditors to anomalies or other incidents
requiring investigation (Haimes 2018).
At present, cryptocurrencies, such as Bitcoin, are the best known and most widely adopted application
of blockchain technology, but increasingly, the financial sector and other industries are investigating and
experimenting with other blockchain applications. Blockchain technology has various potential advantages
for specific uses in accounting, but at present, such proposed uses remain largely theoretical. However, a
shift towards any of these would clearly represent a major disruptive event in the accounting industry.
Pdf_Folio:60
Company A Company B
Blockchain
Due to data security concerns and businesses’ preference for control, an alternative — more likely —
application of blockchain is in a permissioned or private network where only trusted parties are able to
participate. Alternatively, blockchain data structures may merely be used as another database approach,
recording information in ways that largely mirror current processes.
Auditors will need to understand blockchain technology as it is implemented by their clients because it
has the potential to impact all record-keeping processes. As new techniques and procedures emerge with
the use of blockchain, the auditor’s role may continue to change. For example, ‘methods for obtaining
sufficient appropriate audit evidence will need to consider both traditional stand-alone general ledgers
as well as blockchain ledgers’ (Bible et al. 2017, p. 2). In addition, more efficient data extraction and
analysis may be possible due to greater standardisation and transparency in reporting and accounting using
blockchain technology.
Overall, the use of blockchain technology will result in multiple benefits to businesses and the
accounting profession.
• Blockchain-based accounting systems could greatly expand the scope and quality of information able
to be captured within accounting systems. As a distributed, tamper-proof ledger, a well-designed
blockchain doesn’t just cut out intermediaries, reduce costs, and increase speed and reach, it also offers
greater transparency and traceability for many business processes.
• Smart contracts hosted in a blockchain give rise to the ability to invoke and record the transactions
automatically. The automated nature of record keeping reduces the costs and risks of errors or fraud
encountered in manual record keeping and also reduces the associated costs (Carlin 2018).
• By capturing each transaction, and all relevant supporting documents and associated data in time-
stamped records in the blockchain, the entire life of every accounting incident can be captured. Entire
business processes — including accounting processes, but also numerous other dealings, such as the
supply chain — spanning over multiple departments or companies, become easily traceable (Andersen
2016; O’Leary 2017).
As a result, blockchain technology can further enhance audit efficiency and effectiveness. Big data and
analytics offer the potential of auditing 100% of an entity’s transactions. Blockchain technology can further
contribute by preventing records from being changed, falsified or destroyed.
The key points covered in this part, and the learning objectives they align to, are below.
KEY POINTS
1.1 Apply the International Framework for Assurance Engagements (the Framework) and the
related standards and other guidance to assurance engagements.
• Gaining an understanding of the entity, including its business model, is important when planning
an audit and assessing the risk of material misstatements. Rapid changes to the environment have
led to business models continually evolving to enable entities to maintain a competitive advantage.
• The majority of climate change and climate-risk-related disclosure provided to date have been
provided on a voluntary basis.
P df_Folio:61
REVIEW
This module started by providing an overview of the current assurance environment, including the
regulation of auditing in Australia. It then discussed the development of the International Framework
for Assurance Engagements (the Framework) that shapes auditing and other assurance engagements.
Following the structure of the Framework, the module introduced the key matters pertaining to an
assurance engagement, including:
• ethical principles — including requirements set out in the Code
• quality control standards — including ISQC 1 requirements
• description of assurance engagements
• attestation and direct engagements
• reasonable and limited assurance engagements
• scope of the Framework
• elements of an assurance engagement:
– three-party relationship
– underlying subject matter
– criteria
– evidence
– assurance report.
The discussion of evidence emphasised the importance of professional scepticism and professional
judgment in collecting and evaluating evidence. Expanding on various types of assurance engagements,
this module distinguished between audits of historical financial statements, audits of specialised areas,
review engagements, historical non-financial reports assurance, future-oriented information assurance,
assurance on systems and processes, assurance on aspects of behaviour and performance of an activity.
The module then discussed the application of standards to different types of entities, including private
sector, public sector and small and medium-sized entities. The typical mandates of auditors-general in
Australia and Hong Kong were also discussed briefly.
The final section outlined the impact a changing environment is having on auditing. The challenges
faced by the audit profession due to evolving business models, enhanced disclosure requirements related
to climate-risks and the incorporation of technological innovations, which are impacting on auditors when
gaining an understanding of the entity and its environment, were discussed.
df_Folio:62
P
P df_Folio:63
REFERENCES
Andersen N 2016, ‘Blockchain technology: a game-changer in accounting?’, Deloitte, March, accessed July 2019, https://
www2.deloitte.com/content/dam/Deloitte/de/Documents/Innovation/Blockchain_A%20game-changer%20in%20accounting.pdf
Audit Commission 2019a, ‘History of the Audit Commission’, accessed July 2019, http://www.aud.gov.hk/eng/aboutus/
about_history.htm
Audit Commission 2019b, ‘Role of the Director of Audit’, accessed July 2019, http://www.aud.gov.hk/eng/aboutus/about_role.htm
Australian National Audit Office (ANAO) 2019, ‘The Australian National Audit Office’, accessed August 2019,
https://www.anao.gov.au/about/australian-national-audit-office
Australian Securities and Investments Commission (ASIC) 2011, Regulatory Guide RG 230 Disclosing non-IFRS financial
information, accessed July 2019, https://asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-230-disclosing-
non-ifrs-financial-information/
Australian Securities and Investments Commission (ASIC) 2013, Regulatory Guide RG 34 Auditor’s Obligations: Reporting to
ASIC, accessed November 2017, http://www.asic.gov.au/media/1238083/rg34-published-31-may-2013.pdf
Australian Securities and Investments Commission (ASIC) 2018, Climate risk disclosure by Australia’s listed companies, Report
593, September, accessed July 2019, https://asic.gov.au/regulatory-resources/find-a-document/reports/rep-593-climate-risk-
disclosure-by-australia-s-listed-companies/
Australian Securities and Investments Commission (ASIC) 2019, Audit Inspection Program Report for 2017–18, Report 607,
accessed July 2019, https://download.asic.gov.au/media/4990650/rep607-published-24-january-2019.pdf
ASX 2018, ‘ASX Ltd Overview’, November, accessed August 2019, https://www.asx.com.au/documents/investor-relations/asx-
investor-fact-sheet.pdf
Bible, W, Raphael, J, Riviello, M, Taylor, P & Valiente, IO 2017, ‘Blockchain Technology and Its Potential Impact on the Audit
and Assurance Profession’, Chartered Professional Accountants of Canada (CPA Canada) & the American Institute of CPAs
(AICPA), accessed July 2019, https://www.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/
downloadabledocuments/blockchain-technology-and-its-potential-impact-on-the-audit-and-assurance-profession.pdf
Carlin, T 2018, ‘Blockchain and the journey beyond double entry’, Australian Accounting Review, DOI: 10.1111/auar.12273, CPA
Australia.
Center for Audit Quality (CAQ) 2010, Deterring and Detecting Financial Reporting Fraud: A Platform for Action, accessed July
2019, https://www.thecaq.org/wp-content/uploads/2019/03/deterring-and-detecting-financial-reporting-fraud-a-platform-for-
action.pdf
Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2004, Enterprise Risk Management—Integrated
Framework, American Institute of Certified Public Accountants, New York.
Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013, Internal Control–Integrated Framework,
American Institute of Certified Public Accountants, New York.
CPA Australia 2017, Companies Limited by Guarantee and Incorporated Associations, accessed August 2019,
cpaaustralia.com.au/~/media/corporate/allfiles/document/professional-resources/auditing-assurance/incorporated-
associations.pdf
Deloitte 2019, ‘Audit - a regulated profession: responding to regulatory trends’, accessed August 2019, https://www2.deloitte.com/
au/en/pages/audit/articles/audit-regulated-profession.html
df_Folio:64
P
• Definitions
• Elements
• Professional scepticism and judgment
• Quality control
• Ethical principles
misstatements
LEARNING OBJECTIVES
IESBA International Code of Ethics for Professional APES 110 Code of Ethics for Professional Accountants
Accountants (including International Independence (including Independence Standards)
Standards)
ISA 200 Overall Objectives of the Independent Auditor ASA 200 Overall Objectives of the Independent Auditor
and the Conduct of an Audit in Accordance with and the Conduct of an Audit in Accordance with
International Standards on Auditing Australian Auditing Standards
ISA 210 Agreeing the Terms of Audit Engagements ASA 210 Agreeing the Terms of Audit Engagements
(Compiled)
ISA 220 Quality Control for an Audit of Financial ASA 220 Quality Control for an Audit of a Financial
Statements Report and Other Historical Financial Information
(Compiled)
ISA 240 The Auditor’s Responsibilities Relating to Fraud ASA 240 The Auditor’s Responsibilities Relating to
in an Audit of Financial Statements Fraud in an Audit of a Financial Report (Compiled)
ISA 250 (Revised) Consideration of Laws and ASA 250 Consideration of Laws and Regulations in an
Regulations in an Audit of a Financial Report Audit of a Financial Report
ISA 260 (Revised) Communication with Those Charged ASA 260 Communication with Those Charged with
with Governance Governance (Compiled)
ISA 300 Planning an Audit of Financial Statements ASA 300 Planning an Audit of a Financial Report
(Compiled)
ISA 315 (Revised) Identifying and Assessing the Risks ASA 315 Identifying and Assessing the Risks of
of Material Misstatement through Understanding the Material Misstatement through Understanding the
Entity and Its Environment Entity and Its Environment (Compiled)
ISA 320 Materiality in Planning and Performing an Audit ASA 320 Materiality in Planning and Performing an
Audit (Compiled)
ISA 330 The Auditor’s Responses to Assessed Risks ASA 330 The Auditor’s Responses to Assessed Risks
(Compiled)
ISA 450 Evaluation of Misstatements Identified during ASA 450 Evaluation of Misstatements Identified during
the Audit the Audit (Compiled)
ISA 540 (Revised) Auditing Accounting Estimates and ASA 540 Auditing Accounting Estimates and Related
Related Disclosures Disclosures
ISQC 1 Quality Control for Firms that Perform Audits ASQC 1 Quality Control for Firms that Perform Audits
and Reviews of Financial Statements, and Other and Reviews of Financial Reports and Other Financial
Assurance and Related Services Engagements Information, Other Assurance Engagements and
Related Services Engagements
P df_Folio:67
The risk that an auditor will form an incorrect opinion is known as audit risk and is discussed next.
Audit Risk
Audit risk is the risk that the auditor will express an incorrect opinion when the financial statements are
materially misstated (ISA 200). Audit risk is a combination of all types and categories of risk, including
inherent, control and detection risks.
Inherent risk is a function of the nature and uncertainty surrounding some transactions, account bal-
ances and disclosures, such as complex calculations and accounting estimates. An entity’s environment,
including technological change and industry characteristics, may also present inherent risks.
Control risk relates to the efficacy of an entity’s internal controls and the risk that those controls will
not prevent, or detect and correct, a material misstatement at the assertion level. An absence of sufficient
or effective internal controls can provide both opportunities and motivation to engage in dysfunctional
behaviour.
Inherent and control risks exist independently of the audit of the financial statements. Managing these
risks is the responsibility of management. For example, some corporate failures and scandals (e.g. Hertz
and Banking Royal Commission) provide evidence that factors such as declining economic conditions,
changes in technology and demand, and poor internal controls, in conjunction with the attitude of
management towards achieving specified goals, prompted dysfunctional behaviour that resulted in the
misstatement of financial statements.
Detection risk is a function of the adequacy and effectiveness of the nature, timing and extent of audit
procedures that are determined by the auditor to reduce audit risk to an acceptably low level. It is the risk
that the procedures undertaken by the auditor will not detect a material misstatement.
The audit risk model provides a framework for auditors to follow in responding to these assessed risks
through their choice of audit procedures. However, note that the auditing standards are not specific on
what is an acceptable level of audit risk, and use of the audit risk model requires a significant degree of
judgment by the auditor. In relation to the components of audit risk, the auditor generally expresses each
component in non-quantitative terms (such as low, medium and high, as shown in figure 2.1). The matrix
demonstrates that the acceptable levels of detection risk are inversely related to the assessments of inherent
and control risks.
Auditors plan and perform their audit to keep audit risk at an acceptably low level (ISA 200, para. 17).
If inherent and control risks are high for an assertion, the auditor will set detection risk as low, to maintain
a low audit risk. A low detection risk means the auditors increase the amount of detailed audit procedures
used to test the year-end account balances and transactions from throughout the year.
Pdf_Folio:69
If an auditor’s assessment of control and inherent risks are both high (there is high likelihood of errors
in the financial statements), then the acceptable level of detection risk will have to be very low; that is,
the risk that the auditor’s substantive procedures will not detect material misstatements will need to
be low. Conversely, if an auditor’s assessment of control and inherent risks are both low (there is only
a small likelihood of errors in the financial statements), then the acceptable level of detection risk can
be high; that is, the risk that the auditor’s substantive procedures will not detect material misstatements
can be high.
The auditor often assesses inherent and control risks jointly when assessing the risk of material
misstatement (i.e. inherent risk and control risk determine the probability that financial statements contain
material misstatements).
While inherent risk and control risk are the entity’s risks, they are still important to the auditor given
their relationship to overall audit risk. For a given level of detection risk, the higher the inherent and
control risks, the greater the audit risk (i.e. the risk that an auditor may express an inappropriate opinion
on financial information that is materially misstated). The risks of material misstatement may exist at
two levels:
• the overall financial statement level; and
• the assertion level for classes of transactions, account balances, and disclosures (ISA 200, para. A36).
Risks of material misstatement at the overall financial statement level refer to risks that relate to
the financial statements as a whole, potentially affecting many assertions. On the other hand, risks of
material misstatement at the assertion level relates to specific classes of transactions, account balances and
disclosures. Examples of factors that increase inherent risk and control risk at the financial statement level
are shown in figure 2.2.
Further details on risks of material misstatement are contained in ISA 200, paragraphs A36–A38.
Read these sections now.
In order to reduce audit risk to an acceptably low level (ISA 200, para. 17), and thereby enable the
auditor to form an opinion, it is necessary for the auditor to obtain sufficient appropriate audit evidence.
In order to obtain sufficient appropriate audit evidence, the extent of audit testing is based on the level of
detection risk set by the auditor to achieve a low level of audit risk.
The ASIC audit inspection program report for 2017–18 found that for 24% of key audit areas reviewed,
auditors did not obtain reasonable assurance that the financial report as a whole was free of material
misstatement (ASIC 2019, p. 4). ASIC continues to stress the importance for auditors to focus on the
sufficiency and appropriateness of audit evidence obtained (ASIC 2019, p. 7).
In its 2017–18 report, ASIC notes that ‘in addition to maintaining a strong culture of audit
quality . . . audit firms should continue to improve both the adequacy of their audits of asset values
and revenue recognition’ (ASIC 2019, p. 28).
Pdf_Folio:70
QUESTION 2.1
Consider the following three scenarios and state whether the scenario involves inherent risk,
control risk or detection risk.
(a) A business has high volumes of low-value revenue streams in multiple currencies.
(b) A business has limited segregation of duties in functional areas.
(c) The auditor of a business conducts inappropriate substantive testing.
Example 2.1 deals with the factors that increase or decrease inherent risk. Review the example now.
EXAMPLE 2.1
Inherent Risk
LRS Ltd is a hotel chain that operates 40 hotels throughout Australia and Asia. While its head office is in
Melbourne, it has hotels in all Australian capital cities as well as Beijing, Hong Kong SAR, Kuala Lumpur,
Singapore and Shanghai. Mr Lee, the chair of the board and CEO, has just put the audit out to tender, as he
believes the present auditor insisted on very conservative accounting policies. Control of the organisation
is in the hands of Mr Lee’s family, who have been majority shareholders for over 30 years. They have
extensive experience in the hotel industry. The board consists of four family members, who also hold
senior management positions, and there is one independent member of the board who is chairperson of
the audit committee.
As a result of credit restrictions, there has been a fall in the Australian share market, so the company
has delayed its public listing until later in the year. LRS Ltd has a low debt–equity ratio compared to the
industry average.
............................................................................................................................................................................
Identify the inherent risk factors and then evaluate whether they increase or decrease the inherent risk of
LRS Ltd.
Check your response against the suggested answer at the end of the book.
Example 2.2 deals with inherent risk at the financial statements level and at the account level for
inventory and trade debtors. Review the example now.
Pdf_Folio:71
Having explained the components of audit risk and identified the overarching purpose of an audit of
financial statements, we now discuss the legal, regulatory, professional and ethical requirements.
Regulatory Environment
The regulatory environment includes the following.
• The audit review processes, including reviews performed by the professional bodies and those performed
by regulatory authorities. In Australia, ASIC’s statutory audit inspection process is considered a strength
of the regulatory process.
• A legally enforceable audit regulation framework that includes accounting standards, auditing standards
and auditor independence requirements.
• The quality of the applicable financial accounting framework.
• The soundness of corporate governance, law and regulation.
As discussed in module 1, the International Standards on Auditing (ISAs) are to be applied to the audit
of historical financial information. In this module, focus is on many of the 200, 300 and 400 series of
standards covering general principles and responsibilities (200 series) and risk assessment and response to
assessed risks (300 and 400 series). Of particular importance is ISA 300 Planning an Audit of Financial
Statements.
The Financial Reporting Council (FRC) empowers the AUASB to issue standards, guidance notes and
other information to provide clear standards for auditing and assurance services, in addition to other
related services. FRC also provides strategic advice related to the quality of audits conducted by Australian
audit firms.
df_Folio:72
P
Each of these items was discussed in module 1. The engagement partner must remain alert for evidence
of non-compliance with the ethical requirements relating to the audit engagement.
Non-compliance can be at the firm level (e.g. the control system to monitor employee ownership of
shares in listed companies is not adequate) or at the individual client level (e.g. the audit manager and the
CFO are related). In most firms, senior personnel (e.g. risk management partners) will be assigned to look
after these issues at the firm level. However, individual partners are responsible at the engagement level.
ASIC (2019) discusses compliance with these independence requirements. It states that most firms have
established policies and processes to facilitate compliance with the auditor independence requirements of
Pdf_Folio:73
The Code
Source: Adapted from International Ethics Standards Board for Accountants (IESBA) 2018, International Code of Ethics for
Professional Accountants (Including International Independence Standards), accessed May 2019, https://www.ifac.org/publications-
resources/2018-handbook-international-code-ethics-professional-accountants
The maximum seven-year time-on period required by IESBA is calculated on a cumulative basis and
need not be consecutive.
In response to these changes, the Accounting Professional & Ethical Standards Board (APESB)
approved amendments that reflect the Code and take into consideration the Australian requirements
imposed by the Corporations Act.
This applies in Australia as the applicable law (the Corporations Act) prescribes a cooling-off period that
is shorter than the Code. However, the transitional provision specifies a sunset to the three-year cooling-
off period. This will see the three-year cooling-off period transition to a five-year cooling-off period for
audits of financial statements for periods beginning after 31 December 2023. The requirements under the
Corporations Act for listed entities of five years on and two years off are more restrictive than the APES
110 for PIEs. Therefore, the legislative requirements take precedence.
FIGURE 2.3 Mandatory audit firm rotation and audit partner rotation arguments
Loss in client-specific
Increased level of knowledge will
scepticism adversely affect
audit quality
Client acceptance/ • Threats to integrity may arise from • Obtain knowledge of governance
continuance issues associated with clients • Secure client’s commitment to address
(e.g. questionable conduct) the matter in question
• Periodic review on compliance matters
Engagement acceptance • A self-interest threat may result in lack • Acquire necessary knowledge
of competence • Assign staff with necessary
competence
• Use experts where necessary
• Comply with quality control procedures
Changes in a professional • Threats to compliance in relation to a • Contact with existing auditor regarding
appointment tendering process for the task matters pertinent to non-acceptance
• Notify existing auditor of the proposed
work
• Seek other information
Conflict of interest • Threat to objectivity for two or • Based upon all specific facts and
more clients circumstances (such as the nature
• Threat to compromise judgment of the services, the size of the firm
• Compromise of independence and the client base), assess that a
reasonable and informed third party
would be likely to conclude that
compliance with the fundamental
principles might be compromised
• The significance of relevant interests
and the significance of the threats
should be considered
• Use separate teams, perform regular
reviews, disclosure of interests
Non-compliance with laws • Fraud, corruption and bribery • Assess the nature of the matter if it
and regulations • Money laundering, terrorist financing is inconsequential. If not, take the
• Securities dealing, banking products, following steps in a timely manner:
etc. where non-compliance is apparent obtain understanding of the matter,
address the matter with those charged
with governance, advise them to take
appropriate actions. Auditors are
required to identify and respond to
non-compliance, communicate with
those charged with governance and
consider implications.
• Further actions may be required to
disclose the matter to appropriate
authority and/or withdrawing from the
engagement
Second opinions • Possible threat to professional • Evaluate the significance of the opinion,
competence seek permission to contact existing
• Opinion shopping by non-client on accountants for explanations, describe
accounting treatment limitations or withdraw from giving the
opinion
Pdf_Folio:78
Custody of client assets • Compliance and objectivity threats • Shall not assume custody of client
monies or other assets unless it is
lawful, separate records are kept,
regular accountability
Source: Examples taken from Sections 310 to 360 of the Code, as at June 2019.
Professional accountants should evaluate the significance of threats to objectivity before accepting or
continuing with specific engagements. Some additional safeguards include clear guidelines for engagement
personnel on issues of security and confidentiality, and regular review of client engagements. Overall, the
auditor must observe objectivity at all times and judge, based on all relevant facts and circumstances, if
the threats posed are at an acceptable level and that there are safeguards to ensure that the fundamental
principles of ethics are adhered to. If that is not the case, the auditor should withdraw from the engagement,
seek advice and follow supervisory procedures, including discussing the issue with authorities or those
charged with governance of the client.
QUESTION 2.2
You are Mark Mitchell, an audit senior with the firm Pull, Lift, Tug & Co. You are planning the financial
report audit of Nestree Ltd, a manufacturer of confectionery.
From the review of the draft financial statements that you have received, Nestree appears to take
an optimistic approach to its valuation of development expenditure capitalised in intangible assets.
Executive remuneration includes a profit-related bonus.
(a) Evaluate the above situation and identify the ethical threat involved.
(b) How can the auditor avoid this threat?
Pdf_Folio:79
Have a
• Critically assess the validity of
questioning
audit evidence
mind
Professional
scepticism
Do not:
• overlook unusual circumstances
• over-generalise
Be careful • use faulty assumptions
• rely on management honesty and integrity
• accept unpersuasive audit evidence
• accept management representations as a
substitute for sufficient appropriate audit evidence
Pdf_Folio:80
Audit reporting • Whether a modified audit report is appropriate, and if so, which one
• Whether an emphasis of matter paragraph is appropriate
• Qualified, disclaimer, adverse opinions
• What key audit matters (KAMs) to include in the audit report, if any
• Whether a going concern basis is appropriate
• The wording of other assurance reports
The complexity of business transactions, expanded use of fair values and subjective estimates, and
the move to more principles-based accounting standards, all tend to heighten the degree of professional
judgment and scepticism auditors need to apply (Glover & Prawitt 2013).
The concepts of professional scepticism and professional judgment will be addressed throughout this
Study guide as we cover the process auditors use to detect material misstatements and reach their audit
opinion as to whether the financial statements are fairly presented in accordance with the applicable
financial reporting framework.
Review example 2.3 which demonstrates how professional scepticism is applied at various stages of
an audit.
EXAMPLE 2.3
P df_Folio:81
df_Folio:82
P
KEY POINTS
2.1 Explain the responsibilities of management and the auditor in relation to an audit.
• Management and those charged with governance have the primary responsibility for the prevention
and detection of fraud.
• The auditor is responsible for obtaining reasonable assurance that the financial statements are free
from material misstatement caused by fraud or error.
• The auditor has additional responsibilities under law, regulation or relevant ethical requirements
regarding an entity’s non-compliance with laws and regulations (NOCLAR), including fraud.
2.2 Evaluate historical financial information by applying professional scepticism and judgment.
• The concepts of professional scepticism and judgment were introduced and linked to the decisions
auditors make when identifying material misstatements and when determining the appropriate audit
opinion based on the evidence gathered.
• Auditors must maintain an attitude of professional scepticism and remain alert to the possibility of
fraud during the conduct of the audit.
• Examples of where auditors use professional judgment during an audit were provided.
• The use of the audit risk model requires a significant degree of judgment by the auditor, especially
when determining the appropriate level of detection risk and extent of audit testing required to
maintain a low level of audit risk.
• Example 2.1 demonstrated the use of professional judgment to identify factors in a business situation
which increase or decrease inherent risk of an entity.
• Example 2.2 demonstrated the use of professional judgment to identify factors that increased the risk
of material misstatement at the financial statement level and to identify inherent risks at the assertion
level. It also required professional judgment to identify factors that increased or decreased the level
of control risk in the business scenario.
• Example 2.3 demonstrated how the auditor is likely to apply professional scepticism at various stages
of the audit of historical financial information.
PRECONDITIONS
The auditor needs to confirm that the preconditions of an audit are established by the following.
• Determining whether the financial reporting framework to be applied in the preparation of the financial
statements is acceptable (ISA 210, para. 6a). Financial reporting standards, such as International
Financial Reporting Standards (IFRS), are often used as the applicable financial reporting framework. In
Australia, the applicable financial reporting framework would include Australian Accounting Standards,
the Corporations Act and other relevant legislation that may be applicable to other entities (e.g. overseas
accounting pronouncements for Asian subsidiaries).
• Obtaining agreement from management that it acknowledges and understands its responsibilities,
including for:
– the preparation of the financial statements
– the internal control system necessary to enable the preparation of the financial statements that are
free from material misstatement due to fraud or error
– providing the auditor with necessary access and information (ISA 210, para. 6b).
Pdf_Folio:83
CHANGES TO TERMS
ISA 210 covers recurring audits and acceptance of a change in the terms of an engagement. For recurring
audits, the auditor assesses whether the terms of the audit engagement must be revised and whether it is
necessary to remind the entity of the existing terms of the audit engagement (ISA 210, para. 13).
The auditor also needs to consider whether there is a need to send a new engagement letter. In practice,
many firms send a new engagement letter each year. This is particularly important if there is:
• Any indication that the entity misunderstands the objective and scope of the audit.
• Any revised or special terms of the engagement.
• A recent change of senior management [or those charged with governance].
• Any significant change in ownership [or in the] nature or size of the entity’s business
• A change in legal or regulatory requirements.
• A change in the financial reporting framework . . . [or] other reporting requirements (ISA 210,
para. A30).
If, prior to completion of the audit, the auditor receives a request from management to change the
engagement to a lower level of assurance (e.g. an audit to a review or a related service) they need to consider
the appropriateness of their reason for doing so (ISA 210, paras 14–17, A31–A33). For example, it may
be appropriate to do so when there has been a change in circumstances affecting the need for assurance or
a misunderstanding of the nature of an audit.
Pdf_Folio:84
You are considering whether to accept a new audit engagement for EZY Ltd when you notice that
management have imposed a limitation on the scope of the auditor’s work. As a result of the
limitation, you believe it will not be possible to give an opinion on the truth and fairness of the
financial statements.
Should you accept this audit engagement? Justify your answer by referring to the relevant ISA.
Review example 2.4, which covers the justification for sending out a new engagement letter for a
recurring audit engagement.
EXAMPLE 2.4
Following the discussion of the terms of audit engagements, including preconditions, the engagement
letter and the auditor’s choices when the terms are changed, we now discuss the auditor’s responsibilities
relating to communication of audit matters with those charged with governance.
Now that we have discussed all the preliminary engagement activities, in the next section, our focus will
turn to audit planning procedures.
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
2.1 Explain the responsibilities of management and the auditor in relation to an audit.
• The auditor is required to obtain an agreement from management that it acknowledges and
understands its responsibilities for the preparation of the financial statements, the internal control
system used for the preparation of the financial statements and providing the auditor with access
and information required to conduct the audit.
• The auditor needs to confirm that the preconditions of an audit are established by determining
whether the financial reporting framework to be applied in the preparation of the financial statements
is acceptable.
• For recurring audits, the auditor assesses whether the terms of the audit engagement must be revised
and whether it is necessary to remind the entity of the existing terms of the audit engagement.
• The auditor needs to consider whether there is a need to send a new engagement letter to the entity.
df_Folio:85
P
Audit planning
QUESTION 2.4
If inherent risk and control risk are high, why will detection risk be set as low, and what effect does
this have on the audit strategy?
The next step in audit planning is to develop an audit plan, which is discussed next.
df_Folio:88
P
2. Is internal control over related transaction Due to the small size of the company, there are
streams/processes expected to be reliable? limited controls. We obtained an understanding
If so, could the controls be tested to reduce of internal control, but we will not test controls or
need/scope for other substantive procedures? place any reliance on them.
3. Are there substantive analytical procedures The completeness of sales will be addressed by a
available that would reduce need/scope for combination of substantive analytical review and
other audit procedures? tests of details.
5. Are there significant risks that require special The possibility of inconsistent revenue recognition
attention? or fraud will be addressed through suitably
tailored substantive tests of details.
Need to be mindful of undisclosed related party
transactions outside of the normal course of
business throughout the audit.
The following is a sample audit response to the assessed level of risk for accounts receivable.
A more detailed plan of the audit procedures to be performed is often documented in the form of an
audit program. The audit program typically outlines the nature and extent of procedures and the assertions
addressed along with spaces to record details, such as who performed the procedure, working paper file
reference and the findings. The audit program should include sufficient detail of the work to be performed,
Pdf_Folio:89
Various factors, including the size and complexity of the entity, the area of the audit (e.g. inventory,
financial instruments), the risks of material misstatement, and the capabilities and competence of personnel
performing the work (e.g. prior industry audit experience) all have an impact on the required direction and
supervision of the engagement team (ISA 300, para. A16). For example, if the work related to inventory
and the preparer was an audit manager with extensive manufacturing experience, the level of direction,
supervision and review would be less than if the preparer was an assistant whose previous audit experience
was with banks and insurance companies. Where there is an increase in the assessed risk of material
misstatement for the area of audit risk, there would be expected increases in the extent and timeliness of
direction and supervision of engagement team members and a more detailed review of their work.
Pdf_Folio:90
QUESTION 2.5
The auditor of LRS Ltd has completed the audit strategy and audit plan and is presently carrying
out substantive procedures. The auditor discovers some errors that suggest that the original audit
plan may have assumed incorrectly that the controls over inventory were strong. Is it too late to
change the audit plan? Why?
Audit assertions and audit materiality are two key issues in auditing and are thus key in developing the
audit plan. These are discussed next.
Assertion Definition
Note in this example, how occurrence is similar to existence except that it relates to transactions and
events which occur rather than statement of financial position items which exist.
As illustrated in the above example, completeness relates to both classes of transactions and events and
account balances. The completeness assertion is generally one of the hardest to test for — looking for
things that should be but are not included in the entity’s records. Completeness is particularly important
for liabilities and expenses as understatement of these items results in profits being overstated.
Note how, in establishing the accuracy assertion, the auditor is concerned that the details of the
transactions under review are completely correct. It is surprising how easily small errors of detail can
arise and how significant the impact of the mistakes can be. Consider the calculation of sales revenue by
Pdf_Folio:92
In establishing the classification assertion, the auditor is concerned that the correct account is used in
recording a transaction. This is not always a simple matter. Consider, for example, the decision relating to
whether certain types of overhead costs should be capitalised or expensed.
In establishing presentation, the auditor is concerned that both transactions and events, as well as
year-end accounts, are appropriately aggregated or disaggregated and clearly described. A useful way
of thinking about assertions regarding presentation is that they primarily relate to the presentations and
disclosures contained in the notes to the accounts.
In establishing rights and obligations, the auditor is concerned with obtaining evidence that recorded
assets are future economic benefits controlled by the entity and that liabilities are the future sacrifices of
economic benefits that an entity is presently obliged to make as a result of past transactions or other past
events. The auditor needs to obtain evidence that the accounting recognition is appropriate. The rights and
obligations objective usually involves procedures to provide evidence that assets in the client’s possession
that have been sold or pledged are not reported as assets.
The audit procedures used to obtain evidence of rights and obligations may include examining land tax
assessments, rate notices, title deeds, correspondence and minutes of meetings of the board of directors,
and making enquiries of the client’s management to verify ownership (see the following example).
P df_Folio:93
EXAMPLE 2.5
Identifying Assertions
The auditor of Beta Ltd carried out audit procedures for sales and inventory and detected the following
misstatements.
1. Some inventory items were out on consignment and were not counted during the physical inventory.
2. During the physical count, the client’s employees mistakenly counted some items twice.
3. The basis of inventory valuation was not included in the draft financial statements.
4. Included in the inventory counts were some items that were held on consignment.
5. Some inventory items were listed at cost, but the realisable value was lower.
6. It was recognised that some sales were being recorded before they were shipped.
7. The sales price recorded for sales transactions was different to that agreed with the customer. It was
found to be taken from an outdated version of the sales price file.
............................................................................................................................................................................
For each misstatement, what financial statement assertion is relevant? Justify your selection.
Check your response against the suggested answer at the end of the book.
QUESTION 2.6
Assume you are the auditor for EquipMachines Ltd, a machinery company that sells high-tech
machines for the mining industry. You are concerned about the following two issues:
1. management override of internal controls
2. possibility of some of the high-tech inventory becoming obsolete.
For each of the above issues, would the risk be considered at the financial statement level or
the assertion level? Why?
DOCUMENTATION
ISA 230 Audit Documentation deals with the auditor’s responsibility to prepare audit documentation
for an audit of financial statements. ISA 230 contains mandatory requirements relating to documentation.
Audit documentation needs to:
• provide evidence that the audit was planned in accordance with applicable auditing standards and legal
and regulatory requirements
• provide evidence that the audit was performed in accordance with applicable auditing standards and
legal and regulatory requirements
• provide evidence of the auditor’s basis for a conclusion (ISA 230, para. 2).
The form, content and extent of audit documentation will vary between audits and will depend on such
factors as the nature of the audit procedures to be performed and the extent of judgment required. Little
guidance is given to the auditor regarding exactly how much documentation is required. The problem the
auditor faces is that if an issue has been considered but not documented, it may be difficult to convince
others in later inspections that the issue actually has received consideration.
For example, as stated earlier, ASIC (2019) found that in 24% of the total key audit areas reviewed in
their 2018 audit inspection program, the auditor did not document evidence of having obtained sufficient
appropriate audit evidence to provide reasonable assurance that the overall financial report was free of
material misstatement.
The engagement letter, audit plan and detailed audit program are some examples of documentation
covered so far in this module. Other examples will be covered later in this module and in the remaining
modules.
df_Folio:94
P
EXAMPLE 2.6
EXAMPLE 2.7
QUESTION 2.7
Consider each of the listed items and describe how they affect the risk of a material misstatement.
1. Management has a poor reputation in the business community over the integrity of recent
decisions.
2. Repairs and maintenance accounts were misstated in previous audits.
3. Management lacks experience.
4. The entity is facing a cash flow problem.
5. The inventory consists of a range of expensive jewellery.
6. Taxation calculations are extremely complex.
7. The entity is a computer manufacturer.
8. Management’s rewards are heavily dependent on financial results.
9. Provisions are a material liability.
P df_Folio:97
Following the discussion on applying materiality concepts to various situations, the discussion turns to
distinguishing between overall and performance materiality.
Overall materiality refers to a limit above which the financial statements would be considered to be
materially affected by the issue or misstatement. For example, assume that the overall materiality for
the audit of a company is set at $1 000 000. Any misstatement or error that exceeds $1 000 000 will be
considered material and would affect the audit report.
Performance materiality looks at individual items that are less than overall materiality but that could,
when added together, exceed overall materiality (see ISA 320, para. 9). It is important to note that when
actually performing the audit work and carrying out tests of detail, the auditor cannot just look at amounts
that exceed $1 000 000.
Example 2.8 demonstrates when performance materiality is applicable for audit tests. Review this
example now.
EXAMPLE 2.8
Performance Materiality
You have set overall materiality for the audit of ABC Ltd at $1 000 000.
When auditing property, plant and equipment (PPE), can you just select and test assets with a balance
greater than $1 000 000?
When auditing property, plant and equipment (PPE), the auditor cannot just select and test assets with
a balance greater than $1 000 000 because individual assets with a balance less than overall materiality
may result in a material misstatement when put together. The auditor would instead use ‘performance
materiality’ to select the items to be tested.
For the audit of ABC Ltd, performance materiality has been set at $500 000. You discovered assets
included in the fixed asset register that were in fact sold. The value of the assets are $550 000 and $670 000
respectively.
Should these assets be selected for testing?
If the auditor used overall materiality when performing the audit, these assets would not have been
selected for testing as they are below the set limit of $1 000 000.
However, when performing the audit, the auditor would use performance materiality, which in this
case was set at $500 000. This would enable the auditor to discover the two assets that were below
overall materiality individually, but whose combined misstatement exceeds overall materiality (i.e. the total
misstatement of the assets is above $1 000 000).
Materiality within a specific account or transaction would focus on the individual items making up the
total account balance and on those amounts in relation to the total account balance. See example below.
Assume that while auditing the debtors, the auditor selects a debtor with an account balance of
$650 000, since it exceeds the performance materiality of $500 000. The balance may comprise a number
of transactions ranging from a $50 sale on credit up to a large $650 000 transaction. In selecting the items
to be tested within this balance, the auditor would not normally select the smaller transactions (e.g. a $50
purchase) because they would not make a difference in relation to the overall balance.
df_Folio:98
P
EXAMPLE 2.9
Now that the preliminary audit procedures have been discussed and the key concepts have been
explained, it is time to consider the different phases of the audit.
PHASES OF AN AUDIT
Before we begin the discussion of the first phase of an audit, it is important to emphasise that each audit is
unique. For example, risks associated with the audit of a hardware store will not be the same as the risks
associated with an audit of a mobile phone store, even though both are retailers. Risks associated with the
oil and gas industry will be different from risks associated with the computer technology industry because
of different laws and regulations that apply to each industry. Auditors must tailor their audit to be specific
to each client, but broadly speaking, once the client acceptance or continuance decision has been made,
Pdf_Folio:99
The phase covering planning the audit involves gaining an understanding of the entity, performing
analytical procedures, risk assessment of internal controls, fraud risk, going concern risk, climate-related
risks, related-party risk, identifying factors that may impact the risk of a material misstatement occurring in
the financial statements, NOCLAR, performing a materiality assessment, and developing an overall audit
strategy.
The phase covering performing the audit involves the performance of detailed tests of controls and
detailed testing of transactions and account balances, called substantive testing.
The phase covering conclusions and reporting involves an evaluation of the results of the detailed testing
in light of the auditor’s understanding of the client and forming an opinion on the fair presentation of the
client’s financial statements. The auditor’s reporting obligations are also fulfilled during this phase.
ISA 300 Planning an Audit of Financial Statements requires auditors to plan the audit by assessing risk
to reduce audit risk to an acceptably low level. As described earlier, audit risk is the risk that an auditor
expresses an inappropriate audit opinion when the financial statements are materially misstated.
An auditor will perform various risk assessment procedures to ensure that appropriate attention is paid
to the accounts and transactions most at risk of being materially misstated. For example, the inventory
account at The Boeing Company has a higher risk of material misstatement than the prepaid expenses
account. Why is that? First, think about the difference in the dollar amount of the two accounts. Inventory
will most likely be the largest current asset, and prepaid expenses will be one of the smallest. Also, the
number and complexity of transactions in the inventory account will be much higher than the number of
transactions in the prepaid expenses account. Therefore, auditors should plan to devote more audit time
to the inventory account than to the prepaid expenses account. This Boeing example illustrates that the
risk assessment phase of the audit provides the opportunity to optimise efficiency and effectiveness when
conducting an audit. Efficiency refers to the amount of time spent gathering audit evidence. Effectiveness
refers to minimising audit risk.
You should also understand that the risk assessment process is an iterative process. Auditors make
preliminary risk assessments while planning the audit. Those risk assessments are later confirmed, or
refuted, when auditors perform tests of internal controls, or tests of account balances, transactions or
disclosures. On occasion, auditors might obtain information in the phase covering performing the audit
that causes them to revise their preliminary conclusions drawn during the audit planning phase. Auditors
must be open to evaluating evidence obtained at any phase of the audit and to considering its implications
for risk assessments made earlier in the audit.
Figure 2.9 provides a graphical depiction of the audit planning phase of the audit and some key concepts
that are applied during risk assessment. Once the elements of risk assessment have been considered,
auditors can develop their audit strategy (discussed earlier in this module).
Materiality, professional scepticism, audit risk and audit strategy were discussed earlier in this module,
and each of the risk assessments included in figure 2.9 will be discussed in the remaining sections of this
module. The outcome of these risk assessments will inform the audit strategy, which will be discussed
further in the final section of this module.
Pdf_Folio:100
Audit strategy
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
2.1 Explain the responsibilities of management and the auditor in relation to an audit.
• The auditor is responsible for planning the audit so that it will be performed in an effective manner.
• The auditor is responsible for determining the overall audit strategy and preparing an audit plan
based on their risk assessment.
• The auditor is responsible for documenting the procedures undertaken during the audit and their
findings.
• The auditor is responsible for setting overall and performance materiality levels.
2.3 Apply the processes and procedures undertaken by auditors in planning an audit.
• Audit planning activities and procedures that need to be coordinated early in the audit process were
identified.
• As part of the planning activities, the auditor is required to establish an overall audit strategy that sets
the scope, timing and direction of the audit. This strategy guides the development of the audit plan.
• The auditor has two main alternative overall audit strategies and chooses the strategy based on an
assessment of materiality, audit risk and what constitutes sufficient appropriate audit evidence. The
strategies range from a lower assessed level of control risk approach to a predominantly substantive
testing approach.
• Auditors document a detailed plan of the audit procedures to be performed in the form of an audit
program.
• Auditors use management’s assertions embodied in the financial statements to consider the different
types of potential misstatements that may occur.
• Auditors gather evidence to assess whether the financial statements are true and fair or whether
material misstatements exist.
• Some audit firms use a rule-of-thumb approach to determine planning or overall materiality by
selecting a percentage of particular benchmarks such as 5% of profit before tax.
• The risk assessments made during the planning stage of the audit were identified in preparation for
further discussion later in the module.
• Example 2.5 demonstrated the identification of assertions relevant to audit procedures performed
for sales and inventory.
• Example 2.6 provided an example of when the overall materiality benchmark used in the previous
year may not be suitable for the current year.
P df_Folio:101
df_Folio:102
P
Business Operations
Knowledge of the entity’s business operations includes understanding such matters as the entity’s:
• business model — method of obtaining revenues (e.g. manufacturing, retailing, import–export trading,
banking, utility) (discussed in the next section)
• products or services and markets (e.g. major customers and contracts, terms of payment, profit margins,
market share, competitors, exports, pricing policies, reputation of products, warranties, back orders,
marketing strategy, objectives)
• conduct of operations (e.g. stages and methods of production, business segments, fixed vs variable costs,
details of declining or expanding operations)
• location of production facilities, warehouses and offices
• employment (e.g. wages levels, union contracts, superannuation benefits, incentive bonus programs,
government regulation relating to employment matters)
• transactions with related parties.
An auditor usually expects differing financial positions, results of operations and cash flows for
manufacturers as opposed to service entities. Companies in the airline or hotel industries, for example,
have high fixed costs, and capacity use is an important aspect of the business. The auditor of the airline
might focus on the relationship between fuel costs, employee compensation and revenues. This type of
information helps the auditor develop a knowledgeable perspective about financial amounts and disclosures
that are specific to the entity.
Pdf_Folio:103
Investments
Knowledge of the entity’s investing activities includes understanding the entity’s:
• capital investment activities, including investments in plant and equipment and technology and any
recent or planned changes
• acquisitions, mergers or disposals of business activities (planned or recently executed)
• investments and disposition of securities and loans
• investments in non-consolidated entities, including partnerships, joint ventures and special-purpose
entities.
A crucial decision for any business is its investment in productive assets. A forest products company is
usually concerned about its investments both in timber and timberlands and manufacturing capacity. The
company’s ability to generate revenues depends on these investments. Critical investments for technology
and pharmaceutical companies are their investments in research and development. Software companies
invest in people, and although this human capital cannot be capitalised on the balance sheet/statement
of financial position, it is nevertheless important to revenue generation. Understanding the nature of an
entity’s investments helps the auditor develop expectations of financial statement amounts and disclosures.
In an environment where public companies are under significant pressure to perform, an auditor should
understand the relationships between productive assets and a company’s revenues and cost. It is essential
for auditors to understand the economic drivers of financial results. For example, technology companies
might spend very large amounts of money on a manufacturing line for a product that might have a useful
Pdf_Folio:104
Pdf_Folio:105
What is the relationship between business risk and the risk of material misstatement?
Example 2.10 provides an opportunity to identify specific business risks faced by an entity. Review the
example now.
EXAMPLE 2.10
Appendix 2 of ISA 315 (Revised) provides a detailed list of conditions and events that may indicate
risks of material misstatement. Read Appendix 2 ‘Conditions and Events That May Indicate Risks of
Material Misstatement’ of ISA 315 (Revised) to gain an understanding of the conditions and events that
may indicate a risk of material misstatement.
A proposed revision of ISA 315 (Revised) is expected to become effective for audits of financial
statements for periods beginning on or after 15 December 2020. This update was deemed necessary
to modernise the standard for changes in a continually evolving environment. In particular, changes to
improve guidance have been made to:
• promote a deeper understanding of the entity’s business model
• explicitly acknowledge how auditors may use automated tools and techniques, such as data analytics,
to perform risk assessment procedures
• enhance the auditor’s required understanding of the entity’s use of information technology for financial
reporting (IAASB 2018).
Later in this module, the various techniques used in understanding a client’s business are discussed in
detail.
QUESTION 2.9
Your client is a manufacturer of golf equipment accessories, including golf bags, golf buggies
and various attachments (e.g. water-bottle holders, scorecard holders). The year 20X9 has been
particularly profitable with the introduction of a golf bag with wheels attached that has proven
extremely popular with travellers. Suggest some potential business risks faced by the client.
P df_Folio:107
KEY POINTS
2.1 Explain the responsibilities of management and the auditor in relation to an audit.
• The auditor is responsible for obtaining an understanding of the entity and its environment, including
its industry, regulatory and economic factors; nature of the entity; the entity’s selection and
application of accounting policies; the entity’s objectives, strategies and related business risks; and
measurement and review of the entity’s financial performance.
2.3 Apply the processes and procedures undertaken by auditors in planning an audit.
• Auditors obtain an understanding of the entity and its environment to enable them to plan the audit.
2.6 Apply the appropriate standards that relate to audit planning.
• ISA 250 (Revised) Consideration of Laws and Regulations in an Audit of a Financial Statements states
that the auditor must obtain a general understanding of the legal and regulatory framework applicable
to the entity and the industry and the entity’s level of compliance.
• ISA 315 (Revised) Identifying and Assessing the Risks of Material Misstatement through Understand-
ing the Entity and Its Environment establishes mandatory requirements and provides application and
explanatory material to the auditor on obtaining an understanding of the entity and its environment
and on assessing the risks of material misstatement in the financial statements.
df_Folio:108
P
ol
ntr t
Co nmen ass Ris
es k
iro sm
v
en en
and communicatio
Information sys
Financial Reporting
Objectives
tem
n
s
M
on l
it o t ro
rin
g C o n iti e s
iv
a ct
The requirements for each of these five components are covered in ISA 315 (Revised), paragraphs
14–24 with the relevant application and explanatory material in ISA 315 (Revised), paragraphs
A77–A121. You should read these sections now.
The ISA 315 (Revised) paragraphs outline certain requirements of which an auditor must have an
understanding. These are:
• the control environment, including evaluating whether management has created and maintained a culture
of honesty and ethical behaviour and the appropriateness of the control environment (ISA 315 (Revised),
para. 14)
• whether the entity has a process for:
– identifying business risks relevant to financial reporting objectives
– estimating the significance of the risks
– assessing the likelihood of their occurrence
– deciding the actions to address these risks (ISA 315 (Revised), para. 15) — various different actions
are required by the auditor depending on whether the entity has established such a process (ISA 315
(Revised), paras 16–17)
• an understanding of the information system — including the related business processes — related to
financial reporting (ISA 315 (Revised), paras 18–19)
• an understanding of control activities relevant to the audit, which are the ones the auditor judges to be
necessary to understand in order to assess the risks of material misstatement at the assertion level, and
design further audit procedures responsive to those assessed risks (ISA 315 (Revised), para. 20), and an
understanding of how the entity has responded to risks arising from IT (ISA 315 (Revised), para. 21)
• an understanding of the major activities that the entity uses to monitor internal control over financial
reporting (ISA 315 (Revised), para. 22)
Pdf_Folio:109
Control Environment
The control environment sets the tone of an organisation. It ‘includes the governance and management
functions and the attitudes, awareness and actions of those charged with governance and manage-
ment concerning the entity’s internal control and its importance in the entity’ (ISA 315 (Revised),
paras A77–A78).
The tone of an organisation influences the control-consciousness of its people. Some elements of an
entity’s control environment have a pervasive effect on assessing the risks of material misstatement. For
example, an entity’s control-consciousness is influenced significantly by those charged with governance,
because one of their roles is to counterbalance pressures on management in relation to financial reporting
that may arise from market demands or remuneration schemes.
It is important that management, overseen by the board of directors, places a strong emphasis on
fraud prevention and fraud deterrence. Fraud prevention is enhanced by management establishing and
maintaining internal control, overseen by the board, including controls relevant to achieving financial
reporting quality. The importance of the ‘tone at the top’ in creating a culture of honesty and ethical
behaviour cannot be overestimated.
The auditor considers the following in evaluating the design of the entity’s control environment.
• Communication and enforcement of integrity and ethical values. Examples include the existence and
implementation of codes of conduct and other policies regarding acceptable business practice, conflicts
of interest, or expected standards of ethical and moral behaviour.
• Commitment to competence. Examples include job descriptions or other means of defining tasks that
comprise particular jobs; staff selection procedures.
• Participation by those charged with governance. Examples include the independence of the board from
management so that necessary, or even difficult and probing, questions are raised.
• Management’s philosophy and operating style. Examples include the nature of business risks accepted
and the attitudes and actions towards financial reporting, including the aggressiveness of the choice of
accounting policies.
• Organisational structure. Examples include the appropriateness of the entity’s organisational structure
and its ability to provide the necessary information flow to inform managers.
• Assignment of authority and responsibility. Examples include the assignment of responsibility and
delegation of authority throughout the organisation.
• Human resource policies and practices. Examples include the extent to which policies and procedures
for hiring, training, promoting and compensating employees are in place (ISA 315 (Revised), para. A78).
Pdf_Folio:110
Control Activities
Control activities are the policies and procedures that help ensure management directives are carried out
and include those listed here.
• Authorisation. Examples include the level of management with authority to authorise expenses to a
particular level to ensure that only authorised purchases are made. Other examples include controls
to ensure that goods are not shipped to a customer with bad credit risk or that goods are not shipped
to a customer if the invoice value is greater than the approved credit limit without authorisation of
management as there would be a high risk of non-payment for goods.
• Performance reviews. Examples include actual performance versus budgets, forecasts, prior periods and
competitors; major initiatives are tracked to measure the extent to which targets are being reached.
• Information processing. Examples include controls performed to check accuracy, completeness and
authorisation of transactions; a customer’s order is only accepted after reference to an approved customer
file and credit limit.
• Physical controls. Examples include that equipment, inventories, cash and other assets are secured
physically, such as in a secure location.
• Segregation of duties. Examples include division of duties among different people to reduce the risk of
error; responsibilities for authorising transactions, recording transactions and handling the related asset
are segregated.
Refer to ISA 315 (Revised), paragraphs A99–A104 for a discussion of which control activities are
relevant to the auditor.
Pdf_Folio:111
QUESTION 2.10
Discuss the main factors that may result in an internal control system failing.
Following the discussion of the components of internal control, we look briefly at internal controls in
SMEs before taking a closer look at controls in an IT environment.
QUESTION 2.11
CONTROLS IN AN IT ENVIRONMENT
The IT environment influences the internal control and the procedures adopted by an entity. The following
seven factors explain why.
1. There is a breakdown of the traditional division of duties between personnel and departments and
a concentration of the recording, processing and control functions within the IT department. This
concentration of functions has resulted in a greater reliance being placed on program controls, including
authorisation of transactions, by users to ensure the reliability of IT outputs.
2. The human scrutiny and checking inherent in manual systems disappears. This loss of human involve-
ment, coupled with the lack of visible evidence in IT, may reduce the potential to detect errors and
increase the potential for individuals to gain unauthorised access to information and assets or alter
information to the detriment of the entity.
3. The concentration of system expertise and control within the IT department, coupled with the
concentration of computer resources in one of a few locations within the entity, may increase the
potential risk of fraud or error and make detection difficult.
4. The partial or complete loss of traditional audit trails, as well as the temporary nature of such audit
trails in IT and the absence of source documents and visible output, will have a direct bearing on the
auditor’s assessment of the risks of material misstatements.
5. Access to computer programs and data files by multiple users increases the potential for unauthorised
access to, and alteration of, data and programs in the absence of appropriate controls.
6. IT ensures that all transactions entered are subject to the same processing procedures, thus increasing
the reliability of the system through the reduction of random errors. Poor programming, however, may
result in the occurrence of systematic errors, the effect of which can be greater than random errors if
not discovered.
7. IT may be designed to permit the single transaction update of multiple or database computer files as
well as the automatic initiation and execution of transactions. A risk is that an error in one data item
can potentially affect a number of different applications across the entity.
Types of Controls
Controls over IT systems are effective when they maintain the integrity of information and the security of
the data, such as systems process, and include effective general IT controls and application controls (ISA
315 (Revised), para. A107).
General IT controls refer to the overall controls an entity has over its entire IT environment. These
controls affect all applications processed by the IT department. The purpose of general IT controls is to
establish a framework of overall control of the IT activities and to provide a reasonable level of assurance
that the overall objectives of internal control are achieved.
Application controls refer to controls that are specific to individual accounting applications — that
is, they relate to, and are unique to, particular accounting systems (e.g. debtors, creditors, payroll and
inventory). The purpose of IT application controls is to establish specific control procedures over the
Pdf_Folio:113
Input
Computer processing
Computer general and programmed
control procedures application control
procedures
Output of processed
Exception reports
transactions and reports
User controls
Manual follow-up
over assertions
The integrity of the system output and financial statement representations depends on the effectiveness
of general controls. Because of the pervasive impact of general controls, significant weaknesses in general
controls may affect the reliability of application controls due to the potential risk of undetected fraud or
error in processing transactions.
General Controls
Organisational and management controls are designed to establish the:
• organisational structure of IT activities
• policies and procedures necessary to ensure the performance of duties
• segregation of incompatible functions.
In an IT environment, it is important to separate the systems development, systems maintenance,
database administration and operating functions. The IT department should be:
1. independent of the functions of initiating or authorising transactions and maintaining custody of assets
— it should not change or correct data that originated outside the department
2. segregated and separated from other user departments — there should be clearly defined lines of
authority and responsibility between IT personnel.
In the case of small IT installations, such as in a small business environment, it may not be possible
to achieve a satisfactory segregation of duties. If any degree of segregation can be achieved, however,
it should be between programming and operations. Adequate supervision may compensate for a lack of
segregation of duties.
Systems development and program maintenance controls are designed to establish control over:
• program changes
• the conversion, testing, implementation and documentation of new or revised systems, and access to
system documentation
• the authorisation and approval of new or revised IT systems
Pdf_Folio:114
EXAMPLE 2.11
General Controls
Acme Ltd is planning to update its accounting system. Computer hardware will be purchased from a
national vendor. Software will be written by members of the organisation’s IT staff. The update of the
accounting system will take place in phases, with the payroll function being completed first.
The payroll system functions in the following sequence.
• An employee’s immediate supervisor reviews and approves timesheets.
• The timesheets are sent to the payroll department where they are reviewed for completeness and
obvious errors.
• The timesheet data is converted into a transaction file for uploading into the payroll system.
• The transaction file is uploaded to the payroll system.
• Outputs include:
– online payment details
– a payroll journal
– payroll summary
– error listings.
df_Folio:116
P
Application Controls
The purpose of application controls is to provide reasonable assurance that transactions are appropriately
authorised and recorded, and are processed accurately, completely and in a timely manner and that incorrect
transactions are rejected, corrected and resubmitted. Application controls include controls over:
• input
• processing and computer files
• output.
Prior to relying on the general and application controls, the auditor should conduct a preliminary
evaluation of the controls to determine whether they are effective and efficient. Weakness in the general
controls may preclude reliance on application controls.
Input Controls
Input controls are designed to provide reasonable assurance that:
• transactions are authorised, and accurately and completely converted into machine-readable form, that
is, not lost, added to, duplicated or improperly changed
• incorrect transactions are rejected, corrected and resubmitted.
Proper Authorisation
Proper authorisation can be achieved through the following procedures.
• Duties are segregated.
• Access controls, data entry and program controls are used, such as field tests, reasonableness tests, limit
tests, validity tests, completeness tests and sequence tests.
• Transactions are authorised by affixing a signature or stamp onto source documents. (If the documents
are electronic, a digital signature and time stamp can be attached.)
• Transactions are approved by a responsible supervisor or through the use of special forms, access to
which is restricted to those designated to initiate transactions.
Accurate Conversion
Accurate conversion requires the following.
• Adequate document design (standardisation). This is a very important input control that aids in
safeguarding assets and in contributing to the accuracy of output information. Forms should be pre-
printed and standardised to reduce and monitor errors. Unchanged information can be pre-printed as
formatted forms, which are more readable, and all documents should be pre-numbered and sequentially
accounted for.
• Adequate training and supervision.
• Data entry manuals (written procedures). These deal with data conversion and the correction of
errors.
• Appropriate chart of accounts. Using one of these to code data can greatly reduce transcription and
transposition errors.
Completeness of Data
The following input controls are designed to ensure the completeness of data.
• ‘Turnaround documents’ are documents produced by the computer system that are later resubmitted
into the system. This minimises errors in data preparation when the output that has already been verified
becomes input. Most bills, including domestic power and telephone bills, are turnaround documents.
• Control totals are effective in ensuring that all data are accurate and complete: data have not been lost,
suppressed, duplicated, added or otherwise improperly changed. One control total is manually computed
Pdf_Folio:117
EXAMPLE 2.12
Controls in an IT Environment
China Wide Consortium (CWC) has recently converted its phone sales ordering service to an e-commerce
system where customers can place their orders and have them processed over the internet.
Under this new system, online customer purchases are initiated when customers access CWC’s home
page, click on the ‘Customer order’ icon, order the goods on the relevant template and then click on the
‘Submit’ icon. Clicking on the ‘Submit’ icon transfers the customer’s order to CWC’s central processing
facility. This then responds to customers, via an email message, informing them that the order has been
P df_Folio:119
Following obtaining an understanding of the entity and its environment, including internal controls, in
the next section, we turn our focus on risk assessments for specific matters that are likely to be significant
risks.
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
2.1 Explain the responsibilities of management and the auditor in relation to an audit.
• The auditor is responsible for gaining an understanding of the entity’s internal controls.
2.2 Evaluate historical financial information by applying professional scepticism and judgment.
• The deeper understanding of the entity and its environment obtained from the use of IT and data
analytics should improve the auditor’s ability to apply professional scepticism and professional
judgment during the audit.
2.3 Apply the processes and procedures undertaken by auditors in planning an audit.
• Auditors obtain an understanding of the entity’s internal controls to enable them to assess the
effectiveness of internal controls and plan the appropriate audit strategy.
2.4 Apply techniques to analyse factors that could impact fraud risk.
• Because of the pervasive impact of general controls, significant weaknesses in general controls may
affect the reliability of application controls due to the potential risk of undetected fraud or error in
processing transactions.
• Auditors need to determine if moving data to the cloud has introduced fraud risks.
2.5 Design appropriate processes and procedures undertaken by auditors to identify and assess
risks during audit planning.
• Auditors need to determine if moving data to the cloud has introduced risks with the integrity of data,
the accuracy of reports, susceptibility to fraud or cyber attack, segregation of duties, the availability
of records, and even compliance.
df_Folio:120
P
FRAUD RISK
The engagement team must discuss the susceptibility of the entity’s financial statements to material
misstatement due to fraud or error (ISA 315 (Revised), para. 10). These engagement team meetings provide
an opportunity for more experienced team members to share their insights (ISA 240, para. A11). Significant
risks determined in audit team meetings, and the way that the risks are to be addressed in the audit, must
be documented. ISA 240, paragraph A12 presents a list of issues that are ordinarily discussed, such as
consideration of circumstances that may indicate the possibility of fraud. The first point on the exchange
of ideas about potential frauds is often referred to as fraud brainstorming.
The auditor is required to perform certain procedures to obtain information for use in identifying the
risks of material misstatement due to fraud (ISA 240, para. 17). Enquiries are a major risk-identification
technique. The auditor is required to ask management, those charged with governance (i.e. the board) and
the internal auditor (where applicable) about:
• their assessment of the risk of material misstatement due to fraud
• procedures carried out by management for identifying and responding to risk at the account balance,
transaction class and disclosure levels, and the nature and extent of the board’s oversight of these
procedures
• their knowledge of any actual, suspected or alleged fraud (ISA 240, paras 18–22).
Factors to be considered include management’s own assessment of the risk of financial statements
misstatement due to fraud and detection and prevention measures implemented in response to these
perceived risks. Where an entity has multiple locations and/or business segments, the auditor must also
gain an understanding of the nature and extent of monitoring by management of each location and segment.
They must also ascertain whether any specific risk factors pertain to individual sites. Communications with
those charged with governance as well as employees regarding the risk of fraud and business practices
and ethical behaviour are also important. The frequency, nature (formal vs informal) and extent of such
communications are also part of the process.
ISA 240, paragraph A16 recognises that enquiries of management may be useful in detecting employee
fraud but of limited value in detecting management fraud. This is why enquiries are also to be sought from
others within the entity.
Pdf_Folio:121
Types of Fraud
There are four broad types of fraud. Examples of these types of fraud are shown in figure 2.13.
Pdf_Folio:122
1. Recording fictitious journal entries, particularly close to the end of an accounting period, to manipulate
operating results or achieve other objectives.
2. Inappropriately adjusting assumptions and changing judgments used to estimate account balances.
3. Omitting, advancing or delaying recognition in the financial statements of events and transactions that
have occurred during the reporting period.
4. Omitting, obscuring or misstating disclosures required by the applicable financial reporting framework,
or disclosures that are necessary to achieve fair presentation.
5. Concealing facts that could affect the amounts recorded in the financial statements.
6. Engaging in complex transactions that are structured to misrepresent the financial position or financial
performance of the entity.
7. Altering records and terms related to significant and unusual transactions (ISA 240, para. A4).
Auditors need to be aware that fraud may be perpetrated in a variety of ways. Perpetrators of fraud are
likely to know of the procedures that the auditor will perform to detect fraud, and therefore may carry out
the fraud strategically to reduce the effectiveness of these audit procedures. There is a checklist of ‘red
flags’ that indicate the possibility of fraud in ISA 240, Appendix 3. A sample of these red flags is provided
in figure 2.14. Perpetrators of fraud aiming for concealment may consult the checklist and design their
fraudulent activities so that suspicion is not aroused.
Refer to the checklist of ‘red flags’ that indicate the possibility of fraud in ISA 240, Appendix 3 for a
more detailed list of indicators.
According to PwC in 2018, 45% of respondents indicated their organisations had experienced fraud
by misappropriation of assets; cybercrime (31%); consumer fraud (29%) and business misconduct (28%).
The PwC report also states that organisations are using innovative and sophisticated technologies such as
machine learning, predictive analytics and other artificial intelligence techniques to fight fraud.
Pdf_Folio:123
False or misleading records or documents are often used to conceal the fact that assets are missing or have
been used without proper authorisation. Not all misappropriation of assets leads to material misstatements
as the dollar amount may be below the materiality threshold. However, it could indicate a pattern of small
misappropriations being repeated either frequently or infrequently.
Bribery and Corruption Frauds
Bribery involves influencing someone’s behaviour by giving or receiving an unearned reward — often
referred to as a kickback. Corruption involves seeking advantage through illegitimate means through
unlawful or improper behaviour. Bribery and corruption often go hand-in-hand with money laundering,
which is the process of concealing the origins of money gained from illegal activities.
Cyber Frauds
Cyber frauds include deliberate deception for unfair or unlawful gain through the internet. This is a growing
area of fraud and includes traditional types of fraud conducted through the internet. One of the biggest
concerns in this area is data theft. Of particular concern are the theft of intellectual property, trade secrets
and client data. Cyber frauds have the potential to disrupt the business’s operations. Types of cyber frauds
identified in the 2018 Global Economic Crime and Fraud Survey are shown in figure 2.15
You can read more about recent trends in fraud and misappropriation of assets in PwC’s
‘Pulling fraud out of the shadows: Global Economic Crime and Fraud Survey 2018’, available at:
www.pwc.com/gx/en/forensics/global-economic-crime-and-fraud-survey-2018.pdf
FIGURE 2.15 Types of cyber frauds that companies were a victim of through cyber attack
Politically
Asset 24% 5% motivated or state
misappropriation sponsored attacks
Other
Disruption of business 30% 8%
processes
These three factors are often referred to as ‘the fraud triangle’ (see figure 2.16) First, the incentive
(or pressure) arises from a perceived benefit from committing fraud. Second, opportunity results from
the conditions that allow fraud to occur. The third element of the triangle, attitude or rationalisation, is the
propensity of the perpetrator of the fraud to rationalise the fraud by justifying or making excuses for the
fraud in their own minds. For example, a manager who works extremely long hours and is not paid for
the extra hours may inappropriately rationalise that a fraud is not unreasonable under the circumstances.
Opportunity
Incentives/pressures Attitudes/rationalisation
EXAMPLE 2.13
QUESTION 2.12
How could professional scepticism be encouraged within the engagement team, with respect to
the susceptibility of the entity’s financial statements to material misstatement due to fraud?
The next significant risk factor to be discussed relates to auditing accounting estimates.
EXAMPLE 2.14
The going concern basis of accounting is fundamental to the preparation of financial statements. Under
the going concern basis of accounting, an entity is expected to continue in business for the foreseeable
future. There is no intention or necessity to liquidate or otherwise cease its operations. The foreseeable
future is referred to as the relevant period in auditing standards and covers at least 12 months from the date
of the financial statements (ISA 570 (Revised), para. 13).
When the entity is considered to be a going concern, its ‘assets and liabilities are recorded on the basis
that the entity will be able to realize its assets and discharge its liabilities in the normal course of business’
(ISA 570 (Revised), para. 2). If an entity is not a going concern, assets and liabilities are recorded at
liquidation values.
Pdf_Folio:129
CLIMATE-RELATED RISK
To date, climate change risks have generally been reported in the operating and financial review or
management commentary sections within the annual report. As these sections are outside the financial
statements and associated notes, it is defined in the auditing standards as ‘other information’. Therefore,
auditors are only required to read it to identify if any material inconsistencies with the audited financial
statements or any material misstatements of fact exist. Consideration of this other information is limited
to the auditor’s knowledge obtained in the audit.
However, the AASB/AUASB issued a joint guidance statement on the integration of climate-related
risks into financial statement materiality considerations. Auditors will need to consider if their client’s
climate-related risks are material, and if material, whether those risks are adequately disclosed in the
financial statements. Climate-related risks are considered material if they are important to investors’
decision making. As such, if climate-related risks are addressed in the financial statements, then it will
be subject to the scrutiny of an audit, necessitating engagement of expertise to understand those risks and
their impact on the financial statements (Grayston 2019).
This shift of emphasis from ‘other information’ to the financial statements is particularly significant
for auditors as they are required to provide an opinion on the financial statements but not on additional
Pdf_Folio:130
QUESTION 2.13
ISA 250 (Revised) and section 360 of the Code provide guidance to help the auditor in working out
how best to respond to identified or suspected NOCLAR. Outline how the auditor should respond
when the following NOCLAR are discovered during an audit.
(a) The audit client narrowly missed a deadline for filing its tax return.
(b) The auditor found that the audit client has not been sufficiently accruing and paying its
employees’ superannuation/pension fund commitments.
Our next section discusses the various risk assessment procedures that auditors use in obtaining an
understanding of the entity, including internal controls and identified significant risks.
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
2.1 Explain the responsibilities of management and the auditor in relation to an audit.
• The auditor is responsible for assessing the risk of fraud, appropriateness of accounting estimates,
related parties risk, going concern risk, climate-related risk and NOCLAR.
• During the risk assessment phase, the objective of the auditor is to gain an understanding of a client’s
related party relationships and transactions.
• Management is required to make an assessment of an entity’s ability to continue as a going concern.
• The auditor’s responsibility with regard to going concern is to consider the appropriateness of
management’s use of that basis of accounting in preparing financial statements, and to consider
whether there are material uncertainties about the entity’s ability to continue as a going concern that
need to be disclosed in the financial statements.
• The AASB/AUASB issued a joint guidance statement on the integration of climate-related risks
into financial statement materiality considerations. Auditors will need to consider if their client’s
climate-related risks are material, and if material, whether those risks are adequately disclosed in
the financial statements.
• Expectations regarding consideration of climate-related risk for the June 2019 reporting period
will necessitate auditors having sufficient understanding of relevant climate-related risks to enable
df_Folio:132
P
P df_Folio:133
QUESTION 2.14
Provide one example of an audit procedure for each of the four procedures listed below.
1. Observation of the entity’s operations
2. Inspection of documents
3. Inspection of reports prepared by management and those charged with governance
4. Inspection of the entity’s premises and plant facilities.
Strategic Analysis
As part of the strategic analysis of the entity, the auditor obtains information about the:
• broad environment in which the client operates
• industry within which the organisation operates
df_Folio:134
P
TABLE 2.5 Risk assessment: strategic risks and potential audit implications
Source of
Strategic business risk/threat threat Potential audit implications
Competitors begin offering extended Competitors • Inherent risk: Increase in warranty commitments may
warranty protection on products. require that warranty expense estimates be increased
above historical patterns.
Competitors are rapidly increasing the Competitors • Control risk: Reliability of decision making and
rate paid to key senior accounting and information processing may decrease with employee
management personnel. turnover.
• Inherent risk: Allocations of labour costs may need to
be revised based on relative changes in salary levels.
• Inherent risk: Accruals for benefits may need to be
increased.
Top-grade raw materials are in Suppliers • Inherent risk: Wastage and spoilage rates may need
extremely short supply due to bad to be increased in standard costing formulas.
weather conditions in producing • Inherent risk: Valuation problems related to purchase
regions. commitments may exist.
• Control risk: Pressure to cut corners to meet
customer demand.
Customer industries are in a recession. Economic, • Inherent risk: Receivables may not be collectible at
customers historical rate and allowance for doubtful debts may
need to be increased.
• Going concern risk: Shrinking customer base.
P df_Folio:135
(continued)
Source of
Strategic business risk/threat threat Potential audit implications
Consumer tastes have changed, Social, • Going concern risk: Loss of market share.
necessitating improved functionality customers • Inherent risk: Inventory on hand may become
and quality in company products. obsolete or out of favour so that carrying values may
not be realisable.
• Control risk: Pressure to hit sales targets to protect
jobs and/or bonuses.
The preferred distribution channel Technology, • Inherent risk: Existing distribution channels may need
for the company’s product changes customers to be shut down with resulting restructuring cost
from retail locations to internet, (lay-offs, asset disposal).
telemarketing and home delivery. • Going concern risk: Inability to adapt on a timely
basis.
New entrant to the market is Technology, • Inherent risk: Inventory valuation may need to be
technologically superior to current new reduced to lower of cost or market value due to
products. entrants obsolescence or excess quantities.
• Going concern risk: Loss of market share.
Government imposes new regulations Social, • Going concern risk: Loss of market share if not
on distribution of a company’s political adaptable.
product. • Inherent risk: Inventory valuation may need to be
reduced to lower of cost or market value due to
obsolescence or excess quantities.
• Control risk: Efforts to circumvent regulations to meet
sales targets.
Activists protest the company’s Social • Inherent risk: Valuation of capitalised development
approach to research and develop- costs if associated product demand drops.
ment (R&D). • Control risk: Efforts to hide or disguise nature of R&D.
Foreign currency fluctuations squeeze Economic • Inherent risk: Proper treatment of exchange gains
profit margins on international sales. and losses.
• Inherent risk: Accounting treatment of financial
derivatives.
Source: Adapted from Knechel, W. R. & Salterio, S. 2017, Auditing: Assurance and Risk, 4th edn, Taylor & Francis, New York,
pp. 163–5.
Strengths Weaknesses
Opportunities Threats
Just making lists of the strengths, weaknesses, opportunities and threats is not sufficient. It is important
to use the SWOT analysis to learn about the entity’s situation and what impact it is likely to have on the
audit.
Strengths refer to characteristics, expertise, assets, etc. that provide a competitive advantage (e.g.
technological know-how, natural resources, strong management, good location, valuable brands, superior
products, strong alliances). A weakness is a condition that puts it at a competitive disadvantage (e.g. lack
of technological know-how, poor location). Entities have a range of market opportunities, and they need to
appraise the profit potential of the opportunities most likely to be successful. In addition, entities face
threats to their profitability and competitiveness from the environment, for example, due to changing
customer tastes and new technologies.
Example 2.15 demonstrates how risks identified during a SWOT analysis impacts on audit planning.
Review this example now.
Pdf_Folio:137
Identifying Risks
The client, FB Ltd, is a manufacturer of timber flooring. During a SWOT analysis, it is identified that more
than 90% of the company’s production is supplied to one customer LR Ltd (a larger retailer of home
furnishings). There are many alternative suppliers, and LR Ltd has mentioned the possibility of switching
to another supplier.
............................................................................................................................................................................
What impact does this information have on identifying risks faced by FB Ltd?
Check your response against the suggested answer at the end of the book.
Political
• Government outsourcing
• Government policy
• Social welfare policies
• Taxation laws
Economic
• Business cycles
• Disposable income and savings rates
• Inflation rates
• Interest rates
• Money supply
• Unemployment levels
Social
• Attitudes to work and leisure balance
• Education levels
• Income distribution trends
• Lifestyle changes
• Mobility of the labour force
• Population demographics, ageing
• Workforce diversity
Technological
• Government and industry focus on
technological effort
• Government and industry spending on
research and development
• New discoveries/development
• Obsolescence rates for equipment
• Speed of technology transfer
The PEST framework can under-emphasise environmental and legal issues. In light of this weakness, the
PEST analysis may be extended to PESTEL (political, economic, social, technological, environmental and
legal) analysis. Figure 2.18 can be converted to a PESTEL framework by adding an environmental category
df_Folio:138
P
Political
• Government stability in routes flown
• Traffic rights and freedom (e.g. what countries
can the aircraft land in)
• Route restrictions (e.g. open-sky agreements)
• Airport restrictions
• Taxation on tickets
• Terrorist activities
Environmental
• Environment regulation related to noise and
pollution emission
• Airport curfews related to noise level
• Community around airports
• Fuel consumption
• Carbon emissions
Legal
• Safety regulations
• Foreign ownership regulations
• Employment law
P df_Folio:139
Possible risk of
Primary activity Example Weakness/risk misstatement
Pdf_Folio:140
TABLE 2.7 Examples of support activities, deficiencies and implications for audit risk
Firm infrastructure Planning, finance, accounting, quality Deficiencies in this firm infrastructure may
control, information management lead to poor estimates of financial amounts
aimed to support the entire value (e.g. allowance for doubtful debts, fair value
chain. estimates for impairment decisions).
Human resource Activities involved with recruiting, Changes in human resource management
management training, staff development, related to recruiting and rewarding policies
rewarding. may increase the likelihood of error and
fraud — that is, recruiting, training and staff
development policies potentially affect the
likelihood of error; changes to reward systems
can affect the likelihood of fraud (e.g. increased
incentives).
(continued)
P df_Folio:141
Technology Improving products and processes Deficiencies in product design and process
development used in production (e.g. research development can lead to poor product
and development, product design, quality (and consequent effects on inventory
process development). valuation and warranty provisions) or late
deliveries (and consequent effects on
collectability of trade debtors difficulty of
achieving sales targets, etc.).
Example 2.16 focuses on the breakdown of Creamy Ltd’s value chain. Review the example now to see
how this impacts on the audit.
EXAMPLE 2.16
Analytical Procedures
An important technique for understanding the client and the industry is analytical procedures. Analytical
procedures refers to the investigation and analysis of fluctuations and relationships to determine whether
there are inconsistencies with other relevant information or deviations from predicted amounts.
The risk assessment procedures outlined in ISA 240, paras A13–A28, require auditors to consider
unusual or unexpected relationships and other information derived from analytical procedures, audit team
discussions and other internal/external sources that may be indicative of material financial statement
misstatement due to fraud. Analytical procedures to test expected relationships between financial statement
items and accounts may assist the auditor to identify unusual transactions and events. In addition,
auditors are required to ‘evaluate whether unusual or unexpected relationships that have been identified
in performing analytical procedures . . . indicate risks of material misstatement due to fraud’ (ISA 240,
para. 23).
Analytical procedures include:
• comparisons with prior periods, anticipated results (e.g. budgets and forecasts) and industry comparisons
• consideration of relationships between elements of financial information that would be expected to
follow a predictable pattern
• relationships between financial information and relevant non-financial information.
Certain elements of financial accounting would be expected to conform to predictable patterns, for
example:
• gross margin and sales
• sales commission and sales
• trade debtors and sales
• interest expense to borrowings.
df_Folio:142
P
Profitability Ratios
Profitability ratios generally provide an indication of an organisation’s profitability and changes in
profitability. Profitability ratios are shown in figure 2.20.
Gross profit
Gross profit (Gross margin) =
Sales
Note that many ratios can be calculated in a number of different ways. For example, for return on asset
(ROA), EBITDA, EBIT, profit before tax or net profit after tax could be used. If you are unsure about the
interpretation of any of the ratios, you should consult any introductory financial accounting textbook.
The gross margin ratio is one ratio that is commonly used by auditors. For many firms, this ratio
will have a relatively stable and predictable pattern. Fluctuations may indicate changes in the nature of
the business (such as competition, pricing policies, manufacturing efficiencies, sales mix changes), or
financial statement errors. If the gross margin to sales ratio is increasing, the auditor needs to be aware
of the possibility that sales may be overstated (e.g. fictitious sales without a corresponding cost of goods
sold (COGS) entry). The return on assets ratio and net profit ratios (also called ‘net profit margin’ ratios)
indicate trends in profitability and the effectiveness with which the organisation’s resources are being used.
Many companies use EBIT (earnings before interest and tax) or EBITDA (earnings before interest, tax,
depreciation and amortisation) instead of operating profit before tax when calculating this ratio. Ratios of
expenses to sales may provide reasons for changes in profitability as well as possible financial statement
errors. For example, a large increase in the ratio of repairs and maintenance to sales may indicate that a
capital item has been charged to the repairs and maintenance account.
Activity Ratios
Activity ratios provide an indication of an entity’s efficiency in using available resources. They include
those shown in figure 2.21. Note that days in debtors is also referred to as average collection period in
days, and days in payables is also referred to as average payment period in days.
Pdf_Folio:145
Sales
Asset turnover =
Total assets
Credit sales
Debtors turnover =
Average debtors
The inventory turnover ratio can be compared over time and with the industry average. If the ratio is
substantially below those of past years or the industry average, it can indicate obsolete and slow-moving
stock. Generally, a high ratio is preferable as it indicates efficient inventory management. However, it can
also indicate problems such as unrecorded inventory. The ratio varies significantly between industries, and
for some industries, it will vary seasonally. Ratios may also vary within industries because of different
methods of accounting for inventory (e.g. first-in first-out (FIFO), weighted average).
The debtors turnover ratio is an indication of an entity’s credit control policy. The higher this ratio is, the
better the performance. A decrease in this ratio compared to prior years or industry average may indicate
deficiencies in the entity’s credit and collection policies, possible uncollectability of some accounts,
possible fictitious sales or incorrect cutoff, or an increase in the credit period granted in order to increase
sales. Fluctuations in these ratios may indicate changes in liquidity or cash management procedures.
These ratios used an average of opening and closing balances for the year (i.e. opening inventory plus
closing inventory divided by two). It is common to use closing figures (i.e. year-end balances) for these
analytical procedures as this version of the ratios has the advantage of increasing the likelihood of detecting
a material misstatement related to year-end adjustments. For example, if there was a financial statement
fraud where cost of goods sold had not been recorded by overstating year-end inventory (i.e. not putting
through the journal entry Dr. COGS, Cr. Inventory), it would be easier for the auditor to detect if the
inventory turnover ratio used the closing balance.
Liquidity Ratios
Liquidity ratios provide an indication of an organisation’s ability to meet current obligations as they fall
due. Unusual or unexpected trends may also indicate over- or understatement of current assets (e.g. trade
debtors, inventory) and current liabilities (e.g. payables, accruals). The ratios need to be reviewed with
regard to the organisation’s current and projected cash flow. Examples of liquidity ratios are shown in
figure 2.22.
Current assets
Current ratio =
Current liabilities
df_Folio:146
P
Total liabilities
Debt–equity ratio =
Shareholders’ equity
Long-term liabilities
or
Shareholders’ equity
Total liabilities
Debt–assets ratio =
Total assets
EBIT
Number of times interest earned =
Interest expense
The first two ratios indicate the gearing level. The third one considers the ability of the entity to meet its
interest commitments as they fall due. Changes in these ratios may indicate business risk, and the auditor
needs to consider related audit risk.
There are often multiple ways to calculate the various ratios. For example, some calculations can be
performed using either profit before tax or profit after tax. When performing such analysis, the key thing
to remember is to be consistent with the calculation chosen (and understand the inputs used in a given
output). This consistency must be maintained from year to year for comparability.
The debt–equity ratio, for example, can be calculated as long-term liabilities divided by shareholders’
equity or total liabilities divided by shareholders’ equity. The choice of ratio will depend on the outcome
required by the auditor. For example, if the user wishes to know what proportion of total resources was
being provided by the owners as against those from third parties, the likely measure would be total liabilities
divided by shareholders’ equity. If, on the other hand, they were considering the long-term financing
position of the firm, then they would use the ratio of long-term liabilities divided by shareholders’ equity.
If the auditor is looking for unusual trends, they may calculate both versions of the ratio.
In addition, the relationships between different ratios can be used to determine areas that require
particular attention. This is illustrated in example 2.17. Review this example now.
EXAMPLE 2.17
P df_Folio:147
............................................................................................................................................................................
What do the relationships between these key ratios tell the auditor about areas that require audit attention?
Check your response against the suggested answer at the end of the book.
QUESTION 2.15
While performing the preliminary analytical procedures at the audit planning stage, a substantial
increase in goods returned (as a percentage of total sales) was observed over last few months.
Which assertions could be identified for potential risk of misstatement? Explain why.
DuPont Analysis
In interpreting the set of ratios discussed, it is important to consider the relationships between ratios.
One way of doing this is to consider a DuPont analysis. The name is used because DuPont in the
United States was the first company to formally integrate the linking of these ratios into its organisational
control system. For example, the DuPont analysis shows that ROA can be explained by profit margin
and total assets turnover. The relationship between relevant ratios used with DuPont analysis is shown in
figure 2.24.
A disadvantage inherent to all financial ratio analysis methods, including DuPont analysis, is that when
used for comparing one entity’s profitability and efficiency with that of another entity, it works best when
the two entities are of similar size and operate within the same industry. As many business entities are now
diversifying, it is not easy to find a suitable entity to use for comparison purposes.
Common-Size Statements
Common-size statements are another common method used to help the auditor in identifying trends that
indicate where additional attention will be needed during the audit.
If you are unsure how to prepare common-size statements, refer to either an auditing or introductory
financial accounting textbook.
Example 2.18 demonstrates the use of common-size statements to identify trends that the auditor would
need to pay additional attention to during the audit. Review this example now.
df_Folio:148
P
P df_Folio:149
............................................................................................................................................................................
What trends indicate areas where the auditor will need to pay additional attention during the audit?
Check your response against the suggested answer at the end of the book.
QUESTION 2.16
Your client is Gateshead Pty Ltd, a large family-owned company which imports and sells computer
hardware products. You are planning the 30 June 20X9 audit and, from your enquiries of manage-
ment, have obtained the following information.
1. In January 20X9, Gateshead applied for, and was granted, a new loan. The submission made to
the bank stated:
• the current ratio was 0.90
• gross profit was up by 25% compared with that at the same time last year
• the debt-to-equity ratio was 0.40.
2. The bank agreed to the new loan but did enter into a loan covenant with Gateshead. The covenant
required that the company should not breach certain ratios and placed certain restrictions on
dividends.
Based on your prior experience with the client, you are sceptical about the validity of the ratios
discussed in the submission. Outline the specific audit planning implications of this information.
Following our discussion of the common methods used for risk assessment, we now turn our focus to a
more recent addition to the auditors’ collection of risk assessment tools — i.e. audit data analytics.
Data analytics
Being able to analyse the entire population of a dataset contributes to the audit planning process as:
• auditors will be equipped with a better understanding of the scale and operations and the client
which feed into resource allocation decisions for engagements and allows auditors to engage more
meaningfully with the client when undertaking risk assessment procedures
• auditors will be able to perform more focused audits in areas of higher risk identified (e.g. anomalies,
outliers) through the application of data analytics tools (Stansell 2018).
Example 2.19 provides an illustration of how data analytics is used during audit planning. Review the
example now.
EXAMPLE 2.19
The use of ADA is providing opportunities to rethink how an audit is performed. In some ways, the
audit does not change as the auditor must still audit the same assertions, understand the entity and its
environment, and must still understand an entity’s internal controls. However, ADA allows the auditor to
rethink how to assess risk and how to perform substantive procedures to collect audit evidence.
Integrating analytics into audits poses many challenges. For example, access to audit-relevant data can
be limited; qualified and experienced resources to process and analyse the data is scarce; and integrating
analytics into the audit continues to be a challenge for auditors (Ernst & Young 2017). However, progress
is being made on each front.
Pdf_Folio:151
Pdf_Folio:152
Pdf_Folio:153
Data analytics
techniques for
risk assessment
Matching
Regression Time-series
Cluster analysis information in key Visualisation
analysis regression
data fields
Source: Johnson & Wiley 2019.
Cluster Analysis
Cluster analysis is the process of discovering groups (termed clusters in data science) of similar items
in a set of data; items in the same group are similar, while items in different groups are not as similar.
The characteristics of the groups need not be known beforehand; they are determined by the data. For
this reason, it is a particularly useful technique when the auditor does not know much about the data set.
However, in the audit environment, clustering is often informed by the auditor’s knowledge of the business
and industry, knowledge of the client, and an understanding of the accounts, transactions, and assertions
being audited. Consequently, the creation of groups should be guided by a combination of the data and
the auditor’s expert knowledge. The auditor is generally not advised to outsource clustering work without
active communication with the person performing the clustering.
Cluster analysis involves sorting client data into various dimensions or measures. For example, data
can be sorted based on location, cost centre, or manager. Once sorted, it can be measured across those
dimensions for items such as rent expense, sales revenue, inventory (sold, on hand and purchased).
Following this, data can be analysed to determine whether the relationships between the various data are
consistent with the auditors’ understanding of their client. Summaries can be prepared using a range of
criteria such as by month, division or manager.
Regression Analysis
Regression analysis can be used to investigate relationships among different groups of data (variables). This
analysis considers the relationship between a dependent variable, such as sales, and various independent
variables, such as selling costs, purchases, and advertising expense (Johnson & Wiley 2019). Regression
analysis provides a statistical measure of the relationships among data and establishes whether movements
in the independent variables result in a change in the dependent variable. Any significant differences
between the client’s reported balances and what the regression model predicts are investigated by the
auditor as they indicate a potential misstatement (e.g. an overstatement of sales relative to the associated
expenses).
Time-Series Regression
Time-series regression can be used to analyse data that occur regularly within the client, for example, sales
and purchases. This form of analysis uses data from the past to predict the future. For example, sales made
in the past can be used to predict sales in the current period. The audit team can then investigate significant
fluctuations in expected sales trends, taking into consideration changes that occurred during the period
that may explain the observed variations. For example, if the client closed some retail outlets it would
explain a sharp decline in sales. When conducting a time-series analysis, auditors look at the long-term
trend, seasonal variations (for example, sales of frozen yoghurt are likely to be higher in summer), and
unexpected variations.
Visualisation
Visualisation is the representation of a data set, or key information, as a chart or another image.
Visualisations are produced to reveal information to people. Good visualisations have the following
characteristics.
• Facilitate people making visual comparisons between data elements. This can help auditors to identify
patterns, deviations from patterns, and outliers in the analysis stage of ADA.
• Are generally understood by a wider audience. Visualisations reduce the message to its core components
and use minimal, or no, jargon. This is particularly useful to auditors because they have to present
findings to business people with varied backgrounds. This benefit is also applicable to auditors sharing
the results of ADA with the rest of the audit team who will not be as familiar with ADA as the auditor
who performed it.
• Communicate a lot of information efficiently. There is truth to the saying a picture is worth a thousand
words. Managers are extremely busy people and so auditors will benefit from being able to communicate
their findings efficiently. Once again, a similar logic applies to auditors communicating findings within
an audit team.
• Are likely to be better remembered. Having a strong recollection of the findings from ADA is useful to
the auditor when combining the large number of findings to make sense of the audit as a whole. It is
also useful for clients (and any other stakeholders) to better remember what auditors are trying to tell
them.
In the context of ADA, a visualisation can be used to assist with the analysis, to communicate findings
effectively and efficiently, or both. The use of visualisation in the form of a planning dashboard can be
very useful in understanding the client’s processes and data population, assisting in identifying inherent
Pdf_Folio:155
Microsoft Microsoft Excel is commonly used by many CPAs as a basic tool for various analyses. The latest
Excel version of Excel includes a variety of tools to improve the ability to import data, as well as some
new functions and workflow tools.
IDEA IDEA is a powerful and user-friendly tool designed to help accounting and finance professionals,
including CPA firms and internal audit groups extend their auditing capabilities, detect fraud, and
meet documentation standards. It easily imports data from almost any source to analyse large
data sets, report findings using visualisation tools, and automate repeatable processes without
programming. See IDEA’s Academic Partnerships at http://www.casewareanalytics.com/idea-
academic-partnership.
ACL ACL is another popular audit software, similar to IDEA, that is used by accounting firms and internal
audit groups.
Tableau The focus of Tableau software is visual analytics to help individuals and organisations see and
understand their data. Tableau Desktop and Tableau Prep are free for students and faculty: see
https://www.tableau.com/academic/students.
R R is one of the most popular software environments for data science. It is open source, which
means it is freely available to all users. R provides a vast array of analytics and visualisation
capabilities that can be used for any purpose, including ADA. One of the reasons for its popularity is
that R has ongoing updates from the analytics community and thus is kept up-to-date with cutting-
edge advances in analytics. RStudio is a popular user interface to access R that many people
find easier to use than R directly. Details and installation instructions for RStudio can be found at
https://www.rstudio.com/. Please note that R should be installed (https://www.r-project.org/) before
installing RStudio.
Python Python is another very popular programming language for data science, with similiar capabilities
as R.
Power BI Power BI is a business analytics service by Microsoft. It provides interactive visualisations and busi-
ness intelligence capabilities with a simple interface enabling end-users to create their own reports
and dashboards. Guided learning of Power BI is available at https://powerbi.microsoft.com/en-
us/learning
Qlik Qlik Sense helps you do more with data by easily combining any data sources, regardless of size or
Sense complexity, into a single view. A free trial is available at www.qlik.com/us
Example 2.20 demonstrates the use of audit data analytics to items of interest where the auditor will
need to pay additional attention to during the audit. Review this example now.
Pdf_Folio:156
Product A
Product B
Inventory sales $ per invoice
Items to be
investigated
............................................................................................................................................................................
What do the outliers indicate?
Check your response against the suggested answer at the end of the book.
Source: Adapted from CPA Canada 2017.
When testing 100% of the population using data analytics, it could potentially create an issue with a large
number of outliers being identified that would require the auditor’s attention. Using prioritisation methods
to filter the outliers would allow auditors to focus on items with a higher risk of material misstatement for
follow-up substantive procedures (No, Lee, Huang & Li 2019).
Pdf_Folio:157
Expected sub-process
Adjustments by
unapproved staff
Approved
pricing adjustments
Invoice issued
Using Data Analytics and Data Visualisation to Assess the Risk of Fraud
Data analytics and data visualisation can uncover a wealth of evidence and paint a clearer picture than
traditional analytical procedures as it includes the analysis of unstructured data. Accounts that have
been manipulated to conceal fraud usually show unusual relationships with other accounts that were
not manipulated. Data analytics can help to identify fraud and errors when combined with interviews to
gain an understanding of the business operations, accounting processes and information systems (Todd &
Gill 2018).
Financial fraud and errors are more difficult to detect when controls have been circumvented, but most
can be detected much sooner through data analytics and visualisations when designed to drill down into
financial data to identify suspicious transactions. Some examples of where data analytics can be used for
identifying suspicious transactions include finding:
• duplicate supplier invoices
• vendor’s invoices regularly under the threshold where an executive’s signature is required
• invoices with consecutive invoice numbers supplied to one vendor
• multiple invoices with the same issue date from one vendor
• fictitious vendors
• manipulated dollar values (Todd & Gill 2018).
Analysis of unstructured data (e.g. email, text, voicemail etc.) can also provide invaluable insights into
data manipulations by employees or management, especially when patterns of deceit emerge.
The next section discusses how auditors respond to the assessed risks. The key points covered in this
section, and the learning objectives they align to, are shown below.
KEY POINTS
2.2 Evaluate historical financial information by applying professional scepticism and judgment.
• In carrying out these risk assessment procedures, the auditor obtains an understanding of the entity
and its environment, which provides the frame of reference for planning and exercising professional
judgment throughout the audit.
• When the engagement team has a discussion to gain a better understanding of potential fraud or
errors, professional judgment is required in order to decide whom to include in the discussion, how
and when the discussion occurs and its extent.
df_Folio:158
P
QUESTION 2.17
How could an understanding of the internal and external environment of the audit client facilitate
the identification and evaluation of the risk of material misstatement due to fraudulent activity?
Having gained an understanding of the entity and its environment, including its internal control and any
significant risk factors, the auditor will respond to the assessed risks by determining the appropriate overall
audit strategy prior to performing the audit.
df_Folio:160
P
Tests of
controls
Planned level of
substantive procedures
QUESTION 2.18
Princess Island Vineyards is a boutique wine maker based on Princess Island. Over the years, the
business has grown firstly by supplying local retailers, and then through exports. In addition, there
is a cellar door shop and café located next to the main processing plant on Princess Island, serving
tourists who also visit the other specialist food and wine businesses in the region. Quality control
over the wine manufacturing process and storage of casks and bottles at Princess Island Vineyards
is extremely high. All members of the business are committed to high product quality because any
poor practices which could result in a drop in wine quality would ruin the business very quickly.
The export arm has been built up to become the largest revenue earner for the business by
the younger of the two brothers who have run Princess Island Vineyards since it was established.
Jim Bannock has a natural flair for sales and marketing but is not so good at completing the
associated detailed paperwork. Some of the export deals have been poorly documented, and Jim
often agrees to different prices for different clients without consulting his older brother, Bob, or
informing the sales department. Consequently, there are often disputes about invoices and Jim
makes frequent adjustments to debtor accounts using credit notes when clients complain about
their statements. Jim sometimes falls behind in responding to customer complaints because he
is very busy juggling the demands of making export sales and running his other business, Café
Consulting, which provides contract staff for the café business at Princess Island Vineyards.
1. Identify the factors that would affect the preliminary assessment of inherent risk and control risk
at Princess Island Vineyards.
2. Explain how these factors would influence the auditor’s reliance on control testing and substan-
tive testing for sales, inventories and debtors.
Tests of Controls
Once an understanding of the internal control that is sufficient for audit planning is obtained, the auditor
must assess the control risk or the risk of material misstatement occurring. If the auditor assesses that
control risk is less than high, it means they plan to rely to some extent on key controls in the control
system. They need evidence to support reliance on these controls; the tests to gather this evidence are
called tests of controls. If control risk is assessed as high, then no reliance is to be placed on these controls,
there will be no testing of the controls, and more substantive testing will need to be undertaken.
Pdf_Folio:161
QUESTION 2.19
The initial audit plan for sales transactions placed substantial reliance on the system of internal
control and the use of analytical procedures rather than substantive tests of detail. The testing of
the internal control system for sales has found a significant number of instances where customers’
credit ratings have not been checked. The sales manager states that these changes are the result
of difficulties in maintaining past sales levels.
Your task is as follows.
1. Identify the balance sheet account and the relevant assertion most at risk given the information
provided. Explain why.
2. Discuss how the initial planned strategy would change given the additional information in regard
to the results of testing of controls.
Substantive Procedures
Substantive procedures are aimed at detecting material misstatement (at the assertion level) in the dollar
value of the information contained in the accounting records or in the financial statements. Thus, the risk of
material misstatement is reduced by the auditor undertaking tests of controls and substantive procedures.
If the auditor can gain confidence that the controls in place will help reduce material misstatement, the
auditor is able to reduce the level of substantive testing.
Substantive procedures consist of two categories: substantive analytical procedures and tests of details
(ISA 330, para. 4). A more detailed discussion of actual procedures is included in module 3.
Analytical procedures include the comparisons of the entity’s financial information with prior period
information, budgeted information and similar industry information. They also include a consideration of
the relationship of elements of financial information where one would expect a predictable pattern (e.g.
gross margin to sales) and between financial and non-financial information (e.g. payroll costs and employee
numbers). Analytical procedures are generally more applicable to large volumes of transactions that tend
to be predictable over time.
Tests of details are tests of transactions and balances designed to obtain direct evidence to support the
account balances shown in the financial statements. Commonly, this will involve drawing conclusions from
a sample of the transactions or account balances and projecting these results to the entire population. For
example, tests of details relating to PPE could include inspecting invoices for new acquisitions, checking
the arithmetic on depreciation schedules, and inspecting specific items of PPE for both existence and
valuation (e.g. evidence of deterioration).
‘Irrespective of the assessed risks of material misstatement, the auditor shall design and perform
substantive procedures for each material class of transactions, account balance and disclosure’ (ISA 330,
para. 18). If under ISA 315 (Revised) it has been determined that the ‘assessed risk of material misstatement
at the assertion level is a significant risk [e.g. significant risk of material overstatement of sales], the auditor
shall perform substantive procedures that are specifically responsive to that risk’ (ISA 330, para. 21).
These substantive tests related to significant risks should be tests of details only and/or in combination
with analytical procedures.
It is important to consider the nature, timing and extent of substantive tests. The nature of the tests refers
to the use of substantive analytical procedures or test of details. The former are generally more applicable
to large volumes of transactions that tend to be predictable over time, whereas tests of details are ordinarily
more appropriate in obtaining evidence regarding certain assertions (e.g. existence and valuation) about
account balances.
df_Folio:162
P
QUESTION 2.20
For each audit procedure listed below, state whether it is a test of controls or a substantive test.
For the procedures that are substantive tests, identify the key financial statement assertion being
tested.
1. Examine high-value invoices for the two days prior to year-end to determine if sales are recorded
in the correct period.
2. Compare inventory turnover across products using monthly data for the last two years.
3. Select a sample of trade debtors to be confirmed and follow up on non-replies.
4. Attend the annual inventory stocktake and ensure all procedures are complied with.
5. Review any changes to the staff involved in authorising fixed asset purchases and disposals.
6. For a sample of fixed assets, determine if the depreciation rates used are consistent with the
approved depreciation policy of the client.
7. Check arithmetic on a sample of sales invoices.
8. Check authorisation signatures on a sample of travel reimbursements.
EXAMPLE 2.21
The key points covered in this section, and the learning objectives they align to, are shown below.
KEY POINTS
2.1 Explain the responsibilities of management and the auditor in relation to an audit.
• The auditor is responsible for designing and implementing overall responses to address the assessed
risks of material misstatements at the financial statement level.
• The auditor is responsible for designing and performing further audit procedures whose nature, timing
and extent are based on and are responsive to the assessed risks of material misstatement at the
assertion level.
2.2 Evaluate historical financial information by applying professional scepticism and judgment.
• Question 2.19 requires students to apply professional judgment to identify the balance sheet
accounts and relevant assertions most at risk and then determine how the planned audit strategy
would change based on the results of tests of controls.
df_Folio:164
P
REVIEW
The main focus of the module was specifically related to the audit of financial statements and an overview
of the 200 and 300 series of the ISAs. After the general principles governing an audit of financial
statements were outlined, the responsibility of personnel within a firm for the quality control of audits was
discussed. Next, the terms of audit engagements and audit planning procedures were discussed, including
the overall audit strategy, the audit plan and financial statement assertions. Before explaining materiality,
the mandatory requirements for audit documentation were discussed.
After discussing the audit planning procedures, our focus turned to understanding the entity and its
environment. This entailed obtaining an understanding of the entity’s industry, regulatory and other
external factors along with the nature of the entity, including its business model.
Internal control is one way that management can mitigate business risks, and the auditing standards
require the auditor to understand the entity’s internal controls. Controls in an IT environment and SMEs
were also discussed.
Given the increased emphasis by the profession on the detection of fraud, we discussed in some detail
the auditor’s responsibility to consider fraud in an audit of financial statements. Other risk assessments for
specific matters that have the potential to be significant risks were discussed, including audit accounting
estimates, and risks relating to related-parties, going concern, and climate-related risks. The module also
discussed the auditor’s responsibility to consider laws and regulations in an audit of financial statements,
especially in responding to the entity’s NOCLAR, including fraud.
This module considered the importance of business risk for the auditor. The auditor’s role in under-
standing entities and their environments and assessing the risk of material misstatement was considered.
As audit firms have moved to a much greater emphasis on risk analysis, a variety of techniques for
conducting strategic analyses in order to better understand these risks were outlined. Also, analytical
procedures were discussed as they play an important role in understanding business risk and the audit
implications. In recent years, audit data analytics and visualisations have become important tools for
auditors, and as such, these were discussed in detail.
Having assessed the risks of material misstatement, the auditor needs to develop procedures in response
to the assessed risks. These procedures depend on the overall audit strategy determined by the auditor.
To respond to the assessed risks, the auditor will undertake tests of controls and substantive procedures
including analytical procedures to gather sufficient appropriate audit evidence to enable the auditor to form
an opinion on the truth and fairness of the financial statements.
Performing the audit to gather sufficient appropriate audit evidence will be the focus of the next module.
Pdf_Folio:165
REFERENCES
ACCA n.d., ‘Professional scepticism’, Think Ahead, accessed June 2019, https://www.accaglobal.com/an/en/student/
exam-support-resources/professional-exams-study-resources/p7/technical-articles/scepticism.html
Accounting Professional & Ethical Standards Board (APESB) 2018, Amendments to Long Association of Personnel with an
Audit or Assurance Client requirements in APES 110 Code of Ethics for Professional Accountants, April, accessed May 2019,
https://www.apesb.org.au/page.php?id=12
Andersen, N 2016, ‘Blockchain technology: a game changer in accounting?’ Deloitte, March, accessed June
2019, https://www2.deloitte.com/content/dam/Deloitte/de/Documents /Innovation/Blockchain_A%20game-
changer%20in%20accounting.pdf
df_Folio:166
P
Pdf_Folio:167
OPTIONAL READING
International Federation of Accountants (IFAC) 2018, Guide to Using International Standards on Auditing
in the Audits of Small and Medium-sized Entities, 4th edn, accessed June 2019, https://www.ifac.org/
publications-resources/guide-using-international-standards-auditing-audits-small-and-medium-sized-en
Pdf_Folio:168
PERFORMING THE
AUDIT OF HISTORICAL
FINANCIAL
INFORMATION
Module 1
Auditing and Assurance Framework
Module 4
Module 2 Module 3
Conclusions and
Planning the audit Performing the audit
reporting responsibilities
P df_Folio:169
LEARNING OBJECTIVES
ISA 240 The Auditor’s Responsibilities Relating to Fraud ASA 240 The Auditor’s Responsibilities Relating to
in an Audit of Financial Statements Fraud in an Audit of a Financial Report (Compiled)
ISA 250 (Revised) Consideration of Laws and ASA 250 Consideration of Laws and Regulations in an
Regulations in an Audit of Financial Statements Audit of a Financial Report
ISA 315 (Revised) Identifying and Assessing the Risks ASA 315 Identifying and Assessing the Risks of
of Material Misstatement through Understanding the Material Misstatement through Understanding the
Entity and Its Environment Entity and Its Environment (Compiled)
ISA 320 Materiality in Planning and Performing an Audit ASA 320 Materiality in Planning and Performing an
Audit (Compiled)
ISA 330 The Auditor’s Responses to Assessed Risks ASA 330 The Auditor’s Responses to Assessed Risks
(Compiled)
ISA 450 Evaluation of Misstatements Identified during ASA 450 Evaluation of Misstatements Identified during
the Audit the Audit (Compiled)
ISA 501 Audit Evidence — Specific Considerations for ASA 501 Audit Evidence — Specific Considerations for
Selected Items Inventory and Segment Information (Compiled)
ISA 540 (Revised) Auditing Accounting Estimates ASA 540 Auditing Accounting Estimates and Related
and Related Disclosures Disclosures
ISA 600 Special Considerations — Audits of Group ASA 600 Special Considerations — Audits of a Group
Financial Statements (Including the Work of Component Financial Report (Compiled)
Auditors)
ISA 610 (Revised) Using the Work of Internal Auditors ASA 610 Using the Work of Internal Auditors
ISA 620 Using the Work of an Auditor’s Expert ASA 620 Using the Work of an Auditor’s Expert
IAS 10 Events after the Reporting Period AASB 110 Events after the Reporting Period
df_Folio:170
P
In planning the audit, as described in module 2, these assertions are used to help the auditor identify those
classes of transactions, account balances and related disclosures in the financial statements that contain a risk
of material misstatement. The advantage of taking this risk assessment to the assertion level is that, once the
auditor has identified the assertions at risk, the appropriate response to assessed risks becomes apparent. This
module focuses on the audit procedures undertaken by the auditor, in response to the assessed risks, to gather
evidence about management’s assertions. Before reading the following overview of audit procedures, study
example 3.1, which links risk assessment and response at the assertion level.
EXAMPLE 3.1
df_Folio:172
P
Audit procedures
Response
Substantive audit
Tests of controls
procedures
Substantive
Tests of
analytical
details
procedures
Sufficient appropriate
Result
Tests of controls and substantive audit procedures are the focus of the next sections of this module.
Before reading more about tests of controls, consider example 3.2.
Pdf_Folio:173
QUESTION 3.1
Differentiate between the evidence obtained from tests of controls and substantive tests of details.
The key points covered in this section, and the learning objectives they align to, are below.
KEY POINTS
3.3 Evaluate the sufficiency and appropriateness of the audit evidence gathered.
• The concepts of sufficiency and appropriateness of audit evidence obtained from both tests of
controls and substantive audit procedures were defined to enable evaluation of evidence gathered.
• Sufficiency relates to the quantity of audit evidence. The quantity of audit evidence required relates
to the level of risk of misstatement and the appropriateness of the evidence.
• Appropriateness relates to the quality of audit evidence, which is determined by its relevance and
reliability.
3.4 Apply the appropriate standards that relate to the auditor’s response to assessed risks.
• Auditors are required to design and perform audit procedures in order to obtain sufficient appro-
priate audit evidence to be able to draw reasonable conclusions on which to base their opinion in
accordance with ISA 500 Audit Evidence.
• Audit evidence, while primarily obtained from audit procedures performed during the audit, may
include information from other sources, for example, an entity’s non-compliance with laws and
regulations (ISA 500 Audit Evidence and ISA 250 (Revised) Consideration of Laws and Regulations
in an Audit of a Financial Report).
Controls
Tests of controls
Prevention, detection or correction
Control activities
of misstatements
SMEs often use off-the-shelf packaged accounting software without any modification. Many of these
software packages contain proven application controls that the entity could use to reduce the extent of
errors and possibly deter fraud. Auditors might want to ask their clients whether these controls are being
used and, if not, whether there would be value in using them (IFAC 2018a).
However, it is often not practical to perform tests of control activities in SMEs due to the limited
segregation of duties. Additionally, reliable control activities may be very limited, or non-existent, in some
small entities, and a primarily substantive approach may be the only option. However, before auditors
decide to rely on substantive procedures, they should consider:
• other internal control elements and the strength of the control environment
• the existence of control activities over assertions where obtaining evidence through tests of controls
would be more efficient
• assertions where substantive procedures alone will not provide the level of evidence required to reduce
the risks of material misstatement to an acceptably low level.
The auditor tests controls when they expect to rely on the effectiveness of controls to help to reduce the
risk of material misstatement to an acceptable level. Tests of controls are also considered when substantive
procedures alone will not provide the auditor with sufficient appropriate audit evidence at the assertion
level. For example, where online sales provide no documentation of transactions other than through the
IT system, the auditor will need to consider tests of controls to obtain the level of evidence required. This
relationship is illustrated in figure 3.3.
The next section of the module describes the objectives of tests of controls in more detail before we
move on to describing the techniques that can be used.
Would
substantive
audit procedures
No Yes
alone provide sufficient
appropriate audit
evidence at the
assertion
level?
Audit procedures
Would
Yes tests of controls
Tests of controls be a more efficient
way to obtain
evidence?
Substantive procedures No
QUESTION 3.2
EXAMPLE 3.3
P df_Folio:177
EXAMPLE 3.4
Risk addressed No emphasis is placed on the need for integrity and ethical values.
Identified controls All new employees are required to sign a form stating they agree with the
firm’s fundamental ethical values and understand the consequences for
non-compliance.
Control design Read the form that employees are required to sign and ensure it addresses
integrity and ethical values.
Control implementation Review one employee file, checking for the signed form and consider any
evidence that employees practise the values (e.g. look for any notes on
disciplinary actions taken). Could also interview the employee.
Test of controls Select a sample of employee files and check for signed forms. Also, ask a
sample of employees questions about the stated entity policies.
Documentation Prepare a memo providing details of the employee files selected, notes
based on the interviews and conclusions reached; include the name of the
employees and the date the testing was conducted.
QUESTION 3.3
JayJay Ltd installs solar power systems to buildings. Most of its staff are employed as installers of
the solar power systems. There is only one employee who is responsible for all the record keeping
and spare parts inventory control. You have been engaged to conduct an audit of JayJay’s financial
statements for the current year.
Justify why a predominantly substantive approach may be more suitable to this audit
engagement.
EXAMPLE 3.5
As you can see from this example, a major benefit of using CAATs is that you can now test the total
population, allowing you to claim this in your report. This can add more weight to your observations and
make it easier for you to communicate to the business how you reached your conclusion.
The use of CAATs is currently limited to data saved on files using a systematic pattern. Unfortunately,
much data is not documented this way, such as with big data. Data often contains deficiencies and is poorly
classified or difficult to obtain; thereby lacking integrity. Due to these shortcomings, CAATs may be used
to complement an auditor’s tools and techniques. Sometimes CAATs aren’t suitable to use for a particular
audit, but there are also audits which couldn’t be efficiently performed with due care without the use of
CAATs. However, take care when handling larger volumes of data as more errors are likely to be observed.
The auditor may use a variety of software-based techniques to test controls. A common technique
involves submitting test data to the client’s software application while the application is under the auditor’s
control. Submitting auditor test data to the client’s application will allow the auditor to verify that the
application is functioning as designed (Johnson & Wiley 2019). Test data will be discussed further in the
next section.
Table 3.1 highlights the key information related to IT application controls. Note that the evidence was
obtained using software-based audit techniques.
In addition, in various circumstances the auditor may use a form of audit data analytics to test controls.
For example, let’s assume that transactions are both authorised and approved electronically, and the
software electronically tracks the individuals authorising or approving transactions. Subsequently, the
Pdf_Folio:179
What can go wrong Unauthorised sales may be made to customers that are significant credit
risks.
Example control Authorisation of sales. The software application checks to see that the
customer is on the master customer file and compares account balance to
credit limit on the customer master file.
Example test of controls Test IT general controls to determine that the program is operating
effectively. Submit two transactions to test the program itself: one
transaction to ensure the program appropriately accepts a transaction,
and one to ensure that the program appropriately rejects a transaction.
Evidence obtained Software-based audit techniques. Document the results of submitting test
data to test the sales program.
Exception to effective Evidence that the software application authorised sales that should not
operation of the control have been authorised, or evidence that the program rejected transactions
that should have been authorised based on authorisation criteria.
Test Data
The test data technique involves the auditor creating simulated dummy transactions to test specific
controls in computer software as well as the logic and procedural operations of the client’s computerised
application. This technique is used to assess independently the existence, effectiveness and continuity of
software controls. It provides the auditor with evidence of the integrity of the system and the information
contained within.
The transactions that are designed by the auditor to test the software controls identified should include
both valid and invalid (illogical, incorrect and incomplete) transactions. The auditor must predetermine
how the application software will process the test data and design the test data to test the program controls.
This step is indicated by ‘audit test data simulated transactions’ in figure 3.4.
This technique provides the auditor with evidence that the software controls exist and are working
effectively. Note that this provides the auditor with direct evidence about the existence and effectiveness
of software controls. The evidence-gathering techniques outlined in ISA 500 that are most commonly used
for testing manual controls — inspection, observation and enquiry — do not provide direct evidence of
software controls.
Review example 3.6 and consider your response to the posed question about simulated transactions prior
to checking the suggested solution.
EXAMPLE 3.6
Simulated Transactions
If a software control is devised so that the number of payroll hours per week cannot exceed 50, the auditor
usually designs transactions to test these controls, by including dummy transactions such as:
• employee A having payroll hours per week equalling 50
• employee B having payroll hours equalling 51.
df_Folio:180
P
Example 3.7 looks at how an auditor can use test data to test controls. Review the example now and
consider your response to the posed question before comparing your answer with the suggested solution.
EXAMPLE 3.7
Exception
Master reports
file
Audit
test data Predetermined
simulated results
transactions of run
Live
master Client
Live file summary
transactions
reports etc.
Client
application ITF test data
ITF processing processing
transactions results
ITF
files
Predetermined Compare
results results
EXAMPLE 3.8
Store table
Code Store
1038 Cairns
2013 Canberra
3067 Carnegie
5790 Chatswood
6702 Christchurch
4690 Coolangatta
GL code Expense
7832 Tape
P df_Folio:183
Field Comments
Description
Unit Price
Vendor Code
GL Code
............................................................................................................................................................................
Select the information from Boomerang’s system as described, to create test data to verify effectiveness of
controls on ten simulated orders that a branch may make and ten simulated vendor invoices.
Check your response against the suggested answer at the end of the book.
Source: Parkes et al 2015.
QUESTION 3.4
Jasmine Motor Factors Ltd sells car parts to vehicle repair centres. Customers have a login into
Jasmine’s parts system, which allows them to place orders for parts online. If orders are made on
the system before 8 am, Jasmine guarantees same-day delivery.
You are planning the financial report audit for Jasmine and are considering the use of CAATs to
audit the company’s purchase system. You know from the previous year’s audit that there have
been problems with the system accepting invalid inputs from suppliers. You have decided to use
test data to check the validity of inputs into the purchase system. You have discussed this approach
with Jasmine’s staff, and they have agreed for you to enter dummy transactions onto the live
system.
Design test data transactions that you could use to gain confidence that Jasmine’s purchase
system does not accept invalid inputs.
QUESTION 3.5
Jackie opened the file of purchase invoices and selected 20 orders as part of tests of controls over
occurrence assertion. Is this an example of an audit sampling technique? Discuss.
QUESTION 3.6
You have just completed testing controls in the payroll expense area for a large company. The
results of your testing showed that there was one instance of a part-time employee being paid an
incorrect hourly rate. You recorded this exception as a control deviation in your working paper.
Justify why you recorded this one exception as a control deviation by referring to any potential
control weaknesses related to the system’s failure to detect, prevent and correct this type of error.
The key points covered in this section, and the learning objectives they align to, are below.
KEY POINTS
3.2 Apply processes and procedures to gather sufficient and appropriate audit evidence.
• Tests of controls obtain evidence on whether the controls operated in accordance with the auditor’s
understanding and as documented during the risk assessment process.
• Tests of controls confirm whether the controls functioned effectively throughout the period of
intended reliance.
• The auditor tests controls when they expect to rely on the effectiveness of controls to help to reduce
the risk of material misstatement to an acceptable level.
• Tests of controls are also considered when substantive procedures alone will not provide the auditor
with sufficient appropriate audit evidence at the assertion level.
• Audit sampling is appropriate for gathering audit evidence when the sample selected is represen-
tative of the items in the population.
• Computer-assisted audit techniques can enable the entire population of items to be tested.
3.4 Apply the appropriate standards that relate to the auditor’s response to assessed risks.
• ISA 500 Audit Evidence outlines the various methods the auditor can use to gather audit evidence
about particular account balances and class of transactions.
• ISA 530 Audit Sampling provides guidance to auditors on the use of audit sampling in performing
audit procedures in response to assessed risks.
Amortisation expense Amortisation rate × capital asset balances (taking into account additions
and disposals)
The Australian Securities and Investments Commission (ASIC)’s Audit Inspection Program Report for
2017–2018 (ASIC 2019) suggests that improvements are required in relation to the audit of revenue,
including substantive analytical procedures. With respect to ‘revenue and receivables’, about a third of
ASIC’s findings relate to substantive analytical procedures which were used without:
(i) evidence of a ‘plausible relationship’
(ii) evaluating ‘the reliability of data used to develop the auditor’s expectation’
(iii) determining acceptable thresholds for investigation, or failing to ‘disaggregate revenue by product
type or geographical location’; and
(iv) investigating results of ‘differences from expectations’ (ASIC 2019, p. 32).
QUESTION 3.7
Identified risk: Analytical procedures for a retailer show significant decreases in both profit margins
and inventory turnover days.
(a) This risk indicates that the retailer may be experiencing problems with inventory shrinkage.
What type of fraud could this entail?
(b) Which assertion is relevant to this potential misstatement?
The source of the For example, information obtained from independent sources outside the entity
information may be more reliable than information obtained from within an entity.
The comparability of For example, if expectations of areas of misstatement are developed based
the information on comparisons with industry data, consideration needs to be given to how
representative the client entity is of the industry.
df_Folio:188
P
Whether the amount The deviation from the expectation that can be accepted without further
of difference from an investigation needs to take into account the possibility that a misstatement,
expectation is acceptable either individually or when aggregated with other misstatements, may cause the
financial statements to be misstated.
When the amount of difference from an expectation is less than performance materiality, the amount
is likely to be acceptable. Procedures used by auditors to investigate the differences from expectations
include:
• reconsidering the methods and factors used to form their expectation
• enquiring to management about the causes of differences from expectations and assess management’s
responses (need to consider the auditor’s understanding of the business obtained during the audit)
• corroborating management’s explanations by performing other audit procedures.
Following this investigation, the auditor may conclude that:
• the differences from expectations and recorded amounts do not represent missstatements
• differences may represent misstatements — in this case, further audit procedures need to be performed
to obtain sufficient appropriate audit evidence as to whether a material misstatement exists.
More complex techniques such as regression analysis (e.g. of sales data) and modelling (e.g. of infor-
mation systems) could be extremely powerful in their predictive ability and often provide a numeric
measure of their accuracy. The disadvantage of some of these techniques is that they can be time-
consuming, be difficult to use and require trained personnel. This often restricts their use in practice.
EXAMPLE 3.9
Reasonableness Tests
Company That Rents Storage Space
Consider a company that rents storage space and charges by the square metre.
............................................................................................................................................................................
1. What would be a suitable reasonableness test if the storage space is fully occupied (e.g. there is a waiting
list for space)?
2. What would be a suitable reasonableness test if the storage space is not fully occupied?
Hotel in a Tourist Destination
Consider a hotel in a tourist destination, where occupancy rates vary across time (e.g. days of the week,
seasons) and room rates vary considerably depending on the outlook (e.g. ocean views, mountain views)
and the size of the room.
............................................................................................................................................................................
1. Would this variability impact on the reasonableness test?
Check your responses against the suggested answer at the end of the book.
QUESTION 3.8
............................................................................................................................................................................
1. Analyse the results of the analytical procedures, and identify which account balances of the Huggins Ltd
financial statements would warrant increased audit attention?
2. To what extent can substantive analytical procedures be used to eliminate the need for tests of details in
the audit of the following material account balances? Justify your answer.
(a) Trade debtors
(b) Sales commission expense
(c) Repairs expense
Check your response against the suggested answer at the end of the book.
TESTS OF DETAILS
Tests of details include tests of transactions and account balances and are designed to obtain direct evidence
aimed at reducing the risk of material misstatement for a particular account. The assertions provide the
link between the risks of misstatement (identified in module 2) and the audit procedures that provide the
response to these assessed risks.
Nature of Tests
The nature of the audit procedures carried out will depend on the type of account being audited and the
assertions identified as being at risk. For example, to confirm the existence of an asset, an auditor may
physically verify its existence and title. To confirm the existence of a bank balance, a commonly used
audit procedure is to obtain a letter from the bank confirming the account balance.
Pdf_Folio:191
External Confirmations
The use of external confirmations in an audit is quite common. There are many items in a financial
statement for which external confirmations may be an appropriate method of obtaining sufficient and
appropriate audit evidence. This is recognised in ISA 505 External Confirmations. External confirmations
provide evidence about the completeness of a liability and the existence of an asset. They also provide
evidence on whether the amount has been accurately recorded in the accounting records (accuracy
assertion) and in the appropriate accounting period (cutoff assertion). However, they are less relevant to
the valuation and allocation assertion because it does not provide evidence of the recoverability of trade
debtors or the obsolescence of inventory held in stock.
Examples of when external confirmations are suitable include when obtaining evidence of:
• the terms and conditions of transactions that an entity made with third parties
• the trade debtors’ balances and terms
• the trade payables’ balances and terms
• bank balances and other relevant banking information
• the amounts due to lenders, any restrictive covenants and relevant repayment terms
• investments held for safekeeping by third parties
• investments purchased from stockbrokers but not yet delivered
• property title deeds held by lawyers or financiers as security or for safe keeping
• inventories held by third parties (including those on consignment).
The use of external confirmations is not mandated by ISA 505. Rather, it recognises that confirmation
of account balances should be determined based on an assessment of their effectiveness in providing
audit evidence to support financial statement assertions. For this purpose, the standard sets out the
matters that should be considered when determining whether and to what extent external confirmations
are the most appropriate form of audit evidence. The reliability of the evidence obtained by external
confirmations depends on the auditor applying appropriate procedures when designing the external
confirmation requests, performing the external confirmation procedures, and evaluating the results of these
procedures. Factors affecting the reliability of external confirmations include:
• the control the auditor exercises over confirmation requests and responses
• the characteristics of the respondents
• any restrictions included in the response or imposed by management.
The role of both positive and negative confirmation requests is detailed in ISA 505. It also indicates that
the choice between the two depends on the prevailing circumstances, including the assessment of inherent
and control risks.
Pdf_Folio:193
QUESTION 3.9
Explain why external confirmation of accounts receivable provides relevant and reliable audit
evidence regarding assertions. Outline the limitations.
Bank Confirmations
Bank confirmation requests are used to obtain audit evidence concerning a client’s dealings with its
bank(s). Guidance Statement GS 016 Bank Confirmation Requests states that information obtained from
such requests may assist the auditor in obtaining sufficient appropriate evidence regarding bank-related
transactions and account balances, and their related presentation and disclosure in the financial statements.
While such bank confirmation requests are not required, the auditor would normally send such requests
when the entity’s banking activities are significant, complex or unusual (GS 016, para. 13). The Guidance
Statement identifies that there may be instances (e.g. when an entity’s banking activities are straightforward
and there is other appropriate evidence available) where the auditor may decide not to send a bank
confirmation. However, it is usual in practice for an auditor to confirm an entity’s banking activities for
nearly all audit clients.
Some of the major features of GS 016 include:
• a discussion of the relevance and reliability of the evidence obtained from a bank confirmation
• a discussion of the necessity for the auditor to remain alert to the possibility of fraud occurring in the
entity’s banking activities
• the procedures to be undertaken, including determining the bank information to be confirmed, designing
the bank confirmation request, and submitting and following up on the request
• the inclusion of a ‘Bank Confirmation — Audit Request (General)’ form, on which the information to
be confirmed relates to ‘normal banking activities’
• the inclusion of a ‘Bank Confirmation — Audit Request (Treasury and Other Operations)’ form, on
which the information to be confirmed relates to the client’s treasury operations and use of treasury
management instruments, such as forward rate agreements, foreign exchange contracts and interest rate
swaps.
Many bank confirmation processes are now completed electronically (ISA 505, para A12; GS 016,
para. 59). Electronic confirmations are addressed in ISA 505, paragraph A12 and GS 016. While electronic
confirmations may speed up the process and potentially increase the reliability of responses, this type
of confirmation process may introduce some new risks. These new risks would include the difficulty
of proving the origin of the response, whether the respondent was authorised to respond, and whether
there were any unauthorised alterations to the information transmitted. However, ISA 505, paragraph
A12, highlights that if the auditor and the respondent use a secure environment for the responses received
electronically, it may mitigate these risks and may actually enhance the reliability of the related responses.
df_Folio:194
P
QUESTION 3.10
Outline the steps that an auditor can undertake in order to place greater reliance on an electronic
response to a bank confirmation request.
At stocktake, the auditor carries out test counts. Any differences between the auditor’s counts and the
client’s counts need to be reconciled. These differences may be due to errors in counting by either party
or may be due to other issues, such as certain inventory items being in more than one location.
Direction of Testing
The assertion being tested determines whether vouching or tracing should be used for testing.
• Vouching involves testing from the accounting record to the source document or underlying assets. The
auditor tests for existence by vouching items from the ledger to the physical stock or stocktake records.
• Tracing involves testing from the source documents or underlying assets to the accounting records. The
auditor tests for completeness by comparing the physical count to the ledger.
The auditor needs to follow up any differences. For example, if the physical count is less than the ledger
account, it is possibly due to items in transit or on consignment, and follow-up procedures would need to
be carried out to confirm this.
Table 3.5 identifies the relationships between assertions, specific audit objectives and substantive
procedures for inventories.
Example 3.11 deals with the audit procedures to be adopted for testing transactions and balances and
the related disclosures. Read the scenario presented and consider your responses to the posed questions
before checking the suggested solution at the back of the book.
Pdf_Folio:195
df_Folio:196
P
QUESTION 3.11
Listed in this question are four audit procedures performed during the 20X9 audit of JayJays
Ltd. For each procedure, indicate the relevant assertion(s) and indicate what type of substantive
procedure was performed (i.e. analytical procedure, test of details of balances or test of details of
transactions).
(a) Calculate the trade debtors’ turnover and compare with prior year’s turnover.
(b) Review all invoices received for one month after the 30 June 20X9, to ensure that the transac-
tions are recorded in the appropriate accounting period
(c) Attend the year-end stocktake and perform test counts on a sample of inventory items.
(d) Review the adequacy of the company’s allowance for doubtful debts.
Extract data from client files based The auditor specifies what data should be extracted from client files
on criteria specified by the auditor for audit purposes. The criteria or specifications for data extraction
(exception reporting) will depend on the audit objectives and subsequent audit procedures
to be conducted.
Once extracted, the data are edited and reformatted for audit
purposes and transferred to an audit work file, which is available for
use by other routines (programs) in the package. This is a very useful
technique and is widely used to direct the auditor’s attention to risky
or material items.
For example, in the audit of accounts receivable, the auditor can
identify all accounts that are overdue by more than 30 days. This is
useful in directing the auditor’s attention to accounts that have a risk
of misstatement with regard to the accuracy, valuation and allocation
assertion.
Test calculations The auditor can use the software to verify the accuracy of extensions
or footings of journals or listings.
Select and print audit samples The software can use various sampling methods (e.g. random or
systematic selection) to select samples and can stratify and analyse
data statistically (e.g. providing mean and/or median values).
Summarise data for audit analysis and Audit software is capable of formatting and printing data in a
format and print outputs variety of ways to produce desired reports, analyses and/or forms
(e.g. confirmation request forms).
The software can also simulate client program processing functions,
compare the output with the actual output of the client and analyse
data for trends (e.g. ageing or turnover).
Purpose-Written Programs
Purpose-written programs are computer programs designed to perform audit tasks in specific circum-
stances. These programs may be prepared by the auditor, the entity or an outside programmer. They may
contain the same functions as GAS or any reduced set of functions considered appropriate for the purpose
for which it was written. Purpose-written programs are often used when a client’s computer system is not
compatible with the GAS or where the auditor wants to perform functions that the GAS is unable to do.
These programs need to be updated regularly to remain compatible with updates to the client’s system and
generally cost more than GAS.
Advantages Disadvantages
They can be easy to use as they are well-documented Utility and systems management programs have only
and (usually) user-friendly. limited applications. They do not have all the functions
normally included in audit software.
They provide a higher level of reliability. Because They could corrupt files if incorrectly used.
they are generally supplied by hardware/software
manufacturers, they are extensively tested and widely
used.
EXAMPLE 3.12
Item number
Description
Size
Colour
Quantity on hand
Last cost
Vendor code
Reorder point
The client has had stock count sheets prepared in duplicate with the first four of the preceding fields
filled in and a blank space for quantity on hand to be written in. Client staff are about to count the inventory
and complete the stock sheets. The second copies were given to you.
............................................................................................................................................................................
Describe substantive procedures that could verify Boomerang’s inventory valuation. Assume that you have a
comprehensive generalised accounting software package available.
Check your response against the suggested answer at the end of the book.
Source: Parkes et al. 2015.
P df_Folio:199
Fitzroy Homewares Ltd is a wholesaler of household goods including furniture, kitchen appliances,
soft furnishings and electronic equipment. Fitzroy purchases products directly from the manufac-
turers and sells to a wide range of retailers, both large and small. Fitzroy has around 480 customers.
The terms of agreements between Fitzroy and its customers vary widely in relation to discounts,
credit limits and payment terms. The larger customers have balances of hundreds of thousands of
dollars with amounts up to 60 days old, whereas smaller customers have balances in the thousands
of dollars and generally have payment terms of 30 days.
You are designing your audit testing for the trade debtors’ balance at the year-end and, due to
the large number of customers, you would like to use CAATs to improve the efficiency of the audit.
Design five specific audit procedures that could be carried out using generalised audit software
to test Fitzroy’s trade debtors’ balances.
Advanced audit data analytic techniques, which can analyse complete data sets (also commonly referred
to as ‘big data’), can be used at the audit planning stage and as part of the evidence-gathering procedures
to identify and assess risk. These techniques have the ability to analyse complete populations of data and
can identify patterns, correlations, and deviations from expected results. These methods can provide the
auditor with new or additional insights about the entity and its risk environment. They can also improve the
auditor’s knowledge about the transactions that comprise the balances contained in the financial statements.
Audit data analytic techniques can allow external auditors to improve financial statement audits by:
• testing complete sets of data rather than testing samples
• aiding risk assessment through identification of anomalies and trends that the auditors need to investigate
further
• providing audit evidence by analysing all transactions that comprise an account balance (Murphy &
Tysiac 2015).
IAASB (2016a) suggests that the use of data analytics provides the auditor with the opportunity to
gain a more robust understanding of the entity and its environment, which improves the application
of professional scepticism and professional judgment together with the quality of the auditor’s risk
assessments and responses to risks. However, IAASB (2016a) also notes certain limitations of using data
analytics.
• Analysis of data that is not relevant to the audit or unreliable data can negatively impact audit quality.
• Testing 100% of the population does not change the meaning of reasonable assurance or provide more
than reasonable assurance.
• It will not replace professional scepticism and professional judgment.
• It can lead to overconfidence of the auditor.
ASIC (2017) suggests that while the use of data analytics may lead to a more effective audit, there
are risks and limitations in its use. In particular, ASIC warns that auditors need to consider whether the
applications have been properly implemented (e.g. data must be accurate, controls across the data should be
reviewed and tested, exceptions should be investigated, and sufficient documentation should be obtained);
auditors also need to consider whether the results can be relied on. Note that the present International
Standards on Auditing (ISAs) neither prohibit nor stipulate the use of data analytics. However, the title of
IAASB (2016a), Exploring the Growing Use of Technology in the Audit, with a Focus on Data Analytics,
and the related request for comments indicate that the profession is seriously considering the need to
address these issues in future ISAs.
df_Folio:200
P
EXAMPLE 3.13
MUS selection is usually undertaken using audit software. This technique is relatively easy to use and
results in an evaluation in terms that facilitate audit decisions. MUS is a statistical technique that provides
an estimate of the maximum amount of overstatement of a recorded amount with measurable levels of
Pdf_Folio:201
EXAMPLE 3.14
EXAMPLE 3.15
df_Folio:202
P
QUESTION 3.13
(a) The total value for the trade debtors account is $1 600 000, consisting of 850 items. The auditor
randomly selected 64 items for testing. The dollar value of the sample of trade debtors selected
for testing is $295 000. Assume the auditor discovered errors totalling $18 408 when conducting
the substantive testing of the sample. Extrapolate the errors to the population and calculate the
total projected error.
(b) If materiality is set at $100 000, evaluate whether the trade debtors’ balance is materially mis-
stated. Justify your decision.
The key points covered in this section, and the learning objectives they align to, are below.
KEY POINTS
P df_Folio:203
3.4 EVIDENCE-GATHERING IN AN
E-COMMERCE ENVIRONMENT
This section considers the evidence-gathering steps used by the auditor in the e-commerce environment,
which has become the norm. What must clearly be remembered is that the audit objective — reducing the
risk of material misstatement in the financial statements to an acceptably low level — does not change in
an e-commerce environment.
Pdf_Folio:205
The key points covered in this section, and the learning objectives they align to, are below.
KEY POINTS
df_Folio:206
P
Pdf_Folio:208
EXAMPLE 3.17
QUESTION 3.14
In response to your assessed level of risk regarding related parties, you have selected the following
audit procedures in accordance with ISA 550 Related Parties, paragraph A32.
• Confirm specific aspects of transactions with intermediaries, such as banks.
• Confirm the purpose of related party transaction with the related parties.
• Read financial statements of the related party to verify substance of transactions.
Which of the following scenarios is most likely in this situation?
(a) The auditor has identified related parties not previously disclosed by management.
(b) The auditor has assessed a high risk of undisclosed related parties.
(c) The auditor has assessed a high risk of material misstatement due to a dominant related party.
The key points covered in this section, and the learning objectives they align to, are below.
Pdf_Folio:209
3.2 Apply processes and procedures to gather sufficient and appropriate audit evidence.
• Auditors obtain a sufficient understanding of related party relationships and transactions to be able
to recognise fraud risk factors arising from any related party events.
3.4 Apply the appropriate standards that relate to the auditor’s response to assessed risks.
• ISA 550 Related Parties provides guidance on how auditors obtain a sufficient understanding of
related party relationships and transactions to be able to recognise fraud risk factors arising from
any related party events.
COMPONENT AUDITORS
ISA 600 Special Considerations — Audits of Group Financial Statements (Including the Work of
Component Auditors) provides guidance when undertaking group audits, especially with regard to the work
of other auditors — called component auditors — who perform work on financial information related to
a component for a group audit (e.g. a subsidiary). When relying on the work of a component auditor, the
group auditor should:
• assess whether the component auditor understands and complies with the relevant ethical requirements,
in particular, the independence requirements
• obtain information regarding the professional competence of the component auditor
• be involved in the work of the component auditor to an extent that ensures that sufficient appropriate
audit evidence is obtained
• understand the regulatory requirements that actively oversee the component auditor (ISA 600, para. 19).
If a component of the group, such as a subsidiary, is significant because of its financial significance
to the group, an audit that employs a materiality level for that component or group must be performed
on that component’s financial information. In practice, financial significance is commonly assessed as a
component that contributes more than 15% of the chosen benchmark, commonly net profit before tax, for
the group (ISA 600, para A5). A component of the group may also be assessed as individually significant
because it is likely to include significant risks of material misstatement for the group. In these situations,
an audit of either the component’s financial information as a whole or those specific areas containing the
risks needs to be undertaken (ISA 600, paras 26–7). For components that are not significant, analytical
procedures performed at the group level may provide sufficient appropriate evidence (ISA 600, para. 28).
It is required that the planned scope of the group audit be such that sufficient appropriate evidence on
which to base the group audit opinion is obtained (ISA 600, para. 29).
For significant components, the group auditor becomes involved in the component auditor’s risk
assessment to identify significant risks of material misstatement of the group’s financial statements. The
group auditor also requests the component auditor to communicate to them any matters relevant to their
conclusion regarding the group audit. A list of these matters is contained in ISA 600, paragraph 41, and
includes the uncorrected misstatements of the component’s financial information, indicators of possible
df_Folio:210
P
INTERNAL AUDITORS
As described in ISA 610 (Revised), paragraph 8, if the external auditor determines that the work performed
by an internal audit function is likely to be relevant to the external audit, they need to determine whether,
and to what extent, they can use the specific work of the internal auditor. If using this work, the external
auditor needs to assess whether it is adequate for the purposes of the audit (see figure 3.5).
In determining whether, and to what extent, the internal auditor’s work can be used, the external auditor
needs to determine the extent to which this work is adequate for the purposes of the audit (ISA 610
(Revised), para. 13). This requires an evaluation of the internal audit function’s:
• organisational status and relevant policies and procedures
• level of competence
• application of a systematic and disciplined approach (ISA 610 (Revised), para. 15).
To prevent undue reliance on the work of the internal audit function, the external auditor should plan to
use less of the internal audit function’s work and perform more of the work directly when:
(a) more audit judgment is involved
(b) the assessed risk of material misstatement at the assertion level is higher
(c) there are concerns about organizational status and relevant policies and procedures of the internal audit
function
(d) there is a lower level of internal audit competence (ISA 610 (Revised), para. 18).
Note that the Australian standard ASA 610 differs from ISA 610 (Revised) in that the Australian standard
does not allow internal auditors to provide direct assistance to the external auditor. Direct assistance is
the use of an internal audit to perform audit procedures under the direction, supervision and review of an
external audit. For example, in a group audit, this means that internal auditors cannot be the ones conducting
an audit or review of an overseas subsidiary of that group. This is to strengthen the external auditor’s
independence and to ensure that the external auditor takes responsibility for the audit work undertaken.
The work of internal auditors should not be relied upon to the same extent as work performed by the
external audit team. This is because internal auditors are not completely independent as they are hired by
the entity and are part of its internal control.
If the external auditor is going to use specific work of the internal auditors, the external auditor will
need to evaluate and perform audit procedures on this work to determine its adequacy for external audit
purposes. This will include:
• discussing with the internal audit function the planned use of their work as a basis for coordinating their
respective activities to obtain an understanding of the procedures performed and the major findings
(ISA 610 (Revised), para. 21)
• reading the reports of the internal audit function relating to the work of the function that the external
auditor plans to use (ISA 610 (Revised), para. 22)
• undertaking audit procedures on the work of the internal audit function to determine its adequacy for
reliance by the external auditor (ISA 610 (Revised), para. 23).
Further details of the risk assessment procedures and the auditor’s responses to assessed risk for
internal auditors are contained in ISA 610 (Revised), paragraphs 15–25. Read these sections and the
associated application and other explanatory material before proceeding.
Pdf_Folio:211
Internal auditors
ISA 610
ASA 610
(Revised)
Is it relevant to the
Don’t use
external audit?
Don’t use
External auditors
External auditor may use internal External auditor may use direct
auditor’s work in combination with: assistance of internal auditor with:
• discussion with internal audit team • appropriate direction
• reading the internal audit reports • appropriate supervision
• undertaking audit procedures • appropriate review.
on the internal audit function.
QUESTION 3.15
During the audit of JLJ Ltd, you have been assigned the task of evaluating the work performed by
the entity’s internal auditor on certain specific areas.
Differentiate between the internal and external audit functions with respect to:
• independence
• objectives
• reporting.
df_Folio:212
P
QUESTION 3.16
You are an audit senior, and your firm audits Big Mine Ltd, a large mining company that operates
all over Australia. Big Mine Ltd owns some highly specialised mining tools and equipment held at
various remote regions across the country. Your firm has engaged an expert to carry out a physical
audit check of the equipment and tools at each location, and to perform an independent valuation
of each material asset.
(a) Identify two key assertion(s) at risk in relation to the asset balances in the financial statements.
(b) Describe the audit procedures you would perform to gather sufficient appropriate audit
evidence on each of these assertions.
KEY POINTS
df_Folio:214
P
Audit documentation needs to provide evidence of the auditor’s basis for a conclusion and that the
audit was planned in accordance with applicable auditing standards and legal and regulatory requirements
(ISA 230, para. 2).
Preparing sufficient and appropriate audit documentation on a timely basis helps to enhance the quality
of the audit and facilitate the effective review and evaluation of the audit evidence obtained and conclusions
reached before the auditor’s report is finalised. The auditor can only rely on documented evidence. One
way to view this is to say, ‘If it is not documented, it is not done’.
ISA 230 considers significant matters, and the related significant judgments are discussed in
ISA 230, paragraphs A8–A11. You should refer to those paragraphs now.
The form, content and extent of audit documentation will vary between audits and will depend on such
factors as the nature of the audit procedures to be performed and the extent of judgment required. Little
guidance is given to the auditor regarding exactly how much documentation is required. The problem the
auditor faces is that, if an issue has been considered but not documented, it may be difficult to convince
others in later inspections that the issue actually has received consideration.
ISA 230, paragraph 10, states that ‘the auditor shall document discussions of significant matters with
management, those charged with governance, and others, including the nature of the significant matters
discussed and when and with whom the discussions took place’. ‘Others’ includes personnel within the
entity and external parties providing professional advice to the entity.
ISA 230 puts considerable emphasis on the importance of the assembly and maintenance of an audit file.
Auditors are required to complete the assembly of an audit file usually within 60 days from the date of the
auditor’s report. Internationally, following ISQC 1, the audit file retention period for audit engagements
is ordinarily not less than five years from the date of the auditor’s report. In Australia, the auditor cannot
discard or delete audit documentation during the retention period (under s. 307B of the Corporations Act,
it is seven years or an earlier date to be determined by ASIC). We will discuss audit file requirements
further after briefly examining the need to maintain security and confidentiality of client data.
301–400 File completion, such as memos on significant decisions, checklists and management
representation letters
401–500 Audit planning, including audit strategy and materiality
501–600 Risk assessment, including understanding the entity and internal control
601–700 Risk response, including detailed audit plans by financial statement area
15 Materiality
A Cash
C Receivables
D Inventory
BB Payables
DD Long-term debt
20 Revenues
30 Purchases
40 Payroll
50 Taxation
120 Contingencies
Inventory
Inventory listing from our inventory count did not tie into the final listing — understated inventory by 1800€
and income by 1800€: see WP D. 108.
Audit Response
Error was caused by Ruby not using the final inventory listing. Our substantive procedures will be
expanded to ensure that all adjustments discussed at the count have been reflected in the final listing.
df_Folio:216
P
Circumstances of Pre-tax
Description Occurrence WP Ref. Assets Liabilities Income Equity Corrected?
Errors in New Clerk made D.300 (19 000) (19 000) (15 200) Yes
inventory some mistakes.
valuation
calculation.
Personal Found during 550.8 (4800) (4800) (3840) Yes
expenses paid expense testing.
through Dephta This prompted
and not added some additional
to shareholder work to find similar
account. items.
Customer Review of aging C.305 12 000 12 000 9600 Yes
account over and subsequent
90 days no payments.
subsequent
payments
received.
Total of identified misstatements (7000) (4800) (11 800) (9440)
during the audit
Misstatements corrected by (7000) (4800) (11 800) (9440)
management
Total uncorrected misstatements 0 0 0 0
A cross-reference would also be provided in the listing above to where additional work has been
performed to ensure other similar misstatements do not exist or that the misstatement is not indicative of
a more serious issue such as management override.
Source: IFAC 2018b, p. 239.
QUESTION 3.17
Jackie James is reading the documents prepared by the members of the team working on the audit
of trade debtors for a large client. Jackie is the senior manager assisting the engagement partner,
Ruby Rogers. Jackie and Ruby have worked together on many audits, and Jackie knows the types
of questions that Ruby will ask about the working papers if they are not up to the standard required
by ISA 230 Audit Documentation. Jackie is trying to make sure that all documents are up to the
required standard before Ruby reviewed them.
P df_Folio:217
KEY POINTS
Level of
aggregated or
The decisions of a reasonable user of the qualitative
financial statements would be affected. misstatement
is material
Depending on the level of the misstatements and the circumstances of their occurrence there may be a
need to revise the overall audit strategy and audit plan (ISA 450, para. 6), as discussed earlier in relation
to ISA 300. For example, if many of the misstatements identified during the audit occurred in a particular
month, yet the original audit plan placed no particular emphasis on this month, a revised audit plan may
be necessary.
If ADA has been used and the entire population has been tested, this does not imply that the auditor is
able to provide something more than a reasonable assurance opinion (IAASB 2016). Using ADA does not
change the meaning of ‘reasonable assurance’.
Unless prohibited by law or regulation, auditors are required to communicate to management all
misstatements accumulated and request management to correct those misstatements (ISA 450, para. 8).
Examples of laws or regulations that may restrict such communication are given in ISA 450,
paragraph A11. For example, in some jurisdictions, there may be a specific prohibition against such
communication if it might prejudice an investigation by an appropriate authority into actual or suspected
money laundering (ISA 450, para. A11).
If management refuses to correct some of the misstatements, the auditor needs to obtain an understanding
of the reasons and take that into account in forming an opinion (ISA 450, para. 9).
Note that management may refuse to correct some misstatements because they genuinely believe they
have made the correct judgments. This is much more likely to be the case where there are differences arising
from the judgments of management concerning estimates compared to the auditor’s judgments. It may also
relate to what is the appropriate accounting policy or treatment in areas where accounting standards are
vague. These differences between auditors and management often lead to prolonged negotiations where
additional evidence is collected by both sides and the accounting firms may draw on the expertise of the
technical experts within their firms.
The auditor also needs to consider uncorrected misstatements that are considered material, either
individually or in aggregate. ISA 450, paragraph 11, requires the auditor to:
• consider the size and nature of these misstatements
• consider the effect of uncorrected misstatements related to prior periods or the relevant classes of
transactions, account balances or disclosures and the financial statements as a whole, including:
– total current assets and current liabilities
– total assets and liabilities
– net income
– total revenue and expenses.
Pdf_Folio:220
QUESTION 3.18
Outline the differences between the application of materiality at the planning and final review stages
of the audit.
QUESTION 3.19
Outline the differences between the application of qualitative and quantitative materiality consid-
erations.
QUESTION 3.20
Outline the factors that will determine whether the auditor has obtained sufficient appropriate
evidence to support a particular control risk assessment.
P df_Folio:221
KEY POINTS
REVIEW
In this module, the general principles underlying the evidence-gathering procedures in an audit have been
discussed. Emphasis has been placed on the need for auditors to obtain sufficient appropriate audit evidence
on which to base their opinion. Tests of controls were also described in this module. Substantive procedures
adopted to gather evidence can be grouped under substantive analytical procedures and tests of details. Both
types of procedures were examined in detail.
Audit evidence-gathering techniques in e-commerce environments and advanced audit data analytic
techniques were also considered.
The requirement to maintain audit documentation in relation to the conduct of the audit was examined
along with the need to maintain the security and confidentiality of the documents used in the audit.
Finally, the auditor is required to evaluate the audit evidence to ensure sufficient appropriate audit
evidence has been collected to inform their audit opinion.
df_Folio:222
P
REFERENCES
Australian Securities and Investments Commission (ASIC) 2019, Audit Inspection Program Report for 2017–18, Report 607,
accessed June 2019, https://asic.gov.au/media/4990650/rep607-published-24-january-2019.pdf
Chartered Institute of Internal Auditors (CIIA) 2019, ‘Computer assisted audit techniques’, 2 January, accessed August 2019,
https://www.iia.org.uk/resources/delivering-internal-audit/computer-assisted-audit-techniques-caats/?downloadPdf=true
International Auditing and Assurance Standards Board (IAASB) 2016, Exploring the Growing Use Technology in the Audit, with a
Focus on Data Analytics, accessed June 2019, https://www.ifac.org/system/files/publications/files/IAASB-Data-Analytics-WG-
Publication-Aug-25-2016-for-comms-9.1.16.pdf
International Auditing and Assurance Standards Board (IAASB) 2018, International Standard on Auditing 540 (Revised):
Auditing Accounting Estimates and Related Disclosures, accessed June 2019, https://www.ifac.org/publications-resources/isa-
540-revised-auditing-accounting-estimates-and-related-disclosures
International Federation of Accountants (IFAC) 2018a, Guide to Quality Control for Small- and Medium-Sized Practices, Volume
1 – Core Concepts, Fourth Edition, accessed June 2019, https://www.ifac.org/publications-resources/guide-using-international-
standards-auditing-audits-small-and-medium-sized-18
Pdf_Folio:223
Pdf_Folio:224
CONCLUSIONS AND
REPORTING
RESPONSIBILITIES FOR
AN AUDIT OF
HISTORICAL FINANCIAL
INFORMATION
Module 1
Auditing and Assurance Framework
Reporting responsibilities
P df_Folio:225
Communication and • Communication with relevant
reporting responsibilities parties
to relevant parties • Reporting responsibilities
LEARNING OBJECTIVES
ISA 220 Quality Control for an Audit of Financial ASA 220 Quality Control for an Audit of a Financial
Statements Report and Other Historical Financial Information
(Compiled)
ISA 240 The Auditor’s Responsibilities Relating to Fraud ASA 240 The Auditor’s Responsibilities Relating to
in an Audit of Financial Statements Fraud in an Audit of a Financial Report (Compiled)
ISA 250 (Revised) Consideration of Laws and ASA 250 Consideration of Laws and Regulations in an
Regulations in an Audit of Financial Statements Audit of a Financial Report
ISA 260 (Revised) Communication with Those Charged ASA 260 (Revised) Communication with Those
with Governance Charged with Governance (Compiled)
ISA 265 Communicating Deficiencies in Internal Control ASA 265 Communicating Deficiencies in Internal
to Those Charged with Governance and Management Control to Those Charged with Governance and
Management (Compiled)
ISA 320 Materiality in Planning and Performing an Audit ASA 320 Materiality in Planning and Performing an
Audit (Compiled)
ISA 330 The Auditor’s Responses to Assessed Risks. ASA 330 The Auditor’s Responses to Assessed Risks
(Compiled)
ISA 450 Evaluation of Misstatements Identified during ASA 450 Evaluation of Misstatements Identified during
the Audit the Audit (Compiled)
ISA 501 Audit Evidence — Specific Considerations for ASA 501 Audit Evidence — Specific Considerations for
Selected Items Inventory and Segment Information (Compiled)
ASA 502 Audit Evidence — Specific Considerations for
Litigation and Claims (Compiled)
ISA 540 (Revised) Auditing Accounting Estimates, and ASA 540 Auditing Accounting Estimates and Related
Related Disclosures Disclosures
ISA 570 (Revised) Going Concern ASA 570 (Revised) Going Concern
ISA 700 (Revised) Forming an Opinion and Reporting ASA 700 (Revised) Forming an Opinion and Reporting
on Financial Statements on a Financial Report (Compiled)
ISA 701 Communicating Key Audit Matters in the ASA 701 Communicating Key Audit Matters in the
Independent Auditor’s Report Independent Auditor’s Report (Compiled)
ISA 705 (Revised) Modifications to the Opinion in the ASA 705 (Revised) Modifications to the Opinion in the
Independent Auditor’s Report Independent Auditor’s Report
Pdf_Folio:226
ISA 710 Comparative Information — Corresponding ASA 710 Comparative Information — Corresponding
Figures and Comparative Financial Statements Figures and Comparative Financial Reports (Compiled)
ISA 720 (Revised) The Auditor’s Responsibilities ASA 720 (Revised) The Auditor’s Responsibilities
Relating to Other Information Relating to Other Information
IAS 10 Events after the Reporting Period AASB 110 Events after the Reporting Period
IAS 37 Provisions, Contingent Liabilities and AASB 137 Provisions, Contingent Liabilities and
Contingent Assets Contingent Assets
P df_Folio:227
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 227
PREVIEW
Having discussed the audit planning, evaluation of internal controls and evidence-gathering stages of the
audit process in modules 2 and 3, this module focuses on the final stage of the process: the completion of
the fieldwork, conclusions the auditor draws, and the preparation and issuing of the auditor’s report.
As can be seen from the International Framework for Assurance Engagements (the Framework), which
was discussed in module 1, the objective of an assurance engagement is for a practitioner to:
obtain sufficient appropriate evidence in order to express a conclusion designed to enhance the degree of
confidence of the intended users other than the responsible party about the outcome of the measurement or
evaluation of an underlying subject matter against criteria (IAASB, Framework, para. 10).
The credibility of the written report is enhanced by having the assurance practitioner, who is both
independent and an expert, examine the subject matter in accordance with suitable criteria and report
on it.
The International Framework for Assurance Engagements was discussed in detail in module 1. If
necessary, you should review that module.
This module discusses the various forms of reporting associated with audits of financial statements.
Initially, this module explores unmodified auditor’s reports on general purpose financial statements, which
provide reasonable assurance to users.
The departures from the standard form (unmodified) audit opinion are then discussed, as are the varying
circumstances under which different types of audit opinions can be issued. It should be noted that these
forms of departures are also applicable to most other types of assurance engagements and levels of
assurance (to be discussed in module 5). The implications of comparative information contained within the
financial statements are also considered. This is followed by a discussion on the auditor’s responsibility
regarding information contained within the annual report that is not covered by the auditor’s report.
This module also discusses the auditor’s communication and reporting responsibilities, particularly to
those charged with governance and management.
Pdf_Folio:228
Accounting Estimates
In responding to the assessed risks of material misstatement regarding accounting estimates, the auditor
will undertake one or any combination of the following:
(a) Obtain audit evidence from events occurring up to the date of the auditor’s report.
(b) Test how management made the accounting estimate and the data on which it is based. In doing so, the
auditor shall evaluate whether:
(i) the method of measurement used is appropriate in the circumstances; and
(ii) the assumptions used by management are reasonable in light of the measurement objectives of the
applicable financial reporting framework.
(c) Test the operating effectiveness of the controls over how management made the accounting estimate,
together with appropriate substantive procedures.
(d) Develop a point estimate or a range to evaluate management’s point estimate (ISA 540 (Revised)
Auditing Accounting Estimates, Including Fair Value Accounting Estimates, and Related Disclosures,
paras 18–36).
For example, auditors may need to consider climate-related estimates used by management in accor-
dance with ISA 540 (Revised). Auditors will need to substantiate climate-related risks disclosed in the
financial statements by entities to ensure the disclosures are appropriate given the uncertainty surrounding
such risks (Thomson, Fikkers & Stott 2019).
In making the evaluation as to whether sufficient appropriate audit evidence has been obtained, the
auditor should consider all the relevant audit evidence obtained — this includes corroborative and
contradictory evidence. If the auditor is unable to obtain sufficient appropriate audit evidence, the auditor
will need to evaluate the implications for the audit.
In determining whether the accounting estimates made by management are reasonable, the auditor takes
into account qualitative aspects of the entity’s accounting practices. An important part of this includes
indicators of management bias, or a lack of neutrality, which may arise in the judgments made by
management with regards to the amounts and disclosures in the financial statements. Indicators of a lack
of neutrality include:
(a) management adjusting misstatements that have the effect of increasing reported earnings, but not
adjusting those that have the effect of decreasing reported earnings
(b) possible management bias in the accounting estimates they have made (ISA 700 (Revised), para. A2).
Indicators of possible management bias do not constitute misstatements for purposes of drawing
conclusions on the reasonableness of individual accounting estimates. They may, however, affect the
auditor’s evaluation of whether the financial statements as a whole are free from material misstatement
(ISA 700 (Revised), para. A3).
Further details of the overall evaluation of accounting estimates based on audit procedures are
contained in ISA 540 (Revised), paragraphs 33–36. Read these sections and the associated application
and other explanatory material now.
Related Parties
As outlined in module 3, due to the nature of related-party relationships and transactions, the auditor
usually has a high level of professional scepticism towards any transactions or relationships with related
parties. Of particular interest to auditors are:
• transactions outside the normal course of business
• the possibility of fraud.
During the fieldwork stage of the audit, the auditor needs to ascertain whether sufficient appropriate
evidence has been obtained about related parties and their transactions to determine whether a material
misstatement exists and whether disclosures are adequate for the financial statements to achieve fair
presentation (ISA 550 Related Parties, para. 25).
Pdf_Folio:229
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 229
As mentioned in module 3, the auditor would be concerned with the existence of related parties and any
transactions the entity has had with related parties. The auditor should review management information
that identifies related parties and perform audit procedures to ensure that the risk of not detecting related
parties is low. Procedures may include reviewing working papers from the previous period, shareholder
records and minutes of shareholders and directors’ meetings.
In addition, the auditor should be alert for material related-party transactions, including those that have
abnormal conditions, lack logical reasons for occurrence, have substance that is different from form, or
have been processed in an unusual manner.
When considering whether sufficient appropriate evidence has been obtained about related parties and
their transactions, the auditor considers both the size and nature of misstatements and the reason why they
occurred. The nature of the related-party relationship may be relevant to users in addition to the size of the
misstatement.
As mentioned later in this module, the management representation letter may complement other auditing
procedures in connection with the completeness of identified related-party transactions.
The next area to consider as part of completing the fieldwork is to evaluate the sufficiency of the evidence
obtained in relation to the assessed risk of material misstatement due to fraud.
Fraud
An auditor who assesses a risk of material misstatement due to fraud must design and perform further
audit procedures that respond to the nature, timing and extent of the risk at both the financial statement
and assertion levels. The response to specific fraud risks identified should be consistent with the response
to assessed risks contained in ISA 330 The Auditor’s Responses to Assessed Risks.
Some of the responses the auditor can use to address the assessed risks of material misstatement due
to fraud at the financial statement level are outlined in ISA 240 The Auditor’s Responsibilities Relating to
Fraud in an Audit of Financial Statements, paragraph 30. They include:
(a) assigning personnel with the appropriate knowledge, skill and ability to the areas where there are
significant risks of material misstatement
(b) evaluating whether the selection and application of accounting policies by the entity is indicative of an
attempt by management to manage earnings
(c) incorporating an element of unpredictability into the planned audit procedures.
• Unsupported balances
• Unauthorised transactions
• Last-minute adjustments that significantly affect results
• Evidence of employees accessing systems/records inconsistent
with their duties
Other
Source: Adapted from IFAC 2018a, ISA 240 The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements,
Appendix C, p. 205.
To gain further understanding of the factors related to fraud, you should refer to Appendix 3 of
ISA 240 ‘Examples of Circumstances that Indicate the Possibility of Fraud’.
QUESTION 4.1
An auditor could use data analytics to compare payroll transactions with the supporting employee
data, to uncover payroll fraud. Identify five indicators of potential payroll fraud that audit data
analytics could be designed to uncover. What factors should the auditors consider in evaluating
the findings?
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 231
rest of this section. IAS 37 Provisions, Contingent Liabilities and Contingent Assets, paragraph 10 defines
a contingent liability as either:
(a) a possible obligation that arises from past events and whose existence will be confirmed only by the
occurrence or non-occurrence of one or more uncertain future events not wholly within the control of
the entity; or
(b) a present obligation that arises from past events but is not recognised because:
(i) it is not probable that an outflow of resources economic benefits will be required to settle the
obligation; or
(ii) the amount of the obligation cannot be measured with sufficient reliability.
When the conditional event meets the recognition criteria of reliability of measurement and probability
of occurrence, the obligation should be recognised as a liability in the financial statements and thus is no
longer a ‘conditional’ liability. When the conditional event does not meet the criteria for recognition, it
may still meet the disclosure requirements as a contingent liability. Irrespective of whether conditional
liabilities should be recognised as liabilities or otherwise described in the notes, they are of relevance to
the auditor because they are unlikely to be recorded in the accounting records until the occurrence of the
uncertain future event. Therefore, there is a risk that they will not be completely and properly disclosed.
These obligations include potential liabilities from income tax disputes, product warranties, guarantees of
obligations of others, and litigation and claims.
The auditor’s concerns about contingent liabilities are not limited to completing the audit. However,
the review will often be towards the end of the audit because the auditor needs the most complete
information set available. During audit testing, and particularly in searching for unrecorded liabilities,
the auditor should be alert to the possibility of contingent liabilities. Moreover, in reading the minutes of
board meetings and in reviewing contracts, the auditor should look for circumstances that may indicate
contingencies that should be investigated. Contingencies that are often the highest risk to auditors are
associated with litigation. The most appropriate audit procedure in relation to this type of contingency is
enquiry of the entity’s lawyer(s) by means of a representation letter to a lawyer (Leung 2019).
Solicitors’ Representation Letters
The auditor is required by ISA 501 Audit Evidence — Specific Considerations for Selected Items to design
and perform audit procedures in order to identify litigation and claims involving the entity, which may give
rise to a risk of material misstatement. These include:
(a) Inquiry of management and, where applicable, others within the entity, including in-house legal
counsel;
(b) Reviewing minutes of meetings of those charged with governance and correspondence between the
entity and its external legal counsel; and
(c) Reviewing legal expense accounts (ISA 501, para. 9).
If the auditor identifies a risk of material misstatement regarding litigation or claims that have
existed or may exist, the auditor should seek a direct communication with the entity’s external legal
counsel. Direct communication with the entity’s external legal counsel may help the auditor in obtaining
sufficient appropriate audit evidence as to whether potential material litigation and claims are known and
management’s estimates of the financial implications, including costs, are reasonable (Leung et al. 2019).
This is normally done through a letter of enquiry prepared by management, and sent by the auditor,
that requests that the entity’s external legal counsel communicates directly with the auditor (ISA 501,
para. 10).
In Australia, auditing standard ASA 502 Audit Evidence — Specific Considerations for Litigation and
Claims has an additional requirement.
Where in-house legal counsel has the primary responsibility for litigation and claims and is in the best
position to corroborate management’s representations, the auditor shall endeavour to obtain a representation
letter, from the in-house legal counsel, seeking information similar to that sought from the entity’s external
legal counsel (ASA 502, para. Aus 5.1).
GOING CONCERN
At the planning stage of the audit, the auditor is required to evaluate the entity’s ability to continue as a
going concern. As discussed in module 2, going concern is a risk that must be assessed in every audit. In
this module, we focus on how the auditor responds to this assessed risk when events or conditions cast
Pdf_Folio:232
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 233
Going Concern — SMEs
Managers of small-to-medium enterprises (SMEs) may not prepare a detailed assessment of the entity’s
ability to continue as a going concern. Instead they may rely on their in-depth knowledge of the business
and its future prospects. The auditor would normally evaluate an SME’s ability to continue as a going
concern by:
• discussing long-term financing with management
• corroborating management’s intentions with other evidence obtained when gaining an understanding of
the entity
• inspecting supporting documentation and making enquiries as to future predictions of the viability of
the business operations
• making enquiries to identify events or conditions beyond management’s assessment period that would
cast significant doubt on the entity’s ability to continue as a going concern (IFAC 2018b).
Factors that could cast significant doubt on an SME’s ability to continue as a going concern include:
• the entity’s ability to withstand adverse conditions
– SMEs may be able to respond quickly to exploit opportunities, but may not have the reserves to
sustain operations
• availability of financing
– for example, banks and other lenders ceasing to support the entity
– withdrawal or major alteration in the terms of a loan or loan guarantee from the owner-manager (or
other related parties including family members)
• other major changes
– for example, loss of a principal supplier, major customer, key employee, operating license, franchise,
or other legal agreement (IFAC 2018b).
Mitigating Circumstances
The auditor should be aware of, and evaluate the effect of, any mitigating circumstances that might serve
to offset the conditions that have raised doubts about the entity’s ability to continue as a going concern.
When going concern problems are identified, the auditor needs to discuss with management its plans
for overcoming the problem, such as the possibility of raising additional finance (ISA 570 (Revised),
para. A17).
For example, the effect of an entity being unable to make its normal debt repayments may be
counterbalanced by management’s plans to maintain adequate cash flows by alternative means, such as
by disposing of assets, rescheduling loan repayments or obtaining additional capital. The auditor will need
to consider the bases upon which the plans have been prepared, their feasibility and their likelihood of
implementation.
The significance of those going concern risks related to cash flow or solvency can often be mitigated by
management’s plans or opportunities with respect to the risk factors (asset, debt, cost and equity) identified.
Table 4.1 provides examples of these factors.
Factor Example
Pdf_Folio:234
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 235
• all relevant information and access as agreed in the terms of the audit engagement has been provided to
the auditor
• all transactions have been recorded and are reflected in the financial report (ISA 580, paras 10–11).
The management representation letter may complement other auditing procedures (e.g. in connection
with (1) the completeness of identified contingent liabilities and related party transactions or (2) the
existence of mitigating factors in the presence of going concern problems). In some cases, however, a
representation letter may be the main source of audit evidence. When a client plans to discontinue a
line of business, for example, the auditor may be unable to corroborate this event through other auditing
procedures.
If the written representations are inconsistent with other audit evidence, the auditor will need to
undertake further audit procedures to resolve the matter. If the auditor concludes that the written
representations are not reliable, this may result in a need to modify the auditor’s report (discussed in more
detail later in this module).
In Australia, the auditor does not need to include in the management representation letter any matters
that are covered by representations made by the directors or management in the annual report (e.g. in the
directors’ report or directors’ declaration). These management representations are required by statute or
regulation, such as the Corporations Act 2001 (Cwlth) (Corporations Act).
If management refuses to sign a management representation letter, that would cause the auditors to
question management’s integrity, competence and ethical values, and could have serious ramifications for
the audit. Auditors would be especially concerned about the reliability of audit evidence obtained through
enquiry of management. The refusal by management to sign the representation letter would be considered a
scope limitation and could affect the auditor’s opinion on the financial statements (Johnson & Wiley 2019).
Further details on the requirements for representations by management are contained in ISA 580
Written Representations, paragraphs 9–20. Read these sections and the associated application and
other explanatory material now.
QUESTION 4.2
You are the manager for the engagement to audit Ruff Racers Ltd, an entity that develops nutritional
products to help improve the performance of racing greyhounds. There is a material issue still
outstanding that needs to be addressed before you can conclude the audit.
From the review of board meeting minutes, it was found that Ruff Racers is being sued by a
customer, BlueHound, who claims that the new dog food formula it purchased from Ruff Racers
led to the sickness and death of a racing hound. However, the CEO of Ruff Racers has rejected
the claims as unsubstantiated and states that extensive research has shown the new formula to
be safe. A review of correspondence from the solicitors does not yet indicate the availability of
evidence to support the claims made by BlueHound.
Evaluate the issue and determine the appropriate course of action in relation to concluding the
audit of Ruff Racers Ltd. Justify your conclusions.
SUBSEQUENT EVENTS
In this section, the auditor’s responsibilities regarding subsequent events will be considered, and then the
various audit procedures the auditor should consider applying will be described. Subsequent events are
events occurring between the period end and the date of the auditor’s report, and facts discovered after the
date of the auditor’s report.
At the outset, it should be noted that the auditor’s report should be dated (discussed in more detail
later in this module). Dating the report informs the reader that the auditor considered the effect on the
financial statements and the auditor’s report of events or transactions that the auditor was aware of, up to
that date. The impact on the financial statements of subsequent events is dealt with in IAS 10 Events after
the Reporting Period, and the audit implications are set out in ISA 560 Subsequent Events.
An example of a material subsequent event is when a trade debtor becomes bankrupt after the end of
the reporting period due to conditions that existed at balance date. This event signals that the debt was
not collectable at the end of the financial reporting period. As such, the entity should adjust the carrying
amount of the trade debtor by recording the value outstanding as a bad debt.
Before continuing, please review ISA 560.
df_Folio:236
P
If management amends the financial statements, the auditor should carry out the procedures necessary
to determine that the amendment has been appropriately carried out.
• Period 3: For facts which become known to the auditor after the financial statements have been issued,
the auditor has similar responsibilities to those outlined under time period 2 (ISA 560, paras 14–17).
In addition, if new financial statements and a new or amended auditor’s report are issued, the auditor
should indicate an ‘Emphasis of Matter’ or ‘Other Matter’ paragraph (discussed later in this module)
in the re-issued auditor’s report discussing the reason for the revision of the previously issued financial
statements. If management refuses to revise the financial statements, the auditor should take action to
prevent future reliance on the auditor’s report.
In Australia, directors have a duty to consider and disclose any matter arising in the period from the
balance date to the date of signing the directors’ statement when such a matter prejudices the truth and
fairness of the accounts (Corporations Act, ss. 297, 298, 299, 300). The auditor must make a judgment
as to the adequacy of the disclosure. The directors’ report must provide the particulars of any subsequent
matter or circumstance that has affected, or may affect, the operations, results and state of affairs of the
company and group in succeeding financial years (Corporations Act, s. 299).
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 237
Specific Procedures
The auditor will carry out procedures specifically aimed at detecting and evaluating material subsequent
events. Essentially, these will involve undertaking procedures as near to the time of completion (and signing
of) the auditor’s report as is practicable and will ordinarily include the following:
• reviewing procedures established by management to ensure that subsequent events are identified
• reading minutes of the meetings of shareholders, the governing body, and audit and executive commit-
tees held after the period’s end
• reading the entity’s latest available interim financial statements and reviewing any budgets, cash flow
forecasts and other related management reports that are considered appropriate
• enquiring of the entity’s lawyers
• enquiring of management as to whether any subsequent events have occurred that might affect the
financial statements.
Examples of enquiries of management on specific matters are as follows:
the current status of items that were accounted for on the basis of preliminary or inconclusive data …
• Whether new commitments, borrowings or guarantees have been entered into;
• Whether sales or acquisitions of assets have occurred or are planned;
• Whether … the issue of new shares or debentures … is planned;
• Whether any assets have been … destroyed, for example by fire or flood;
• Whether there have been any developments regarding [risk areas and] contingencies;
• Whether any unusual accounting adjustments have been made or are contemplated;
• Whether any events have occurred or are likely to occur that will bring into question the appropriateness
of accounting policies used in the financial statements …;
• Whether any events have occurred that are relevant to the measurement of estimates or provisions made
in the financial statements; and
• Whether any events have occurred that are relevant to the recoverability of assets (ISA 560, para. A9).
In a continuing audit, much of the work performed for subsequent events can be used in next year’s
audit, particularly in the stages of planning and understanding the entity, where up-to-date knowledge of
the business is required.
As noted, although the auditor need not perform specific procedures to identify subsequent events
after the date of the auditor’s report, the auditor still has a responsibility with regard to any subsequent
events that come to their attention. This is discussed in ISA 560, paragraphs 10–17. Review these
paragraphs now before proceeding.
Now review example 4.1, which considers the appropriate treatment of different types of subsequent
events.
EXAMPLE 4.1
df_Folio:238
P
The financial year of Toys Galore Ltd (TGL) ended on 30 June 20X0. The auditor’s report was signed
on 25 August, and the financial statements were issued on 10 September. The following events
were noted after the end of the financial year.
1. On 15 August McVicar, a debtor of TGL, declared bankruptcy on that date. The most recent sale
had taken place on 20 May, and no transactions had occurred since that date.
2. On 12 September, the auditor became aware that a fire burnt down one of TGL’s warehouses,
resulting in a loss of 40% of the inventory that was on hand at that date.
3. On 30 September, management discovered that Johnno, a major debtor of TGL who was facing
financial difficulties, became bankrupt on 15 September. All sales to Johnno were made before
the end of the financial year.
The next issue discussed is the performance of analytical procedures which are performed before
completing the fieldwork.
In earlier modules, the application of analytical procedures in planning an audit, in risk assessment and
performing year-end substantive procedures was explained. Near the end of the audit, the auditor designs
and performs analytical procedures in order to arrive at an overall conclusion as to whether the financial
report is consistent with the auditor’s understanding of the entity. Due to the knowledge gained through
audit procedures during the audit, the auditor would not normally expect to find any major unexpected
variations during the overall review of the financial statements as a whole. If variations are revealed, it
may be necessary for the auditor to perform additional procedures, or reperform the original procedures.
Analytical procedures are applied to critical audit areas after audit adjustments have been made to the
financial statements. The reason for using analytical procedures in the overall review is to corroborate
conclusions formed during the audit and to assist in arriving at the overall conclusion that the financial
statements as a whole are consistent with the auditor’s knowledge of the entity’s business. Applying
analytical review procedures at the end of the audit is also a useful way of gaining assurance that the
company will remain a going concern for the relevant period.
Many types of analytical procedures may be used. Typical analytical procedures conducted during the
final review include:
• comparing entity data with expected entity results
• comparing company data with available industry data
• using relevant non-financial data, such as units sold or the number of employees, to analyse relationships
with financial data.
In carrying out an overall review, the auditor reads the financial statements and accompanying notes.
The auditor considers the adequacy of the evidence gathered for unusual or unexpected balances and
relationships that have been either anticipated (planning stage) or identified during the audit (when
performing substantive procedures). Analytical procedures are then applied to the financial statements.
These procedures will help to determine whether any other unusual or unexpected relationships exist.
If such relationships are identified, then the auditor should perform additional audit procedures before
completing the audit. Given the knowledge gained over the course of the audit, the auditor is usually in a
good position to critically evaluate the results of analytical procedures at the end of the audit.
The auditor who completed a large amount of the audit fieldwork may be ‘too close’ to the audit work
performed and may miss unusual or unexpected relationships that would be recognised by someone who
Pdf_Folio:239
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 239
has not been directly involved with the audit. For this reason, and because this review is so important,
the audit partner or audit manager on the engagement also reviews the analytical procedures. This audit
partner or manager should have a comprehensive knowledge of the entity’s business and not have been
directly involved with the audit fieldwork. Often, audit partners or managers identify inconsistencies or
problems because they have extensive business knowledge and because they can look at the figures more
objectively than someone who completed most of the fieldwork.
Example 4.2 demonstrates the performance of analytical review procedures and the analysis of the
findings. Review this example now.
EXAMPLE 4.2
20X9 20X8
$m $m
Income statement
Non-current assets
Current assets
Cash - 0.4
Current liabilities
QUESTION 4.4
(a) Auditors could perform analytical procedures at the planning, testing and conclusion stages of
the audit. Why does an auditor perform analytical procedures at the conclusion and reporting
stage of an audit?
(b) If the results of the final analytical review are inconsistent with the auditor’s expectations, what
action should the auditor take?
df_Folio:240
P
KEY POINTS
4.2 Evaluate the key issues involved in the final review and completion of an audit.
• In making the sufficiency and appropriateness evaluation of accounting estimates, the auditor
should consider all the relevant audit evidence obtained — this includes corroborative and
contradictory evidence. If the auditor is unable to obtain sufficient appropriate audit evidence,
the auditor will need to evaluate the implications for the audit.
• During the completing the fieldwork stage of the audit, the auditor needs to ascertain whether
sufficient appropriate evidence has been obtained about related parties and their transactions to
determine whether a material misstatement exists and whether disclosures are adequate.
• The auditor is expected to evaluate whether the judgments and decisions made by management
in making accounting estimates indicate a possible bias that may represent a risk of material
misstatement due to fraud.
• If the auditor identifies a risk of material misstatement following the evaluation of litigation or claims
that have existed or may exist, the auditor should seek direct communication with the entity’s
external legal counsel.
• The auditor should evaluate mitigating factors that may reduce the likelihood of a going concern
problem.
• The management representation letter may complement other auditing procedures (e.g. in con-
nection with (1) the completeness of identified contingent liabilities and related party transactions
or (2) the existence of mitigating factors in the presence of going concern problems).
• The auditor will carry out procedures specifically aimed at detecting and evaluating material
subsequent events. Essentially, these will involve undertaking procedures as near to the time of
completion (and signing of) the auditor’s report as is practicable.
• Near the end of the audit, the auditor designs and performs analytical procedures in order to arrive
at an overall conclusion as to whether the financial statements are consistent with the auditor’s
understanding of the entity.
4.3 Evaluate the indicators of potential fraud and recommend a course of action.
• Where misstatements indicative of fraud are identified, the auditor must reconsider the risk
of misstatement in other aspects of the audit, including specific locations and management
representations.
4.5 Apply the appropriate standards that relate to a range of engagement circumstances that
impact the auditor’s report and the auditor’s opinion.
• IAS 10 Events after the Reporting Period requires adjustment of the amounts recognised in the
company’s financial statements to reflect adjusting events after the reporting date and disclosure
of non-adjusting events after the reporting date if they are material and could influence the
economic decisions of users that are made on the basis of the financial statements.
• ISA 560 Subsequent Events requires the auditor to perform audit procedures designed to obtain
sufficient appropriate audit evidence to demonstrate that all events that may require adjustment or
disclosure in the financial statements, up to the date of the auditor’s report, have been identified.
• ISA 570 (Revised) Going Concern requires the auditor to obtain sufficient appropriate evidence to
determine whether or not a material uncertainty exists related to events or conditions that may
cast significant doubt on the entity’s ability to continue as a going concern.
• ISA 501 Audit Evidence — Specific Considerations for Selected Items require auditors to design
and perform audit procedures in order to identify litigation and claims involving the entity which
may give rise to a risk of material misstatement.
• ASA 502 Audit Evidence — Specific Considerations for Litigation and Claims also requires auditors
to obtain a representation letter seeking information from the in-house legal counsel where they
have the primary responsibility for litigation and claims and is in the best position to corroborate
management’s representations.
• IAS 37 Provisions, Contingent Liabilities and Contingent Assets defines a contingent liability.
Pending litigation and claims are classified as contingent liabilities.
• ISA 580 Written Representations specifies the requirements for management representation letters
which may complement other auditing procedures (e.g. in connection with (1) the completeness
of identified contingent liabilities and related party transactions or (2) the existence of mitigating
factors in the presence of going concern problems).
• ISA 540 (Revised) Auditing Accounting Estimates, Including Fair Value Accounting Estimates,
and Related Disclosures specify the procedures auditors should perform to obtain sufficient
appropriate audit evidence relating to accounting estimates.
P df_Folio:241
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 241
• ISA 550 Related Parties requires auditors to determine whether sufficient appropriate evidence
has been obtained about related parties and their transactions to determine whether a material
misstatement exists and whether disclosures are adequate for the financial statements to achieve
fair presentation.
• ISA 250 (Revised) Consideration of Laws and Regulations in an Audit of a Financial Statements
specifies the auditor’s responsibilities in relation to compliance with laws and regulations.
• ISA 240 The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements
specifies that the objective of the review of management judgments and assumptions related to
significant accounting estimates is to determine whether possible bias on the part of management
is indicated.
• ISA 520 Analytical Procedures requires the auditor to design and perform analytical procedures
near the end of the audit that assist the auditor when forming an overall conclusion as to whether
the financial report is consistent with the auditor’s understanding of the entity.
A material misstatement will affect the overall outcome of the financial statements and may affect the
decision-making process for end-users. If the possibility of material misstatements is pervasive (i.e. it
affects many facets of the financial statements), the issue of concern is that the financial statements cannot
be relied upon to represent a true and fair view of the entity’s state of affairs. In practice, where the effect of
a single issue is very material, a qualified opinion is more likely to be observed if the impact of the issue on
the financial statements can be adequately described in the auditor’s report. Thus, the more serious forms
of modified opinion are more commonly associated with multiple concerns affecting a number of accounts
in the financial statements, or a single concern that affects many accounts in the financial statements (such
as the result of a failure to use Australian Accounting Standards in Australia, or a failure to consolidate
the financial statements of a major subsidiary).
Example 4.3 demonstrates how auditors make the final assessment of aggregated misstatements and its
effect on the financial statements as a whole. Review this example now.
Pdf_Folio:243
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 243
EXAMPLE 4.3
The manager has asked you to review the errors and prepare a summary working paper that will enable
her to assess whether the financial statements are materially misstated.
............................................................................................................................................................................
Using the provided information, prepare a summary of audit differences working paper for the audit manager.
Analyse the findings and determine whether the financial statements are materially misstated.
Check your response against the suggested answer at the end of the book.
QUESTION 4.5
What should the auditor do in relation to the aggregated uncorrected misstatements identified prior
to formulating their opinion on the financial statements?
QUESTION 4.6
You are the senior auditor on the audit of TopSocks Ltd for the year ended 30 June 20X9. In the
audit plan, trade debtors, inventory and warranty provisions were identified as significant risks and
specific audit attention was devoted to related assertions. The following is an extract from the draft
financial accounts prepared by TopSocks Ltd management for the year ended 30 June 20X9 and
the related provisions identified as critical audit areas.
$000s
Trade debtors 4122
Inventories 3589
Warranty provision 1788
Profit before tax 5097
df_Folio:244
P
Discuss the effect of these tests on your conclusions about the related assertions and state the
impact on your audit opinion.
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 245
significant risks and other areas considered important by the partner. Given the importance of the review
process, we include a separate, more detailed section on it here.
The audit review will usually be conducted on two levels.
1. A detailed review of all audit working papers by the person (often termed ‘auditor in-charge’) who is
directly responsible for carrying out detailed audit procedures and for supervising the work of audit
assistants.
2. A higher-level review by the individual who has the ultimate responsibility for the audit and who signs
the auditor’s report. In practice, a substantial part of this higher-level review may be carried out by an
audit manager, but it should be noted that the delegation of any part of the high-level review in no way
absolves the engagement partner from the primary responsibility for the audit.
The extent of the more detailed review will vary according to the problems and complexities of the
engagement, the level of audit risk and the experience and competence of the audit field staff. The objective
of this review is to ensure that:
• the auditor’s internal policies and procedures and the auditing standards have been complied with in the
conduct of the audit and in the preparation of the working papers
• all audit procedures have been successfully completed
• all queries raised during the conduct of the audit or during reviews have been cleared
• the evidence collected supports the audit opinion
• control weaknesses and other matters of concern have been communicated to the management or the
directors of the entity being audited, in an appropriate manner.
The reviewer should appropriately document any queries raised in the detailed review. All working
papers reviewed should be initialled to verify their examination. When the reviewer is satisfied that all
queries have been successfully cleared and documented, the audit files would be passed to the engagement
partner for a final review.
The extent of the work undertaken by the engagement partner will vary but, in any event, it will include:
• participation in the planning of the audit
• review and approval of the audit plan
• review and approval of the audit program
• review and clearance of all matters raised by the audit manager
• approval and signing of management letters, reports and correspondence issued by the auditor in relation
to the audit.
When considering the extent of the review of the audit working papers, the engagement partner will
have regard to the degree of complexity of the engagement and the problems encountered, any previous
experience gained through working with the organisation, and the extent to which the audit manager is
involved in the conduct of the audit.
If there are no adverse circumstances following this consideration, the engagement partner may
undertake the review as illustrated in figure 4.3.
QUESTION 4.7
Sally Fletcher has just completed testing of the depreciation of property, plant and equipment for
her client Happy Grapple Ltd. Information from the draft financial report of Happy Grapple shows
(rounded to $000s):
In testing depreciation, Sally selected a sample of 35 items with a value of $1 672 000 and
established a tolerable error of 5% of base values. The result of the tests showed systematic errors
in the sample of $72 400 and Sally has concluded that this is an acceptable error and no further
audit work is required.
You are Sally’s manager and are reviewing her work. Do you agree with her conclusions in relation
to depreciation? Justify your conclusions.
P df_Folio:246
• Review queries
• Ensure all queries are resolved
Critical areas
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 247
ISA 220 also emphasises the requirement for an engagement quality control review (EQCR), previously
called a second partner review. For audits of financial statements of listed entities and other audit
engagements for which the firm decides that an EQCR is required, the engagement partner shall:
(a) Determine that an engagement quality control reviewer has been appointed;
(b) Discuss significant matters arising during the audit engagement, including those identified during the
engagement quality control review, with the engagement quality control reviewer; and
(c) Not date the auditor’s report until the completion of the engagement quality control review (ISA 220,
para. 19).
An EQCR shall include an objective evaluation of ‘the significant judgments made by the engagement
team, and the conclusions reached in formulating the auditor’s report’ (ISA 220, para. 20). The evaluation
must involve:
1. Discussion of significant matters with the engagement partner;
2. Review of the financial statements and the proposed auditor’s report;
3. Review of selected audit documentation relating to the significant judgments …; and
4. Evaluation of the conclusions reached … and consideration of whether the proposed auditor’s report is
appropriate (ISA 220, para. 20).
For audits of listed entities, the engagement quality control reviewer also considers:
• The engagement team’s evaluation of the firm’s independence in relation to the audit engagement;
• Whether appropriate consultation has taken place on matters involving differences of opinion or other
difficult or contentious matters …; and
• Whether audit documentation selected for review reflects the work performed in relation to the
significant judgments and supports the conclusions reached (ISA 220, para. 21).
The evaluation may also include:
• Significant risks identified during the engagement in accordance with ISA 315 (Revised), and the
responses to those risks in accordance with ISA 330, including the engagement team’s assessment of,
and response to, the risk of fraud in accordance with ISA 240.
• Judgments made, particularly with respect to materiality and significant risks.
• The significance and disposition of corrected and uncorrected misstatements identified during the audit.
• The matters to be communicated to management and those charged with governance and, where
applicable, other parties such as regulatory bodies (ISA 220, para. A30).
The extent of the engagement quality review will vary between audits and will be affected by such
factors as the complexity of the audit, the level of audit risk, and the experience of the engagement partner
and the audit team.
Consideration of the Results of the Firm’s Monitoring Process
If a difference of opinion arises within the engagement team or between the engagement partner and the
EQCR, then ‘the engagement team shall follow the firm’s policies and procedures for dealing with and
resolving differences of opinion’ (ISA 220, para. 22).
The engagement partner is required to consider information circulated by the audit firm in its monitoring
process, and whether any deficiencies noted (and rectifying measures taken) have implications for the audit
engagement (ISA 220, para. 23). This information could include findings from internal quality control
reviews and reviews by external inspections (e.g. ASIC).
ASIC’s information sheet on ‘Improving and maintaining audit quality’ (INFO 222) emphasises that:
Partners and firms should not hesitate to revisit an audited entity to undertake additional work. Undertaking
the work necessary to complete their audits for the reporting period in question will ensure that the audit
report is supportable and that the market can be properly informed if any material misstatements are
detected (ASIC 2017).
After completing the final evaluation of materiality and audit risk, conducting a technical review of the
financial statements, and a final review of the working papers and the engagement team’s performance, it
is time for the auditor to evaluate the findings and form an opinion on the financial statements.
FINAL CHECKLIST
The adage ‘last but not least’ applies to completing the audit. The decisions made by the auditor in this
last stage are usually crucial to the ultimate outcome of the audit. Moreover, the conclusions reached by
Pdf_Folio:248
Materiality
Audit evidence
Accounting policies
Audit opinion
Audit report
The auditor would determine the appropriate audit opinion based on the evaluations of the overall
financial statement presentation, including disclosures. The audit opinion is expressed within the audit
report and is discussed next.
Example 4.4 highlights the factors that the auditor should take into account in forming an opinion on
the content of the auditor’s report. Review the example now.
Pdf_Folio:249
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 249
EXAMPLE 4.4
Forming an Opinion
E-ffervescence.com Ltd had been listed for five years, and it had an earnings and dividend growth history
that was the envy of most other new listings in the technology industry. Analysts were predicting a rosy
future for the company with the ‘whizz kid’ entrepreneur at the helm who seemingly could do no wrong.
E-ffervescence marketed its own and other brands of health products over the internet. Its statistics in
terms of growth in ‘hits’ were almost exponential, and the list of health product manufacturers who wanted
to supply through E-ffervescence’s site was growing.
Jack King, the founding CEO and driving force behind E-ffervescence, was extremely upbeat about the
company’s performance. He owned 20% of the company’s shares, and his strength lay in the research and
development that was required to bring new products to the market rather than in attention to financial
matters. One of the perennial problems with such newly listed technology enterprises is the need for
access to capital for research and development and the long lead time before products get to market.
However, Jack was not worried: the lead time for discovery to market for E-ffervescence was much lower
than that of competitors, and the capital market seemed to have great confidence in the company, giving
it a price-to-earnings multiple of 30.
Jack’s accountant kept trying to alert him to a likely technical breach of the company’s debt covenants
that would trigger automatic invocation of payment in full of the debt within the following fiscal year rather
than the three years remaining in the debt contract. Jack knew how important debt covenants were but
argued the company was close to launching its new anti-obesity product with the potential to double sales
revenue in the following year, and so it was inconsequential whether repayment of the debt in either one,
two or three years occurred.
When the auditor discovered the breach of the covenant and its consequences during the annual
audit, disclosure of the full amount of the loan as a current liability rather than partially non-current
was recommended as an adjustment to the financial statements. Between balance date and completion
of the audit fieldwork, there was a significant downturn in the sharemarket, especially impacting ‘new
technology’ companies and companies with high levels of debt. Many companies were effectively
re-rated overnight, especially if they did not have a proven earnings stream. Although E-ffervescence
had a proven and sustainable earnings stream, the flow of future finance into this ‘new economy’ sector
slowed significantly. Any company seeking extra finance to refinance would struggle in this market.
Almost overnight the optimistic picture Jack had foreseen for his company became less rosy and
the lack of cash flow became crucial. In the aftermath of these developments, Jack refused to alter
the disclosure for the loan. He argued that the key clause creating the need for prompt repayment
of the debt in full was not triggered until after the reporting period date and so it was quite correct to
leave what would have been due in two years as a non-current liability. He went on to state that bringing
the whole amount in as a current liability reduced the quick asset ratio from 0.80 to 0.60 and would make it
more difficult to get bridging finance to continue in business until the crisis over approval for marketing the
anti-obesity drug was over. Jack went on to argue that if the auditor continued with this line of argument,
responsibility for the potential downfall of the company was not out of the question.
............................................................................................................................................................................
(a) Evaluate the case facts to inform the preparation of the auditor’s report.
(b) What role does the materiality of the bank loan play in the auditor’s evaluation of the case facts?
(c) What are the reporting options available to the auditor under these circumstances?
Check your response against the suggested answer at the end of the book.
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
4.2 Evaluate the key issues involved in the final review and completion of an audit.
• In the event of the auditor becoming aware of information during the audit that would have caused
the auditor to calculate a different materiality level initially, the auditor will revise the materiality used
during planning at, or near, the end of the audit to determine the type of auditor’s report to issue.
• If the auditor’s evaluation of the possibility of material misstatements is pervasive (i.e. it affects
many facets of the financial statements), the issue of concern is that the financial statements
cannot be relied upon to represent a true and fair view of the entity’s state of affairs.
• The extent of the more detailed review will vary according to the problems and complexities of the
engagement, the level of audit risk and the experience and competence of the audit field staff.
df_Folio:250
P
Pdf_Folio:251
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 251
FIGURE 4.5 Types of auditor’s reports
Auditor’s report
Adverse
An Australian Perspective
Section 297 of the Corporations Act requires the auditor to give an opinion as to whether the accounts are
drawn up so as to give a true and fair view. It further states that this section does not affect the obligation
under section 296 for a financial report to comply with Australian Accounting Standards without exception.
If, however, directors do not believe that the financial report resulting from following associated standards
are true and fair, they must add such information in the notes to the financial report as is necessary to give
a true and fair view (s. 297).
In practice, in Australia, there are virtually no current examples of listed companies adding additional
notes in order to provide a true and fair view. If the auditors are of the view that the further information
Pdf_Folio:253
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 253
necessary to give a true and fair view is not disclosed, this would constitute a disagreement with
management and, if material, lead to a modified opinion. Again, in practice in Australia, there are virtually
no current examples of auditors of listed companies modifying the auditor’s report on this basis (Carson &
Zhang et al. 2016). These observations suggest that both management and auditors believe that preparation
of accounts in accordance with the current Australian Accounting Standards provides a true and fair view.
Following an investigation of events or conditions indicating going concern problems and the completion
of additional audit procedures considered necessary in the circumstances, the auditor should conclude
whether a material uncertainty exists about the entity’s ability to continue as a going concern. The key
provisions of ISA 570 (Revised) relating to auditors’ reporting considerations when the going concern
basis is appropriate are summarised next. Auditor’s reporting considerations when the going concern basis
is not appropriate will be discussed later in this module.
Going Concern Basis is Appropriate
When the auditor is satisfied that there is a reasonable expectation that the entity will continue as a going
concern for the relevant period, the auditor should issue an unmodified opinion.
When ‘the auditor concludes that [the] use of the going concern basis of accounting is appropriate …
but a material uncertainty exists, the auditor shall determine whether the financial statements:
(a) Adequately disclose the principal events or conditions that may cast significant doubt on the entity’s
ability to continue as a going concern and management’s plans to deal with these events or conditions;
and
(b) Disclose clearly that there is a material uncertainty related to events or conditions that may cast
significant doubt on the entity’s ability to continue as a going concern and, therefore, that it may
be unable to realize its assets and discharge its liabilities in the normal course of business (ISA 570
(Revised), para. 19).
When there is adequate disclosure of the existing material uncertainty, the auditor shall express an
unmodified opinion and include a separate section under the heading ‘material uncertainty related to
going concern’. This paragraph should highlight the material uncertainty and draw attention to the note
in the financial statements where this matter is disclosed (ISA 570 (Revised), para. 22). An example of
such a paragraph that might be used in the auditor’s report can be found in the Appendix to ISA 570
(Revised), Illustration 1. Other instances where matters that could modify the audit report, but not the
auditor’s opinion, are discussed on page 262.
An example of a real-life ‘material uncertainty related to going concern’ paragraph is included in the
audit report extract presented as example 4.5. Review this example now.
EXAMPLE 4.5
EXAMPLE 4.6
Review figure 4.6: Determining and communicating key audit matters, which was developed by the
IAASB (2016) to provide an overview of how to determine which matters are KAMs, in accordance with
ISA 701, and what is communicated in respect of KAMs.
Pdf_Folio:255
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 255
FIGURE 4.6 Determining and communicating key audit matters
The nature and extent of communication with The concept of significant auditor attention
those charged with governance provides an recognises that an audit is risk-based.
indication of which matters are of most significance.
Accordingly, matters that pose challenges to the
Other considerations in determining the auditor in obtaining sufficient appropriate audit
relative significance of a matter include: evidence or in forming an opinion on the financial
statements may be particularly relevant in
• importance of the matter to intended users’ determining KAMs.
understanding of the financial statements
as a whole, in particular its materiality to the Areas of significant auditor attention often relate to
financial statements areas of complexity and significant management
• nature of the underlying accounting policy or judgment in the financial statements, and therefore
complexity or subjectivity in management’s often involve difficult or complex auditor judgments.
selection of an appropriate accounting policy
• nature and materiality of corrected and In turn, this often affects the overall audit strategy,
uncorrected misstatements related to the allocation of resources, and extent of audit effort.
matter These effects may include, for example, the extent
• nature and extent of audit effort needed to of involvement of senior personnel on that audit
address the matter engagement or the involvement of an auditor’s
• nature and severity of difficulties in applying expert or individuals with expertise in a specialised
audit procedures or obtaining relevant and area of accounting or auditing, whether engaged or
reliable audit evidence employed by the firm to address these areas.
• severity of any control deficiencies related to
the matter.
The description of KAM in the auditor’s report shall include a reference to the related
disclosure(s), if any, in the financial statements and shall address:
a) Why the matter was considered to be one of most significance in the audit and therefore
determined to be a key audit matter; and
b) How the matter was addressed in the audit.
Source: International Auditing and Assurance Standards Board (IAASB) 2016, Determining and Communicating Key Audit
Matters (‘KAM’), accessed July 2019, http://www.ifac.org/publications-resources/determining-and-communicating-key-
audit-matters. © July 2016 by the International Federation of Accountants (IFAC). All rights reserved. Reproduced with permission
of IFAC.
Pdf_Folio:256
When the auditor modifies their opinion in accordance with ISA 705 (Revised) as a result of what they
have identified as a key matter, they do not include this matter in the KAMs section of the auditor’s report
(ISA 701, para. 12). Communicating KAMs cannot be a substitute for disclosures that management are
required to make in the financial statements.
The auditor uses an appropriate subheading to identify each KAM. The description of each matter in the
KAM section should include a reference to any related disclosure in the financial statements and should
outline:
(a) Why the matter was considered to be one of most significance in the audit and therefore determined to
be a key audit matter; and
(b) How the matter was addressed in the audit (ISA 701, para. 13).
The only circumstances in which a KAM is not communicated in the auditor’s report are when:
(a) Law or regulation precludes public disclosure about the matter; or
(b) In extremely rare circumstances, the auditor determines that the matter should not be communicated
in the auditor’s report because the adverse consequences of doing so would reasonably be expected
to outweigh the public interest benefits of such communication. This shall not apply if the entity has
publicly disclosed information about the matter (ISA 701, para. 14).
The auditor shall communicate those matters determined to be KAMs to those charged with governance,
or, if applicable, the auditor’s determination that there were no KAMs to communicate in the auditor’s
report (ISA 701, para. 17).
Research conducted by Fargher (2019) suggests that most issues included as KAMs do not improve the
quality of financial reporting as the majority of KAMs do not provide any new information to users of the
audited financial statements. Reasons quoted for this were because many of the KAMs related to known
current-year transactions or were disclosed in the previous years’ annual reports.
In New Zealand, the requirement to communicate KAMs in the auditor’s report for listed entities was
extended to cover audits of complete sets of general purpose financial statements for FMC reporting entities
(as defined in the Financial Markets Conduct Act 2013 (NZ) (FMC) s. 6(1)) that are considered to have a
higher level of public accountability (ISA (NZ) 700 (Revised), para. NZ30.1). For FMC reporting entities
other than listed issuers, this will become a requirement two years after the requirement to disclose KAMs
by listed entities, for periods ending on or after 31 December 2018 (ISA (NZ) 700 (Revised), para. NZ5.2).
The IAASB has prepared some example KAMs. One such illustrative example is included as
example 4.7. Review this example now.
EXAMPLE 4.7
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 257
the [name of product] sale agreement (IAASB 2015, p. 5). Note: the auditor may refer to the related note
disclosure in the description of the KAM.
Revenue Recognition — Description of How the KAM Was Addressed in the Audit
Our audit procedures to address the risk of material misstatement relating to revenue recognition, which
was considered to be a significant risk, included:
• testing of controls, assisted by our own IT specialists, including, among others, those over input of
individual advertising campaigns’ terms and pricing; comparison of those terms and pricing data against
the related overarching contracts with advertising agencies; and linkage to viewer data
• detailed analysis of revenue and the timing of its recognition based on expectations derived from our
industry knowledge and external market data, following up variances from our expectations (IAASB
2015, p. 6.)
Example 4.8 shows KPMG’s reporting of one of the KAMs identified in the Qantas 2018 Annual Report.
Review this example now and then compare to the example provided by IAASB shown in example 4.7.
EXAMPLE 4.8
The Key Audit Matter How the matter was addressed in our audit
Recognition of passenger revenue is a key Working with our IT specialists, our procedures included
audit matter due to: the following.
• its financial significance • Analysing the end to end flow of ticket information
• the high volume of relatively low value through passenger revenue systems and evaluating
passenger tickets the logic of accounting outputs against accounting
• accounting process complexity arising standards.
from a variety of ticket conditions and • Evaluating the accurate processing of tickets and
points of sale. associated accounting outcomes in internal passenger
Our audit effort was directed to assessing revenue systems. We did this by testing the key controls
these conditions, in particular the restricting access to appropriate users and preventing
accounting process complexity, which is unauthorised changes to the systems. We tested key
influenced by: controls within the system that relate to ticket validation
• the use of multiple systems and their and the recognition of revenue at flight date.
interface and interactions with agents, • Testing key controls related to manual changes to
other airlines and industry bodies given revenue accounting records where tickets have been
the possible variations in the method of identified as exceptions to automated validation.
purchasing and modifying tickets • Assessing the historical accuracy of the Group’s
• the accuracy of automated revenue expectation of the proportion of tickets that will expire
recognition within the Group’s systems unused after scheduled flight date by comparing
and consistency with accounting previous estimates to actual outcomes.
standards, given the Group’s dependence • Checking the accurate calculation and use of source
on automated processes for recording system reports in the Group’s expectation of the
ticket sales and recognising revenue at proportion of tickets that will expire unused after
passenger flight date scheduled flight date.
• the application of estimates to recognise • Analysing passenger revenue recognised by comparison
revenue for the proportion of tickets that to an expectation created using key revenue indicators,
are unused on the scheduled flight date, external data and knowledge of the Group.
but with terms and conditions that allow • Testing of balance sheet reconciliations including
future usage comparing to source systems and information available
• manual revenue recognition processes post year-end.
related to tickets identified as exceptions
to automated rules.
Given the dependence on systems and
controls, we involved our IT specialists in
addressing this key audit matter.
df_Folio:258
P
Consider the following scenarios and then determine which of these issues are likely to be disclosed
by the auditor as a KAM. Justify your conclusions.
(a) The determination of the amount of the write-down of goodwill, which is a significant balance in
the client’s financial statements and the write-down has been determined as a significant risk.
(b) The risk of fluctuations in the market price of oil for an oil production company.
(c) A complex judgment about the most appropriate basis for revenue recognition.
(d) A disagreement with management about the carrying value of a non-current asset.
The auditor is required to read and consider the other information contained in the annual report
(ISA 720 (Revised), para. 14). This is because other information that is materially inconsistent with the
financial statements or the auditor’s knowledge obtained in the audit may indicate that there is a material
misstatement of the financial statements or that a material misstatement of the other information exists.
Either of these may undermine the credibility of the financial statements and the auditor’s report. It is also
recognised that such material misstatements may also inappropriately influence the economic decisions
of the users for whom the auditor’s report is prepared. When other information is incorrectly stated or
otherwise misleading, a misstatement may exist. For example, when the other information paragraph
omits or obscures information that is necessary to properly understand the matter disclosed in the other
information section.
If the auditor identifies that a material inconsistency appears to exist …, [they should] discuss the matter
with management and, if necessary, perform other procedures to conclude whether:
(a) a material misstatement of the other information exists;
(b) a material misstatement of the financial statements exists; or
(c) the auditor’s understanding of the entity and its environment needs to be updated (ISA 720 (Revised),
para. 16).
If it is considered necessary to revise the audited financial statements prior to the date of the auditor’s
report and management refuses to make the revision, the auditor should modify their opinion in accordance
with ISA 705 (ISA 720 (Revised), para. 20).
If the auditor concludes that a material misstatement exists in the other information obtained prior to the
date of the auditor’s report, and the other information is not corrected after communicating with those
charged with governance, the auditor shall take appropriate action, including:
(a) Considering the implications for the auditor’s report and communicating with those charged with
governance about how the auditor plans to address the material misstatement in the auditor’s report; or
(b) Withdrawing from the engagement, where withdrawal is possible under applicable law or regulation
(ISA 720 (Revised), para. 18).
If the other information is obtained after the date of the auditor’s report and the auditor concludes
that a material misstatement exists and is not corrected after communicating with those charged with
governance, the auditor should ‘take appropriate action considering [their] legal rights and obligations
to seek to have the uncorrected material misstatement appropriately brought to the attention of users for
whom the auditor’s report is prepared’ (ISA 720 (Revised), para. 19).
Pdf_Folio:259
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 259
In practice, in most countries, it would be very rare that material inconsistencies in the other information
were not corrected after these inconsistencies were communicated to those charged with governance. In
Australia, the withdrawal from the engagement is not permitted for audits undertaken in accordance with
the Corporations Act.
ISA 720 (Revised) requires the auditor’s report to contain:
‘a separate section … ‘Other Information’ …, when, at the date of the auditor’s report:
(a) For an audit of financial statements of a listed entity, the auditor has obtained, or expects to obtain, the
other information; or
(b) For an audit of financial statements of an entity other than a listed entity, the auditor has obtained some
or all of the other information (ISA 720 (Revised), para. 21).
This section outlines the auditor’s responsibility for this other information. It will include:
(a) A statement that management is responsible for the other information;
(b) An identification of:
(i) Other information, if any, obtained by the auditor prior to the date of the auditor’s report; and
(ii) For an audit of financial statements of a listed entity, other information, if any, expected to be
obtained after the date of the auditor’s report;
(c) A statement that the auditor’s opinion does not cover the other information and, accordingly, that the
auditor does not express an audit opinion or any form of assurance conclusion thereon;
(d) A description of the auditor’s responsibilities relating to reading, considering and reporting on other
information as required by this ISA … (ISA 720 (Revised), para. 22).
Examples of reports that the auditor does not need to consider because they are outside the scope of the
audit, when issued as standalone documents rather than as part of the annual report, include:
1. Separate industry or regulatory reports (for example, capital adequacy reports), such as may be prepared
in the banking, insurance, and pension industries.
2. Corporate social responsibility reports.
3. Sustainability reports.
4. Diversity and equal opportunity reports.
5. Product responsibility reports.
6. Labour practices and working conditions reports.
7. Human rights reports (ISA 720 (Revised), para. A5).
You should now read ISA 720 (Revised), paragraphs 11–25 and related application material to
confirm your understanding of the auditor’s responsibilities with regards to other information in
documents containing audited financial statements.
Independence Declarations
It will be noted that the standard format report is headed ‘Independent Auditor’s Report’, and it says
the auditor is independent of the company in accordance with the International Ethics Standards Board for
Accountants (IESBA) Code and other relevant ethical requirements in the jurisdiction (ISA 700 (Revised),
para. 28(c)).
In Australia, a further independence declaration is also currently required of the auditors. It is seen
as important that the auditor makes such a statement and communicates this to the financial statement
users. This has been imposed in Australia through the Corporations Act, which requires auditors,
when undertaking audits of companies, registered schemes or disclosing entities, to abide by certain
independence requirements.
Section 307C of the Corporations Act requires the individual auditor or lead auditor in a firm or company
to give the directors of the audited entity a declaration that there have been no contraventions of the auditor
independence requirements of the Corporations Act or any applicable ethics code or code of professional
conduct. The declaration can be either an unqualified declaration or a qualified declaration; however,
when a qualified declaration is given, the auditor is required to disclose in the declaration the details of
the contraventions. Failure to give the declaration is a strict liability offence. However, section 307C(7)
provides some indemnity safeguards. Under section 298(1)(c), the declaration is required to be included
in the directors’ report for that year.
Example 4.9 shows the ‘Auditor’s independence declaration’ from the ASX Annual Report 2018. The
declaration is included just after the Director’s report. Read this example now.
Pdf_Folio:260
Along the same lines as the independence declarations, and because of concerns about the impact of the
provision of non-audit services on auditor independence in Australia, section 300(11B) of the Corporations
Act also requires the board of directors of a listed company to provide a statement in the annual report that
identifies all non-audit services provided by the audit firm and the fees applicable to each category of
non-audit service. The section also requires the report to include a statement by the directors that they are
satisfied that the provision of non-audit services is compatible with the general standard of independence
and an explanation of why those non-audit services do not compromise audit independence. Section
300(11D) requires that where the listed company has an audit committee, this statement must be made
in accordance with advice provided by that committee.
Independence requirements were discussed in module 2.
Example 4.10 shows the ‘Directors’ declaration of satisfaction with independence of auditor’ from the
ASX Annual Report 2018. This declaration is included as part of the Director’s report. Review the example
now.
EXAMPLE 4.10
QUESTION 4.9
The financial statements of a company for the current year show an operating profit after tax of
$50 million and share capital and reserves totalling $100 million. The auditor decided to issue an
unmodified opinion in each of the following cases.
P df_Folio:261
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 261
(a) The auditor was unable to attend the physical count of inventories that were held at international
locations totalling $200 million but was satisfied, by other means, of their existence and
condition.
(b) The company is the defendant in a lawsuit involving a claim against the company for $20 million.
No provision has been made in the financial statements because the company’s legal counsel
is firmly of the opinion that the company’s defence will prove successful.
(c) The company is the defendant in a lawsuit involving a claim against the company for $2 million.
Based on legal advice, the directors hope to settle out of court for $100 000; however, no
provision has been made for this eventuality in the financial statements, as the directors feel
it would prejudice their negotiations.
(d) In the auditor’s opinion, the allowance for doubtful debts is understated by $100 000.
Explain the circumstances under which the auditor could be justified in issuing an unmodified
opinion in each case.
The auditor is cautioned that the widespread use of Emphasis of Matter paragraphs diminishes the
effectiveness of the auditor’s communication of such matters.
Example 4.11 provides an example of an Emphasis of Matter paragraph in an auditor’s report. Review
this example now.
EXAMPLE 4.11
For an example of an Emphasis of Matter paragraph, refer to the Independent auditor’s report to the
members of Cochlear Ltd available at: https://www.cochlear.com/intl/about/investor/annual-reports,
See pages 103–104, in particular page 103.
QUESTION 4.10
Consider the following scenarios and then determine whether the auditor might consider it
necessary to include an Emphasis of Matter paragraph. Justify your conclusions.
(a) The auditor has determined that the write-down of goodwill is a significant risk, but is satisfied
that the client has appropriately determined and disclosed the amount of the write-down.
(b) The auditor becomes aware that a significant proportion of an entity’s operating facilities has
been destroyed in a fire after year-end but before they have signed the auditor’s report.
(c) The auditor has concerns as to whether the entity will continue as a going concern, but is
satisfied that there is adequate disclosure of the uncertainty in the notes to the financial
statements.
We now turn our attention to when Other Matter paragraphs are relevant.
Other Matter Paragraph
The inclusion of an Other Matter paragraph in the auditor’s report provides the auditor with the ability to
draw the user’s attention to any other matter that is not presented or disclosed in the financial statements
that they believe are sufficiently important to highlight and are relevant to the users’ understanding of the
audit, the auditor’s responsibilities or the auditor’s report (ISA 706 (Revised), para. 10).
Circumstances in which an Other Matter paragraph may be necessary include:
• where it is not possible to withdraw from the audit even though a limitation imposed by management
on the scope of the audit is pervasive (a matter relevant to the users’ understanding of the audit)
• where national regulations require or permit the auditor to further elaborate on their responsibilities in
the audit (a matter relevant to the users’ understanding of the auditor’s responsibilities)
Pdf_Folio:263
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 263
• where the auditor’s report covers more than one set of financial statements, both prepared in accordance
with general purpose financial frameworks, such as a national framework and International Financial
Reporting Standards (a matter relating to reporting on more than one set of financial statements) (ISA
706 (Revised), paras A9–A14).
Another area that can give rise to an Other Matter paragraph is comparative information included in the
financial statements.
Comparative Information
For comparative financial statements, the auditor is required to include this statement in an Other Matter
paragraph in the auditor’s report ‘unless the predecessor auditor’s report on the prior period’s financial
statements is reissued with the financial statements’ (ISA 710, para. 17).
ISA 710 Comparative Information — Corresponding Figures and Comparative Financial Statements
establishes standards and provides guidance to auditors as to their responsibilities with respect to
comparative information in an audit of financial statements. However, the principles espoused in
ISA 710 should also be applied to the audits of special purpose financial statements, which are discussed
in module 5. Comparative financial information is the amounts and disclosures included in the financial
statements in respect of one or more prior periods in accordance with the applicable financial reporting
framework. It is recognised that internationally, there are many differences in the types of comparative
information that is required to be disclosed under the various reporting frameworks. ISA 710 distinguishes
between two various broad approaches to the auditor’s reporting responsibilities in respect of such
comparative information:
• corresponding figures
• comparative financial statements (ISA 710, para. 2).
Corresponding figures is defined as:
Comparative information where amounts and other disclosures for the prior period are included as an
integral part of the current period financial statements, and are intended to be read only in relation to
the amounts and other disclosures relating to the current period (ISA 710, para. 6b).
Comparative information where amounts and other disclosures for the prior period are included for
comparison with the financial statements of the current period and, if audited, are referred to in the auditor’s
opinion. The level of information included in those comparative financial statements is comparable with
that of the financial statements of the current period (ISA 710, para. 6c).
The distinction between corresponding figures and comparative financial statements in the international
auditing standards is because the auditing standards have become more complex as they need to be applied
to multiple jurisdictions. The main question to ask is ‘Does the auditor’s report explicitly refer to the
comparative information?’
When corresponding figures are presented, the auditor’s opinion does not refer to the corresponding
figures because the auditor’s opinion is on the current period’s financial statements as a whole, including
the corresponding figures (ISA 710, paras 10 and A2).
For comparative financial statements:
Because the auditor’s report on comparative financial statements applies to the financial statements for each
of the periods presented, the auditor may express a qualified opinion or an adverse opinion, disclaim an
opinion, or include an Emphasis of Matter paragraph with respect to one or more periods, while expressing
a different auditor’s opinion on the financial statements of another period (ISA 710, para. A9).
The audit procedures for any comparative information are similar. The auditor needs to determine
whether the financial statements contain the required comparative information and whether this infor-
mation is appropriately classified. To do this, the auditor evaluates whether:
(a) The comparative information agrees with the amounts and other disclosures presented in the prior
period or, when appropriate, have been restated; and
(b) The accounting policies reflected in the comparative information are consistent with those applied
in the current period or … whether those changes have been properly accounted for and adequately
presented and disclosed (ISA 710, para. 7).
Pdf_Folio:264
For both corresponding figures and comparative financial statements, if the prior period financial
statements were not audited, the auditor is required to state this in an Other Matter paragraph. Even after
making such a statement, the auditor needs to obtain ‘sufficient appropriate audit evidence that the opening
balances do not contain misstatements that materially affect the current period’s financial statements’
(ISA 710, paras 14, 19).
You should now read ISA 710, paragraphs 7–19, and related application material to confirm your
understanding of its requirements.
QUESTION 4.11
In our opinion, the financial statements referred to above present fairly, in all material respects,
the financial position of XYZ Company as at December 31 20X1 and 20X0 and the results of its
operations and its cash flows for each of the years in the three-year period ended 31 December
20X1, and are in conformity with generally accepted accounting principles in the United States
of America.
Matters that Modify the Audit Report and Affect the Auditor’s Opinion
ISA 705 (Revised) establishes standards and provides guidance to the auditor about the form and content
of any modifications to the standard auditor’s opinion that are required. This standard, which covers
matters that modify the auditor’s report and affect the auditor’s opinion (resulting in a qualified opinion,
disclaimer of opinion or adverse opinion), needs to be distinguished from ISA 706 (Revised), which
covers matters (referred to as ‘Emphasis of Matter’ or ‘Other Matter’) that modify the standard auditor’s
report but do not modify the auditor’s opinion.
If the auditor is unable to issue an unmodified opinion, the auditor has a choice of issuing the following
modified opinions:
• a qualified opinion
• an adverse opinion
• a disclaimer of opinion (also known as an inability to form an opinion) (ISA 705 (Revised), para. 2).
The auditor’s decision as to which type of modified opinion is appropriate depends on:
(a) The nature of the matter giving rise to the modification, that is, whether the financial statements are
materially misstated or, in the case of an inability to obtain sufficient appropriate audit evidence, may
be materially misstated; and
(b) The auditor’s judgment about the pervasiveness of the effects or possible effects of the matter on the
financial statements (ISA 705 (Revised), para. 2).
Pervasive means that the effects or possible effects of misstatements are usually not confined to specific
elements, accounts or items in the financial statements. The concept was discussed earlier in this module.
The form and content of the standard (unmodified) auditor’s report changes when a modification to the
auditor’s opinion is issued. The opinion itself should be modified as discussed in the next section, and the
headings ‘Qualified Opinion’, ‘Adverse Opinion’ or ‘Disclaimer of Opinion’ shall be used as appropriate
(ISA 705 (Revised), para. 16). The use of these headings makes it clear to the reader that a modified opinion
of a particular type has been issued.
Pdf_Folio:265
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 265
In addition to the specific elements required by ISA 700 (Revised), an additional section, outlining the
basis for modification, is added to the auditor’s report. This section should adequately describe the reasons
for the modification. It is placed immediately after the opinion paragraph in the auditor’s report in order
to provide the financial statement user with the context and rationale for the auditor’s opinion. The section
should be headed:
• Basis for Qualified Opinion
• Basis for Adverse Opinion
• Basis for Disclaimer of Opinion, as appropriate (ISA 705 (Revised), para. 20).
If there are specific amounts in the financial statements that are materially misstated, the basis for the
modification section should, if practical, include a description and quantification of the financial effects of
the misstatement (ISA 705 (Revised), para. 21). For example, if inventory is overstated, the auditor may
quantify the effect on income tax, income before taxes, net income and equity. If it is not practicable to
quantify the financial effects, a statement to this effect shall be included in the paragraph.
The form and content of the modified auditor’s report for each of these audit opinions are discussed
next.
Matters Giving Rise to a Modified Opinion and the Type of Modification
The matters giving rise to a modified opinion and the type of modification are outlined in figure 4.7. There
are two categories of matters giving rise to the need for a modified audit opinion:
• the financial statements are materially misstated
• the auditor is unable to obtain sufficient appropriate audit evidence.
FIGURE 4.7 The auditor’s judgment and the type of modified opinions to be expressed
Nature of matter
giving rise to Cannot obtain sufficient
Financial statements are
the modification appropriate audit
materially misstated
evidence
Auditor’s judgment
about effects on the Is the effect/possible Is the effect/possible
financial statements effect on the financial effect on the financial
statements pervasive? statements pervasive?
Yes No Yes No
Type of
modified opinion Adverse Qualified Disclaimer of Qualified
opinion opinion opinion opinion
Source: International Auditing and Assurance Standards Board (IAASB) 2018a, ISA 705 (Revised) Modifications to the Opinion in
the Independent Auditor’s Report, para. A1, in Handbook of International Quality Control, Auditing, Review, Other Assurance, and
Related Services Pronouncements, 2018–19 edn, vol. 1, p. 788, accessed July 2019, https://www.ifac.org/publications-resources/
2018-handbook-international-quality-control-auditing-review-other-assurance
Material misstatements may arise when there is a disagreement between the auditor and management
in relation to:
(a) the appropriateness of the accounting policies selected by management, such as the choice of an
accounting policy that is not allowed under the applicable financial reporting framework
(b) the method by which selected accounting policies have been applied, such as management applying
an accounting policy inconsistently to similar transactions
(c) the appropriateness or adequacy of disclosures in the financial statements, such as the omission of
certain disclosures required by the applicable financial reporting framework.
Pdf_Folio:266
EXAMPLE 4.12
QUESTION 4.12
Evaluate the following scenarios and conclude whether they result in a material misstatement
or scope limitation. Identify the type of modifications to the audit opinion that would be most
appropriate in each case.
P df_Folio:267
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 267
(a) The audit client is required to equity account its investment in an overseas company in
accordance with the applicable financial reporting framework, but the auditor is not able to
obtain sufficient information about the associated entity’s financial performance and position
to determine whether the equity accounting method has been appropriately applied.
(b) Based on testing of a sample of potentially obsolete inventory, the auditor concludes that the
client has under-provided for inventory write-off by 30%.
(c) The audit client has requested the auditor not to confirm a debt with a government department
on the basis that it is in confidential discussions with this department for a possible significant
contract.
Now that the matters giving rise to a modified opinion have been discussed, we turn our attention to the
three types of modified opinions — starting with the qualified opinion.
Qualified Opinion
The auditor should issue a qualified opinion when, after having obtained sufficient appropriate audit
evidence, they conclude that uncorrected misstatements, either individually or in the aggregate, are
material, but not pervasive, to the financial statements or, if unable to obtain sufficient appropriate audit
evidence, that the possible effects of undetected misstatements on the financial statements are potentially
material, but not pervasive (ISA 705 (Revised), para. 7). Therefore, in order to issue a qualified opinion,
the issue of concern must be of a material nature, but not so pervasive that the financial statements cannot
be relied upon (which would result in an adverse opinion), or that the auditor cannot determine whether
the financial statements can be relied upon (which would result in a disclaimer of opinion).
Thus, the auditor is stating that in their opinion, except for the reservations outlined, the remainder
of the financial statements can be relied upon. As outlined previously, the auditor should quantify any
reservations so that the user can adjust the information contained in the financial statements.
Qualified opinions are the most common of the three forms of modified opinions observed in practice,
although they are still issued relatively infrequently. The more serious forms of qualification, to be discussed
later, are rarely seen in practice. The fact that qualifications are rare is likely to increase their sanctioning
power; if qualifications were common, management would be less concerned about receiving one.
An example of a modified auditor’s report, outlining the basis for the qualified opinion and the
qualification, is given in example 4.13. Review this example now.
EXAMPLE 4.13
An example of a qualified auditor’s report for a fictional NZ entity, outlining the basis for the qualified
opinion and the qualification, is provided in example 4.14. Refer to the fictional Independent auditor’s
report to the members of ABC Finance Limited provided in this example now. Note that the 2018 financial
statements were qualified due to an inability to obtain sufficient appropriate corroborating evidence in
relation to material related party transactions. However, also note that there was one instances of Emphasis
of Matter paragraph concerning related party issues. This issue is not part of the qualification but has
been included an Emphasis of Matter paragraph to bring attention to this matters to users of the financial
statements.
Closely examine the extracts included in figure 4.8 so that you will be able to distinguish between items
requiring a qualification and those that do not modify the audit opinion (Emphasis of Matter paragraph).
FIGURE 4.8 Qualified opinion — ABC Finance Ltd 2018 Audit Report
Qualified opinion
In our opinion, the accompanying financial We have audited the accompanying financial
statements of ABC Finance Limited (the statements which comprise:
‘Company’) on pages 5 to 17, except for the − the balance sheet as at 31 March 2018;
possible effects of the matter described in the basis − the statements of profit or loss, changes in
for qualified opinion: equity and cash flows for the year then ended;
i. present fairly in all material respects the and
Company’s financial position as at 31 − notes, including a summary of significant
March 2018 and its financial performance accounting policies and other explanatory
and cash flows for the year ended on that information.
date; and
ii. comply with New Zealand Equivalents to
International Financial Reporting Standards
and International Financial Reporting
Standards.
EXAMPLE 4.14
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 269
Our responsibilities under ISAs (NZ) are further described in the auditor’s responsibilities for the audit
of the financial statements section of our report.
Emphasis of Matter — Regulatory Non-Compliance
Note 2 to the financial statements sets out the Company’s non-compliance with requirements of its trust
deed that relate to its related party exposure limit, concentration of debtors and its minimum capital. The
note also sets out the actions being taken by the Company to address this matters with the company’s
supervisor.
As part of our responsibilities as the Company’s auditor under the Financial Markets Conduct Act 2013,
we have formally notified that non-compliance to NZ Corporate Trustee Limited in their role as supervisor
of the Company.
Our opinion is not modifed in respect of this matter.
Disclaimer of Opinion
A disclaimer of opinion should be expressed when the auditor ‘is unable to obtain sufficient appropriate
audit evidence on which to base the opinion, and the auditor concludes that the possible effects’ of
the adjustments could be both material and pervasive (ISA 705 (Revised), para. 9). There is also a
specific requirement in ISA 580, which states that if the auditor ‘concludes that there is sufficient doubt
about the integrity of management such that the written representations required’ of management under
ISA 580, paragraph 10–11 cannot be relied upon, or if management does not provide the required written
representations, the auditor should issue a disclaimer of opinion (ISA 580, para. 20).
Similar to adverse opinions, disclaimers of opinion are a very significant form of modification and
communicate that the auditor cannot reasonably obtain the necessary evidence to resolve the uncertainty
or multiple uncertainties that have arisen. Before issuing such an opinion, the auditor should first exhaust
all reasonable alternative means of obtaining sufficient appropriate audit evidence.
This form of modification is again very rare in practice, with, in any year, usually less than 1% of listed
companies in Australia receiving such types of modification.
An example of the disclaimer of opinion and basis for disclaimer of opinion paragraphs for an auditor’s
report modified for a disclaimer of opinion is given in example 4.15. Review this example now.
EXAMPLE 4.15
df_Folio:270
P
For a real-life example of a disclaimer of opinion, refer to the 2018 independent auditor’s report to the
members of AusGroup Limited shown as example 4.16. Note the wording of the basis for the disclaimer
of opinion and then go back to the qualified and adverse opinion examples and compare and contrast the
basis for each opinion.
EXAMPLE 4.16
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 271
In the next section, the auditor’s communication and reporting responsibilities will be discussed.
QUESTION 4.13
Assume that you have collected the audit evidence required to reach a conclusion.
Evaluate each of the following scenarios and determine the type of opinion the auditor should
issue. Justify your conclusions.
(a) The auditor has concerns as to whether the entity will continue as a going concern, but is
satisfied that there is adequate disclosure of the uncertainty in the notes to the financial
statements.
(b) The auditor has concerns as to whether the entity will continue as a going concern but does not
believe that this is adequately disclosed in the notes to the financial statements.
(c) The auditor believes that it is improbable that the entity will continue as a going concern.
Management has refused to prepare the financial statements on a liquidation basis.
QUESTION 4.14
Evaluate each of the following independent situations and then determine the type of audit opinion
which should be given. Justify your conclusions.
(a) A flood destroyed the client’s offices and all the accounting records just before the end of the
financial year. The client does not have another copy of the records.
(b) An entity is facing significant litigation as a result of dumping oil in the ocean. This is adequately
disclosed in the notes to the financial statements.
(c) The client has provided a provision for inventory obsolescence of $250 000. Based on your audit
assessment, you have determined that the provision should be $300 000. Materiality for the client
has been set at $80 000, and you are satisfied in all other material respects.
(d) The client refuses to include all liabilities in the balance sheet, and the auditor believes that the
effect of this action is pervasive on the financial statements.
(e) You are currently performing the audit of XYZ Limited. Your audit firm has been in dispute with
management over the carrying value of brand names. Due to the materiality of the amounts
involved, you decided to engage an expert to perform an independent valuation. The result
from the expert was close to your original estimate and still materially different from that of
management. The directors refuse to amend the financial statements.
(f) The auditor believes that the client’s financial statements present a true and fair view of its
financial position and performance, and the financial statements are in accordance with the
applicable financial reporting framework.
Adverse Opinion
An adverse opinion is a very serious form of modified opinion issued when the auditor concludes that
misstatements are, either individually or in aggregate, material and pervasive to the financial statements
(ISA 705 (Revised), para. 8). The underlying message that the auditor is trying to convey is that they
consider the financial statements to be misleading or of little use to the intended users.
An example of the adverse opinion and basis for adverse opinion paragraphs contained in an auditor’s
report modified for an adverse opinion is given in example 4.17. Review this example now.
EXAMPLE 4.17
df_Folio:272
P
This form of audit opinion is rarely observed in practice. Extracts of the basis for adverse opinion from
adverse auditor’s reports for financial statements between 2015 and 2018 are provided as example 4.18.
Review this example now, taking note of the reasons stated as to why an adverse opinion was deemed
necessary in each situation.
EXAMPLE 4.18
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 273
position and results of the Company and its subsidiaries. However, as disclosed in note 2.1 to the financial
statements, the directors have not prepared consolidated financial statements because in the opinion
of the directors, the Company has prepared the consolidated financial statements in accordance with
International Financial Reporting Standards (‘IFRS’) which is available for public use on the company’s
website, and it has no real value to reproduce consolidated financial statements under HKFRSs for
the statutory requirements of the Hong Kong Companies Ordinance to the members of the Company.
According to the Company’s accounting policies, interests in subsidiaries are stated at cost less
impairment losses, if applicable. The results of the subsidiaries are accounting for by the Company on
the basis of dividends received and receivable on the reporting date. The non-preparation of consolidated
financial statements is a departure from HKFRS 10 as well as sections 379(2) and 380 of the Hong Kong
Companies Ordinance. Had the subsidiaries been consolidated, many elements in the financial statements
would have been materially affected. The effects on the financial statements of the failure to consolidate
can be referenced to the consolidated financial statements published on the company’s website.
Extract 4: Financial Services
As explained in Note 12, the Management has performed an impairment test of the goodwill at
31 December 2018 and concluded that no impairment is required. Management estimated cash flow
projections over a period of five years using a strong growth rate. We consider the following.
• Cash flow projections used in measuring value in use must be based on reasonable and supportable
assumptions that take into account both past and actual cash flows and management’s past ability
to forecast cash flows accurately. Management performed a back testing of the 2017 assumptions
used for the impairment test of the goodwill at 31 December 2017 which showed significant negative
deviations. Over the last past few years, financial projections were consistently either not realised or
delayed.
• Despite what we consider to be aggressive growth rates, it still results in projected negative cash-flows
up to 2021 and the full amount of the value in use is based on the perpetual future cash flows calculated
from 2024 onwards.
• To achieve the financial cash-flow forecast, the Group will need to secure additional financing to
compensate the negative operational cash-flow which are projected beyond the next 12- to 15-month
period.
We are of the opinion that the risks linked to the recoverable amount of the goodwill are not sufficiently
reflected in the impairment considerations applied by the Group, and are of the opinion that the carrying
value of the goodwill is overstated by USD $21.1 million resulting in an understatement of the loss of
the year and an overstatement of the total equity in the same amount. As a consequence, the relevant
impairment disclosures are missing in Note 12. In our opinion, this has a pervasive and material impact
on the financial statements.
In addition, the Group recognises deferred tax asset (DTA) of its two subsidiaries. The recognition of
the DTA depends on the ability to generate taxable profit in the near future. We are of the opinion that the
deferred tax asset is overstated in the amount of USD $1.8 million, resulting in an understatement of the
loss of the year and an overstatement of the total equity in the same amount.
The first extract indicates that there is significant doubt on the company’s ability to continue as a
going concern. In fact, this company has recorded a negative working capital since 2012 indicating this
is an ongoing problem. Even though the company has managed to source the required funds to continue
operating in the past, there is no evidence to show that the necessary funds will be able to be sourced during
the next financial year. The company believes they will be able to continue to source the required funds
and prepared the financial statements on a going concern basis whereas the auditor believes that the going
concern basis is not appropriate.
The second extract also indicates a disagreement with management on the preparation of the financial
statements on a going concern basis being the reason for the adverse audit opinion.
The third extract highlights the importance of companies preparing their annual reports and consolidated
financial statements (when applicable) in accordance with the financial reporting standards and company
legislation in their jurisdiction.
The fourth extract highlights issues with assumptions used to calculate cash flow projections which are
then used to determine impairment of items such as goodwill. These assumptions must be realistic and
supported by reliable evidence.
Going Concern Basis is Not Appropriate
If the auditor believes that a going concern basis of accounting has been inappropriately used in preparing
the financial statements, the auditor should issue an adverse opinion (ISA 570 (Revised), para. 21).
df_Folio:274
P
QUESTION 4.15
The financial statements of a company for the current year show an operating profit after tax of
$50 million and share capital and reserves totalling $100 million. Evaluate each of the following
scenarios and determine the type of opinion the auditor should issue. Justify your conclusions.
(a) Assume the provision for long service leave in the financial statements is understated by
$30 million.
(b) Assume that the company is a trustee of a trust in which there is a deficiency of assets
amounting to $300 million and for which the company is required to assume liability. Although full
disclosure of the circumstances is made in the notes to the financial statements, the liabilities
of the trust are not included in the statement of financial position, and no provision for the
deficiency has been made in the income statement.
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
4.1 Explain the auditor’s reporting responsibilities in relation to the auditor’s report and opinion.
• The auditor’s responsibility is to form an opinion on the financial statements based on the evidence
obtained during the audit.
• KAMs are often areas of complexity and/or areas involving significant management judgment in
the financial statements and, therefore, often involve difficult or complex auditor judgments.
• When the auditor has formed the opinion that the financial statements are prepared, in all
material respects, in accordance with the applicable financial reporting framework, the standard
unmodified audit report is issued signifying that the auditor has concluded that they have obtained
reasonable assurance that the financial statements as a whole are free of material misstatement,
whether due to fraud or error.
• The auditor uses an ‘Emphasis of Matter’ paragraph when matters are appropriately presented or
disclosed in the financial statements but they are of such importance that they are fundamental to
users’ understanding of the financial statements.
• When matters are not presented or disclosed in the financial statements but are relevant to users’
understanding of the audit, the auditor’s responsibilities or the auditor’s report, an ‘Other Matter’
paragraph is used to bring it to the attention of users.
• When the auditor concludes that a material uncertainty related to going concern exists and the
matter has been appropriately disclosed in the financial statements, the auditor should add a
paragraph titled ‘a Material Uncertainty Related to Going Concern’.
• The auditor is responsible for evaluating the circumstances to determine whether the standard
unmodified audit opinion is appropriate or whether a modified opinion is justified.
P df_Folio:275
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 275
4.4 Evaluate circumstances that may give rise to modifications to the standard auditor’s report,
to the auditor’s opinion and other than to the auditor’s opinion.
• The auditor needs to evaluate the circumstances that may give rise to modifications to the
standard auditor’s report and/or to the auditor’s opinion. For example, while matters such as
those described in an Emphasis of Matter, Other Matter or Material Uncertainty Related to Going
Concern paragraphs do not modify the auditor’s opinion, they do modify the auditor’s report from
the standard unmodified report.
• The auditor evaluates the circumstances to determine whether modifications to the standard
auditor’s report is necessary, resulting in a qualified opinion, disclaimer of opinion or adverse
opinion.
• The auditor evaluates the audit evidence to determine the appropriate audit opinion to issue.
This requires professional judgment to ascertain whether the matters are material or material and
pervasive.
• Example 4.6 demonstrates the use of professional judgment to evaluate an entity’s circumstances
to identify significant events or conditions that cast doubt on the entity’s ability to continue as a
going concern.
• The auditor should issue a qualified opinion when, after having obtained sufficient appropriate
audit evidence, they conclude that uncorrected misstatements, either individually or in the
aggregate, are material, but not pervasive, to the financial statements or, if unable to obtain
sufficient appropriate audit evidence, that the possible effects of undetected misstatements on
the financial statements are potentially material, but not pervasive.
• When the auditor concludes that misstatements are, either individually or in aggregate, material
and pervasive to the financial statements, an adverse audit opinion is issued, indicating that the
auditor considers the financial statements to be misleading or of little use to the intended users.
• When the auditor is unable to obtain sufficient appropriate audit evidence on which to base the
opinion, and the auditor concludes that the possible effects of the adjustments could be both
material and pervasive, a disclaimer of opinion is expressed indicating that the auditor cannot
determine whether the financial statements can be relied upon.
• Example 4.12 demonstrates the use of professional judgment to evaluate issues about a subsidiary
and consolidated financial statements to justify the type of audit opinion issued.
4.5 Apply the appropriate standards that relate to a range of engagement circumstances that
impact the auditor’s report and the auditor’s opinion.
• ISA 570 (Revised) Going Concern applies where the use of the going concern basis of accounting is
considered appropriate but a material uncertainty exists. The auditor shall express an unmodified
opinion and include a separate section in the auditor’s report under the heading ‘Material
Uncertainty Related to Going Concern’.
• ISA 700 (Revised) Forming an Opinion and Reporting on Financial Statements deals with the
auditor’s responsibility to form an opinion on the financial statements and the types of opinion
that can be issued.
• ISA 701 Communicating Key Audit Matters in the Independent Auditor’s Report requires the auditor
to describe each KAM in a separate section of the auditor’s report headed ‘Key Audit Matters’.
• ISA 705 (Revised) Modifications to the Opinion in the Independent Auditor’s Report addresses the
auditor’s responsibility to issue an appropriate report in circumstances when, in forming an opinion
in accordance with ISA 700 (Revised), the auditor concludes that a modification to the auditor’s
opinion on the financial statements is necessary.
• ISA 705 (Revised) Modifications to the Opinion in the Independent Auditor’s Report addresses
matters that modify the auditor’s report and affect the auditor’s opinion (resulting in a qualified
opinion, disclaimer of opinion or adverse opinion).
• ISA 706 (Revised) Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent
Auditor’s Report covers matters (referred to as ‘Emphasis of Matter’ or ‘Other Matter’) that modify
the standard auditor’s report but do not modify the auditor’s opinion.
• ISA 710 Comparative Information — Corresponding Figures and Comparative Financial Statements
establishes standards and provides guidance to auditors as to their responsibilities with respect
to comparative information in an audit of financial statements.
• ISA 720 (Revised) The Auditor’s Responsibilities Relating to Other Information outlines the
appropriate response by the auditor when the annual report includes other unaudited information
that could undermine the credibility of the financial statements and the auditor’s report.
df_Folio:276
P
Management Letter
A further written communication between the auditor and management is the management letter, which
is normally issued at the conclusion of every audit engagement. This letter outlines significant issues
identified by the auditor during the course of the audit, especially from their assessment of the entity’s
business and inherent risk, and any recommended improvements in risk identification and internal control.
With regard to internal control, the communications that are required under ISA 265 Communicating
Deficiencies in Internal Control to Those Charged with Governance and Management may be com-
municated in the management letter, or they may be communicated at an earlier time orally, to allow
management to remedy the identified deficiency. If communicated orally, they should also be later
documented in writing, usually in the management letter. Upon completion, the management letter is
normally reviewed first by operational management, and then by the audit committee or governing body.
A primary concern of the audit committee is operational management’s response and follow-up actions to
issues raised in the management letter.
There are a few issues that the auditor should communicate on a timely basis to those charged with
governance — usually before the management letter is written. As outlined in module 2, if the auditor
has identified a fraud or obtained information that indicates a fraud may exist, they should communicate
these matters on a timely basis (immediately) to the appropriate level of management (ISA 240,
para. 41). The auditor shall also communicate on a timely basis to those charged with governance events or
Pdf_Folio:277
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 277
conditions identified that may cast significant doubt on the entity’s ability to continue as a going concern.
The communication should include:
(a) Whether the events or conditions constitute a material uncertainty;
(b) Whether management’s use of the going concern basis of accounting is appropriate in the preparation
of the financial statements;
(c) The adequacy of related disclosures in the financial statements; and
(d) Where applicable, the implications for the auditor’s report (ISA 570 (Revised), para. 25).
ISA 570 (Revised), paragraph 24 requires that the auditor communication also consider the implications
for the auditor’s report when management is unwilling to make or extend its period of assessment of the
going concern basis of accounting.
The communication requirement of ISA 570 (Revised) is consistent with the requirements in ISA 260
(Revised) and the discussion in module 2 about the communication of audit matters with those charged
with governance.
If, as a result of a misstatement resulting from fraud or suspected fraud, the auditor encounters exceptional
circumstances that bring into question the auditor’s ability to continue performing the audit, the auditor
shall:
(a) Determine the professional and legal responsibilities applicable in the circumstances, including whether
there is a requirement for the auditor to report to the person or persons who made the audit appointment
or, in some cases, to regulatory authorities;
(b) Consider whether it is appropriate to withdraw from the engagement, where withdrawal is possible
under applicable law or regulation; and
(c) If the auditor withdraws:
(i) Discuss with the appropriate level of management and those charged with governance the auditor’s
withdrawal from the engagement and the reasons for the withdrawal; and
(ii) Determine whether there is a professional or legal requirement to report to the person or persons
who made the audit appointment or, in some cases, to regulatory authorities, the auditor’s
withdrawal from the engagement and the reasons for the withdrawal (ISA 240, para. 39).
Given the potential for a legal or regulatory response to corporate failures, scandals or disputes
with management, ISA 240, paragraphs 45–48 provide guidance on documentation to be prepared and
maintained by the auditor.
In Australia and many other jurisdictions, a change in auditor is constrained by a regulatory policy
(e.g. by ASIC in Australia) that it should generally take place only after a shareholders’ vote at the annual
general meeting.
QUESTION 4.16
ISA 240 states that the auditor ordinarily recognises that audit procedures that are effective for
detecting error may not be appropriate in the context of an identified risk of material misstatement
due to fraud.
What implications does this statement have for the auditor’s evidence gathering procedures?
(a) A statement that the engagement team and others in the firm … have complied with relevant ethical
requirements regarding independence; and
(i) All relationships and other matters between the firm … and the entity that, in the auditor’s
Pdf_Folio:279
professional judgment, may reasonably be thought to bear on independence. This shall include
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 279
total fees charged during the period covered by the financial statements for audit and non-audit
services provided by the firm …; and
(ii) The related safeguards that have been applied to eliminate identified threats to independence or
reduce them to an acceptable level (ISA 260 (Revised), para. 17).
These requirements operationalise the conceptual framework threats and safeguards approach to
independence that was discussed in module 1.
Even if the auditor communicates with the audit committee or any other subcommittee of the governing
body, they still need to determine whether they need to communicate to the full governing board (ISA 260
(Revised), para. 12).
REPORTING RESPONSIBILITIES
The auditor has a broad range of reporting responsibilities. In most countries, the auditor’s reporting
responsibility is to the members, or shareholders, of the entity. Additionally, the auditor’s reporting
responsibilities have extended in certain areas to regulatory bodies that are charged with overseeing the
financial market, including the roles and responsibilities of the auditors, as well as to those charged
with governance and the management of the audited entity. This section reviews the auditor’s reporting
responsibilities.
In this section, we discuss the auditor’s reporting responsibilities first to those charged with governance
and management, then to shareholders and lastly to regulatory bodies.
EXAMPLE 4.19
P df_Folio:281
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 281
In relation to cash payments, we noted that two cheques for transfers to the company’s payroll account
were signed by only one signatory, Mr Sullivan. Apparently, other signatories were not available on those
days and so the payments were processed in order to meet wage obligations.
During our petty cash count at the Parramatta branch, we noted that there were no supporting vouchers
for $927.56 of expenditure. This may place the related tax deductions at risk as the expenses are
unsubstantiated. Also, it casts suspicion on the petty cash officer who may be taking money from petty
cash.
Would you please respond in writing regarding the action you intend to take regarding the above
matters? We remind you that these are only the matters we found during our testing; there could be
many other undiscovered weaknesses in the internal control structure. Also, we remind you that this letter
is solely for the use of Egral Ltd and should not be disclosed to third parties without our permission.
ABC Accountants
............................................................................................................................................................................
(a) Critically analyse the draft management letter and outline your suggestions for improvement.
(b) Assume you found some minor errors during the audit (such as an accrual not taken up) that were rectified
by the time the financial statements were issued. Would you include these in the management letter? Why
or why not?
Check your response against the suggested answer at the end of the book.
QUESTION 4.17
What action should an auditor take if they believe their communication with those charged with
governance has not been adequate?
Reporting to Shareholders
In most countries, the primary group for whom the audit is undertaken is the members, or shareholders,
of the entity. The auditor’s report is usually addressed to this group, and for many of the audits of
general purpose financial statements using this group as the addressee is supported by the relevant national
legislation.
An Australian Perspective
In Australia, in the context of statutory reporting responsibilities for a single company, the auditor has the
following reporting responsibilities imposed on them.
• An auditor must form an opinion concerning whether:
– the financial report is in accordance with the Corporations Act, including whether the report complies
with Australian Accounting Standards (s. 307(a)(i)) and whether it gives a true and fair view of the
financial position and performance of the entity (s. 307(a)(ii))
– the auditor has been provided with all the information, explanations and assistance required to
undertake the audit (s. 307(b))
– the entity has kept financial records sufficient to enable the preparation and auditing of a financial
report (s. 307(c)).
– the entity has kept all other registers and records required by the Corporations Act (s. 307(d)).
• The auditor must report to members whether the financial report is, in the auditor’s opinion, properly
drawn up:
– in compliance with Australian Accounting Standards
– to give a true and fair view (s. 308(1)).
• If the auditor is not of that opinion, they must state why.
• If, in the auditor’s opinion, the financial report has not been drawn up in accordance with a particular
accounting standard, the auditor’s report must give particulars of the quantified financial effect on the
financial report of failing to draw it up in accordance with that accounting standard (s. 308(2)).
• The auditor’s report must also describe any defect or irregularity in the financial report (s. 308(3)(a)) in
regard to a deficiency, failure or shortcoming for matters contained in section 307, on which there is no
reporting requirement under section 308(1). Thus, on an exception basis (meaning they will only report
df_Folio:282
P
These RDRs are evidenced by a shading of the paragraphs in the standards for the specific requirements
that these entities do not need to apply.
Further, as outlined in module 5, certain types of companies limited by guarantee may be exempted from
needing to prepare a general purpose financial report, while others may have their general purpose financial
report reviewed rather than audited. Further, the Australian Securities and Investments Commission
may grant relief from compliance with a particular accounting standard under section 340 of the
Corporations Act.
Pdf_Folio:283
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 283
An Australian Perspective
In Australia, the regulatory body with public company oversight is the Australian Securities & Investments
Commission (ASIC). The auditor has an obligation to report in writing to ASIC under section 311 of the
Corporations Act if, in the course of the performance of their duties as an auditor of a company, they:
• have reasonable grounds to suspect that there has been a contravention of, or a failure to comply with,
any of the provisions of the Corporations Act
• believe that the matter will not be adequately dealt with by:
– comment in the auditor’s report, or
– notifying the directors.
Section 311 does not require that the auditor be satisfied beyond reasonable doubt that a breach has
occurred before being required to report to ASIC. This means that the auditor need not conduct exhaustive
and conclusive investigations, nor rely exclusively on evidence that would be admissible in criminal
proceedings. Rather, section 311 requires an auditor to take action where the auditor has ‘reasonable
grounds’ to suspect a contravention of the Corporations Act. This requires that there must be some facts
or some evidence that would lead a reasonable auditor to hold that suspicion.
It should also be pointed out that under section 311, an auditor’s duty is limited to reporting contra-
ventions or breaches of the Corporations Act of which the auditor becomes aware in the course of the
performance of the audit. ASIC does not expect the auditor to actively search for contraventions but
requires auditors to show vigilance and follow up where breaches are suspected. ASIC believes that
the vigilance for section 311 responsibilities should be noted in the audit plan. The ASIC Regulatory
Guide 34 (2013) explains to auditors their reporting obligations under section 311 of the Corporations
Act, such as when reporting suspected insolvent trading.
Before reporting suspected contraventions of the Corporations Act to ASIC, auditors must be able to
demonstrate that they have asked questions of directors or considered the impact of any comment that
might be made in the auditor’s report. The auditor’s belief that the contravention could not be ‘adequately
dealt with’ in the auditor’s report or by raising the matter with directors must be based on more than just
the auditor’s personal feelings. It should be capable of withstanding subsequent scrutiny.
The auditor’s duty to maintain the confidentiality of client information may prevent them from reporting
fraud to third parties. However, the law may override the duty of confidentiality. The auditor of a financial
institution may have a duty to report fraud to supervisory authorities. Also, the auditor may have a duty to
report misstatements to authorities where those charged with governance fail to take corrective action.
The auditor should obtain legal advice to determine the appropriate course of action in these circum-
stances.
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
4.1 Explain the auditor’s reporting responsibilities in relation to the auditor’s report and opinion.
• The auditor needs to consider the adequacy of the communication with those charged with
governance and management. If the auditor considers the communication is not adequate
appropriate action needs to be taken as it is likely to impact on the auditor’s ability to obtain
sufficient appropriate evidence which is required to support an audit opinion.
4.2 Evaluate the key issues involved in the final review and completion of an audit.
• The auditor obtains a letter from management acknowledging management’s responsibility for the
preparation of the financial statements. The letter also details any verbal representations made by
management during the course of the audit to provide corroborative evidence of audit findings
prior to forming an opinion.
• When the auditor identifies deficiencies in internal control during the audit, the auditor needs to
determine which (if any) of these deficiencies need to be communicated to management and those
charged with governance.
4.3 Evaluate the indicators of potential fraud and recommend a course of action.
• If the auditor has identified a fraud or has obtained information that indicates that a fraud may
exist, the auditor should communicate these matters, unless prohibited by law or regulation, on a
timely basis with the appropriate level of management.
• The auditor also has the responsibility to determine whether they are required, or it may be
appropriate in the circumstances, to report fraud to an appropriate authority outside the entity.
df_Folio:284
P
REVIEW
It is important that the auditor’s report is an effective communication device as it is the principal means of
communication between the auditor and the financial statement users. There have been significant steps
undertaken to enhance the communication effectiveness of the auditor’s report.
This module first outlined the auditor’s responsibilities involved in completing the fieldwork. This
entailed discussing the auditor’s responsibilities for evaluating significant areas related to management’s
accounting estimates, related party transactions and fraud.
This was followed by a discussion on litigation and claims including outlining when a solicitors’ repre-
sentation letter is warranted. Next, going concern issues were discussed including mitigating circumstances
and the availability of financial support to mitigate these risks.
Obtaining a management representation letter was then discussed, before outlining the applicable audit
procedures performed to identify subsequent events and the evaluation of management’s treatment thereof.
To complete the fieldwork, the auditor performs analytical procedures on the final financial statements
to form an overall conclusion as to whether the financial statements are consistent with the auditor’s
understanding of the entity.
Auditors then make a final review of all the evidence before reaching conclusions as to the truth and
fairness of the financial statements. First, a final evaluation of materiality and audit risk is made before
undertaking a final review of the financial statements to ensure sufficient appropriate audit evidence has
been obtained to support an audit opinion. The engagement quality control review was also explained. The
final task after evaluating the findings is to form an opinion on the financial statements.
Next, the expanded auditor’s reporting requirements that apply to audits of financial statements,
including a discussion of the auditor’s report structure, the identification and disclosure of KAMs, audit
implications of comparative information and extended requirements for matters that do not affect the
audit opinion (Emphasis of Matter, Other Matter and Material Uncertainty Related to Going Concern
paragraphs) were discussed. The types of auditor’s reports that are issued, and the circumstances in which
they are issued were also considered.
The final section covered a discussion of the auditor’s communication and reporting responsibilities to
shareholders, regulatory bodies and those charged with governance and management.
Pdf_Folio:285
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 285
WESTERWAYS CASE STUDY ACTIVITY
df_Folio:286
P
Pdf_Folio:287
MODULE 4 Conclusions and Reporting Responsibilities for an Audit of Historical Financial Information 287
MODULE 5
OTHER ASSURANCE
ENGAGEMENTS
Module 1
Auditing and Assurance Framework
• Non-financial information
• Future-orientated information
Other assurance
engagements • Pro forma financial information
• Assurance on behaviour
• Systems and processes
Performance
Performance engagements
engagements
• Agreed-upon procedures
Non-assurance services • Comfort letter engagements
dPf_Folio:288
• Compilation engagements
LEARNING OBJECTIVES
ISA 700 (Revised) Forming an Opinion and Reporting ASA 700 Forming an Opinion and Reporting on a
on Financial Statements Financial Report (Compiled)
ISA 800 (Revised) Special Considerations — Audits ASA 800 Special Considerations — Audits of Financial
of Financial Statements Prepared in Accordance with Reports Prepared in Accordance with Special Purpose
Special Purpose Frameworks Frameworks (Compiled)
ISA 805 (Revised) Special Considerations — Audits of ASA 805 (Revised) Special Considerations — Audits
Single Financial Statements and Specific Elements, of Single Financial Statements and Specific Elements,
Accounts or Items of a Financial Statement Accounts or Items of a Financial Statement (Compiled)
ISA 810 (Revised) Engagements to Report on Summary ASA 810 Engagements to Report on Summary
Financial Statements Financial Statements
ISRE 2400 (Revised) Engagements to Review Historical ASRE 2400 Review of a Financial Report Performed
Financial Statements by an Assurance Practitioner Who is Not the Auditor of
the Entity
ASRE 2405 Review of Historical Financial Information
Other than a Financial Report
ISRE 2410 Review of Interim Financial Information ASRE 2410 Review of a Financial Report Performed by
Performed by the Independent Auditor of the Entity the Independent Auditor of the Entity (Compiled)
ISAE 3000 (Revised) Assurance Engagements ASAE 3000 Assurance Engagements Other than Audits
Other than Audits or Reviews of Historical Financial or Reviews of Historical Financial Information (Revised)
Information
ISAE 3402 Assurance Reports on Controls at a Service ASAE 3402 Assurance Reports on Controls at a Service
Organization Organisation
ISAE 3410 Assurance Engagements on Greenhouse ASAE 3410 Assurance Engagements on Greenhouse
Gas Statements Gas Statements (Revised)
ISAE 3420 Assurance Engagements to Report on ASAE 3420 Assurance Engagements to Report on
the Compilation of Pro Forma Financial Information the Compilation of Pro Forma Historical Financial
Included in a Prospectus Information Included in a Prospectus or other
Document
(continued)
P df_Folio:289
ISRS 4400 Engagements to Perform Agreed-Upon ASRS 4400 Agreed-Upon Procedures Engagements to
Procedures Regarding Financial Information Report Factual Findings
ISRS 4410 (Revised) Compilation Engagements APES 315 Compilation of Financial Information
dPf_Folio:290
Financial statements prepared in accordance with such frameworks may be the only financial statements
prepared by an entity when general purpose financial statements are not required and, therefore, may be
relied upon by a broader group than those for whom the framework was designed. Despite this potentially
broad distribution, such financial statements are regarded as special purpose as they are designed to meet
the needs of specific users (ISA 800 (Revised), para. A4) rather than general purpose financial statements,
which meet the needs of primary users.
In determining whether to accept an engagement involving an audit of special purpose financial
statements, the auditor is required to obtain an understanding of:
(a) the purpose for which the financial statements are prepared;
(b) the intended users; and
(c) the steps taken by management to determine that the applicable financial reporting framework is
acceptable in the circumstances (ISA 800 (Revised), para. 8).
A key factor in this determination is the financial information needs of the intended users (ISA 800
(Revised), para. A5).
In planning and performing a special purpose audit, the auditor is required to comply with:
(a) relevant ethical requirements, including those pertaining to independence …; and
(b) all ISAs relevant to the audit (ISA 800 (Revised), para. A9).
When performing an audit of special purpose financial statements, the requirements of the ISAs
that apply to general purpose financial statements are applicable. However, the ‘application of some of
the requirements of the ISAs in an audit of special purpose financial statements may require special
consideration by the auditor. For example, in ISA 320, judgments about matters that are material to users
of the financial statements are based on a consideration of the common financial information needs of
users as a group’, while these ‘judgments are based on a consideration of the financial information needs
of the intended users’ for an audit of special purpose financial statements (ISA 800 (Revised), para. A10).
When forming an opinion and reporting on special purpose financial statements, the auditor applies the
requirements of ISA 700 (Revised) (ISA 800 (Revised), para. 11). The auditor’s report also describes either
the purpose for which the financial statements are prepared and identifies the intended users, or refers to
a note in the special purpose financial statements that describes these circumstances (ISA 800 (Revised),
para. 13). It also includes ‘an Emphasis of Matter paragraph alerting users … that the financial statements
are prepared in accordance with a special purpose framework and may not be suitable for another purpose’
(ISA 800 (Revised), para. 14).
Examples of auditor’s reports on special purpose financial statements are contained as illustrations
to ISA 800 (Revised). You should read this now.
Please note ISA 800 (Revised) Illustration 2, which is an auditor’s report for special purpose financial
statements prepared by management in accordance with the tax basis of accounting. Compare and
contrast this example auditor’s report with the auditor’s reports issued for general purpose financial
statements under ISA 700 (Revised). Work through this exercise before proceeding.
The auditor’s report on summary financial statements gives an opinion as to whether the information in
the summary is consistent with the full financial statements. The auditor should ensure that the summary
Pdf_Folio:293
An Australian Perspective
Listed entities in Australia can elect to prepare summary financial statements in the form of a concise
financial report to send to their shareholders instead of the full annual report that includes the financial
statements for the year. However, this will not alter the entity’s requirement to prepare a full set of
general purpose financial statements. Concise financial reports are prepared in accordance with Australian
Accounting Standard AASB 1039 Concise Financial Reports as required by the Corporations Act 2001
(Cwlth) (Corporations Act). Guidance for auditors reporting on a concise financial report is contained in
Guidance Statement GS 001 Concise Financial Reports under the Corporations Act issued by the AUASB.
The audit of concise financial reports should be treated as a separate engagement from the audit of the
annual general purpose financial reports. Additional audit procedures will be required when undertaking
the audit of the concise financial report as AASB 1039 requires the inclusion of a discussion and analysis of
the principal factors that affect the financial performance, financial position and financing and investment
activities of an entity. Although AASB 1039 does not mandate specific discussion and analysis disclosures,
it does illustrate the types of disclosures that may be made in the concise report.
The additional audit procedures required when conducting the audit of a concise financial report will
enable the auditor to reach a conclusion on the discussion and analysis when forming an opinion whether,
in all material respects, the concise financial report complies with the requirements of AASB 1039. For
example, the auditor may need to recalculate ratios and trend analyses which are included in the discussion
and analysis section and ensure these disclosures are consistent with the information in the financial report
for the year.
If the auditor considers that the discussion and analysis is overly subjective and/or prospective and that
it cannot be quantified or verified, then the auditor will issue a modified auditor’s report in accordance
with ASA 705 Modifications to the Opinion in the Independent Auditor’s Report (ISA 705 (Revised)),
qualifying the auditor’s opinion as a result of a disagreement with management over the adequacy or
appropriateness of disclosures in the concise financial report.
Review example 5.1 now.
EXAMPLE 5.1
Diabetes Victoria
Access the Independent auditor’s report on the 2018 Concise Financial Report prepared for the members
of Diabetes Victoria. On the Diabetes Victoria website: https://www.diabetesvic.org.au, in About us —
Financial reports, select the ‘2018 Concise Financial Report’ from the list and scroll to page 9. Study the
independent auditor’s report and then consider the following questions.
............................................................................................................................................................................
(a) On what basis has the audit been conducted?
(b) What audit procedures have been performed?
(c) How is the opinion worded?
(d) Is the auditor’s report issued under a fair presentation framework or a compliance framework? Why?
Check your response against the suggested answer at the end of the book.
The key points covered in this section, and the learning objectives they align to, are shown below.
KEY POINTS
dP f_Folio:294
Pdf_Folio:296
No.
Must a review report
ASA 701 does not cover review engagements, so key audit
include key audit
matters are not required in a review report.
matters?
If key audit matters are included in a review report, the
treatment should be consistent with ASA 701, which could
be problematic.
No.
Must a review report ASA 720 does not cover review engagements, so an
include an ‘Other ‘Other information’ section is not required in a review report.
information’ section?
QUESTION 5.1
What is a financial report review? Why would a review be appropriate for a set of half-yearly financial
reports?
QUESTION 5.2
DDD Motor Sales Ltd is privately owned. It wants to expand its business and has approached its
bank for a loan. DDD wants the funds to purchase additional inventory and will be able to provide
excellent security to the bank. The bank has agreed that, since DDD can provide good security
for the loan, an external audit will not be required. The bank manager has insisted that DDD hire
a firm of professional accountants to examine DDD’s financial records and provide some level of
assurance.
1. What type of engagement is required? Explain your answer.
2. Assume that DDD contracts with Cicak & Jones, CPAs, to perform the required services. What
is the title of the report or communication that Cicak & Jones will prepare?
3. Identify the types of procedures Cicak & Jones will be required to conduct.
KEY POINTS
5.1 Explain the types of assurance engagements, other than the audit of historical financial
information.
• A review provides only limited assurance regarding whether the financial statements conform to
generally accepted accounting principles.
P d f_Folio:299
OVERARCHING STANDARD
ISAE 3000 (Revised) is an umbrella standard for ‘other’ assurance engagements. The conditions for
accepting or continuing other assurance engagements) are set out in ISAE 3000 (Revised), paragraph 22.
These conditions include the general requirements that the practitioner (signing partner) believes that the
engagement team satisfies relevant ethical requirements, including independence. The practitioner should
also be satisfied that the engagement team, collectively, has the appropriate competence and capabilities.
Further, the practitioner should be satisfied that the preconditions of an assurance engagement, as discussed
in ISAE 3000 (Revised), paragraph 24, are present. These preconditions include:
• an appropriate underlying subject matter
• suitable criteria that will be available to the intended users
• evidence to support the practitioner’s conclusion
• a written report that presents the practitioner’s conclusion
• a rational purpose for undertaking the engagement, including (in the case of a limited assurance
engagement) that the practitioner expects to be able to obtain a meaningful level of assurance.
The practitioner shall plan the engagement so that it will be performed in an effective manner
(ISAE 3000 (Revised), para. 40). This includes determining the nature, timing and extent of planned
procedures that are required to be carried out in order to achieve the objective of the practitioner.
dP f_Folio:300
Standards Examples
ISAE 3410 Assurance Engagements on Greenhouse Performance engagements on use of resources or
Gas Statements value for money, such as:
• greenhouse gas statements
ISAE 3610/AWAS 2 Assurance Engagements on
• sustainability reports
General Purpose Water Accounting Reports
• key performance indicators
• statements on effective use of resources
• statement on value for money
• corporate social responsibility reporting
• integrated reports.
Future-oriented information
Standards Examples
ISAE 3420 Assurance Engagements to Report on the Performance engagements, such as:
Compilation of Pro Forma Financial Information • forecast/projected cash flows.
Included in a Prospectus Position engagements, such as:
• forecast/projected financial position.
ASAE 3450 Assurance Engagements involving
Corporate Fundraisings and/or Prospective Financial Performance engagements on use of resources or
Information value for money, such as:
• expected emissions reductions attributable to a
new technology
• greenhouse gases to be captured by planting trees
• a statement that a proposed action will provide
value for money.
Standards Examples
ASAE 3150 Assurance Engagements on Controls Description engagements, such as:
• the description of a system of internal control.
ISAE 3402 Assurance Reports on Controls at a
Design engagements, such as:
Service Organisation
• the design of controls at a service organisation
• the design of proposed controls for a forthcoming
production process.
Operation/performance engagements, such as:
• the operating effectiveness of procedures for
hiring and training staff.
P df_Folio:301
Standards Examples
ASAE 3100 Compliance Engagements Compliance engagements, human behaviour,
such as:
• evaluation of audit committee effectiveness.
Compliance engagements, other, such as:
• fitness for purpose of a software package
(International Framework for Assurance
Engagements, Appendix 4).
Performance of activity
Standards Examples
ASAE 3500 Performance Engagements Performance engagements, such as:
• performance of public sector activity.
Other assurance engagements may be either reasonable or limited assurance engagements. In regard to
the underlying subject matter and other engagement circumstances, ISAE 3000 (Revised), paragraph 46
outlines that:
• for a reasonable assurance engagement, ‘the practitioner shall obtain an understanding of the underlying
subject matter and other engagement circumstances. [This should be] sufficient to … identify and assess
the risks of material misstatement in the subject matter information. [It should also] provide a basis for
designing and performing procedures to respond to the assessed risks and to obtain reasonable assurance
to support the practitioner’s conclusion’.
• for a limited assurance engagement, ‘the practitioner shall obtain an understanding of the underlying
subject matter and other engagement circumstances sufficient to enable the practitioner to identify areas
where a material misstatement of the subject matter information is likely to arise. [It should therefore]
provide a basis for designing and performing procedures to obtain limited assurance to support the
practitioner’s conclusion’.
In regard to obtaining sufficient appropriate evidence for an assurance engagement, ISAE 3000
(Revised), paragraph. 48, outlines that:
For a reasonable assurance engagement, the practitioner shall:
(a) identify and assess the risks of material misstatement in the subject matter information; and
(b) design and perform procedures to respond to the assessed risks and to obtain reasonable assurance to
support the practitioner’s conclusion.
For a limited assurance engagement, the practitioner shall:
(a) identify areas where a material misstatement of the subject matter information is likely to arise; and
(b) design and perform procedures to address the areas identified in (a) and to obtain limited assurance to
support the practitioner’s conclusion.
The assurance report shall be in writing and shall contain a clear expression of the practitioner’s
conclusion about the subject matter information (ISAE 3000 (Revised), para. 67).
The importance of the intended users should also be considered, as environmental reports have a wide
variety of users and their needs can be quite different. For example, companies may provide information
on their water usage and carbon emissions, but this information may be used differently by investors,
environmentalists and local community groups (such as farmers).
Pdf_Folio:302
ISAE 3000 (Revised) also contains requirements relating to the use of the work of experts. When the
work of a practitioner’s expert is to be used, the practitioner shall also:
(a) evaluate whether the practitioner’s expert has the necessary competence, capabilities and objectivity for
the practitioner’s purposes. In the case of a practitioner’s external expert, the evaluation of objectivity
shall include inquiry regarding interests and relationships that may create a threat to that expert’s
objectivity;
(b) obtain a sufficient understanding of the field of expertise of the practitioner’s expert;
(c) agree with the practitioner’s expert on the nature, scope and objectives of that expert’s work; and
(d) evaluate the adequacy of the practitioner’s expert’s work for the practitioner’s purposes (ISAE 3000
(Revised), para. 52).
Given the importance of using experts in sustainability assurance engagements, these requirements are
of particular significance for such engagements.
The IAASB is in the process of developing draft guidance relating to its extended external reporting
(EER) assurance project (IAASB 2019a). The key objective of the project is to enable more consistent and
appropriate application of ISAE 3000 (Revised) to emerging forms of external reporting and greater trust
in the resulting assurance reports by users of EER.
EER includes many different types of reporting, from integrated reporting, sustainability reporting and
other reporting about environmental, social and governance matters. The outcome of this project is aimed
at providing a non-authoritative guidance document for practitioners applying ISAE 3000 (Revised).
We will now turn our attention to a detailed discussion of each of the five core types of other assurance
engagements, beginning with assurance on historical non-financial reports.
QUESTION 5.3
Providers of corporate sustainability assurance reports often state that the work was performed in
accordance with ISAE 3000 and/or ASRE 2405. Obtain a copy of each of these documents.
Explain why ISAE 3000 and ASRE 2405 would be useful in CSR assurance.
QUESTION 5.4
List at least five reasons why accountants are well placed to provide assurance on carbon
emissions.
33%
39% 38% 38% 42% 45%
N100 G250
GRI also recognises that assurance of sustainability reports is at an early stage in its evolution. It
therefore encourages the development and use of principles and guidelines for assurance practices.
Moreover, the GRI recommends that external assurance should:
• be conducted by groups or individuals external to the reporting organisation, who are demonstrably
competent in the subject matter and assurance practices
• utilise groups or individuals who are not limited by their relationship with the organisation to publish
an independent conclusion on the report
• be implemented in a manner that is systematic, documented, evidence-based and characterised by
defined procedures
• assess whether the report provides a reasonable and balanced presentation of performance
• assess the extent to which the report preparer has applied the GRI Reporting Framework
• result in an opinion or set of conclusions that is publicly available in written form, including a statement
from the assurance practitioner on their relationship to the report preparer.
The GRI does not make recommendations on what type of assurance practitioner to use. It is expected
that the reporting organisation will select the assurance practitioner on the basis of these six key qualities.
QUESTION 5.5
How does providing assurance on environmental information differ from auditing financial
statements?
QUESTION 5.6
Climate Balance Pty Ltd is a consulting firm specialising in sustainability and climate change
issues. It offers sustainability report assurance services to a variety of organisations, including
listed companies. It is not a registered company auditor and does not provide company audits.
Why would a listed company obtain sustainability assurance services from a consulting firm and
its company audits from an accounting firm?
dP f_Folio:306
SME Perspective
The previous examples refer to large companies. It is important to also realise that SMEs can benefit by
having the sustainability information they provide assured.
CPA Australia has developed A Guide for Assurance on SME Sustainability Reports. This document
notes that ‘a sustainability report provides financial and non-financial information that helps readers to
understand how a business has performed from broad economical, social and environmental perspectives’
(CPA Australia 2012, p. 5). Importantly, the document sets out the business pressure and opportunities
that are inducing SMEs to consider sustainability reporting, and the consequent importance of CPAs being
capable of discussing these issues with clients and providing opportunities for clients.
CPA Australia (2012) lists four opportunities for SMEs related to sustainability reports.
• Large organisations often require their supply chains to demonstrate sustainability (e.g. through
tender processes or the need for sustainability reports, sometimes with assurance). By demonstrating
sustainability in practices and products, SMEs can differentiate themselves from competitors.
• The reports provide a credible way to present sustainability performance to stakeholders.
• A greater range of finances are available to organisations that can demonstrate sustainability.
• Sustainability reporting can unlock internal advantages such as staff support, risk management and
process improvements.
Furthermore, Global Reporting Initiative (GRI) and the International Organization of Employers (IOE)
published a joint report in 2016 outlining how small businesses can have a big impact by reporting on
sustainability issues. Even though SMEs individually have relatively small environmental and social
impacts, as a group their impact is much larger as they account for about 90% of all businesses and
contribute up to 45% of total employment (GRI & IOE 2016, p. 7). As such, they have a crucial role
to play in building a sustainable future through responsible business practices.
Next, we turn our focus to the assurance on water accounting reports.
EXAMPLE 5.2
P d f_Folio:309
QUESTION 5.8
Upper Crust Pizza Ltd is a profitable business that has been run for many years. The chairman
of the board of directors is Simon Strange, who built the company from nothing to the successful
public company it now is. As he gets close to retirement, Simon wants to ensure his legacy includes
social and environmental success as well as the financial success that he has enjoyed.
Simon is considering how the organisation can improve the welfare of the staff, better look after
customers, and improve how it interacts with the wider community and the environment.
Considering staff, customers, the wider community and the environment, suggest key perfor-
mance indicators that might be used to improve social and environmental performance.
Source: Leung et al. 2018.
FUTURE-ORIENTATED INFORMATION
As mentioned earlier in this section, assurance of future-oriented information includes assurance engage-
ments involving corporate fundraisings and forecast financial information such as projected cash flow
statements and projected statements of financial position. In this section we will focus our discussion on
the assurance of prospective financial information and the compilation of pro forma financial statements.
Assurance on Prospective Financial Information
The relevant standard is ISAE 3400. Prospective financial information is one of the few subject matters,
other than historical financial information, for which the profession provides specific guidance. In practice,
these assurance engagements are commonly performed by the ‘Big Four’ accounting firms and have
become one of the most common assurance services provided, other than assurance on historical financial
information. This is largely due to a general demand for assurance on forecasts — and similar types of
information — that management may be providing to the market where an entity is raising equity from
the public.
Australia does not have an equivalent standard to ISAE 3400, but does have a standard, ASAE 3450
Assurance Engagements involving Corporate Fundraisings and/or Prospective Financial Information that
applies to reporting on:
(a) historical financial information, pro forma historical financial information, prospective financial
information and/or pro forma forecast prepared in connection with a corporate fundraising, and
included in, or to be included in, a public or non-public document; and
(b) prospective financial information, including a pro forma forecast or a projection, prepared for any other
purpose (ASAE 3450, para. 1).
Definition
ISAE 3400 defines prospective financial information as:
financial information based on assumptions about events that may occur in the future and possible actions by
an entity … Prospective financial information can be in the form of a forecast, or projection or a combination
of both, for example, a one year forecast plus a five year projection (ISAE 3400, para. 3).
Pdf_Folio:311
Thus, a forecast is the entity’s best estimate of what is expected to occur, while a projection is an entity’s
estimate of what will occur if a specific course of action is undertaken.
Auditor’s Objective
ISAE 3400 states that the auditor’s objective in providing assurance on prospective financial information
is to obtain sufficient appropriate audit evidence as to whether:
(a) Management’s best-estimate assumptions on which the prospective financial information is based are
not unreasonable and, in the case of hypothetical assumptions, such assumptions are consistent with
the purpose of the information;
(b) The prospective financial information is properly prepared on the basis of the assumptions;
(c) The prospective financial information is properly presented and all material assumptions are adequately
disclosed, including a clear indication as to whether they are best-estimate assumptions or hypothetical
assumptions; and
(d) The prospective financial information is prepared on a consistent basis with historical financial reports,
using appropriate accounting principles (ISAE 3400, para. 2).
Procedures
ISAE 3400 offers guidance on the general procedures to be performed in an engagement that provides
assurance on prospective financial information, as well as on the form and content of the report that the
auditor issues in connection with such an engagement.
More specifically, ISAE 3400 provides the auditor with considerable guidance about:
• the auditor’s assurance regarding prospective financial information
• acceptance of the engagement
• knowledge of the entity’s business, which may have a significant effect on the prospective financial
information, including knowledge of the entity’s process for preparing prospective financial information
• the period of coverage of the prospective financial information and its impact on underlying assumptions
• the assurance procedures to be adopted, particularly in relation to management’s hypothetical and best-
estimate assumptions
• the presentation and disclosure of the prospective financial information
• the form and content of the auditor’s report, including the expression of an opinion, as well as the nature
of the prospective financial information and its limitations.
The procedure for collecting evidence varies between management’s best-estimate assumptions
(i.e. assumptions regarding future events that management expects to occur and actions management
expects to take) and their hypothetical assumptions (i.e. future events and management actions that are
not necessarily expected to take place). In particular:
• sufficient appropriate audit evidence needs to be obtained for best-estimate assumptions (‘forecast’)
(ISAE 3400, para. 18)
• supporting evidence need not be obtained for hypothetical assumptions (‘projection’), but the auditor
would need to:
– consider whether all significant implications of the assumptions have been taken into consideration
– be satisfied that they are consistent with the purpose of the prospective financial information and that
there is no reason to believe they are clearly unrealistic (ISAE 3400, paras 19–20).
In relation to the auditor’s assurance on prospective financial information, a number of key points are
important.
• While evidence may be available to support the underlying assumptions, such evidence is generally
future-oriented and, therefore, speculative in nature.
Pdf_Folio:312
You should now read ISAE 3400 to clarify your understanding of the procedures and reporting
requirements in an assurance of prospective financial information.
For an example of a 2019 assurance report on prospective financial information, refer to the
Independent Reporting Accountant’s Assurance Report on the prospective financial information of
Augusta Kedron Partnership, New Zealand for inclusion in the Offer Register of Augusta Funds
Management. The assurance report is available at: https://smartinvestor.sorted.org.nz/assets/disclose-
documents/13/6a/8d/10a44786f4/Independent-Limited-Assurance-Report-on-the-Prospective-
Financial-Information.pdf
QUESTION 5.9
You are part of an assurance team examining the financial forecasts of a client. The forecasts
include an assumption that sales turnover will increase next year, assuming regulatory approval for
a new product.
What information should the client disclose in order for the user to be able to make judgments
about the uncertainties attached to the estimated increase in turnover?
KEY POINTS
5.1 Explain the types of assurance engagements, other than the audit of historical financial
information.
• Assurance engagements on historical non-financial reports include performance reports on the
use of resources or value for money, such as assurance of corporate social responsibility (CSR)
reports, greenhouse gas statements, sustainability reports, water accounting reports, business
performance measurement reports, and integrated reports.
• CSR Assurance is provided to meet user demands for high-quality, reliable information, and to also
demonstrate a high level of corporate responsibility.
• The assurance approach for GHG statements varies depending on the reporting entity’s level of
precision in its monitoring and disclosure of GHG emissions.
• The assurance requirements for each scheme legislated by the Australian government for mea-
suring, managing, reducing or offsetting Australia’s carbon emissions is administered by the Clean
Energy Regulator (CER) and are underpinned by the NGERS audit framework.
• Organisations are being increasingly held accountable on sustainability issues related to human
rights, climate change, waste management, and the use of scarce resources such as water. With
increased disclosure on sustainability issues, there are increased expectations of assurance on this
information in order to increase its credibility.
• It is critical that users of the water accounting reports have confidence in the credibility of these
reports, therefore, water accounting reports should contain independent attestation that they have
been prepared in accordance with approved water accounting standards (i.e. those developed by
WASB).
• In carrying out a performance measurement assurance engagement, it is often necessary to either
develop appropriate measures as criteria, or assess whether the performance measures being used
are suitable criteria for measuring the right things from the organisation’s perspective.
dP f_Folio:314
Internal Audit
The IAASB ‘Glossary of terms’ defines the internal audit function as a ‘function of an entity that
performs assurance and consulting activities designed to evaluate and improve the effectiveness of the
entity’s governance, risk management and control processes’ (IAASB 2018b, p. 24). Its functions include
monitoring the adequacy and effectiveness of internal control.
This traditional definition of internal auditing is consistent with the view that the role of the internal
auditor is concerned primarily with:
• review of the reliability and integrity of financial and operating information
• review of systems established to ensure compliance with policies, procedures, plans, laws and regula-
tions impacting on operations and reports
• review of the means of safeguarding assets
• appraisal of economy and efficiency of any aspect or functional area of an organisation
• review of operations and programs.
While this definition of internal auditing takes into account the traditional role and objectives of internal
auditing, internal auditing is increasingly being perceived as integral to the risk management, control and
governance processes of an entity.
The Role of the Institute of Internal Auditors
The Institute of Internal Auditors (IIA) is an international professional association dedicated to enhancing
the status of internal auditing. Internal auditors have a unique position within their organisations and
provide audit committee members with objective assurance on governance, risk management and control
Pdf_Folio:315
This definition emphasises some important points that deserve further elaboration.
• Internal auditors should be independent of those managers whose work they are evaluating.
• Internal auditors add value by adopting an objective approach to each of the areas subject to audit
examination. This objectivity is achieved by an appropriate mindset by the auditors.
Institute of Internal Auditors Standards
The International Standards for the Professional Practice of Internal Auditing (Standards) (IIA 2017)
describe the nature of internal auditing, the characteristics of those who perform internal audit services,
and the quality criteria against which the performance of internal auditing can be evaluated.
The IIA (2017) standards have the following purposes:
1. Guide adherence with the mandatory elements of the International Professional Practices Framework.
2. Provide a framework for performing and promoting a broad range of value-added internal auditing
services.
3. Establish the basis for the evaluation of internal audit performance.
4. Foster improved organizational processes and operations (IIA 2017, p. 1).
The standards include basic requirements and interpretations. These standards use the word ‘must’
to specify an unconditional requirement and ‘should’ where conformance is expected except where
circumstances justify direction.
The standards apply to both assurance services and consulting services by internal auditors. Assurance
services involve:
An objective examination of evidence for the purpose of providing an independent assessment on
governance, risk management, and control processes for the organization. Examples may include financial,
performance, compliance, system security, and due diligence engagements (IIA 2017, p. 21).
The standards consist of attribute standards regarding the auditor and performance standards regarding
the auditor’s work. Some key issues covered in the attribute standards include the following.
• The mandatory nature of the standards must be recognised in an internal audit charter.
– Internal audit activity must be independent and internal auditors must be objective. Any threats to
objectivity must be handled at the individual auditor, engagement and organisational levels.
– The chief audit executive (CAE) must confirm to the board, at least annually, the independence of
internal audit activity.
• The CAE reports to the board. The board:
– approves the internal audit charter
– approves the risk-based internal audit plan
– approves the internal audit budget and resource plan
Pdf_Folio:316
For example, the internal audit activity could evaluate the design, implementation and effectiveness of
various ethics-related programs and activities, such as an ethics hotline. It would include activities that
assess whether information technology governance supports the organisation’s strategies and objectives
(IIA 2017).
Risk Management
Risk-management processes include evaluating risk exposures related to governance, operations and
information systems. It also involves evaluating the potential for the occurrence of fraud and how the
organisation manages fraud risk.
Internal risk-management audits are aimed at helping the organisation identify and evaluate significant
exposure to risks and contribute to the improvement of risk management. This includes monitoring and
evaluating the organisation’s risk-management system. A particular internal audit assignment might relate
to part of that system. For example:
• the board of directors may be concerned about exposure to foreign exchange fluctuations
• a bank may be concerned about the unusually high profits in a particular area of trading
• management may ask for large inventory thefts at a particular location to be investigated.
The internal audit activity must evaluate the effectiveness of risk-management processes and contribute
to their improvement. This involves assessing whether:
1. Organizational objectives support and align with the organization’s mission;
2. Significant risks are identified and assessed;
3. Appropriate risk responses are selected that align risks with the organization’s risk appetite; and
4. Relevant risk information is captured and communicated in a timely manner across the organiza-
tion, enabling staff, management, and the board to carry out their responsibilities (IIA 2017, p. 13,
para. 2120).
Control
Internal control audits are aimed at helping the organisation maintain effective controls by evaluating
effectiveness and efficiency and by promoting the continuous improvement of those controls. Internal
auditors can evaluate controls on a rotational basis or based on the results of risk assessments. Internal
auditors might also review operations and programs to determine the extent to which operating goals have
Pdf_Folio:317
QUESTION 5.10
The nature of evidence will vary greatly depending on the nature of the internal audit. For example,
an internal audit related to slow collection of trade debtors may require circularisation of trade debtors
and testing of internal controls related to trade debtors. On the other hand, reviewing warehouse storage
operations will involve extensive interviews with management, observation and examination of supporting
documents.
Documentation is also important to internal auditors who need to document all relevant information to
support the conclusion and engagement results.
Pdf_Folio:319
As the new chief internal auditor, you have been asked by the board of directors to make a
presentation on the role you believe your internal audit team should play in the prevention and
detection of fraud.
Outline some of the key points you would make in this presentation.
EXAMPLE 5.4
Introduction
Present procurement policies 1
Cost of procurement broken down by geographic area 8
Procurement costs of largest companies in the industry 16
dP f_Folio:320
Conducting procurement
Tender processes 27
Ensuring non-discrimination 31
Procurement support 34
Record keeping 38
Monitoring and review 42
Examples of best practice in procurement 47
Conclusions 58
............................................................................................................................................................................
Outline some potential improvements you could make to the structure of the report.
Check your response against the suggested answer at the end of the book.
An important issue for any assurance engagement on internal controls is the identification of suitable
criteria against which the controls can be evaluated. These criteria are a key aspect for engagement
acceptance. The most widely used in practice is the Internal Control — Integrated Framework (COSO
2013).
COSO’s Internal Control — Integrated Framework (2013) has created a greater awareness and
understanding of internal control, particularly with respect to legislators and regulators. It has highlighted
the significance of internal control as part of the overall management process encompassing the entity’s
operational, financial reporting and compliance activities. It has created a foundation of mutual under-
standing — a consensus among diverse parties as to the nature and significance of internal control. The
COSO framework has developed and established standards against which all organisations can measure
the effectiveness of their internal controls. It has clearly delineated the role and responsibilities of all
individuals in an organisation in maintaining and evaluating internal control.
The COSO framework also offers a word of caution — internal control is not a cure-all for an entity’s
problems. There are inherent limitations to internal control in that it is only as good as the people involved.
It cannot overcome human error, faulty judgment or deliberate collusion and circumvention of controls. It
cannot guarantee anything. An effective internal control system can only provide a reasonable assurance
that the entity will achieve its operational, financial reporting and compliance objectives.
Pdf_Folio:321
The primary responsibility for defining internal control — and its related objectives in pursuing an
entity’s strategic mission — rests with the chief executive officer, who is answerable to the board of
directors. The audit committee of the board of directors, in turn, oversees the structure and functioning
of the internal control system as part of its governance role.
COSO’s internal control framework (shown as figure 5.4) consists of five interrelated components:
1. control environment
2. risk assessment
3. control activities
4. information and communication
5. monitoring activities.
COSO sets out 17 principles associated with the five components. Because these principles are drawn
directly from the components, an entity can achieve effective internal control by applying all 17 principles.
All principles apply to operations, reporting, and compliance objectives.
Auditors can assess the entity’s system of internal control in relation to the COSO framework, focusing
on how it has selected, developed and deployed controls that affect the principles within the components of
internal control. Auditors, like management, may use COSO’s illustrative tools as part of this evaluation of
the overall effectiveness of the entity’s system of internal control. The illustrative tools assist users when
assessing whether a system of internal control meets the requirements set forth in the updated framework.
The 17 principles are listed next.
Principles
Control environment
1. The organization demonstrates a commitment to integrity and ethical values.
2. The board of directors demonstrates independence from management and exercises oversight of the
development and performance of internal control.
3. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities
and responsibilities in the pursuit of objectives.
4. The organization demonstrates a commitment to attract, develop, and retain competent individuals in
alignment with objectives.
5. The organization holds individuals accountable for their internal control responsibilities in the pursuit
of objectives.
Risk assessment
6. The organization specifies objectives with sufficient clarity to enable the identification and assessment
of risks relating to objectives.
7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks
as a basis for determining how the risks should be managed.
8. The organization considers the potential for fraud in assessing risks to the achievement of objectives.
9. The organization identifies and assesses changes that could significantly impact the system of internal
control.
Pdf_Folio:322
ns g ce
io rtin ian
at po pl
er
Op Re Co
m
Control Environment
Operating Unit
Function
Risk Assessment
Division
Entity Level
Control Activities
Monitoring Activities
Source: Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013, Internal Control — Integrated
Framework: Executive Summary, p. 6, accessed July 2019, https://www.coso.org/Documents/990025P-Executive-Summary-final-
may20.pdf. © Committee of Sponsoring Organizations of the Treadway Commission 2013. Reprinted with permission.
Pdf_Folio:323
QUESTION 5.12
Consider each of the following activities with respect to an internal control system. Categorise each
activity under the five COSO (2013) components. Justify your responses.
(a) Management’s commitment to competence.
(b) Separation of duties.
(c) Expanded foreign operation.
(d) Management’s questioning of reports that are different from their knowledge of operations.
(e) Corporate restructuring involving staff reductions.
(f) Establishment of a compliance register for improprieties.
(g) The role of the internal auditor.
(h) How authority and responsibility for operating activities are assessed.
(i) Gatekeeper at a factory.
(j) Communication channels with customers.
EXAMPLE 5.5
QUESTION 5.13
You are engaged to write an internal control checklist for Cyber-Sell, a company that buys and sells
products over the Internet as a key secondhand market.
Identify the controls and the risks they could address in the Cyber-Sell sales systems in
relation to:
(a) confidentiality of information
(b) transaction integrity
(c) authorisation of payments
(d) assurance of business credibility.
Source: Leung et al. 2018.
Continuous Auditing
Continuous auditing involves the use of embedded modules in a client’s computer system to perform
auditing activities, such as control and risk assessments, on a more frequent basis. The key to continuous
auditing is that it produces audit results simultaneously with, or a short period of time after, the relevant
events. As continuous auditing can apply to assurance on historical financial information, non-financial
information, systems reliability and behaviour, it is discussed here under a separate heading.
The increased emphasis on continuous auditing derives from the rapid advances in information
technology over recent years. This has resulted in a large amount of information being available more
quickly to a wide range of users. The advanced audit data analytic techniques that were discussed in
module 2 are equally applicable to subject matter such as sustainability reports, GHG reports, or internal
control effectiveness, where the data is captured electronically. These techniques have the ability to analyse
complete populations of data in order to identify patterns, correlations and deviations from expected results.
As such, they have the potential to provide efficient and reliable audit techniques.
It follows that, if decision makers need continuous information on which to base their decisions, it is
likely that they will also require independent assurance on the reliability of that information. In a continuous
audit, auditors would evaluate, using suitable criteria, the relevant subject matter information as described
above. For a continuous financial statement audit, the suitable criteria would be the IFRSs. However, as
described above, continuous audits can cover a broad range of subject matter information. The auditor
would need to consider how the subject matter information can be evaluated against criteria that have the
characteristics outlined in the International Framework for Assurance Engagements, including relevance
and reliability.
A continuous audit involves traditional methods of obtaining audit evidence, including inspection,
observation, enquiry, recalculation, reperformance and analytical procedures. It also relies heavily on
automated tools and techniques to provide much of the evidence because of the time period within which
reporting is required. For example, management would design controls to prevent, detect and correct errors
so that the likelihood of a material error is reduced to an appropriate level. These controls would include
alarm triggers, which are automated warnings to management and auditors that:
• controls are functioning as intended and have identified an error that requires investigation and, if
necessary, correction by management
• controls do not appear to be functioning as intended, based on pre-determined indicators or anomalies
in the information being generated.
dPf_Folio:325
EXAMPLE 5.6
dP f_Folio:326
Johnson Brain is a subsidiary in the Franklin Spleen group of companies and is about to implement
a new IT solution to manage an important part of its production process. The Franklin Spleen group
has a broad range of detailed group policies and procedures that all companies in the group must
follow. The policy around major expenditure requires a tender process to take place as follows.
1. Full detailed project specifications should be produced.
2. Invitations to tender must be advertised publicly.
3. The receipt of tenders submitted must be documented and all submissions opened at the same
time.
4. A project team of at least three must review and assess submissions, one of whom must have
appropriate expertise in IT project management.
5. Contracts will be awarded based on an assessment matrix which gives a score weighted across
various factors of functionality, financial stability of the supplier, track record, price, and future
support. You have been asked to provide assurance on Johnson Brain’s new IT solution.
Identify the type of assurance engagement you have been asked to carry out and for each of
the five points above, suggest procedures that might be carried out to satisfy yourself that the
appropriate tender process has been followed.
Source: Leung et al. 2019, PAQ 4.29.
ASPECTS OF BEHAVIOUR
One of the categorisations of underlying subject matter for other assurance services is aspects of
behaviour (International Framework for Assurance Engagements, Appendix 4). In practice, one of the
most common of these assurance services is the compliance engagement, which covers an individual or
entity’s compliance with rules, regulations, policies, or similar responsibility, and is discussed in the next
section. Other examples include the evaluation of audit committee effectiveness and fitness for purpose of
a software package.
Compliance Engagements
A compliance engagement involves gathering evidence to ascertain whether the person or entity under
review has followed the rules, policies, procedures, laws and regulations with which they must conform.
There are a number of examples of compliance engagements. A tax assurance engagement is used to
determine whether an individual or company has completed their tax return in accordance with the Income
Tax Assessment Act 1936 and the Income Tax Assessment Act 1997. Within an organisation, management
may specify that certain processes be followed when completing a function. For example, a company may
have policies and procedures for the hiring of new staff. In that case, the organisation’s internal auditors may
be called upon to check whether employees are following the specified processes appropriately (Moroney
et al. 2017).
An entity may have an obligation to comply with:
• external requirements, such as those established through law and regulation or contractual arrangements,
and/or
• internally established requirements, such as those established through company policies.
When conducting a compliance engagement, the objectives of the assurance practitioner are to obtain
assurance about whether the entity has complied in all material respects with these requirements; and to
communicate through a written assurance report that expresses either a reasonable or limited assurance
conclusion (ASAE 3100 Compliance Engagements, para. 15).
Australia recently revised one of its Standards on Assurance Engagements, ASAE 3100, for which
there is no equivalent International Standard on Assurance Engagements. This standard was revised to
help assurance practitioners promote a high-quality and consistent approach on performing compliance
engagements. The revised ASAE 3100 provides practitioners with:
• clearer objectives and detailed requirements
• additional application material covering planning, performing and reporting
• a comprehensive set of example letters and reports (Michaelides 2017).
Compliance assurance engagements can be either attestation engagements or direct engagements. The
differences between these are shown in figure 5.5.
Pdf_Folio:327
Report form
Presented in a for conclusion Presented in an
compliance statement assurance conclusion
While these compliance assurance engagements exist in both the public and private sectors, they
are usually discussed in relation to public sector assurance engagements. The reason for this is that
governments and other public sector entities usually operate in accordance with legislation that sets out
directions, conditions and limitations over the source, allocation and use of public resources. Hence,
compliance engagements are an integral part of their accountability process.
Compliance engagements are also common in the private sector. Overall, there is great variety in the
types of compliance engagements conducted, including:
• compliance with corporate governance policies
• veracity of management statements regarding impartiality
• carbon statements for emission trading
• corporate disclosure audits that:
– assess the scope of system design
– review the reliability of systems from which information is collated
– assess compliance with current laws, regulations and industry best practice.
Table 5.1 shows the nature of assurance engagements on compliance. The table sets out the:
• scope or purpose of the engagement
• compliance requirement — the requirements established in law; regulations; other statutory require-
ments; contractual arrangements; industry or professional obligations; or internally via entity policies,
procedures and frameworks
• criteria for evaluating compliance activity — the benchmark, framework or legislation used to evaluate
whether the compliance requirements have been met
• compliance activity — the activity that is undertaken to meet the compliance requirement
• compliance outcome of the evaluation — the outcome of the evaluation of the underlying compliance
activity against the compliance requirements, using the criteria. The compliance outcome is the
statement of the responsible party in an attestation engagement on compliance, or the assurance
practitioner’s conclusion in a direct engagement on compliance
• assurance opinion or conclusion.
Pdf_Folio:328
Source: Australian Auditing and Assurance Standards Board (AUASB) 2017, ASAE 3100 Compliance Engagements, pp. 40–1,
accessed July 2019 http://www.auasb.gov.au/admin/file/content102/c3/ASAE_3100_Compliance_Engagements.pdf
Pdf_Folio:329
EXAMPLE 5.8
QUESTION 5.15
Bravo Bags is a luggage retailer that operates out of a shopping mall. As required by the landlord,
Bravo Bags has hired Brad Pope, CPA, to provide a report to the landlord as to whether Bravo Bags
has met the requirements of its lease agreement in terms of reporting the store’s sales information.
Discuss how this engagement meets the requirements of an assurance engagement.
QUESTION 5.16
You are an internal auditor at Big Co., a large public company with 1500 employees. Your boss calls
you into her office to give you your next assignment.
‘I have just received a special audit request from the Audit Committee at Big Co. There seem
to be rumours out there that employees are padding their expense reports and not complying
with the policies and procedures for expense claim reimbursements that the Board of Directors
had approved this year. As you know, these expense claim requests are only to be used when an
employee incurs out of pocket expenses in which reimbursement is allowable under the policy.
dP f_Folio:330
Source: ASX Corporate Governance Council 2019, Corporate Governance Principles and Recommendations, 4th edn, p. 2,
accessed July 2019, https://www.asx.com.au/documents/regulation/cgc-principles-and-recommendations-fourth-edn.pdf © 2019
ASX Corporate Governance Council.
For each of these principles, the ASX has a set of recommendations on how to achieve best practice. It
also provides guidelines on what information should be included in the corporate governance section of an
annual report and what material should otherwise be made publicly available (e.g. on the entity’s website
under the corporate governance section). Companies are either required to report against these issues in
their annual reports or explain why they have not done so (the ‘comply or explain’ principle).
The ASX Corporate Governance Council (2019) recommendations can be used as criteria for providing
corporate governance assurance. The assurance could be provided for the contents of the corporate
governance disclosures or on the systems that generate the disclosures.
In some cases, the evidence collection for providing assurance could be relatively straightforward
(e.g. the first principle to ‘lay solid foundations for management and oversight’). However, for other
principles, such as ‘structure the board to add value’, assurance would be much more judgmental.
While the above example considers the guidelines developed by the ASX, similar guidelines exist in
most countries.
Pdf_Folio:331
(a) What could form the subject matter of an assurance engagement on briefing papers prepared
by management for the purpose of a board of directors’ meetings?
(b) What difficulties may exist in providing such assurance?
QUESTION 5.18
The key points covered in this section, and the learning objectives they align to, are listed below.
KEY POINTS
5.1 Explain the types of assurance engagements, other than the audit of historical financial
information.
• An important issue for any assurance engagement on internal controls is the identification of
suitable criteria against which the controls can be evaluated. The most widely used in practice
is COSO’s Internal Control — Integrated Framework.
• Continuous auditing involves the use of embedded modules in a client’s computer system to
perform auditing activities, such as control and risk assessments, on a more frequent basis.
• One of the most common assurance services on aspects of behaviour is the compliance engage-
ment. Other examples include the evaluation of audit committee effectiveness and fitness for
purpose of a software package.
• A compliance audit involves gathering evidence to ascertain whether the person or entity under
review has followed the rules, policies, procedures, laws and regulations with which they must
conform.
• The ASX Corporate Governance Council (2019) recommendations can be used as criteria for
providing corporate governance assurance. The assurance could be provided for the contents of
the corporate governance disclosures or on the systems that generate the disclosures.
5.2 Apply the appropriate standard that relates to assurance engagements, other than the audit of
historical financial information.
• ISAE 3402 Assurance Reports on Controls at a Service Organization provides guidance on the
assurance of the design of controls at a service organisation.
• ASAE 3150 Assurance Engagements on Controls sets out mandatory requirements for assurance
practitioners to apply, in conjunction with the requirements in ASAE 3000, when accepting,
planning, performing and reporting on controls.
• The assurance practitioner’s objectives set out in ASAE 3100 Compliance Engagements are
to obtain assurance about whether the entity has complied in all material respects with the
requirements and to communicate findings through a written assurance report that expresses either
a reasonable or limited assurance conclusion.
dP f_Folio:332
PERFORMANCE OF ACTIVITY
While performance auditing is carried out in both the private and public sectors, this section of the module
is concerned with public sector performance auditing only and considers auditing from the perspective of
the public sector auditor, usually the Auditor-General of the Commonwealth, state or territory. Public sector
performance audits are very complex because of the relationships between governments, parliaments and
the public sector.
The public sector auditor never considers the appropriateness of the policy itself. That is, it is a
requirement that the public sector auditor does not question the government’s policy. This reflects
the principle that the merits of the government’s policy are matters for political debate by elected
representatives in parliament and decision by the executive government. Therefore, policy objectives
established by means of, for example, a policy direction by a minister, a policy statement in a budget
paper or a statement of objectives in a corporate plan of an authority approved by a minister, are not valid
subjects of a public sector performance audit. The public sector auditor is not interested in whether those
policies or objectives are appropriate but, rather, whether they are being pursued economically, efficiently
and/or effectively.
In modern democracies, power is shared between the legislature (usually called the parliament) and the
government (the ministers). The legislature usually provides the government with money to enable the
government to implement its policies. Government policies are then implemented by the public sector.
The government’s policies can be related to any aspect of governing the jurisdiction.
The government, in turn, has to be accountable to parliament and the parliament needs to have assurance
regarding the government’s performance in meeting its policy objectives. This assurance is usually
provided by the Auditor-General, who reports to the parliament. This relationship is shown in figure 5.6.
Parliament
Provides assurance
to parliament
Provides funding
and authority
Policy direction
and instructions Audits agencies:
Financial/performance/other
Public sector
The Auditor-General usually has personal responsibility for carrying out their role. However, they also
have an office and the resources necessary to undertake their role. Therefore, the Auditor-General and their
office is often referred to as the public sector auditor. For clarity, this term will be used for the remainder
of this section.
The public sector auditor is usually established by legislation created in each jurisdiction. For example,
in Australia there are public sector auditors in each of the nine jurisdictions — Australia is a federation of
six states and two territories. On the other hand, in England, which has only one government, there is only
Pdf_Folio:333
(a) Economy — the performance principle relating to the minimisation of the costs of resources, within the
operational requirements of timeliness and availability of required quantity or quality.
(b) Effectiveness — the performance principle relating to the extent to which the intended objectives at a
program or entity level are achieved.
(c) Efficiency — the performance principle relating to the minimisation of inputs employed to deliver the
intended outputs in terms of quality, quantity and timing.
Source: Auditing and Assurance Standards Board (AUASB) 2017, ASAE 3500 Performance Engagements, accessed July 2019,
http://www.auasb.gov.au/Pronouncements/Standards-on-Assurance-Engagements.aspx. © Auditing and Assurance Standards Board
2017.
From an organisation’s perspective, it is important to perform well across all three dimensions and not
allow one to dominate. For example, if buying cheap inputs results in an inefficient production process,
efficiency may be seen to be sacrificed to achieve economic goals.
Pdf_Folio:334
Cost-effectiveness
Efficiency
Economy
Effectiveness
Source: CPA Australia 2019.
Efficiency
Efficiency refers to the use of resources; that is, maximising outputs for any given set of resource inputs,
or minimising inputs for any given quantity and quality of service provided. Expressed in another way,
efficiency is the relationship between resource inputs and outputs of goods and services.
Efficiency audits may, for example, consider whether the organisation has:
• avoided duplication of effort by employees
• avoided overstaffing
• used the minimum amount of resources (staff, equipment and facilities) to produce or deliver the
appropriate quantity and quality of goods or services
• employed an adequate system for measuring and reporting performance on efficiency.
Efficiency indicators established by management link resource inputs to resulting outputs. Program
efficiency indicators show the efficiency with which the organisation produces outputs that are directly
related to the primary purpose of the program.
Pdf_Folio:335
QUESTION 5.19
Consider a performance audit of bus services provided as public transport in a metropolitan area.
(a) Outline indicators to measure the economy, efficiency and effectiveness of those services.
(b) Provide criteria that could be used to assess the adequacy of results.
QUESTION 5.20
A state government has allocated extra funding for a 12-month period to increase the number of
random breath tests (RBTs) during the year by 50%. The aim of the program is to reduce the road
toll (i.e. the number of fatal road accidents) in the state by 10%.
(a) List potential indicators to measure the effectiveness of this program.
(b) Outline the issues you would consider in evaluating the effectiveness of the program.
Note: Performance is generally assessed by comparing achievements with some kind of reference point.
Criteria are the normative descriptions of performance while performance indicators are the measure of
the extent to which those particular criteria have been achieved.
To be suitable, therefore, performance indicators should enable those using them to assess the agency’s
performance relative to the following.
• Targets/goals. Does the performance information enable the user to determine whether the agency
attained its goals or, at least, determine how close it got to those goals?
• Previous performance. Does the performance information enable the user to assess whether the agency
is getting better or worse at doing what it set out to do?
• Performance of similar authorities or programs. Does the performance information enable the user to
determine how the agency compares with other agencies that have similar purposes?
The production of performance information costs resources in terms of money and staff time. Accord-
ingly, agency staff seek to reduce the number of types, and frequency of, performance reports by
producing only those that are very relevant and very useful. Performance indicators have become important
management tools in the public sector and a number of jurisdictions have made it compulsory for agencies
to prepare and publicly report them, and for public sector auditors to audit them.
Performance indicators are generally applied on the following basis.
• Ongoing — usually through management information systems that focus on inputs, outputs and
individual processing of transactions of the organisation.
• Periodic when needed — through in-depth studies that focus on the policy environment (i.e. means,
demand, alternatives) and the effects that goods and services have had on clients, or on the community
as a whole.
Generally, the most informative and robust publicly-reported performance indicators are those that are
also used internally by an agency for management purposes, because they are monitored regularly and the
entity will have invested in its systems and processes to produce accurate and reliable information.
Types of Indicators
As discussed earlier, to assist in describing and measuring what a government agency does, an activity
can be broken down into inputs, outputs and outcomes, as described here, with examples from the health
sector.
Pdf_Folio:338
Context: Other
external influences
Source: HM Treasury, Cabinet Office, National Audit Office, Audit Commission and Office for National Statistics 2001, Choosing
the Right FABRIC: A Framework for Performance Information, p. 10, accessed July 2019, https://www.nao.org.uk/report/choosing-
the-right-fabric-3/. © Crown Copyright. Used with permission of the National Audit Office.
Effectiveness considers planned versus actual outputs and outcomes. It also considers whether outputs
lead to desired outcomes. For example, measuring the number of people giving up smoking because of
an anti-smoking campaign would give an indication of how effective the campaign is in improving health
standards. Figure 5.8 also shows that cost-effectiveness and value for money describe the relationship
between the outcomes achieved and resources. It is important to see if the agency is getting value for
money; that is, whether outcomes are being achieved at a reasonable cost.
It should be noted that performance measures should not concentrate solely on outcomes. For example,
there may be a delay between outputs and outcomes (extra inputs, such as more medical equipment or a
disease prevention video, may lead to improvements in health that only become apparent in future years).
Therefore, it is important to consider input, output and outcome performance indicators, as discussed next.
Inputs
Input indicators are designed to report the amount of resources, either financial or non-financial, that have
been used for a specific service or program. This type of indicator provides the user with information about
Pdf_Folio:339
EXAMPLE 5.9
QUESTION 5.21
You are the public sector auditor for a national park. The park provides camping, hiking and picnic
facilities in a number of locations. It charges an entrance fee for users of the park. Suggest some
possible performance indicators for:
(a) efficiency
(b) effectiveness.
Identify potential sources of data for these indicators.
Example 5.10 focuses on the adequacy of performance reporting by an entity’s departments. Read the
information given and then complete the tasks.
EXAMPLE 5.10
There were 304 performance indicators examined across the eight departments. Of these indicators,
less than 50% (146 performance indicators) were relevant to departmental objectives, of which 74 (or
around 50%) provided appropriate information. This equates to around 25% of the 304 performance
indicators being both relevant and appropriate.
............................................................................................................................................................................
Review the report information regarding performance indicators. What alternative method could be used to
evaluate ‘relevant’ and ‘appropriate’?
Check your response against the suggested answer at the end of the book.
P d f_Folio:341
EXAMPLE 5.11
P d f_Folio:343
Criteria
Assurance
report
Intended Practitioner
users
Source: International Auditing and Assurance Standards Board (IAASB) 2018, ISAE 3000 (Revised) Assurance Engagements
Other than Audits or Reviews of Historical Financial Information, in Handbook of International Quality Control, Auditing, Review,
Other Assurance, and Related Services Pronouncements, 2018–19 edn, vol. 2, p. 204, accessed July 2019 https://www.ifac.org/
publications-resources/2018-handbook-international-quality-control-auditing-review-other-assurance
dPf_Folio:344
Head of Accountant
government Mandate
(attestation)
agency Assurance
practitioner
(direct)
Criteria Legislation
ISAE 3000
ASAE 3500
INTOSAI
Activity Findings standards
Assurance
report
Auditor-
Parliament general
Source: Based on ASAE 3500 Performance Engagements, Appendix 3, p. 33 and International Auditing and Assurance Standards
Board (IAASB) 2018, ISAE 3000 (Revised) Assurance Engagements Other than Audits or Reviews of Historical Financial
Information, in Handbook of International Quality Control, Auditing, Review, Other Assurance, and Related Services
Pronouncements, 2018–19 edn, vol. 2, p. 204, accessed July 2019, https://www.ifac.org/publications-resources/2018-handbook-
international-quality-control-auditing-review-other-assurance
Intended users Parliament, the general public, Shareholders, investors, responsible party
responsible party (i.e. agency) (i.e. board and executive management)
Source: Adapted from International Auditing and Assurance Standards Board (IAASB) 2018, ISAE 3000 (Revised) Assurance
Engagements Other than Audits or Reviews of Historical Financial Information, in Handbook of International Quality Control,
Auditing, Review, Other Assurance, and Related Services Pronouncements, 2018–19 edn, vol. 2, p. 68, accessed July 2019,
Pdf_Folio:345
https://www.ifac.org/publications-resources/2018-handbook-international-quality-control-auditing-review-other-assurance
The stages of the audit process set out in figure 5.12, and discussed in this module, represent the broad
framework underpinning the methodology of performance auditing.
Note: In the discussion, the steps in each stage of the audit process are numbered as in figure 5.12.
Reporting
12. Report to the head of the organisation, the minister and parliament.
stage
Follow-up
13. Follow up and report on conclusions and recommendations.
stage
Source: CPA Australia 2019.
Pdf_Folio:346
Pdf_Folio:347
EXAMPLE 5.12
dP f_Folio:348
P d f_Folio:349
While most audits are aimed at a specific agency, performance audits sometimes range over agencies.
Source: Australian National Audit Office (ANAO) 2019, [Performance audits], accessed July 2019, https://www.anao.
gov.au/pubs. © Commonwealth of Australia 2019. Reproduced with permission.
A more comprehensive list of ANAO performance audits or copies of complete performance audit
reports are available on the ANAO’s website at: http://www.anao.gov.au. This website also provides
links to other auditors-general websites in Australia and overseas.
QUESTION 5.22
List two factors that could affect the selection of activities that will form the subject matter for
assurance on performance.
Planning Stage
Once the target organisation, program or activity for performance audit has been selected and the audit
topics identified, the next stage is to plan the audit. This stage contains several interrelated steps, which
are discussed in detail in this section.
You should read the following section in conjunction with ASAE 3500, paragraphs 28–34 and the
planning section of ASAE 3000.
dP f_Folio:350
Pdf_Folio:351
While the auditor may need to adapt these criteria, they are often an excellent starting point. The
auditor always has a responsibility to assess whether criteria are suitable and appropriate to the specific
circumstances of the audit.
Example 5.13 sets out examples of criteria that are appropriate for some performance audits.
EXAMPLE 5.13
Suitable Criteria
Criteria to Assess the Adequacy of Systems and Practices
Systems should or are expected to:
• exist, and respond to risks
• be soundly designed, reflecting normal practices or central agency direction
• operate effectively, providing management with reasonable assurance that inherent risks are appropri-
ately managed.
Criteria to Ascertain Compliance With Authority
• Authority is required for objectives, operations, programs and individually significant transactions.
• Individual expenditures should be proper, related to objectives and approved.
• Expenditures forbidden by law should not be made.
Criteria to Examine Accountability Information
Information about the way that delegated responsibility has been exercised should fairly disclose
significant matters so that:
• the information is a complete and reliable record of significant events and transactions
• the information uses accepted conventions of estimation and measurement
• accepted conventions are used to disclose and present the information in an accessible way.
Criteria to Assess the Adequacy of Results
The organisation should achieve results (in areas of important responsibilities) that are satisfactory
compared with:
• public commitments and statements
• management targets
• reasonable expectations
• comparable organisations.
Source: CPA Australia 2019
P d f_Folio:353
Pdf_Folio:354
EXAMPLE 5.14
(continued)
P d f_Folio:355
Work health and safety • Number of hours of WHS training per person on induction/per annum
(WHS) (compliance culture)
• Number of days lost to injury and illness incidents per annum
QUESTION 5.23
For each of the following questions, list the management system or process and the type of data
that could be examined to provide assurance on performance at a hospital.
(a) What is the wait time in the emergency department?
(b) How is the customer call centre performing?
Comparisons
It is useful to compare trends and statistics with other selected organisations of a similar type. Comparisons
may be made on any (or all) of the following bases:
• service expenditure levels
• usage of services or measures of client population served
• unit costs of services provided
• employment levels
• performance indicators.
In many cases, published figures will not be available, although comparative figures can often be
obtained from other organisations. For example, it may be possible to compare administrative overheads
as a percentage of the total cost of a service department (e.g. accounts payable) with organisations of a
similar size and nature.
Comparisons of costs or statistics between individual facilities of an organisation may be useful because
of the knowledge the auditor has of the organisation and the reasons why there might be differences.
Comparisons between different but similar cost centres can be particularly useful (e.g. between similar
residential homes, schools or divisions). Other examples are repair costs by class of vehicle and energy
costs by school.
Comparison of performance in previous years is also helpful to distinguish trends. A particularly useful
indicator is the trend in the ratio of administrative costs to operational costs, especially in the larger
government agencies, such as those in health and education. A large range of unit costs and performance
measures can be derived from the financial management information system or other agency records.
Effectiveness evaluation
As discussed earlier, effectiveness is arguably the most important element of performance auditing. There
is no point in an organisation doing the ‘right’ thing very efficiently and economically if the major policy
objective is not achieved. For example, it is fruitless for a public sector organisation to provide a vocational
training program that is both economic and efficient if a reasonable percentage of trainees in the scheme
do not or cannot obtain employment related to that training.
In considering the best approach to auditing for effectiveness, the auditor should concentrate on ensuring
that the organisation has systems in place to determine and report upon its own effectiveness.
Generally, to evaluate performance effectively, performance measurement systems require the following
to be set and put in place:
• objectives — which should be clearly defined
• responsibility for achieving those objectives — in accordance with the organisational structure
• performance indicators — in terms of defined objectives and responsibility
dP f_Folio:356
Pdf_Folio:357
EXAMPLE 5.15
While GBRMPA has well-established arrangements for processing and assessing permit applications,
there were weaknesses in the quality and completeness of the assessments undertaken against regulatory
requirements. The causes of these weaknesses included fragmented and incomplete guidance material
for staff, incomplete records, insufficient consideration of relevant assessment requirements and limited
assurance from quality control processes. As a consequence, the permit application assessment reports
prepared for the delegate did not address all regulatory requirements on which decisions to issue or refuse
permits were to be based (Australian National Audit Office (ANAO) 2015).
In examining cause and effect, the auditor should be aware of the following.
• Cause and effect are interrelated and the knowledge of one assists the understanding of the other
(e.g. knowledge of the system for managing human resources helps in understanding the issue of human
resource efficiency).
• Any adverse effects of control weaknesses should be quantified where practical.
• The cause or effect may be either an isolated occurrence or part of a pattern indicating a potential
breakdown of the internal control system.
• Causes may be external to the system or the organisation subject to audit (e.g. directives from central
agencies have an effect on the operations of many public sector agencies), and effects may also extend
beyond the system or organisation subject to audit.
It is important that performance measures actually measure what can be influenced by the actions and
activities of the organisation, or part of the organisation, which is being measured.
An understanding of the techniques for examining economy, efficiency and effectiveness; the require-
ments for audit evidence; and cause and effect are essential to the ‘conducting the audit’ stage of a
performance audit. Following these stages, auditors then evaluate their findings, form conclusions and
prepare the assurance report.
10. Analyse Evidence and Evaluate Findings so as to Develop Conclusions and Recommendations
On a progressive basis throughout the conduct of the audit, the auditor evaluates evidence against the
selected performance audit criteria. The aim of this evaluation is to develop findings to:
• confirm or modify planning decisions and assessments
• develop conclusions relative to the audit objectives
• establish confidence in the audit conclusions.
As discussed earlier, the auditor should consider the implications of evidence obtained. The auditor
must evaluate the extent and the impact of identified variations in the entity’s performance of the activity
which are material (significant) to the auditor’s conclusion. ‘Material variations are those which could
impact performance in relation to economy, efficiency and/or effectiveness and be reasonably expected to
influence relevant decisions of the intended users of the assurance report’ (ASAE 3500, para. 31).
The impact on users of assurance reports is the ultimate test of what is material in the context of an audit.
As such, it is important when assessing materiality that stakeholders’ interests and information needs for
decision making are considered. This may include reporting good performance to provide fairness and
balance in reporting, as decision makers are interested in knowing what is working well, as well as what
needs to be improved.
The auditor should consider carefully why adverse variations or positive variations (which may indicate
over-allocation of resources) from criteria have occurred. Once the causes of variations have been
identified, it is important to consider their effect — actual or potential — on the organisation and the audit.
This process requires that considerable professional judgment is exercised and consultation undertaken to
ensure the process is carried out with due care and objectivity.
Pdf_Folio:359
Pdf_Folio:360
P d f_Folio:363
Follow-Up Audits
Generally, public sector auditors cannot impose the recommendations made in their performance audit
reports on an agency. It is a matter for the agency to determine whether to implement the recommendations.
It is important, however, for the effectiveness of the performance audit function in achieving better
outcomes and improved performance that agencies accept and implement recommendations.
Public sector auditors usually adopt a process of ongoing consultation and discussion with agencies
during the course of an audit to promote acceptance of the recommendations. This includes consultation
with agencies during the planning stages, providing information on the audit approach and objectives,
and maintaining open and regular communication with the auditee. Audit conclusions and any proposed
recommendations are communicated to agencies for comment before the report is finalised.
Finally, after parliament, the minister (if applicable) and the agency’s management have been presented
with a final report, it is sound practice for the public sector auditor to periodically follow up on
recommendations contained in the audit report.
13. Follow Up and Report on Conclusions and Recommendations
Follow-up procedures are the final stage of the performance audit process, as illustrated in figure 5.12
earlier in the module. These procedures include an assessment of whether action taken by the organisation
has corrected or will correct the problems that gave rise to the audit conclusions and recommendations.
They will also ascertain whether any additional work should be done by a subsequent audit.
Assessing the action taken by management on the conclusions and recommendations (and assessing the
benefits of the audit) will also allow the effectiveness of performance audits to be measured.
A similar function is performed in various jurisdictions by parliamentary oversight committees, such
as public accounts committees, which may undertake inquiries to assess the extent to which agencies
have addressed audit findings and implemented recommendations. Where a parliamentary committee has
inquired into the status of audit recommendations, it may not be necessary for the public sector auditor to
conduct a follow-up audit into the audit topic.
Examples of follow-up audits are available at: https://www.anao.gov.au/work/performance-audit/
cybersecurity-follow-audit
QUESTION 5.24
Chan and Partners Accountants is a successful mid-tier accounting firm with a large range of clients
across Australia. During the 2017 year, Chan and Partners gained a new client, Medical Services
Holdings Group (MSHG), which owns 100% of the following entities:
• Shady Oaks Hospital, a private hospital group
• Gardens Nursing Home Pty Ltd, a private nursing home
• Total Cancer Specialists Limited (TCSL), a private oncology clinic that specialises in the treatment
of cancer.
Year end for all MSHG entities is 30 June. TCSL owns two relatively old linear accelerators
used in radiation therapy. Recently, radiation therapists using these linear accelerators have raised
concerns that they have adverse radiation effects on patients.
TCSL also wishes to purchase a new, more technologically advanced linear accelerator. The
Department of Health funded half the purchase price on the basis that TCSL followed the
Department’s ‘Guidelines for procurement of medical equipment’ when purchasing the accelerator.
The Department of Health has engaged the Auditor-General to check that TCSL met the terms of
the funding agreement.
The Auditor-General has also been asked to conduct a performance audit that examines how
well hospitals manage waste. Hospitals generate significant amounts of waste, both general and
clinical. General waste is not dangerous and can be disposed of more cheaply than clinical waste.
Five years ago, the federal government measured the amount of hospital waste produced in terms
of quantity and cost of disposal. The government then set an objective for hospitals to improve how
they manage waste and published a document titled ‘Waste management guidelines’.
dP f_Folio:364
KEY POINTS
5.1 Explain the types of assurance engagements, other than the audit of historical financial
information.
• Performance audits are concerned with the economy, efficiency and effectiveness of an organisa-
tion’s activities.
• The most informative and robust publicly-reported performance indicators are those that are also
used internally by an agency for management purposes, because they are monitored regularly
and the entity will have invested in its systems and processes to produce accurate and reliable
information.
• Performance audits carried out by public sector auditors extend the scope of assurance which
they provide parliament beyond the purely financial reporting of government entities to consider
the economy, efficiency and effectiveness of activities delivered or controlled by the government.
• Performance audits can provide an assessment of how well and how economically the public sector
is implementing the government’s policy program.
• Because public sector agencies are tasked with delivering the government’s policy agenda, typical
commercial indicators of performance, such as profitability and wealth creation, are usually less
important than indicators of efficiency and effectiveness in policy implementation.
• While most public sector auditors in each jurisdiction have complete discretion in the selection
of areas subject to performance audits, in practice this selection is made in consultation with
parliament, government entities and other stakeholders. Choices are made after carrying out an
environmental scan of key risks and challenges to the public sector, and identifying factors that
could potentially improve performance.
• The techniques for examining economy, efficiency and effectiveness during a performance audit
include reviews of inputs and outputs, systems-based reviews, comparisons and effectiveness
evaluations.
• Performance audit reports may also identify suspected poor or wasteful practices, allegations of
fraud, misuse of resources or serious shortcomings in an internal control structure.
• In contrast to financial statement audits, which focus solely on accountability, performance auditing
focuses on improving both accountability and management practice.
• Audit conclusions and recommendations are mainly communicated to management via the
performance audit report.
5.2 Apply the appropriate standard that relates to assurance engagements, other than the audit of
historical financial information.
• ASAE 3500 Performance Engagements is an adjunct to ISAE 3000 (ASAE 3000) (Revised) Assurance
Engagements Other than Audits or Reviews of Historical Financial Information and in order to
comply with the standards, public sector auditors must comply with the requirements of both
standards.
• Guidance on performance audits has also been issued by the International Organisation of Supreme
Audit Institutions (INTOSAI).
• The ISSAI 3000 reporting requirements are consistent with the current practice of the ANAO’s
current approach in reporting to the Parliament and with the ANAO’s purpose.
P d f_Folio:365
AGREED-UPON PROCEDURES
An assurance practitioner can undertake procedures of an assurance nature that are agreed upon with the
entity and the user of the report. Such procedures are potentially broad ranging and can be in any area
where the client and user perceive it to be beneficial to have a report on a matter using audit-related skills.
Agreed-upon procedures engagements are quite common in practice. They are designed to reflect the
individual circumstances of the clients and meet the needs of users. Guidance is provided through ISRS
4400 Engagements to Perform Agreed-Upon Procedures Regarding Financial Information. In Australia,
the relevant pronouncement is ASRS 4400 Agreed-Upon Procedures Engagements to Report Factual
Findings.
ISRS 4400/ASRS 4400 outlines that in accepting such engagements, it is essential that there is a clear
understanding as to which procedures are agreed and the terms of the engagement. These matters are
detailed in the engagement letter that should clearly set out the:
1. Nature of the engagement, including the fact that the procedures performed will not constitute an audit
or a review and that accordingly no assurance will be expressed.
2. Stated purpose of the engagement.
3. Identification of the financial information to which the agreed-upon procedures will be applied.
4. Nature, timing and extent of the specific procedures to be applied.
5. Anticipated form of the report of factual findings.
6. Limitations on distribution of the report of factual findings … (ISRS 4400, para. 9).
Reporting Considerations
ISRS 4400/ASRS 4400 outlines that, for agreed-upon procedures engagements, no opinion is expressed
and consequently no assurance is provided. The report issued by the assurance practitioner should outline
in detail the procedures undertaken (which should be those agreed as outlined in the engagement letter) and
the findings from these procedures. It is up to the user to draw conclusions from the information provided
and to determine the level of assurance to attach to this information (ISRS 4400, para. 5).
The report clearly communicates to the user that agreed-upon procedures were undertaken, not an audit
or review.
The report should contain:
• a title (in many cases, the title ‘Report of Factual Findings’ is used)
• an addressee
• identification of the specific information to which the agreed-upon procedures have been applied
• a statement that the procedures performed were those agreed upon with the recipient
• a statement that the engagement was performed in accordance with ISRS 4400/ASRS 4400
• identification of the purpose of the engagement
• details of the specific procedures performed
• a description of the auditor’s factual findings
• a statement that the procedures performed do not constitute an audit or review and, as such, no assurance
is expressed
• a statement that, had an audit or review been performed, other matters may have come to the auditor’s
attention that would have been reported
• a statement that the report is restricted to those parties that have agreed to the procedures to be performed
• a statement that the report relates only to the information specified and does not extend to the entity’s
financial statements taken as a whole
• the date of the report, the auditor’s address and the auditor’s signature (ISRS 4400, para. 18/ASRS 4400,
Pdf_Folio:366
para. 43).
You can read more about the status of this project at http://www.iaasb.org/projects/agreed-upon-
procedures-isrs-4400.
QUESTION 5.25
One of the most important steps in an agreed-upon procedures engagement is to ensure that the
procedures that are agreed to be performed are acceptable and meet the requirements of the
intended recipients of the report. A statement to this effect must be included in an agreed-upon
procedures report.
(a) How can the auditor be satisfied that the intended recipients would consider the procedures
performed as sufficient for their purposes?
(b) What steps can the auditor take to ensure that there is no misunderstanding as to the
procedures agreed upon, or the form of the report to be issued?
Pdf_Folio:367
Reporting Considerations
When reporting on a compilation engagement, in accordance with ISRS 4410 (Revised), paragraph 40, the
report on the engagement should contain:
(a) the report title;
(b) the addressee(s), as required by the terms of the engagement;
(c) a statement that the practitioner has compiled the financial information based on information provided
by management;
(d) a description of the responsibilities of management, or those charged with governance, in relation to
both the compilation engagement and in relation to the financial information;
(e) identification of the applicable financial reporting framework …;
(f) identification of the financial information …;
(g) a description of the practitioner’s responsibilities in compiling the financial information, including that
the engagement was performed in accordance with this ISRS …;
(h) a description of what a compilation engagement entails …;
(i) explanations that:
i. since a compilation engagement is not an assurance engagement, the practitioner is not required
to verify the accuracy or completeness of the information provided by management for the
compilation; and
ii. accordingly the practitioner does not express an audit opinion or a review conclusion on whether the
financial information is prepared in accordance with the applicable financial reporting framework;
(j) … [†]
(k) the date of the practitioner’s report;
(l) the practitioner’s signature; and
(m) the practitioner’s address.
†Certain other explanatory information if the financial information is prepared using a special purpose
reporting framework.
EXAMPLE 5.17
QUESTION 5.26
You have been approached by a client who is unsure of the requirements with regard to financial
reporting. Your client understands that there are compilations, reviews and audits but is not aware
of the differences between them.
Prepare notes for a meeting with your client to discuss the differences between compilation,
review and audit engagements. Identify the different levels of assurance and the form of opinion
that would be provided under each engagement. You should also provide brief notes about the type
of procedures that could be involved in each engagement.
The key points discussed in this section, and the learning objectives they align to, are listed below.
KEY POINTS
P d f_Folio:369
dP f_Folio:370
REFERENCES
Auditing and Assurance Standards Board (AUASB) 2019, ‘Explanatory Memorandum Exposure Draft 01/19: ASRE 2410 Review
of a Financial Report Performed by the Auditor of the Entity’, May, accessed July 2019, https://www.auasb.gov.au/Work-In-
Progress/Open-for-comment/ASRE-2410.aspx?preview=true
Auditing and Assurance Standards Board (AUASB) 2017, ‘Auditor review reports – the impact of the new auditor reporting
requirements’, AUASB Bulletin, 27 July, accessed July 2019, http://auasb.cmail19.com/t/ViewEmail/r/
822C68B69F019C102540EF23F30FEDED
ASX Corporate Governance Council 2019, Corporate Governance Principles and Recommendations, 4th edn, accessed July 2019,
https://www.asx.com.au/documents/regulation/cgc-principles-and-recommendations-fourth-edn.pdf
Australian Council of Superannuation Investors 2018, Corporate Sustainability Reporting in Australia: An Analysis of ASX200
Disclosure, June, accessed July 2019, https://www.acsi.org.au/publications-1/research-reports.html
Pdf_Folio:371
Pdf_Folio:373
374 GLOSSARY
audit risk The risk that an auditor may give an inappropriate opinion on the financial information that is
materially misstated.
audit risk model A model that expresses the relationships among audit risk components. It simply
states that audit risk = inherent risk × control risk × detection risk.
audit trail A chain of evidence from initiating a transaction to its recording in the general ledger and
financial statements.
balanced Performance indicators should provide a complete picture of what is being done, covering all
significant areas.
blockchain An open, distributed ledger that records transactions between two parties in a verifiable and
permanent way.
business model Everything about how the business creates and delivers value to its stakeholders.
business risk Results from significant conditions, events, circumstances, actions or inactions that could
adversely affect the entity’s ability to achieve its objectives and execute its strategies, or from the
setting of inappropriate objectives and strategies.
cause The reason something happened.
computer-assisted audit techniques (CAATs) CAATs are the computer-assisted tools and techniques
employed by auditors to extract and analyse client data.
comparative information Amounts or disclosures of one or more previous periods that are presented on
a comparative basis with those of the current period.
confidentiality The obligation that all members of the professional bodies refrain from disclosing
information that is learned as a result of their employment to people outside of their workplace.
conflict of interest situation Occurs when the auditor is not capable of exercising objective and
impartial judgment in relation to the conduct of the audit or when a reasonable person with full
knowledge of the relevant facts and circumstances would conclude that the auditor is not capable of
being objective and impartial.
contingent liability A potential liability that becomes an actual liability when one or more future
event(s) occurs or fails to occur.
continuous auditing Continuous auditing involves the use of embedded modules in a client’s computer
system to perform auditing activities, such as control and risk assessments, on a more frequent basis.
control activities Those policies and procedures that help ensure that management directives are carried
out. Control activities are a component of internal control.
control environment Includes the governance and management functions and the attitudes, awareness
and actions of those charged with governance and management concerning the entity’s internal control
and its importance in the entity. It is a component of internal control.
control risk Relates to the efficacy of an entity’s internal controls and the risk that those controls will
not prevent, or detect and correct, a material misstatement at the assertion level.
cost-effective Performance indicators should balance the benefits of the information against the costs of
preparing them.
criteria The standards, rules or benchmarks used to prepare and evaluate the subject matter information
of an assurance engagement.
data analytics A process of inspecting, cleansing, transforming and modelling data with the goal of
discovering useful information, informing conclusions and supporting decision making.
detection risk The risk that the assurance practitioner’s evidence-gathering procedures will not detect a
material misstatement.
deviation A deviation exists when a control exists but does not operate effectively, i.e. it does not
prevent or detect and correct a misstatement on timely basis.
direct In a direct reporting engagement the public sector auditor directly measures or evaluates the
underlying subject matter against criteria (i.e. prepares the subject matter information) and expresses
the conclusion.
direct engagements Engagements where the assurance practitioner directly measures or evaluates the
underlying subject matter against the criteria.
disclaimer of opinion Expressed when the possible effect of a limitation on scope is an extreme case
and the auditor has not been able to obtain sufficient appropriate audit evidence and accordingly is
unable to express an opinion on the financial report.
dummy transactions Fictitious transactions that simulate real transactions and are used to test
internal controls.
Pdf_Folio:375
GLOSSARY 375
economy The performance principle relating to the minimisation of the costs of resources, within the
operational requirements of timeliness and availability of required quantity or quality.
effect The impact of a variation in performance against the audit criteria may be quantifiable.
effectiveness The performance principle relating to the extent to which the intended objectives at a
program or entity level are achieved.
efficiency The performance principle relating to the minimisation of inputs employed to deliver the
intended outputs in terms of quality, quantity and timing.
Emphasis of Matter Emphasis of Matter paragraphs are appropriate whenmatters are appropriately
presented or disclosed in the financial statements but are of such importance that they are fundamental
to users’ understanding of the financial statements.
engagement letter Written terms of an engagement in the form of a letter.
engagement partner The partner or other person in the firm who is responsible for the engagement and
its performance, and for the report that is issued on behalf of the firm, and who, where required, has
the appropriate authority from a professional legal or regulatory body.
engagement risk The risk that the practitioner expresses an inappropriate conclusion when the subject
matter information is materially misstated.
engagement team All partners and staff performing the engagement and any individuals engaged by the
firm or a network firm who perform procedures on the engagement. This excludes an auditor’s
external expert engaged by the firm or by a network firm.
enquiry Consists of seeking information of knowledgeable persons, both financial and non-financial,
within the entity or outside the entity.
entity’s risk assessment process A component of internal control that is the entity’s process for
identifying business risks relevant to financial reporting objectives and deciding about actions to
address those risks and the results thereof.
errors Unintentional misstatements in financial statements, including the omission of an amount or
a disclosure.
evidence Information used by the practitioner in arriving at the practitioner’s conclusion.
extent The quantity of information collected and tested. It is equivalent to sufficiency. More evidence is
better than less, but this is highly dependent on its quality.
factual misstatements Misstatements that are known with certainty.
familiarity May occur when, because of a long or close relationship with a client, a professional
accountant becomes too sympathetic to their interests or too accepting of their work.
fieldwork Entails gathering evidence and analysing and evaluating evidence in accordance with the
audit plan.
financial statements A complete set of financial statements as determined by the requirements of the
applicable financial reporting framework.
firm A sole practitioner, partnership or corporation or other entity of professional accountants.
fraud An intentional act by one or more individuals among management, those charged with
governance, employees, or third parties, involving the use of deception to obtain an unjust or
illegal advantage.
fraud risk factors Events or conditions that indicate an incentive or pressure to commit fraud or provide
an opportunity to commit fraud.
fraudulent financial reporting Involves intentional misstatements, including omissions of amounts or
disclosures in financial statements, to deceive financial statement users.
free from bias Performance indicators should report information impartially, using information that is
gathered and analysed in a way that is free from built-in bias.
general controls Policies and procedures that relate to many applications and support the effective
functioning of application controls by helping to ensure the continued proper operation of information
systems. It commonly includes controls over data centre and network operations; system software
acquisition, change and maintenance; access security; and application system acquisition,
development and maintenance.
generalised audit software (GAS) Software designed to read and process data, typically from large
databases, to perform a wide range of audit tasks.
going concern basis An assumption that an entity will continue in the future unless evidence is available
to the contrary.
haphazard selection Involves the auditor selecting sampling units without any conscious bias and in a
manner that the drawn sample can be expected to be representative of the population.
Pdf_Folio:376
376 GLOSSARY
independence Independence comprises independence of mind (professional judgment not compromised
— acting with integrity and exercising objectivity and professional scepticism) and independence in
appearance (how others perceive the integrity, objectivity or professional scepticism of the auditor).
indicators Measurements of the extent to which the criteria have been achieved.
inducements Are offers of gifts hospitality or other privileges intended to influence the
recipient’s behaviour.
inherent risk A function of the nature and uncertainty surrounding some transactions, account balances
and disclosures, such as complex calculations and accounting estimates.
inspection Examining records or documents, whether internal or external, in paper form, electronic
form, or other media, or a physical examination of an asset.
integrated test facility (ITF) A simple version of embedded audit software that populates a client’s
system with ‘dummy’ records.
integrity The obligation that all members of the accounting professional bodies be straightforward
and honest.
internal audit function The internal audit function is a function of an entity that performs assurance
and consulting activities designed to evaluate and improve the effectiveness of the entity’s governance,
risk management and control processes.
internal control The process designed, implemented and maintained by those charged with governance,
management and other personnel to provide reasonable assurance about the achievement of an entity’s
objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations,
and compliance with applicable laws and regulations. The term ‘controls’ refers to any aspects of one
or more of the components of internal control.
intimidation May occur when a professional accountant is deterred from acting objectively because of
actual or perceived threats.
IT environment The policies and procedures that the entity implements and the IT infrastructure
(hardware, operating systems, etc.) and application software that it uses to support business operations
and achieve business strategies.
judgmental misstatements Typically involve judgments such as accounting estimates in which
uncertainty is a factor.
key audit matter (KAM) Those matters that, in the auditor’s professional judgment, were of most
significance in the audit of the financial report of the current period.
letter of enquiry A letter sent by the auditor to the entity’s legal counsel asking the legal counsel to
provide information directly to the auditor regarding any litigation and claims or other liabilities that
the legal counsel is aware of, including any costs and an estimate of the financial implications.
letter of subordination A letter from the parent company stating it agrees not to demand repayment of
debts that the subsidiary owes for a fixed period (usually 12 months).
letter of support A letter from the parent company stating that it agrees to provide financial assistance
to a subsidiary for a fixed period (usually 12 months).
library controls Are controls over the library collections of information, typically segregated by the
type of stored information, such as programs, data or documentation.
limited assurance engagement An assurance engagement in which the practitioner reduces
engagement risk to a level that is acceptable in the circumstances of the engagement but where that
risk is greater than for a reasonable assurance engagement. The conclusion conveys whether a
matter(s) has come to the practitioner’s attention to cause the practitioner to believe the subject matter
information is materially misstated.
lower assessed level of control risk approach The auditor’s planned assessed level of control risk is
low or medium. The plan involves obtaining a substantial understanding of the internal control
systems, planning extensive tests of controls but restricting the extent of substantive procedures.
management representation letter A letter that contains representations from management to an
auditor made during the conduct of the audit.
material misstatement Information in the financial statements that is misstated by an amount that is
likely to impact on the economic decisions made by users relying on the financial statements.
material uncertainty related to going concern Exists when events or conditions cast significant doubt
on the entity’s ability to continue as a going concern.
materiality In respect of accounting information, an omission, misstatement or non-disclosure that
could adversely affect the decisions of the user in given circumstances.
Pdf_Folio:377
GLOSSARY 377
misappropriation of assets Involves the theft of an entity’s assets and is often perpetrated by employees
in relatively small and immaterial amounts. However, it can also involve management who are usually
more capable of disguising or concealing misappropriations in ways that are difficult to detect.
misstatement A difference between the reported amount, classification, presentation or disclosure of a
financial statement item and the amount, classification, presentation or disclosure that is required for
the item to be in accordance with the applicable financial reporting framework. Misstatements can
arise from error or fraud.
mitigating circumstances Circumstances that offset the conditions that have raised doubts about the
entity’s ability to continue as a going concern.
modified auditor’s report Issued when the audit opinion is qualified, adverse or disclaimer of opinion
or when it is appropriate for the auditor to draw attention to or emphasise a matter that is relevant
to users.
monitoring of controls A process to assess the effectiveness of internal control performance over time.
It includes assessing the design and operation of controls on a timely basis and taking necessary
corrective actions modified for changes in conditions. Monitoring of controls is a component of
internal control.
nature The type and source of evidence.
NOCLAR Non-compliance with laws and regulations (NOCLAR) is an action that violates a law
or regulation that directly impacts on the financial statements or violates laws which address
compliance matters.
non-audit services Services that are not audit related. Examples are accounting, management
consulting, and insolvency and business recovery.
objectivity The obligation that all members of the professional bodies not allow their personal feelings
or prejudices to influence their professional judgement.
Other Matter Include matters not presented or disclosed in the financial statements that are relevant to
users’ understanding of the audit, the auditor’s responsibilities or the auditor’s report.
outcome Could be the reduced percentage of the population being diagnosed with diabetes over a
particular period.
output Could be the number of pamphlets distributed or the number of people attending an
information session.
overall audit strategy Sets the scope, timing and direction of the audit, and guides the development of
the more detailed audit plan.
overall materiality As part of determining the overall materiality for planning purposes, the auditor
selects a base and applies a percentage to that base.
parliament The parliament allocates responsibility to the agency.
performance materiality The amount set by the auditor at less than materiality for the financial
statements as a whole to reduce to an appropriately low level the probability that the aggregate of
uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole.
performed as risk assessment procedures Analytical procedures performed as risk assessment
procedures are used at the planning stage to identify areas of high risk and to assist in determining the
extent of planned audit procedures.
pervasiveness A description of the impact or possible impact of a material misstatement or material
scope limitation on the financial statements as a whole. If the material misstatements affect many
facets of the financial statements it is referred to as having a pervasive impact on the financial
statements as a whole.
predominantly substantive testing approach The auditor’s planned assessed level of control risk is
high, and the plan requires a minimum of understanding of internal control, no tests of controls but
extensive use of substantive audit procedures.
professional behaviour The obligation that all members of the professional bodies comply with rules
and regulations and ensure that they do not harm the reputation of the profession.
professional competence and due care The obligation that all members of the accounting professional
bodies maintain their knowledge and skill at a required level and complete each task thoroughly,
document all work and finish on a timely basis.
professional judgment The application of relevant training, knowledge and experience, within the
context provided by auditing, accounting and ethical standards, in making informed decisions about
the courses of action that are appropriate in the circumstances of the audit engagement.
Pdf_Folio:378
378 GLOSSARY
professional scepticism An attitude that includes a questioning mind, being alert to conditions which
may indicate possible misstatement due to error or fraud, and a critical assessment of evidence.
projected misstatements The result of audit sampling when the sample results are projected to
the population.
projected to the population A projection of the misstatement in the population based on the findings in
the sample.
projecting the errors Projecting the errors in a sample to the population based on findings by applying
the percentage of misstatement in the sample to the population to determine the projected
misstatement in the population.
public interest entities (PIEs) Either a listed company or an entity defined by regulation or legislation
as a public interest entity.
public sector auditor The public sector auditor carries out a process that is superimposed on the
accountability relationship between the parliament and agency, in order to provide assurance regarding
the agency’s policy implementation.
qualified opinion Expressed when the auditor concludes that an unqualified opinion cannot be
expressed but that the effect of any scope limitation, disagreement with those charged with governance,
or a conflict between applicable financial reporting frameworks is material but not extreme.
quantifiable Performance indicators should illustrate the extent to which objectives have been achieved
in absolute and proportional measures (i.e. subjective and judgmental statements should be avoided).
random selection Is where each sampling unit making up the account balance or class of transactions
has a chance (often an equal chance) of selection.
reasonable and informed third party A party, not necessarily an accountant, who possesses the
relevant knowledge and experience to understand and evaluate the appropriateness of the accountant’s
conclusions in an impartial manner.
reasonable assurance engagement An assurance engagement in which the practitioner reduces
engagement risk to an acceptably low level in the circumstances of the engagement as the basis for the
practitioner’s conclusion which is expressed on the basis of the outcome of the measurement or
evaluation of the underlying subject matter against criteria.
related party A party that is a person or other entity that has control or significant influence, directly or
indirectly through one or more intermediaries, over the reporting entity; or another entity over which
the reporting entity has control or significant influence, directly or indirectly through one or more
intermediaries; or another entity that is under common control with the reporting entity.
relevant Performance indicators should relate to the user’s needs and to clearly defined objectives that
communicate what is to be measured.
review engagement A review engagement provides only limited assurance whether the financial
statements conform to generally accepted accounting principles.
risk assessment procedures The audit procedures performed to obtain an understanding of the entity
and its environment, including the entity’s internal control, to identify and assess the risks of material
misstatement, whether due to fraud or error, at the financial statement and assertion levels.
risk of material misstatement The risk that the financial statements are materially misstated prior to
audit. This consists of two components at the assertion level — inherent and control risks.
second partner review A review of working papers by an audit partner who did not participate in
the audit.
self-interest threat May occur as a result of the financial or other interests of a professional accountant.
self-review threat May occur when the assurance team needs to form an opinion on their work or work
performed by others in their firm.
significant risk An identified and assessed risk of material misstatement that, in the auditor’s judgment,
requires special audit consideration.
subsequent events Events occurring between the period end and the date of the auditor’s report, and
facts discovered after the date of the auditor’s report.
substantive analytical procedures Are analytical procedures used as substantive procedures either to
replace or to corroborate a test of details.
substantive procedures Audit procedures designed to detect material misstatements at the
assertion level.
sufficiency Relates to the quantity of audit evidence obtained. The auditor needs enough evidence
to provide reasonable assurance as to whether the financial statements are free from material
misstatements.
Pdf_Folio:379
GLOSSARY 379
sufficiency of evidence The measure of the quantity of evidence.
systematic selection Involves selecting every nth item in the population, the interval being determined
by dividing the number of items in the population by the sample size and then selecting a random
starting point.
technical review A review by an audit partner or manager to ensure that the form and content of the
financial statements are in accordance with the applicable financial reporting framework, including the
Corporations Act and Australian Securities Exchange (ASX) requirements (where applicable).
test data Used by the auditor to test the integrity of the program and systems, and the information
contained within them.
tests of controls Audit procedures designed to evaluate the operating effectiveness of controls in
preventing, or detecting and correcting, material misstatements at the assertion level.
those charged with governance Refers to the governing body of the entity (i.e. the board of directors
for a listed company) and other persons having responsibility for planning and directing activities for
an entity.
three-party relationship Involves the practitioner (professional accountant), the responsible party (the
person(s) responsible for the underlying subject matter) and the intended users of the report.
time-based and timely Performance indicators should cover a defined time period to determine whether
the performer has achieved the target and produced on a timely basis so that corrective action can
be taken.
timing When the evidence is collected (e.g. year-end). Evidence collected at year end, or close to the
date of the subject matter information, is the most reliable.
true and fair view A term that is synonymous with ‘fairly presented’. It is used when expressing a fair
opinion on financial statements when required by the Corporations Act.
unmodified auditor’s report An auditor’s opinion on a general purpose financial report prepared in
accordance with a financial reporting framework designed to achieve fair presentation that states that
the financial report ‘gives a true and fair view’ or ‘presents fairly, in all material respects’, in
accordance with the applicable financial reporting framework.
verifiable Performance indicators should result in similar conclusions when an independent assessment
is conducted.
written assurance report A written report that provides reasonable or limited assurance about the
subject matter information.
written representations Signed statements by responsible and knowledgeable individuals that have
bearing on one or more of management’s assertions.
Pdf_Folio:380
380 GLOSSARY
“Case_Study_PrintPDF” — 2019/11/18 — 6:30 — page 381 — #1
ISA 315 (Revised) Identifying and Assessing the Risks of ASA 315 Identifying and Assessing the Risks of
Material Misstatement through Understanding the Entity and Material Misstatement through Understanding the
Its Environment Entity and Its Environment (Compiled)
ISA 320 Materiality in Planning and Performing an Audit ASA 320 Materiality in Planning and Performing
an Audit (Compiled)
ISA 330 The Auditor’s Responses to Assessed Risks ASA 330 The Auditor’s Responses to Assessed
Risks (Compiled)
ISA 450 Evaluation of Misstatements Identified during ASA 450 Evaluation of Misstatements Identified
the Audit during the Audit (Compiled)
ISA 500 Audit Evidence ASA 500 Audit Evidence (Compiled)
ISA 540 (Revised) Auditing Accounting Estimates and ASA 540 Auditing Accounting Estimates and
Related Disclosures Related Disclosures
ISA 700 (Revised) Forming an Opinion and Reporting on ASA 700 (Revised) Forming an Opinion and
Financial Statements Reporting on a Financial Report (Compiled)
ISA 705 (Revised) Modifications to the Opinion in the ASA 705 (Revised) Modifications to the Opinion
Independent Auditor’s Report in the Independent Auditor’s Report
ISA 706 (Revised) Emphasis of Matter Paragraphs and Other ASA 706 (Revised) Emphasis of Matter
Matter Paragraphs in the Independent Auditor’s Report Paragraphs and Other Matter Paragraphs in the
Independent Auditor’s Report
INTRODUCTION
This section introduces the business entity, a small company whose financial report is to be audited,
together with its owners and its financing arrangements. It gives a picture of the business as it is now
and it looks back a few years to the start of the business. The decision had been made by the founders of
the business to operate in a limited company structure and to arrange for an annual audit of the company’s
financial statements. Campbell Lee Taylor, a local firm of accountants, has been offered the audit work,
together with some other professional services, and the firm’s partners have accepted the offer.
Arnton, where Westerways is based, has a population of about 80 000 and is located 200 kilometres from
the Lusitania capital city, Ventura, a city of 2.5 million. It is located on a river, navigable only by small
boats beyond Arnton, though there is also a railway and a good highway, as well as the nearby airport. It
is in an area whose wealth comes particularly from dairying and horticulture and from a mining company
operating in the nearby hills. The local industry is mainly support engineering for the agricultural activities
and the mine. There is also a growing tourism industry, centred on the river and on lakes and the forested
hills nearby.
Tannam, 170 kilometres from Ventura, is an agricultural and horticultural town. It supplies Ventura with
vegetables and flowers and has a growing export industry making use of the airport. Its horticulturalists are
hoping to experience growth over the next few years, with limiting factors being the availability of good
land and good seasonal labour. Their association is working with the government to develop appropriate
technology.
Lusitania is a country with a population of more than 4 million, adjoining much larger and more populous
countries. Its people are industrious, and in recent decades have come to realise the importance of education
and training as a means to develop their economy. The country is reasonably blessed in its natural features,
with good soil, regular rainfall and sunshine on most days. It has lakes and rivers that facilitate transport as
well as providing water for the horticultural, viticultural and dairying industries. Thirty years ago, minerals
were discovered in Lusitania and it now has a growing mining industry, which has given its government
royalty income for development of the country’s infrastructure. Since then, it has seen the rise of a number
of support and related industries. Lusitania has been quite successful in attracting some ‘down-stream’
industrial development for its primary produce and also some new technology industries, which are located
near its airport in the triangle of land between Ventura, Arnton and Tannam, which is in the centre of what
is becoming a recognised wine-producing area. The capital, Ventura, is the country’s main port and there
are a number of provincial towns based on various combinations of agriculture, mining and industry.
THE MARKET
The initial business strategy was to sell hardware, with most customers likely to be men, in conjunction with
domestic ware and gifts, for which the majority of customers were likely to be women. It was hoped that
‘mums’ and ‘dads’ would come together and that there would be consultation in the store over merchandise
of interest, leading to immediate purchase rather than delay and possible change of mind. The Valentis also
believed that the people of the district would be happy to buy their home and garden needs in one place
in their home town, even if the goods were slightly more expensive, rather than purchase their house and
kitchenware and gifts from small shops and their hardware from the stores on the outskirts of the capital,
Ventura. A further business strategy was to have large windows and eye-catching window displays, and
Joy Valenti’s artistic talents were well suited to this.
The business strategy proved to be a good one. The first Westerways store was very successful from its
opening. The window displays attracted passers-by into the store, including both ‘locals’ and visitors to
the town, and when they came in they bought, and they told their friends of their pleasant experience of
seeing interesting merchandise and of bargaining with Mark and Joy. As the Valentis had hoped, families
were soon coming into the shop. It also soon became apparent that young people were finding the store a
useful source of gifts for their friends. Within a few weeks, the store was employing casual staff to assist.
Sales of gifts and unusual items of house and kitchenware were very successful. The hardware items
sold steadily, though the gross margin for many of these items was among the lower for the items sold.
The kitchenware and gifts were more risky, in the sense that it was more difficult to predict what would
sell, but they generally earned a higher gross margin.
Mark and Joy decided which items to buy based on their business intuition and from what customers
requested from time to time. In fact, as their inventory diversified, more suggestions tended to come from
their regular customers. They had to exercise considerable judgment in making decisions on selling prices
and, where necessary, on discounting of prices where slow-moving lines need to be ‘offloaded’.
There is a trade association for the retail hardware industry in Lusitania, which has an objective to assist
member hardware shop owners in any way it can. However, it has been of little assistance with business
decisions because it covers purely hardware, while the Westerways business strategy is to trade also in fine
homewares and gifts. There is no trade association that can give them assistance here and they have had
to use their own judgment.
The trade association does have data on the value of sales and the number of shop assistants per square
metre of floor space. However, the Valentis believe that their own business already does much better than
the guidelines, so they have made no recent comparisons.
Mark and Joy knew before they started the business that it is generally believed among businesspeople
with small shops that they must be able to mark up the cost of their merchandise by at least 60% on average
if they are to make an adequate return after meeting their expenses.
A variable that the Westerways management closely observe is stock turnover. They have no firm view
yet on stock turnover standards by product but review the data that is available in deciding on discounts
and advertising for the purpose of lowering stock levels.
One guideline for the business comes from the suppliers, most of whom suggest retail prices. They also
give advice on discounting. They are not by law in Lusitania allowed to require retailers to sell at particular
prices.
THE PREMISES
The store and company offices in Arnton occupy the whole of the ground floor of a two-storey building.
The sales area of the store is in two sections, separated by a partition, but with one counter located near
the door and placed in such a way that the person at it has a reasonably clear view of both sections of the
shop. One section, the larger one, sells the various lines of hardware — that is, items such as paint, tools,
electrical appliances, nuts and bolts and similar items for home makers who like to do things themselves,
together with supplies and equipment for gardeners. The smaller section of the shop sells a varying range
of gifts of all sorts and quality homewares — items such as crockery, cutlery, ornaments and other items
of unusual design. These two sections are referred to as the ‘hardware shop’ and the ‘gift shop’ (which,
considering the wide range of goods it sells, is not quite true, but the name seems to be successful from a
marketing point of view).
At the back of the premises on the hardware shop side there is a loading bay, for both supplier deliveries
and collections of large items by customers. At the back on the gift shop side there is an administrative
office, located in such a position that a person working in it looks out into the loading bay area, which
is useful for security purposes. Between the loading dock and the offices, there is a small store used for
merchandise and office supplies.
In the floor above, there are a number of rooms that Westerways did not need and decided to let. They
are not high-quality offices and would not command much rent, but would be attractive to some businesses
and could later be taken over by Westerways. Access to these rooms is via a closed staircase to one side
of the store.
The business premises are quite well secured, though the Valentis have nonetheless chosen to carry
insurance of buildings and contents. Access would be difficult or impossible through the roof because of
the concrete between the store and the rooms above. The front of the shop, with its brick wall and steel
and reinforced glass door, and a relatively high pavement, is protected well enough to deter ramming by
motor vehicles (this being, unfortunately, a recent development in Arnton). The gates at the loading bay
are made of steel. There are varying amounts of cash on the premises, but at night the tills are cleared, a
float is retained in a strong wall safe, and the day’s takings are banked in a night safe located just across
the road. However, there are many valuable and useful items of inventory in both sections.
The store in Tannam is similar to the one in Arnton, but the office area comprises just one small
accounting office and rooms for the staff.
BUSINESS ACTIVITIES
Mark and Joy do the buying, from manufacturers and wholesalers located in the Lusitania region. Some of
the suppliers’ representatives visit the shop to take orders and give advice. Other orders are placed by email
after telephone discussions. The Valentis also visit suppliers and potential suppliers, with Mark focusing
on merchandise for the hardware shops and Joy on merchandise for the gift shops.
Some of the Westerways merchandise comes from other countries. Joy Valenti has been travelling
overseas to buy directly from suppliers. It was found that the Lusitania wholesaler-importers did not carry
the range of lines that the business needed, particularly for the gift shop. For importing, they obtained
the advice of the corporate financial advice specialist in their accounting firm, Alina Lee, and to protect
themselves against currency fluctuations, they work closely with their bank and hedge against risks.
A periodic activity is the receipt of merchandise at the delivery bay. The Supervisor or Deputy usually
take it, though all the staff are trained to receive goods. They check the merchandise in and use a trolley to
move it to the store or directly to the shelves. The packaging is discarded in bins behind the store. All of
Westerways’ inventory is delivered by van, brought from the docks at Ventura or directly from the supplier.
Selling activities occur almost entirely on the shop floor, though some sales are made online to known
credit customers.
Len was persuaded by Mark to have the company buy its premises rather than lease. Mark argued that
Drue Street had declined over the last few years and property values were low. If the new business was
successful, and its owners were determined that it should be, it would attract other businesses back to the
street and that would ‘push up’ values, which the business should benefit from rather than the business’s
landlord. Len was concerned that this increased the capital requirements and the gearing, but he accepted
Mark’s argument and so the management sought and found a suitable freehold building. There would be
rents from the rooms upstairs to help repay the mortgage. Also, the business could expand into this upper
floor if and when it needed to.
Len and the Valentis secured a loan on mortgage from the company’s bank for purchase of the store’s
land and building. The shareholders’ equity was therefore used to finance the balance of the premises, the
other non-current assets and the working capital. However, because the owners thought that the business
would be subject to some seasonal fluctuations, they also made a standing arrangement with the bank to
go into overdraft. As part of its loan contract and overdraft facility, the bank is given each year’s budget
and the audited financial statements.
The company then used its shareholders’ funds to install fixtures, shelving, etc., to buy office furniture,
a trolley for moving the inventory, and a small LAN-based accounting system. It invested further funds in
starting up the business, including purchase of inventory and paying the salaries of Mark and Joy.
Immediately after the purchase of the property, Westerways did some maintenance work on the upper
floor and advertised them on the basis of a one-year lease and subsequent yearly renewals. It let the rooms
at a monthly rent to two small businesses, which have remained there since commencement.
To start trading in Tannam, the company used its own accumulated funds. The directors decided not to
buy the premises in Stone Street because the Valentis were not happy with this property as a long-term
investment. They expected to move the store within the next year two years, when the company’s name
had become known, and buy a property in a neighbouring lower priced street, hoping again to contribute
to the growth of land values in that street and itself to benefit from this.
In addition to meeting its loan repayment conditions, the business has been able to pay cash dividends
in each of its years of operation and expects to do so again in the current year.
as a courtesy, as well as to discuss the progress of the business and its accounting system. She therefore
needs to do little more preparation before contacting the management to advise of the impending interim
audit. She scans the audit documentation to remind herself of any major points arising from the last audit.
She also examines the firm’s correspondence files for any matters relevant to this year’s audit. Then she
telephones the company to arrange the first audit planning visit, finds that Joy is away, and so arranges an
interview with Mark. On this occasion, her intended audit assistant, Bruce Banks, is available and so she
takes him with her for this visit. She had asked Mark on the telephone whether he minded if she brought
an audio tape recorder to record the conversation. He had no objection and she therefore recorded the
interview and later had a CLT typist transcribe the recording. This is attached as Appendix 3.
Before she went, she spoke to the engagement partner, Ray Campbell. He queried with Fiona what
Westerways’ Board of Directors was doing about its governance responsibilities. Fiona responded that
perhaps they should speak to Chairman Len Lewis about that. Ray agreed and so Fiona asked Ray’s
personal assistant to arrange an interview for the two of them with Len soon after her interview with
Mark. She asked the assistant to confirm with Len that she could bring a tape recorder and Len agreed.
The transcript of this interview is also attached, as the second part of Appendix 3.
estimate of the year’s income and expenditure figures, compare this with the budget figures (knowing that
these were likely to have been prepared a year or so earlier), and consult management on whether their
estimates seem to be a reasonable approximation of the year-end figures. They then estimate the closing
assets, liabilities and equity balances. This is done after consultation with management because the levels
of the current assets and liabilities will depend to an extent on management’s actions — for example, to
meet a cash dividend payment, management may decide to delay payment to its creditors in one or two
months, or it may decide to discount some inventory lines for cash sale to increase the company’s cash
balance.
The Campbell Lee Taylor Approach to Assessing Risk at the Assertion Level
Standard working paper PL-TCR-Exp-PrI gives the auditors’ assessment of the risks of material misstate-
ment for purchase invoices. In column 1, the auditors have listed, with bullet points, what they consider
to be the possible material misstatements for the assertions. In column 2, they have listed numerically the
internal controls they have identified (e.g. O1 is the first internal control for the occurrence assertion), and
in column 3, they have given their assessment. Then in form PL-TCT-Exp-PoI, they have given for each
assertion the suggested control tests, cross referencing these to the controls (e.g. OC1 is the control test
for control O1).
Inventory
Attending the Inventory Count
On 1 January, Fiona Kerr and her assistant, Bruce Banks, each attended one of the stock counts conducted
at the two Westerways stores. They had previously attended a meeting at the Arnton store to plan the
counts, this meeting being attended by the Valentis, the Supervisor at each store and the Administrator and
Assistant Administrator. The count procedures were the same as in previous years. The counters worked
from listings containing all lines of inventory expected to be in the store but not giving the numbers on
hand. Each of the counters was allocated a page of the listing and as they counted, they entered the number
on their listing; they also left a card on the shelf beside the items with the item code and the number of items
counted. As they completed each sheet they handed it in to the Administrator, who keyed the quantities into
the system and then printed a listing of lines with a difference between recorded and counted number. The
listings of differences were handed to the Supervisors who did recounts. At the end of the count, the team
toured the store to confirm that all inventory items in their shelves or bins had cards on them indicating
that they had been counted.
At the count, the auditors observed count procedures for two hours at each store and discussed with the
Supervisor the differences revealed by the listing. They also did some test counts, which they recorded in
their working papers for tracing to the final stock report when it was printed a few days later.
The auditors also tested purchases cutoff as follows. They examined the most recent transactions by
obtaining a computer listing of the last three working days’ inputs of packing slips to the computer system
and checking these to the filed packing slips, which had been signed and dated by the person receiving the
goods. They confirmed that these corresponded and that all receipts before the stock count had been input
before the inventory count listings were printed. They confirmed also by inquiry of the Supervisors and
the Administrator that there had been no recent transfers between stores, which could have resulted in a
cutoff error.
The shop was not open for business during the count so there did not seem to be a problem of sales
accounting cutoff. They were informed that inventory dispatches occur only when sales are recorded or
there are transfers between stores. They would later confirm, by examination of accounting records, that
the sales for 31 December were the last sales recorded in the general ledger.
Further Audit Testing of Inventory
After the count, apart from following through the tests performed at the count, the audit focus was on the
valuation of inventory. The auditors tested the unit costs by comparing recorded cost with recent supplier
invoices. They also considered whether any lines needed to be reduced from cost to net realisable value in
accordance with the accounting valuation rule. For this purpose, they were assisted by an Ourbiz system
report listing lines in descending order of stock turn and giving value held. They discussed their conclusions
with Mark and Joy Valenti. They then confirmed that the final inventory report totalled to the inventory
figure in the financial report.
Trade Payable
For trade payable, the auditors focused on the completeness assertion and particularly for purchases of
services. To confirm inclusion of all other purchases, they applied a number of standard audit techniques.
They examined all major payments between balance date and the completion of the audit field work and
confirmed that the related purchase had been accounted for in the correct financial year. They also sent a
request to the company’s solicitors requesting information on liabilities.
Some of the audit procedures for detection of omitted liabilities required the auditors to make good use
of their knowledge of the Westerways business. They read the minutes of Board of Directors meetings and
they reflected on business activities and events and considered how these might have affected the level of
liabilities at this balance date.
REPORTING RESPONSIBILITIES
Formulating and Issuing the Audit Opinion
Depending on the outcome of the discussion with Westerways executive directors about the matters of
concern found during the audit, the auditors may have to modify their opinion in their report to the
shareholders. Task 4.1 activities focus on these matters.
APPENDIX 1: MEMORANDUM
Then Len called in Mark and Joy, who had just arrived as planned, and after the introductions, when I
ascertained that they had met while studying in the same faculty, he in drama and she in art and design, he
left us and the interview went like this.
Ray: You know that Len Lewis has suggested that your proposed business, which I understand is to be a
limited company, employs our firm as its accountants and financial advisers. Also, Len tells me that you
understand something of what auditing is and that he wants the company to have an annual audit of its
financial report.
Mark: Yes, we do. I should ask what you’ll be charging us for the audit work, which does not seem to be
helpful to us, the company, though it may be to the bank! No, first I would like to know what your firm can
do for us. Would you tell us about the other services you provide?
Joy: And can you explain to us the assurance we, and Len, and the bank, get from having the company’s
annual financial statements audited?
So, I found myself telling the Valentis about us and our assurance services first! Then we got on to them.
Ray: Now, I understand that you wanted to start a business and that Len has agreed to go in with you, but why
hardware?
Joy: Of course, it is not going to be only hardware. We expect to get better margins on other things in the
shop. Novel kitchenware, gifts for use in the home, and so on.
Mark: My father worked in a hardware store when I was a kid. I was there often, watching and helping,
because my mum died young. So, I became quite knowledgeable on the merchandise, and on the customers
who bought it — I found their activities intriguing: the debates in the family group as to what to buy, the
apparent lack of recognition of benefits to offset costs, on the other hand the impulsive buying decisions
sometimes! Then dad died when I was only twelve and I lived with his sister — my aunt, and my uncle. My
uncle was a bit of a handyman and used to do things at home and I helped him. Aunt was also a good gardener.
So, there is a history there, even though I have never myself worked in a hardware shop. But I’ve worked in a
variety of Mr Lewis’s businesses since leaving university and I have a good understanding of how to make a
business successful.
Joy: My dad and mum had a grocery shop in a village near here, though the shop used to sell whatever people
seemed to want. Unfortunately, they lost their money and had to sell the shop. I worked in it out of school
till I was seventeen. Then I won a scholarship and did a degree course in art and design. I want to use that
knowledge in business, trading in things I am able to select. I want also to work with some of the suppliers on
their designs. As I said, we have investigated and think that if we can find the right things for our customers,
and adapt as fashions change, and even contribute to fashion changes, we’ll be able to do well with them.
And we hope that our giftware will pull more people into our shop to buy hardware. With good merchandise,
margins of 100 to 200% should be obtainable. Hardware sells steadily, but the margins of most items are lower
than that, and the return per square metre of floor space in hardware is probably a bit lower.
Ray: You both seem to understand retail. What is your experience of business management and finance? I
understand that you want to buy the freehold of your first store, which will mean more funding. That must
mean that you have a business plan. You have put it through Len I suppose?
Joy: As to business experience, we employed a few casual staff in our shop and in the last couple of years
they were my responsibility. I’ve suffered the pain of trying to run a family business without enough capital,
because it was like that in the last year or so! The staff got paid but the creditors often had to be stalled and
weren’t happy!
Mark: I’ve been in management positions under Mr Lewis. In the last job, I was responsible for the financial
management of a subsidiary company — that is, making sure we collected the money from the debtors to buy
the inventory and pay the bills and taxation and the annual dividends to the holding company. That is not the
sort of thing I want to do as a job for life, but I now have some useful experience in it and as soon as we
can we will delegate the details. Yes, we do have a business plan and we have discussed it at length with
Mr Lewis.
Ray: Good. My corporate planning partner might be able to work with you to improve your business plan.
And what are your medium to long term ambitions?
Mark: First things first. We know our town. There are other towns like it nearby. We’re not so knowledgeable
about the big city, Ventura. If this business is successful, we think we’ll be able to open another in Laventa,
which is as you know about half an hour’s drive away. Then maybe into the suburbs of Ventura, or another
provincial town first, for example Tannam. There are other businesses that fit in with ours. We might be able to
diversify. But the main business will remain the hardware and gifts mix, unless that ‘runs out of steam’. There
is always the possibility that one of the Ventura city-based big groups will copy us and undercut us through
their buying power. At least then we’d have had useful experience in retail, so we’d change to another type of
retail, or to something else. Joy has an ambition to be in design. Of course, the buying of the property that you
mentioned is a backup as you might say. If the shop is half successful, even for a few years, the property values
in Drue Street will go up and we’ll have more to sell if we leave the industry.
Joy: How does that sound? What advice will your firm be able to give us over the next few years? Do you
follow the retail industry to help your retail clients?
I then had to expand on the services we provide to our clients, conscious that we are not as good as we
should be in the provision of services in retail.
This seems likely to be a satisfactory business and may grow to be a very good one. On the professional
independence issue for auditing, the total fee from this company will be a fraction of our practice’s income,
less than 1%. This work for Len Lewis with our other work for him will bring our dependence on his
business to about 8% of our income. While at first, we’ll be performing other services for this company,
those will soon cut back to annual compliance work. We may still get the occasional financial planning or
systems advice job, and perhaps some tax return work for the owners. I can’t see that that will threaten our
audit independence or the appearance of independence.
I think we should accept the invitation. The engagement risk to our firm seems low. I have provisionally
arranged to see the three of them here sometime next Tuesday, 19th. Does 12 noon suit? We could talk for
an hour or so and then take them to lunch, finishing at say, 2.30. Please let me know by Friday 15th, 4 pm,
and I’ll confirm with them.
Consignment Trading
Westerways does not, we have been told, take inventory on consignment, for payment to the supplier only
after sale. We need to confirm each year that this remains true.
Staffing
There are now five full time staff, a Supervisor and a Deputy Supervisor (who work different shifts) in
each store, and an Administrator in the Arnton store, but the Valentis are able to employ casuals who are
known to them or recommended, and they have a good record of getting and keeping staff. A problem is
that staff must have knowledge of the products and must be able to give advice to customers on how to use
them. They must, if they are to work in the gift shop, also know how to talk to customers about uses and
potential recipients of gifts.
The Valentis have quite an effective on-the-job training scheme for staff who are learning. In the quiet
times, an experienced staff member selects a product range, for example paints, asks the learner to explain
what he/she understands, then ‘role plays’ a difficult customer. This provides many laughs! Mark himself
is good at role-playing customers and creating a light-hearted atmosphere for the sales staff to throw off
their inhibitions and role play! Talking to the customers about the giftware seems to be found easier by the
staff, because they are themselves intrigued by Joy’s range of goods.
It should be commented that as agreed by the board in 20X6, the Valentis are paid salaries as managers
and they do not earn anything more based on performance other than the annual dividends. Len Lewis is
paid a director’s fee. The Secretary of the Company is by arrangement with Len Lewis the Secretary of
one of his companies, who is charged to Westerways Pty Ltd at a rate per hour.
Fiona Kerr
7 October 20X8
Mark: Hello again, Fiona. I had heard that companies like us tend to get a change of audit staff every year and
here you are again.
Fiona: Yes, Mark. It is the policy of Campbell Lee Taylor to try to keep audit staff on a job for at least
two years. In this case, I would have complained if I had not come here this year because I like visiting
Westerways.
Mark: Good. We aim to please. Now, is that the tape recorder you said on the phone you wanted to use on
me? OK. As long as I am not aware of it, I’ll be happy to oblige.
Fiona: I thought you had been an actor, Mark, and presumed that being recorded would be second nature
to you!
Mark: Ah, the movies. No, I was only on the stage.
Fiona: OK. Mark, this is Bruce Banks, who is on our Westerways audit team this year.
Mark: Pleased to meet you, Bruce. Are you a new chum in the CLT office, or have you transferred from
another division?
Bruce: Pleased to meet you too, Mark. And, no I am not a transferee but quite new at CLT. I came out of
university last year and have been on a few audits and done some systems work also. I graduated with a double
degree in accounting and information systems.
Mark: Well now, you’ll find we aren’t very sophisticated with our systems here, but they are reliable enough
and give us most of the information we want to run the business, and of course they give you annual reports to
audit. Now, what can I do for you both.
Fiona: Thanks for making the time for us, Mark. First, please, the progress of the business this year and your
thoughts on the near future.
Mark: This has been a steady year, with the retail market in Lusitania in quite good shape, and most of the
business’s merchandise has sold reasonably well. There are concerns that next year may not be so good,
because the government is likely to raise interest rates to meet economic requirements. Anyway, we were a
little stretched when we expanded rapidly and opened the second store after only eighteen months. But we are
over that now and are in a steady growth phase again — that is, as business expands, we take on new staff and
we expand the range of merchandise.
Fiona: What areas in particular have changed since we were last at Westerways in January. We understand you
now have a van. What are you particularly using it for now?
Mark: There had been an increasing demand from customers for delivery to their homes. There is also more
need for travel between the two stores for the transfer of merchandise. We decided quite suddenly that we
needed to buy a van and that we could afford it. We spoke to Len and he agreed and so we didn’t wait till the
next board meeting for approval. We recognised that this would mean an increase in overhead expenses but
hope that two benefits will be earned in due course: first, increased sales and second, ability to move inventory
economically between stores to meet demand, again leading to increased sales. We are now delivering free
of charge to customers who request it and who have made purchases to a value exceeding $300. Actually,
we have sometimes on request delivered free to smaller customers when the van is available — that is, to
customers who seem likely to become bigger for us. As a matter of fact, we are going to decide on a delivery
charge policy at the next board meeting. We have great hopes for the future with it. I should say that we have
been fortunate for a driver. Our Administrator Jill’s father is a retired truck driver and he has been happy to
work whenever we want him to. Occasionally, one of our sales staff makes a delivery, too.
Fiona: Any other significant changes?
Mark: Well, we are beginning to earn some good purchase quantity discount refunds. A key to success with
a small business, of course, is getting suppliers to provide purchase discounts, and to win these discounts the
business has to buy more from them — not necessarily more of particular products, but more in total value.
That means that small businesses like ours do better with the large suppliers with the wider range of products.
We are now entering into supply agreements with some of them, under which they calculate what we have
bought from them each month and on a cumulative basis, in accordance with a formula, and pay us a discount
in the form of a refund.
Fiona: And do you check the completeness and accuracy of the refunds?
Mark: Oh, I don’t know. I presume so. You’ll have to speak to Jill Johnson about that.
Fiona: Two auditing issues arise here, I think, Mark. Whether all refunds are brought to account, and whether
to use the cash or accrual basis for bringing them to account.
Mark: Yes, I see, but as to the cash or accrual basis, it’s not going to make any difference over a period of a
year, is it? You’ll get twelve refunds into a year if you use either the cash or accrual basis.
Fiona: Yes, but it will be more accurate to use the accrual basis. I’ll investigate the amounts involved and then
discuss it with Ray Campbell. We are about to start analysing your data for the nine months till the end of
September. Is there anything else you can predict we are going to find that we’ll be back asking you about?
Mark: You’ll find a further increase in the gross profit percentage, resulting from both a change in sales mix
and the purchase discount refunds from more suppliers. You’ll find also a continuing increase in labour cost
as a percentage of sales, and an increase in travel costs because of Joy’s trips to find good merchandise, and of
course the running costs of the van. I recall that for audit planning you use just nine months total data, actuals
and budget figures, don’t you. You realise that we have more detailed information than that? For example, our
accounting system gives us gross profit by inventory line, as we define it. And lots of other analyses. We get it
all on reports at month ends.
Fiona: Yes, we use those later in our audit. We think it useful to do our own analyses with Excel, in the early
planning stage. We look at your detailed reports when performing our substantive procedures. We’ve been
thinking of arranging to download more details for processing on our laptops, but we have not considered it
necessary so far. Mark, you took delivery of the van and began using it on 1st April, we understand. And your
depreciation rate for it is 20% per annum, straight line basis, the same as the other equipment?
Mark: Yes, I think that’s right. Jill will prove it for you.
Fiona: Well, thanks for that, Mark. Now, we are going to speak to Len Lewis, your Chairman, to get his views
on governance of Westerways. We thought we had better let you know, in case you misunderstood our motives.
Mark: Governance? The current fad, overseas as well as here, Joy tells me. But it is our function as well as
Len’s isn’t it?
Fiona: Yes, that is true. Good corporate governance is achieved when there is good management and when
there is good input by the independent, non-executive, members of the board to ensure that there is good
management by the senior management team and then to monitor the activities of the team to ensure that the
management remains good. This is done on behalf of the shareholders and the community. We think we know
the main things that you and Joy do. In the case of Westerways, a small family company, there is only one
non-executive director and he represents himself and the other outside shareholders and the community in
so far as it needs a representative on your board. We see our audit role as being to obtain confirmation that
your non-executive directors know their responsibilities here. And of course, for us as auditors, there is a
requirement that those responsible for governance satisfy themselves that we are independent and able to do
our job for the shareholders.
Mark: Yes, I see. You’ll be phoning his office, I suppose? He won’t be here again till the next board meeting.
Fiona: Well, thanks again, Mark. Bruce will be doing most of the audit testing, and so you’ll be seeing him
around for the next few days.
Mark: Good. OK, Bruce, if you have any questions, don’t hesitate to come and see me. Joy will be away for a
couple of days, but if you’re still with us, you’ll see her too.
2. Transcript of meeting with Len Lewis at his corporate head office on 9 am 6th October 20X9
Len: Hello again, Ray. It does not seem long since we last spoke.
Ray: No, indeed, Ray. Just last Friday. We were able to resolve that problem for you, weren’t we. Now, this
one is of a quite different nature. Have you met, Fiona Kerr? Fiona is one of our rising senior staff and we
hope she will stay with us a long time.
Len: Nice to meet you, Fiona. But I think I have seen you before somewhere.
Fiona: Well, I am flattered that you remember me, Mr Lewis. I was briefly at your Head Office last year when
you spoke a few words to my then manager before you had to rush off to a meeting.
Len: ‘Len’, please – not too much formality here. Good. I hope you do a quick and efficient job for us, to keep
Ray’s fees down! Now, it was about governance you wanted to speak to me I believe.
Ray: Yes. That is correct. About governance of Westerways Pty Ltd in particular. You appreciate that
directors, or at least non-executive directors, are required to wear two hats now, to represent the shareholders
and the community as well as to debate and resolve high level company business questions.
Len: Yes, I have had blurb about that from the Stock Exchange and the regulatory authorities. I already do as
a matter of common sense what they are saying I should be doing. In the case of Westerways, as you know,
I agreed to go into the business with Mark and Joy on condition that it was a limited company and that its
financial report was audited. This was doubly important from my point of view, that I persuaded two friends
to buy shares, on the grounds that it would be a good investment, and I have an obligation to look after them.
Now, you want to know what I do to meet my governance responsibilities, do you?
Ray: Yes, Len, that is exactly it.
Len: OK. I am aware that in a business like this, run by owner managers, there are certain risks that other
investors take. They include incompetence or negligence by the management, of course, but I never expected
those problems with the Valentis. There remain the problems that they might not manage well enough, not use
good management principles, or that they might perpetrate a fraud by either stealing to enrich themselves at
the expense of the other shareholders, most likely by not putting sales through the till, or by inflating profit,
to make the business a better sale prospect, by putting extra cash through the till or manipulating cutoff, or
overstating inventory, or something like that.
So, I cover my responsibilities in two ways. First, in board meetings, I make sure that they are using good
management principles, taking into account the size of the business. With Joy and Mark, competence and
enthusiasm were never going to be a problem, nor of course interpersonal relations, with staff and customers.
Also, they had both managed before. The difficulty they would face, as I saw it, was how they responded to
growth of the business, how they would delegate and manage others doing the work that they could do well
themselves. So, I talk regularly to them about that, and make suggestions from my experience. As you well
know, the business is growing quite rapidly. They are very receptive.
On the matter of potential fraud, I do my best to monitor the results, to establish that the results have
substance. Before each board meeting, after looking at the financial performance reports, I make a point of
visiting each store and poking around, watching procedures, inspecting the inventory, asking the Supervisors
questions, having a chat with the Administrators, and so on. Then I quiz Mark and Joy before the formal
meeting. Beyond that, I rely on you, the auditors. Is that what you wanted to know? What else do you think
I should do?
Ray: That sounds to me like the actions of a conscientious director, Len. On the matter of our audit
responsibilities, we focus, of course, on finding material misstatements in the annual financial report. To do
that, we first assess the business risks, and from that the risks of material misstatement. It might be useful if we
gave you a summary of our assessment and asked for your comments.
Len: That would be interesting.
Fiona: I have that here. (Puts it on the table)
Len: (Reading it and commenting). Yes, I don’t disagree with that. You are able to obtain adequate evidence to
support all items in the financial statements I take it?
Fiona: Yes, we are. Not to prove to the last dollar, but to give us reasonable assurance that there are no
material misstatements.
Ray: Well, there was something else I wanted to talk to you about, Len, on another company. And I think we
should now let Fiona go, to continue her efficient audit of Westerways and keep your fee down!
Len: Good. Nice meeting you Fiona. (Fiona says goodbye and leaves.)
Notional
year ending Year ending Year ending 9 months ending
31/12/20X9 31/12/20X8 31/12/20X7 31/12/20X6
$ $ $ $
TRADING REVENUE
Sales — cash 1 852 860 1 326 224 696 022 486 090
Sales — credit 17 333 132 202 74 400 2300
Total sales 2 029 193 1 458 426 770 422 488 390
Opening inventory 225 650 137 300 86 500 0
Purchases 1 207 420 936 748 510 455 431 390
Closing inventory (295 000) (225 650) (137 300) (139 500)
Cost of Goods Sold 1 138 070 848 398 459 655 291 890
GROSS PROFIT 891 123 610 028 310 767 196 500
Rates and water rates 2853 2840 2764 2240
Wages, salaries and
on-costs 506 413 343 393 159 084 96 668
Power 45 077 32 700 17 624 11 500
Depreciation of non-current
assets 21 981 16 255 10 173 7479
Profit(Loss) on sale of
non-current assets (300)
Stationery and supplies 9892 7012 3560 2560
Interest 14 980 15 505 16 700 11 730
Advertising and promotion 5833 3800 2100 2800
Travel and vehicle
expenses 9963 5830 2800 1730
Rent paid Tannam store 56 000 52 000 12 000 0
Other administrative
expenses 5794 5360 3240 4600
Total expenditure 678 786 484 695 229 745 141 307
NET PROFIT FROM TRADING 212 337 125 333 81 022 55 193
OTHER REVENUE
Rent 8200 8200 8200 7200
Payment discounts
received 680 585 340 0
Total other revenue 8880 8785 8540 7200
NET PROFIT BEFORE TAX 221 217 134 118 89 562 62 393
Company tax 66 365 40 235 26 869 18 718
Notional
year ending Year ending Year ending 9 months ending
31/12/20X9 31/12/20X8 31/12/20X7 31/12/20X6
$ $ $ $
Current assets
Inventory 295 000 225 650 137 300 139 500
Trade debtors 17 600 15 100 7634 254
Prepayments 4080 2 220 2160 1744
Cash and deposits 81 033 44 630 48 802 38 378
397 713 287 600 195 896 179 876
Non-current assets
Land at cost 196 000 196 000 196 000 196 000
Buildings at cost 100 000 100 000 100 000 100 000
Less: Accumulated
depreciation (15 000) (11 000) (7000) (3000)
Store fixtures and furniture 49 700 49 700 34 900 16 480
Less: Accumulated
depreciation (12 915) (7945) (3345) (1236)
Equipment 22 400 12 920 12 920 6120
Less: Accumulated
depreciation (1120) (5066) (2482) (918)
Delivery van 32 540
Less: Accumulated
depreciation (4881)
operator rights. Only Joy Valenti has system administrator access rights but she does not use this user ID,
instead calling in the consultant from the system supplier when needed. We understand that while Joy
knows of the system log (which, for example, records failed access attempts as well as uses of each of the
applications), she does not consider it necessary to formally review the log at regular intervals.
customer keys in his/her PIN and one copy of a docket is given to the customer and the other put in the
till. For credit card sales, the customer signs one copy of the docket, which is put in the till, and is given
another copy. Sometimes, debit card customers ask for cash and, subject to the customer buying goods
worth more than $20, they are allowed this facility, to a limit normally of $100.
Selling prices are on labels on the shelves or other locations, and are stored in the system. Most items
have a bar code on them and this is read by the terminal’s scanner. If there is not a barcode, the operator
refers to the appropriate supplier catalogue for the item code and keys that in. Some catalogues contain
bar codes for products and these can be read by the scanner. The reading of the bar code causes the system
to read the selling price from the inventory system and display it.
Selling prices are keyed into the system when the line is first received and after that they may be modified
(i.e. to discount the item for quick sale) by Mark or Joy, or by the Supervisor on specific authority from
one of them. For these and other standing data changes, the system prints a log report at end of day and this
is scanned by the Administrator, who brings to the attention of Mark or Joy changes which she considers
of interest to them. Then she files the report; it is available for review by Mark or Joy.
Staff are allowed a 20% discount on the selling price of all merchandise. This is both to give them some
additional benefit for working for the company but also to discourage shoplifting or other irregularities
such as deliberately damaging merchandise to reduce its value and buy it at a reduced price.
Delivery Sales
Since buying the van, Westerways has been in a position to deliver to customers. It expects the merchandise
to have been purchased beforehand, on either a cash or a credit sale. It has taken a few phone orders from
well-known customers, payment or charge on delivery and delivery charge free, but have yet to determine
their company policy on this.
Credit Sales
Westerways does have a few regular customers with credit accounts. Some of these customers cause
concern when they pay late, but the Valentis believe that they have to accept this because they expect
them to give an increasing proportion of turnover in the years to come. They have not been given credit
limits, even though the system allows checking for credit availability. The operator asks for identification
(e.g. driving licence, buying company’s authority) and on input the sales terminal generates the invoice
and charges the debtor’s account. Where the account is a business account, the operator asks for an order
number and keys this in.
Receipts from Debtors
Receipts from debtors may be by cash or credit card at the counter, or by cheque received in the mail, in
which case whoever opens the mail (the Administrator, Assistant Administrator, Mark or Joy) brings them
out to the till and watches while they are put through by the cashier. Westerways do offer an early payment
discount, of 3% if paid within one week of sale.
Sales Returns by Customers
Occasionally a customer wants to return something to the store. Only the Supervisors and the Valentis have
the authority to approve a return and they key in their password to allow the till operator to process the
transaction. They first ascertain the type of sale. If the sale had been for cash, a cash sales return docket is
printed by the register and put into the till and the customer is given a refund with a copy of the docket. If
the sale had been a credit sale, a credit note is generated by the system and given to the customer, with a
copy being put in the till. In each case, the authoriser signs the docket in the till. The system prints daily a
listing of all cash sale returns and credit sale return notes, which the Administrator inspects and files. On
a discretionary basis, Joy examines this file.
In accounting for returns, the system automatically accepts the item back into inventory, using the cost
per item on hand. The Supervisor or Mark or Joy then decides whether to put the item back on the shelf or
to return it to the supplier for a credit, in which case they put through a transaction as shown under returns
to suppliers (see below).
Till Controls
The till controls separate recording from custodianship of cash through the log of cash movements written
by the terminal to the system. Also, terminal operators are individually responsible in that they log into a
till machine with their own user ID and password and they remain the only user until clearance. One of
the terminals may be closed down temporarily and then restarted by the same operator.
At the close off for banking, the Supervisor clears the till with the operator. The system display is agreed
to the cash and dockets in the till. If there is a difference between amount recorded for sales and the increase
in amount in the till (including cash and dockets), the person doing the reconciliation counts a second time.
If the difference remains, he or she keys in the actual amounts and the system then prints a revised bank
deposit slip and also reports the difference on the back-office printer, for subsequent examination and
inquiry by the Administrator. The system keeps a running total of differences.
Then the Supervisor prints the close report, signs it and puts it in the box for the Administrator. The
Supervisor, who has the combination for the safe, puts the cash (including separately the $300 till float)
and card dockets in the safe. The tills are left open at night so that anyone breaking into the store would
see that they are empty and probably then not damage them.
The takings are collected for banking by two GardYou Ltd security company officers each morning.
The takings are formally handed over by the Supervisor. One later returns with the stamped bank deposit
slip, which he leaves in the box for the Administrator. Later, the stamped deposit slips are matched to the
system’s cash report and filed together by the Administrator.
Trade Debtors
An end-of-month job prints an aged listing; the total is agreed by the Administrator to the general ledger
control account. She then passes the listing to Mark, who scrutinises it for slow payers and telephones
them if he considers it necessary.
We have ascertained that on request the system will print letters to debtors whose accounts are overdue,
but the Valentis have chosen not to use this facility, preferring to use the friendly approach of telephoning
any slow paying debtors.
In the event that a debt has to be written off, this is input to the sales system, which updates the trade
debtors file and writes a debt write-off transaction for the general ledger.
later inputs the receipt to the system. The system updates the inventory records, for cost using the purchase
order price, and creates a suspense liability.
Recording the Liability
The invoice may be handed over with the merchandise or sent later by mail. When it arrives, the
Administrator matches it to the purchase order copy and packing slip and keys the invoice, including
its payment date, into the system, which replaces the suspense liability with a liability.
Returns
Sometimes inventory has to be returned to suppliers, for example when the item is found to be faulty or
not in accordance with the order. The Supervisor is advised, she raises a return note in duplicate, writing
the reason on it, places one copy on the goods awaiting the next van from the supplier, and passes the
other copy to the Administrator. She raises a supplier debit note, attaches the return note to it, has it signed
for approval by one of the Valentis, keys it in to the system, and puts the two documents in a temporary
file. The supplier sends its credit note and when it arrives the Administrator pulls the note and debit from
the file, attaches the supplier’s note to them, and files them. We have been told that there have never been
rejections by suppliers of these requests.
Other Purchases
For items that are not ordered, such as power and telephone, and for the occasional verbally ordered service,
such as an electrical repair, Mark or Joy check the amount for reasonableness and write ‘pay’ and sign the
invoice before input by the Administrator. The same happens for purchases of non-current assets.
Payments
At the end of each week, the Administrator does a payment run. The system finds the due invoices in the
trade payable file, sorts them by supplier, and prints a payments’ report and remittance advices. Mark or
Joy scrutinises the payments’ report, on a discretionary basis asks to see an invoice and any supporting
documentation before approving the payments. Payments are then made by direct debit to the supplier.
The system itself handles automatic direct debit payments, such as the monthly rental liability, by
printing the remittance advice and activating the direct debit. All expenses are input to and paid by the
system — that is, there is no alternative ‘manual payment’ system. The system also credits the bank and
debits the loan account with the monthly repayments.
There are controls against duplicated payment (which is most likely when a supplier not receiving its
payment when expected sends a second copy of the invoice not marked ‘copy’. This cannot happen for
Westerways with purchases of inventory because of the need to match the invoice with a packing slip. For
most other payments it is also unlikely because of the need to match the invoice with a purchase order.
However, where the item is not purchased with a purchase order, it could happen. The Ourbiz trade payable
system reports any possibly duplicated inputs in accordance with criteria including same amount and
same date.
Inventory
The inventory is held ‘on the shop floor’ and in a store at the back and there is no formal procedure for
transferring them from the store to the shelves or bins. All inventory in the stores is recorded in the Ourbiz
system. We understand that there are no consignment arrangements and all inventory held should be owned
by Westerways.
At six monthly intervals (before opening for business on 1 July and 1 January), there are stock counts
at both stores, these being conducted by some of the staff supervised by the Supervisors, with Mark at
one store and Joy at the other, and the Administrators operating the computer systems. The counters work
from an Ourbiz system report that lists lines that should be on hand but gives no quantities. Westerways’s
counting procedures include: the holding of a count planning meeting beforehand; at the count, the
writing of the quantity on the listing and also on a card which is placed on the inventory (to show that
it has been counted), progressive input of count data to the Ourbiz system and printing of listings of
differences for immediate investigation; and subsequent accounting for cards together with scrutinising
of all areas to confirm complete coverage. To confirm that there has been no mistake in purchases cutoff,
the Administrator ensures that the last delivery before the count has been recorded and that if a delivery
is made during the count it is held at the loading dock until completion of the count and is then recorded
as a liability and a receipt of inventory; she writes comments about delivery and processing dates on the
packing slip and order copy. To confirm no mistake in sales cutoff, the shop is not open during the count
and no sales are recorded or deliveries made till it opens.
Office Letting
The rooms above the Arnton store were let on the basis of a monthly rent. This is transmitted by the tenants
directly to the Westerways bank account. As stated above, the bank reconciliation process includes input
of the rent received as shown in the bank statement.
Financial Management
The Valentis apparently use the system to manage the business in the following ways.
• Monitoring the data processing through the accounting system. Since Joy Valenti acted as the Adminis-
trator in the early months of the business, and was trained for this purpose by CLT ICT division staff, she
is aware of the necessary checks and reviews, including for example the daily cash sales and receipts
put through the tills and banked to sales and receipts recorded in the system, and the monthly bank
reconciliation statement to the bank balance and the recorded account balance.
• Setting what they consider to be maximum attainable mark-ups on the merchandise by inputting the
sales prices and reducing these when they consider it necessary for quick sale.
• Monitoring the levels of the current assets and liabilities. Of these, they know the balance at bank level
every night, and the accounting record figures for this and for trade debtors, payable and inventory by
inquiry on the system and in report form at the end of each month.
• Monitoring merchandise age through stock turnover calculations by type calculations performed by the
system.
• Monitoring performance against budget using the quarterly budget data.
The Board of Directors, comprising Mark, Joy and Len Lewis, meets quarterly, when it considers a
number of financial reports as summarised above.
Fiona Kerr
20 October 20X9
[!b] PL1-RMR:1
Client Westerways Pty Ltd
Risk of material misstatement and audit responses (Summary of audit risk assessment process and
conclusions)
FACTOR COMMENTS
Process in assessment Process was:
of risk of material • Toured Arnton store and interviewed Mark Valenti about business performance this
misstatement through year. Later toured Tannam store.
fraud or error • Performed planning analytical review procedures.
• Performed assessments of risk at the financial report level and the assertion level.
• With partner, Ray Campbell, interviewed Chairman, Len Lewis, about his governance
beliefs and procedures; discussed with him our assessments of risk and he agreed
with them.
• Updated our notes on the company’s systems and in the course of planning our
tests confirmed that our revised notes are accurate.
Audit team meeting Held team meeting in CLT office after the above work and discussed our preliminary
held to discuss risk of assessments of risk. Those present were the engagement partner, Ray Campbell, and
material misstatement all staff who would be working on the job: Senior, Fiona Kerr, and Assistants, Bruce
Banks and Gavin Lee.
All staff understood and agreed with the assessment of risks. We identified not
risks that might be regarded as significant and under Auditing Standards requiring
immediate reporting to management.
Revision of risk <This section will include a summary of any revisions to the initial risk assessments
assessments and comment on how the audit testing strategy was revised as a result of the
revisions.>
Summary of final audit Audit strategy is to rely on substantive procedures, including analytical review and
strategy tests of details of transactions and balances. There was considered to be no difficulty
in achieving the required audit evidence through substantive procedures alone — that
is, there were no areas requiring us to rely on, and therefore test, internal controls.
F Kerr
12/10/X9
Fiona Kerr
PL1-RMR: 2
Minutes of the meeting of the audit team to discuss the audit of the financial report of Westerways
Pty Ltd, held in the board room at Campbell Lee Taylor, High Street, Arnton, at 9 am on 12 October
20X9
Present: Ray Campbell Engagement Partner (Chairman)
Fiona Kerr Senior in charge
Bruce Banks Principal Assistant
Gavin Lee Junior Assistant
4. Conclusions
The recommendations above were accepted by the engagement partner, Ray Campbell.
5. Next meeting
There would be a second planning meeting only if it is found necessary to make significant changes to
the audit strategy.
6. Close
The meeting was closed at 9.30 am.
INVENTORY
TRADE PAYABLE
TRADING REVENUE
Sales — cash 1 855 270 1 326 224
Sales — credit 199 240 132 202
2 054 510 1 458 426
Opening inventory 225 650 137 300
Purchases 1 260 508 936 748
Closing inventory (299 650) (225 650)
Cost of goods sold 1 186 508 848 398
GROSS PROFIT 868 002 610 028
Rates and water rates 3 218 2 840
Wages, salaries and on-costs 486 200 343 393
Power 45 212 32 700
Depreciation of non-current assets 21 981 16 255
Stationery and supplies 7 880 7 012
Interest on loans 12 880 15 505
Advertising and promotion 6 128 3 800
Travel and vehicle expenses 10 180 5 830
Rent on Tannam store 54 000 52 000
Other administrative expenses 5 612 5 360
Total Expenditure 653 291 484 695
NET PROFIT FROM TRADING 214 711 125 333
OTHER REVENUE
Rent 8 200 8 200
Payment discounts received 745 585
TOTAL OTHER REVENUE 8 945 8 785
NET PROFIT BEFORE TAX 223 656 134 118
Safeguards
Evidence provided
Safeguards
Evidence provided
Safeguards
Evidence provided
Safeguards
Evidence provided
• structure
• financing
Implications for the current year’s audit <include here comment on the risk of material
misstatements at the financial report level>
Implications for the audit <this section must include comment on the implications
for the current audit and where appropriate (e.g. where
the client seems likely to experience increasing liquidity
problems) on future audits>
Current liabilities
Current liabilities
Shareholders’ equity
Efficiency
Debtors turnover Credit sales
Average debtors*
Average inventory*
Total assets
Profitability
Net profit margin Operating profit
before tax
Sales
Sales
Total assets
Sales
FACTOR COMMENTS
Discussion of source of <justify data used in calculations>
data
Operating profit base <calculate 5% and 10% of estimated before tax profit
method for the year under audit and discuss judgment of place
within range>
Judgment from profit base method $
Blended method 0.5% of total assets ($ )
0.5% of total revenue ($ + $ )
5% of net profit before tax ($ )
2% of gross profit after depreciation ($ – $ )
1% of equity ($ )
Total
Average /5
Judgment from blended method $
Planning materiality <explain decision on figure derived from the above> $
conclusion
Allocation of planning <comment on reasons for allocation of preliminary
materiality to materiality to components>
components
• discussion
• allocation Revenue/trade debtors
Expenditure/trade payable
Cost of sales/inventory
Non-current assets (tangible)
Non-current assets (intangible)
Cash/deposits etc.
TOTAL $
Prepared by/Date Signature Reviewed by/Date Signature
INVENTORY
Existence
Existence Tests of cutoff Satisfactory
Rights & Obligations
Completeness
Accuracy, valuation & allocation
Accuracy, valuation & allocation
Accuracy, valuation & allocation
Presentation
Expenditure TE-ATP-Exp
Client
Audit for the year
ending
Audit test programme
Audit Tests Risk assessment Sample size Working paper Done by
references (if applicable) references
TRADE PAYABLE
PL-ART -Exp-AcP
PL-ART -Exp-AcP
PL-ART -Exp-AcP
PL-ART -Exp-AcP
PL-ART -Exp-AcP
PL-ART -Exp-Inv
PL-ART -Exp-Inv
PL-ART -Exp-Inv
PL-ART -Exp-Inv
PL-ART -Exp-Inv
PL-ART -Exp-Inv
Prepared by/Date Signature Reviewed by/Date Signature
Finding number and summary a) Audit test(s) that detected b) Discussion of possible action
the finding by auditors
Question 1.2
The importance of a profession is evident in its attributes, which include, (1) a systematic body of
theory, (2) authority, (3) community sanction, (4) ethical codes and (5) culture. It is acknowledged that
non-professionals also possess these attributes to a lesser degree. Professional organisations differentiate
themselves by emphasising the community sanction that they strive so hard to achieve. Professionals would
also claim that they benefit society by their superior performance in fulfilling a highly competent and
sophisticated role.
The accounting professional bodies have implemented a built-in regulatory code to compel ethical
behaviour on the part of its members. The profession would see this regulatory code as a key way of
differentiating itself from other organisations. Through its ethical code, the profession’s commitment to
social welfare becomes a matter of public interest, thereby helping to ensure the continued confidence of
society. Self-regulatory codes are characteristic of all occupations. However, a professional code is more
explicit, systematic and binding: it possesses altruistic overtones and is more public service orientated.
The code also provides the principles of competence and due care, and guidelines where accountants and
auditors should avoid performing tasks that they are not competent in.
Brenda should be advised that the exercise of due care and diligence is part of the duty of auditors. Where
there are doubts relating to the tasks, she should raise it with her seniors and seek independent advice
if necessary. She should be advised that it is not uncommon for auditors to consult others. Section 113
of the International Code of Ethics for Professional Accountants (Including International Independence
Standards) (the Code) refers to the requirement to maintain adequate professional knowledge and technical
skills regarding professional competence.
Brenda should take responsibility for making sure that she has the skills necessary to carry out her work,
and consult with others and request the necessary training where there are gaps. I would discuss with her
the steps to complete the current audit, assisting her in establishing steps to complete the necessary audit
work and I would also supervise her closely to ensure that her work is monitored and she has the support
she needs in order to not be afraid to ask questions, seek advice from others and ask for training to fill her
knowledge and skills gaps.
Question 1.3
1. The fundamental principles of the International Code of Ethics for Professional Accountants (including
International Independence Standards) are:
111 Integrity — should be straightforward and honest in all professional and business relationships.
112 Objectivity — not allow prejudice or bias, conflict of interest or undue influence of others to override
professional or business judgements.
113 Professional Competence and Due Care — a continuing duty to maintain professional knowledge
and skill at the level required of the professional accountant and to act diligently and in accordance with
Pdf_Folio:421
2. The following table discusses whether the effect on professional ethics is a violation, and why.
Effect Rule Reason
1. Violation 113 An accountant should only undertake work that he or she can expect to
complete with professional competence.
2. Violation 114 Only when there is no consent from the client. If client’s consent is obtained, it
can be part of the professional clearance procedures.
3. Violation 115 Any commission must be disclosed. Solicitation of client should not normally
be allowed.
6. Not a violation - Commission should be disclosed. The client’s consent must be in writing and
the public accountant must take care to ensure that the advice is in the best
interests of the client.
7. Not a violation - Normal course of event allowed. Violation only if the loan is obtained using
favourable terms. (Note: The Corporations Act has a limit of $5000 on
non-housing loans)
8. Not a violation - An accountant has a legal right of lien, under certain conditions, over clients’
records in his custody in the event of non-payment of fees.
Question 1.4
Four factors that may indicate that additional client evaluation procedures are necessary when evaluating
the continuance of an audit client are as follows.
1. New legal, regulatory or professional requirements that alter reporting responsibilities and professional
risks.
2. A significant change in the nature, size or structure of a client’s business.
3. A significant change in a client’s management.
4. Particular audit findings for a client (e.g. become aware of a potential NOCLAR, committed by a client,
control weaknesses or proposed adjustments to financial statements).
Question 1.5
The following attributes should be included in the quality review program.
• Reviewers must be independent (e.g. selected from a different office).
• Reviewers must be senior and experienced auditors.
• Guidelines for the selection of partners and their engagements for review must be set out — for example,
a risk-based approach with a review at least every x years.
• The maximum period a partner can go without a review must be set out (e.g. two years).
• A strategy planning memorandum for the review must be approved by a senior partner.
• Documentation should be prepared detailing what action to take for unsatisfactory performance,
including follow-up reviews.
• Overseas reviewers should be involved (because of greater perceived independence).
• Training should be provided for reviewers.
• Criteria must be set out so that there is consistency in review ratings.
• A summary report should be prepared.
• Follow-up action should be taken on the summary report by senior partners.
• There should be written communication to senior partners about any more general problems found.
• When deficiencies are determined, training of audit staff should be provided to reinforce findings and
correct any problems.
• There should be a relationship between the outcome of the reviews and the reward systems.
Pdf_Folio:422
Question 1.8
Reasonable assurance provides comfort that the subject matter is not materially misstated. The level of
work performed by the auditor will ensure that the risk of giving an incorrect opinion (engagement risk)
is reduced to an acceptably low level. The level of work will include detailed substantive testing and
testing of internal controls where they are being relied upon to provide evidence. Audits provide reasonable
assurance.
Limited assurance gives a lower level of comfort than reasonable assurance. Procedures are generally
restricted to obtaining representations and carrying out analytical procedures, rather than detailed substan-
tive testing. A review of a financial report is an example of a limited assurance engagement.
Question 1.9
There are multiple reasons why absolute assurance cannot be provided by auditors. Some of them are as
follows.
• There are inherent limitations of an audit, which result in most of the audit evidence on which the auditor
draws conclusions and bases the auditor’s opinion being persuasive rather than conclusive.
• Inherent limitations of internal controls.
• The use of selective testing.
• The use of professional judgment in gathering and evaluating audit evidence (The Framework, para. 73).
Question 1.10
1. Board of directors and/or the CEO Investors, creditors, employees and various
regulatory bodies
3. Management of the company providing cloud-based Management of the customer and the auditor of the
accounting services financial statements of the customer
P df_Folio:423
Question 1.12
Audit firms can play an important role in cultivating a sceptical mindset in auditors by:
• developing policies that promote a culture of scepticism being considered ‘essential’
• providing ongoing training and mentoring to emphasise the importance of scepticism and develop
the trait
• developing policies that rewards or provides incentives for the demonstration of scepticism either
through performance evaluations or engagement reviews (IAASB 2015, para. 30).
Question 1.13
Auditors apply an attitude of professional scepticism by being alert to conditions, circumstances and
information that may indicate the existence of material misstatements in the financial statements and to
critically assess the audit evidence. The auditor accepts the information obtained unless contradictory
evidence is obtained. As such, auditors use professional scepticism to assess the validity and reliability of
audit evidence obtained, and be alert to any contradicting evidence.
Auditors apply professional judgment to reach appropriate decisions during the engagement. It is a skill
that auditors acquire over time by obtaining relevant training, skill and experience to gain competence
making reasonable judgments. Professional judgment is demonstrated by using knowledge gained from
training and experience to make informed decisions such as whether sufficient appropriate audit evidence
has been obtained, the nature, timing and extent of audit procedures, and determining the materiality and
audit risk levels.
Question 1.14
(a) IAASB defines professional scepticism as an attitude that includes a questioning mind, being alert to
conditions which may indicate possible misstatement due to error or fraud, and a critical assessment
of evidence. Professional scepticism requires an ongoing questioning of whether the information and
audit evidence obtained suggest that a material misstatement due to fraud may exist.
(b) Professional scepticism relates to the identification and assessment of risk, including issues such as
(1) management integrity in relation to governance and oversight and attitudes towards risk and (2) the
implementation and monitoring of internal controls to minimise risk, improve financial controls and
ensure compliance with relevant legislation.
Accordingly, the auditor needs to plan and execute the assurance engagement to include corroboration
of management assertions and responses to enquiries, and resolve any inconsistencies. For an audit of
financial statements, in the presence of inconsistencies or anomalies, professional scepticism requires the
auditor to obtain sufficient appropriate evidence in order to provide reasonable assurance that the financial
statements do not contain material misstatements due to fraud.
Question 1.15
The IAASB provides different standards for different types of engagements. There are specific standards
for assurance engagements other than the audit and review of financial information. An assurance
engagement on controls would fall in the other category. As a result, assurance engagements on an internal
control system and the financial statement audit would be considered separate engagements. However, it
should be noted that as part of the financial statement audit, ISA 315 (Revised) requires auditors to carry out
risk assessment procedures to obtain an understanding of the entity and its environment, and this includes
the entity’s control system. However, the auditor does not provide any assurance on the appropriateness
and performance of the internal controls.
Pdf_Folio:424
Review Audit
Opinion The opinion will state that nothing has The opinion will state that in all material respects
come to the practitioner’s attention to the subject matter complies with the criteria. This
suggest that the subject matter does not is positive form assurance which clearly states to
comply with the criteria. This is negative the users that the subject matter is free from
form assurance and gives a lower level material error.
of comfort to the user than an audit.
Procedures Evidence gathered is largely restricted The auditor will plan the nature, timing and extent
to obtaining representations from the of procedures to provide sufficient and appropriate
management team, or other responsible evidence to ensure that engagement risk is reduced
party and carrying out analytical to an acceptably low level. These procedures include:
procedures rather than detailed tests of (1) obtaining an understanding of the engagement,
control and substantive procedures. This (2) assessing risk, (3) responding to those assessed
level of work will reduce engagement risk, (4) performing procedures such as substantive
risk to a level that is appropriate to tests and where necessary tests of the effectiveness
the engagement. of internal controls and (5) evaluating the evidence.
Question 1.17
1. Preparation of a report giving This is a form of consultancy work providing recommendations and is
advice to a client on the therefore not an assurance engagement. No assurance is provided and no
introduction of a new system opinion given.
of internal controls.
2. A report giving an opinion This is an assertion-based compliance engagement (ASAE 3100). The report
on a school’s responses to a is providing information to the auditor-general indicating the extent to which
questionnaire required by the the organisation has complied with some regulatory requirements. It is likely
auditor-general. to be an audit rather than a review and therefore would require reasonable
assurance with a positive form opinion.
3. Preparation of the company’s This is a compilation of a return from information provided by the client. No
tax returns. assurance is provided and no opinion is given.
4. A report to management about It is likely that this will be a report of findings giving details of the extent to
the success of a marketing which revenue has increased after the marketing campaign. It is unlikely
campaign. that an opinion would be given about success unless success is very clearly
defined to ensure that it is an objective criterion against which to measure
actual performance. Therefore, this is likely to be agreed upon procedures
engagement on which no assurance or opinion would be provided.
P df_Folio:425
MODULE 2
Question 2.1
(a) A business has high volumes of low value revenue streams in multiple currencies. Inherent risk
(b) A business has limited segregation of duties in functional areas. Control risk
(c) The auditor of a business conducts inappropriate substantive testing. Detection risk
Question 2.2
(a) This is a situation where there is the possibility of earnings management using the capitalisation of
development costs to increase profits and therefore managerial bonuses. It is an ethical issue if the
auditor agrees with the ‘optimistic’ assessment of management without further verification work,
including assessing the reasonableness of the underlying management assumptions and estimates.
If the auditor agrees with the dubious numbers for fear of losing the client, it could be a self-
interest threat.
(b) The firm should consider the desirability of continued association with the client if there are doubts as
to the integrity of management.
Question 2.3
If management or those charged with governance impose a limitation on the scope of the auditor’s work
that will result in disclaiming an opinion (i.e. no opinion) on the financial statements, the auditor should
not accept such a limited engagement as an audit engagement unless required by law or regulation to do
so. See ISA 210, para 7.
Question 2.4
If inherent risk and control risk are high then the auditor must expect errors to occur (inherent risk) and
that those errors will not be detected by the internal control system (control risk). In order to ensure that
the overall audit risk comes to an acceptable level for the auditor the detection risk must be set low.
The audit risk model is a multiplication model so the two high values of inherent and control risk must
be multiplied by a low value of detection risk to get the overall result down to an acceptably low level.
In order for detection risk to be low the auditor must carry out extensive audit procedures. The more
and better quality the audit work done, the lower the detection risk. The auditor will not perform tests of
controls where control risk is high. High control risk indicates poor controls and therefore the auditor will
not seek to place any reliance upon them, and will move straight to substantive testing of transactions,
balances and disclosure.
Pdf_Folio:426
Question 2.6
1. If there was concern about management override of internal controls, all parts of the financial
statements could be susceptible to misstatement. Therefore, this risk is considered to be at the financial
statement level.
2. If there was a concern about the possibility of some of the high-tech inventory becoming obsolete, the
risk relates to the accuracy, valuation and allocation assertion. Therefore, this risk is at the assertion
level.
Question 2.7
1. Management has a poor reputation If management lacks integrity, it is more likely that they might
in the business community over the be prepared to produce materially misstated or misleading
integrity of recent decisions. financial statements.
2. Repairs and maintenance accounts Accounts that were misstated in previous audits are more likely
were misstated in previous audits. to contain similar misstatements in the current year.
3. Management lacks experience. Lack of experience and knowledge may affect preparation of
the financial statements. Further, if poor business decisions are
made, this is likely to result in pressure to manipulate the results.
4. The entity is facing a cash flow If the entity is experiencing cash flow problems and poor
problem. liquidity, there may be an incentive to make the financial position
look better.
5. The inventory consists of a range of Small, high-value products are more likely to be stolen than
expensive jewellery. bulky, low-value items.
6. Taxation calculations are extremely Transactions that are subject to difficult calculations or have
complex. complex accounting standard requirements, such as tax-effect
accounting, are more likely to have errors than simple repetitive
transactions.
7. The entity is a computer manufacturer. Some businesses are inherently risky because the nature of their
products may mean that they are subject to the inherent risk of
obsolescence due to improvements in technology.
8. Management’s rewards are heavily If there is a management compensation scheme that is tied
dependent on financial results. to earnings or share prices, there is a clear incentive for
management to misstate the result so that they can get a bonus.
Similarly, if management has substantial shareholdings in the
company, they have a vested interest in reporting a good result
as it will affect the dividends they receive and the value of their
shares. Pressure may also be placed on management by head
office, major investors or lenders to meet budgets, forecasts
or targets.
9. Provisions are a material liability. The more judgment involved in determining an account balance,
the greater the possibility of an error. Accounting estimates,
such as provision for long service leave or provision for warranty,
are more likely to be subject to manipulation than routine factual
data.
10. The company has built a number Decisions involving subjective judgments, such as whether to
of office blocks, which it retains as capitalise development expenditure or whether an entity has
investments. control of a subsidiary, also have a high inherent risk. Items
or events that require using the work of an expert, such as the
value of properties, are more susceptible to misstatement as it is
difficult for the non-expert to assess the true value.
(continued)
P df_Folio:427
12. The entity has just opened a major If the entity buys or sells goods in a foreign currency, inherent
retail outlet in the United States. risk will also increase as there is a risk of incurring foreign-
exchange losses due to changing exchange rates. If hedges are
taken out for those transactions, the hedging contracts may be
complex. The complexity of the recording of the transactions
under the relevant accounting standards also increases the
chance of an error.
Question 2.8
Some of the key points are:
• business risk is broader than the risk of material misstatement (ISA 315, para. A38)
• an understanding of business risk increases the likelihood of identifying risks of material misstatement
• most business risks eventually have financial consequences but these effects may not be immediate and
they may not result in material misstatement.
Question 2.9
One of the clear business risks facing the client is increased competition with a likely result of substantial
reductions in market share. There appear to be low barriers to entry because costs of adapting production
processes are likely to be relatively low for other manufacturers and, as bags with wheels attached are quite
common in the luggage industry, it is unlikely to be protected via patent, and so on. The risk is concerned
with market share and margins being affected by competition. This could have an impact on the valuation
of inventory and potential impairment of non-current assets including equipment and goodwill.
Question 2.10
The main factors that may result in an internal control system failing are as follows.
• Human judgments. The effectiveness of controls can be limited by the judgments made by individuals.
Even well-designed controls can break down (e.g. staff misunderstanding, being careless, fatigued).
• Management override. This refers to the overruling of prescribed policies and procedures by manage-
ment (e.g. ‘No need for credit clearance for X who is an excellent client’).
• Collusion. Individuals acting in collusion can often circumvent controls (e.g. separation of duties
becomes ineffective when collusion occurs).
• Cost versus benefit. Organisations have to consider the costs versus the benefits of establishing and
monitoring controls. Benefits, in particular, can be difficult to measure.
Question 2.11
Direct participation of an owner–manager in the record-keeping and other activities of the business
facilitates the monitoring of employee actions. Such effective involvement may compensate for the lack
of segregation of duties.
Question 2.12
During the discussion among the engagement team, potential ways to increase professional scepticism
related to fraud may include the following.
• Tell auditors to keep an open, questioning mind.
• Ask auditors to consider how someone could commit a fraud in particular circumstances.
• Remind auditors not to assume responses from clients are correct.
• Emphasise importance of verifying authenticity of documentation.
• Choose new and different procedures that have an element of surprise.
• Consider including individuals outside the audit team in the brainstorming session (e.g. industry experts,
forensic experts).
• Provide training, including in interviewing techniques.
Question 2.13
(a) The audit client narrowly missing a deadline for filing its tax return is an example of a trivial breach
that the auditor need not pursue further other than to obtain an understanding of the circumstances
for late lodgement and evaluate possible effects on the financial statements, which are likely to be
inconsequential (IESBA 2018).
Pdf_Folio:428
Question 2.14
Audit procedures Examples
Inspection of reports prepared by management and Inspect monthly reports, balanced scorecard, variance
those charged with governance analysis, capital investment analysis, board minutes
Inspection of the entity’s premises and plant facilities Visits to the entity’s premises such as a factory or
retail outlet
Question 2.15
Based on the results of the analytical procedures the auditor would be likely to focus their audit effort on
the following.
Accuracy, valuation and allocation Valuation of inventory would be The auditor needs to evaluate
at risk reasonableness of the remaining value
of inventory on hand.
Accuracy, valuation and allocation Reasonableness of valuation Unhappy customers are less likely
of trade debtors merits to pay.
audit attention
Accuracy, valuation and allocation Valuation of PPE could be at risk May raise impairment issues if it has
an impact on the generation of cash
flows from equipment.
P df_Folio:429
Industry — computer hardware Potential risk of obsolescence in the inventory held because it is a
product that becomes obsolete very quickly.
Loan — current ratio requirements The company may attempt to overstate current assets and understate
current liabilities to comply with the loan agreement. They may do this
by not providing for doubtful debts or overvaluing inventory. Accruals
may not be completely recorded.
Loan — company has stated that the There is a risk that the cutoff for sales has not been properly effected.
gross profit was increased by 25% This should be carefully reviewed in the audit at the year-end.
Loan — debt to equity ratio This is more difficult to manipulate; however, the auditor should look
for potential misclassification.
It is important for auditors to evaluate the compliance of companies with financial ratios. The
implications of a lack of compliance may be quite severe for the company, including potential going
concern problems.
Question 2.17
A knowledge and understanding of the internal and external environment of the audit client may uncover:
• incentives or pressures
• opportunities and attitudes
• rationalisation to engage in fraudulent activity or the misappropriation of assets.
For individuals, incentives or pressures may be personal circumstances or unrealistic expectations
of management. Incentives or pressures for management are often associated with financial goals set
by the organisation or market expectations. Opportunity usually arises when there is an absence of
adequate or effective internal controls. Internal control deficiencies are often related to positions held by
trusted employees. Rationalisation is the process of neutralising or justifying fraudulent activities or the
misappropriation of assets.
Question 2.18
1. Factors affecting preliminary assessment of inherent risk include the following.
• Wine is vulnerable to storage conditions (temperature), suggesting high risk of spoilage, affecting
inventory valuation.
• Boutique wine operation — highly skilled processes requiring skilled staff (winemaker); reliant on
few customers?
• Export sales, foreign exchange transactions — complicated transactions with risk of incorrect pricing,
risk assessment.
• Tourism based sales at shop and café — fluctuating demand?
• Competing incentives for export sales and café consulting businesses.
• Heavy reliance on export sales increases vulnerability of business to this source of revenue, and
making product available to meet this demand.
Factors affecting preliminary assessment of control risk include the following.
• Effectiveness over quality control over wine production and storage, affecting saleability of product
(although quality control is apparently high).
• Risk of product spoilage, affecting value of inventory.
• Controls over sales made by Jim, documentation, pricing, sales allowances.
• Lack of communication between Jim and brother Bob and other staff — affecting efficiency and
effectiveness of management.
Pdf_Folio:430
Question 2.19
1. The balance sheet account and the relevant assertion most at risk given the information provided is as
follows.
Trade debtors Accuracy, valuation Without appropriate credit checks there is a high
and allocation likelihood of debtors not paying.
2. Less reliance would be placed on tests of controls and more substantive testing would be required.
The substantive testing would be more tests of details as analytical procedures are less reliable when
internal control weaknesses exist (this will be discussed more in module 3).
Question 2.20
1. Examine high-value invoices for the two days Substantive test Cutoff
prior to year end to determine if sales are
recorded in the correct period
(continued)
P df_Folio:431
MODULE 3
Question 3.1
Tests of controls provide evidence on the effectiveness of the design and operation of internal controls and
identify deviations where transactions tested have not been processed in accordance with control policies
and procedures, such as petty cash safety boxes not being locked and kept in a secure location. On the other
hand, substantive tests of details provide evidence whether an account balance is materially misstated, such
as trade debtors being overstated by $50 000. That is, the error being sought in substantive testing are errors
or misstatements in recorded transactions or balances.
Question 3.2
Identifying material misstatements is an objective of substantive testing. Errors and exceptions to the tests
undertaken as tests of controls are referred to as control deviations. When designing tests of controls,
auditors need to define what will constitute an error or exception as the audit team may otherwise waste
time on minor exceptions.
Question 3.3
A predominantly substantive approach may be more suitable to this audit engagement because:
• SMEs may not have adequate resources to implement all appropriate internal controls
• controls may not be as effective due to the lack of segregation of duties
• the size of the entity may make it inefficient for the auditor to rely on controls in performing the audit.
Question 3.4
1. Input a negative order of goods. This order should be rejected because only positive numbers of goods
should be accepted.
2. Input an order for 100 (or similar high value) items. There should be a reasonableness test performed
by the system either rejecting this order as too large or creating an on-screen message to warn the user
of the amount. This will highlight quantity errors.
3. Input a request for an inventory code that does not exist. This will ensure that only valid inventory codes
can be input — a warning should be displayed asking for a re-input.
4. Input an invalid delivery address. The system should be programmed to recognise invalid addresses
such as postal codes that don’t agree with suburb name.
5. Attempt to make changes on screen to billing address, contact name, unit prices, discount rates, payment
due dates, and so on. These data should be fixed in the master files and not be available to be changed
in the ordering system.
Question 3.5
Yes, it is an example of haphazard sampling and while it may appear to be random it is susceptible to
human bias.
Question 3.6
The audit evidence is that there is one instance of a part-time staff member being paid an incorrect hourly
rate. The fact that the payment was incorrect is evidence that the procedures for calculating and checking
the payments have failed in some way. The client’s controls for preventing the error should have stopped
Pdf_Folio:432
Question 3.7
(a) This could indicate misappropriation of assets.
(b) The relevant assertion would be existence.
Question 3.8
(a) A reasonableness test would be as follows.
Square metres per floor rented on lower 10 floors × charge per square metre for 10 lower floors × 10
floors + square metres per floor on top 5 floors × charge per square metre for top 5 floors × 5 floors.
If the floors are not fully occupied, then adjustments need to be made for occupancy rates.
(b) This method will be preferred to the substantive testing of transactions or balances because it will give
a more precise expectation of the revenue of the property lessor. If the auditor sampled for tests of
transactions or balances and verified these individual transactions or balances (of which there could be
many if there are many tenants on each floor or if the company leases out space in numerous buildings),
it would not be possible to verify a large part of the total balance substantively.
(c) Yes.
(d) For the revenue of an airline, a reasonableness test can be developed, but it would be complicated. It
would be related to the load factor of the flights (percentage of seats occupied), the type of aircraft that
is being flown, the number of flights and the types of tickets sold. If the auditor can gain confidence
in the systems that produce these statistics, they can get a good approximation of the total revenue for
the airline. In this case, the reasonableness test would be less accurate than for the property lessor, but
it could still be useful.
Question 3.9
External debtors’ confirmations are received from customers in response to a specific request from the
auditor to confirm the balance outstanding at the year end. The confirmation provides assurance in relation
to existence of balances owed as well as cutoff confirming amounts are recorded in the correct period.
Although generally considered to be an excellent form of evidence, these do not provide comfort that the
amount will be paid and therefore give no evidence as to valuation. Some customers may also respond
without fully understanding what they are confirming. In addition, if the customer is a related party to the
organisation their independence may be in doubt.
Question 3.10
Some of the steps that the auditor could undertake are outlined in GS 016, paras 62–66 and ISA 505,
para A12.
The auditor may design and perform tests of controls as to the operating effectiveness of controls over the
electronic confirmation process. If the auditor is satisfied that the process is secure and properly controlled,
the reliability of the related responses is enhanced.
For the risks of proving the origin of the response, whether the respondent was authorised to respond
or whether there were any unauthorised alterations to information transmitted, the auditor may verify the
source and content of the response by contacting the bank.
Often, a bank uses a third-party service organisation to respond to a confirmation request and the auditor
plans to rely on the service organisation’s internal control process. If this is the case, it is important that the
auditor be satisfied with the controls over the information sent to the service organisation and the controls
applied during data processing and sending the confirmation response to the auditor. A service auditor’s
report on the internal controls at the service organisation may assist the auditor in evaluating the controls
with respect to that process.
The auditor may also be able to rely on various techniques incorporated in the electronic confirmation
process that could help validate the sender of electronic information’s identity and authority to confirm the
requested information. These would include the use of data encryption and electronic digital signatures.
Pdf_Folio:433
Question 3.12
Procedures using CAATs could include the following.
• Calculate days in debtors and compare to prior periods — this could also be done for each month end
to establish how typical the year end is and also how Fitzroy is controlling debtors through the year.
• Check that the total on the list of trade debtors balances extracted from the debtors ledger agrees to the
debtors balance in the nominal ledger.
• Check the additions on the list of debtors’ balances.
• Compare individual debtors’ balances to the customer credit limit and investigate those balances that
exceed the credit limit.
• Compare for individual customers the trade debtors’ balance to sales for the year. Further investigation
of customers where there are high levels of sales but low receivables balances at the year end. It is
possible that the low balance at the year end is an attempt to prevent the customer being selected by
the auditor for testing, this can be avoided by selecting items for testing based on sales level rather than
year-end balance.
• Extract all balances over a certain age, say 90 days, for discussion in relation to the adequacy of
provisions for doubtful debts.
• Stratify the list of balances in order to extract samples for further testing, this may include extracting all
material balances, random sampling of other balances, monetary unit sampling may be used, also credit
balances can be identified.
Question 3.13
(a)
Total Population = $1 600 000
Sample value = $295 000 Errors in Sample = $18 408
% errors in sample = 18 408 / 295 000 = 0.0624 = 6.24%
Projected error = % sample error × Population = 0.0624 × 1 600 000 = $99 840
(b) No, as the amount is less than the set materiality level, the projected error is immaterial. The projected
misstatements would need to exceed $100 000 before it would be classed as materially misstated.
Question 3.14
Answer: (b) The auditor has assessed a high risk of undisclosed related parties.
ISA 550, para. A32 outlines procedures that the auditor may perform when the auditor has assessed a
significant risk that management has not appropriately accounted for or disclosed specific related party
transaction. Therefore, the answer is option b.
Question 3.15
The important differences between internal audit and the external audit functions are as follows.
Independence
As the internal audit function is a part of the entity, no matter how autonomous and objective it is, it cannot
reach the level of independence enjoyed by the external auditors.
Objectives
The objectives of internal audit function vary according to management’s requirements, whereas the
primary objective of external auditor is to determine whether or not the financial statements are free of
material misstatements.
Pdf_Folio:434
Question 3.16
(a) Existence / Accuracy, valuation and allocation.
(b) In this case an independent expert has performed the work on the key risk areas. The auditor would
need to consider ISA 620, Using the Work of an Expert.
• The auditor should assess the appropriateness of the expert’s work.
• The auditor should review the source data used by the expert and ensure that it is sufficient, relevant
and reliable. The auditor should also test the data used by the expert.
• If the results of the expert’s work do not provide sufficient appropriate audit evidence, or if the results
are not consistent with other audit evidence, the auditor should resolve the matter (e.g. more work
or audit qualification etc.)
Other work: Select a sample of fixed asset additions and disposals and vouch to supporting
documentation.
Question 3.17
The audit assistant has documented that there were no replies to certain trade debtor’s positive confirmation
letters. Jackie’s review has shown that the decision to take no further action after non-reply from customers
is not appropriate. According to para. 12, ISA 505 External Confirmations, the auditor shall perform
alternative audit procedures to obtain relevant and reliable audit evidence for each of non-responses.
Jackie should note that further audit work is required and the specific audit work to be done. Examples of
alternative audit procedures the auditor can perform are: a) examining specific subsequent cash receipts;
b) shipping documents and c) sales near the period end for the non-response customers (see para. A18
ISA 505).
Specific consideration should be given to the implication of the non-responses to audit risk for trade
debtors. These conclusions would need to be documented accordance with paras 8–12 of ISA 230 Audit
Documentation.
Question 3.18
At the planning stage the main focus is to ensure an efficient and effective audit and ensure that audit
attention is devoted to appropriate areas. The auditor will carry out a preliminary assessment of the risks
and establish a level of materiality which will determine the nature, timing and extent of audit procedures.
The level of materiality is a matter of judgment and may change as the audit progresses.
At the final review stage the auditor will determine the final materiality figure and be focussed on
evaluating misstatements that may have been found during the audit. The auditor then aggregates the total
identified misstatements and determines if it causes the financial statements to be materially misstated
(compared to the final materiality figure). Where material errors remain in the financial report the auditor
will request that management make the necessary amendments. If management refuse to change the
financial statements the auditor will need to modify the audit opinion. If the misstatements are immaterial
then the auditor will not need to amend the audit opinion.
Question 3.19
Materiality judgments involve an assessment of both the amount (quantity) and the nature (quality) of the
misstatements.
An auditor determines the overall quantitative materiality level for planning purposes by selecting a base
and applying a percentage to that base. For profit-maximising companies, the most commonly used base is
profit before tax and materiality is usually set between 5% and 10% of this base. Other bases and applicable
percentages may be used, depending on a company’s circumstances. Thus, quantitative materiality is the
dollar level used to determine if misstatements are material (either individually or aggregated).
Pdf_Folio:435
Question 3.20
There are a number of factors that will determine whether the auditor has obtained sufficient appropriate
evidence to support a particular control risk assessment. The auditor requires stronger evidence if the
assessed level of control risk is low rather than medium. If control risk is high, the auditor does not have to
gather evidence to support this assessment, as they do not intend to rely on controls. They will gather their
evidence via substantive testing. Other factors that the auditor considers in determining whether the tests
of controls have yielded sufficient appropriate evidence include: type and source of evidence (some types
of audit tests provide stronger evidence); timeliness of evidence; and interrelationship with other evidence
(does all evidence point to the same conclusion?).
MODULE 4
Question 4.1
Data analytics should uncover the following five indicators of payroll fraud.
1. Multiple employees with the same information in the payroll system such as bank account routing
number, social security number, or same home address.
2. Employees on the payroll register prior to their start date or after their termination date.
3. Multiple paychecks issued to an employee within a single pay period.
4. Bonuses paid to employees who are not eligible.
5. Inappropriate wage levels given the employee’s classification.
The auditor uses their knowledge of the entity to identify potential anomalies bearing in mind legitimate
business reasons for any of the anomalies. However, the auditor would need to use professional scepticism
when investigating items flagged for further investigation.
Question 4.2
A written representation is required in the absence of clear evidence one way or the other. The evidence
to support the claim is the claim itself from BlueHound. This evidence against the claim is the director’s
assertion that the food is safe. The solicitors have not been able to clarify the position.
On that basis the auditors should seek representations from management along the following line.
‘There has been a claim for compensation made against the company from BlueHound Ltd in relation
to a product supplied by Ruff Racers Ltd. The directors are of the opinion that the claim is not justified.
Disclosure in relation to this claim contained in the financial statements is adequate and no further claims
of this nature have been received.’
Question 4.3
1. (a) The auditor has a responsibility for identifying and evaluating events up until the date of the audit
report.
(b) This is a subsequent event affecting the value of a debtor’s balance at year-end that will require
adjustment to the provision for doubtful debts (unless it has already been included).
2. (a) The auditor was made aware of this event after the financial report has been issued. In this case the
event occurred after the audit report was signed so the auditor has no responsibility in relation to
the event.
(b) No disclosure required.
3. (a) This is an event occurring after the financial report has been issued. It existed at the date the audit
report was signed. The auditor has no responsibility to look for these events but must consider them
if he or she becomes aware of them. The auditor should discuss with management the possibility of
recalling and revising the financial report, as the debtor is very material.
(b) This is a subsequent event affecting the value of a debtor’s balance at year-end that will require
adjustment to the provision for doubtful debts.
Pdf_Folio:436
Question 4.5
In formulating an opinion on the financial statements, the auditor should assimilate all the evidence
gathered during the examination. An essential prerequisite in deciding on the opinion to express is a final
assessment of materiality and audit risk. The auditor should assess whether the aggregate of the uncorrected
misstatements identified during the audit is material. Normally the aggregate of uncorrected misstatements
will be recorded on a summary schedule at the front of the audit file.
The data that have been accumulated on the summary schedule are then compared with the auditor’s
preliminary judgments concerning materiality. Any adjustments in planning materiality that have been
made during the course of the examination should be included in this assessment. If the aggregate level of
uncorrected misstatements is material, then the auditor needs to consider reducing audit risk by extending
audit procedures or requesting management to adjust the financial statements.
Question 4.6
Impact
Population Sample Sample Expected population on profit
Working $’000 size $’000 error $’000 error $’000 before tax
When the sample results are extrapolated to the population, the overstatement for trade debtors is $321,
which is 7.8% (321 / 4 122 x 100%) of total trade debtors and is therefore materially misstated.
Likewise, inventory is understated by $128 which is 3.6% (128 / 3 589 x 100%) of total inventory and
is therefore not materially misstated.
The overstatement of the warranty provision is $161 or 9.0% of total warranty and is therefore materially
misstated.
The overall misstatement to profit is an overstatement of $32 ($321 – $128 – $161: note the 161 is
deducted because it is overstatement of a liability). This is an error of 0.6% of the profit and is therefore
not material at the profit level.
The trade debtors’ balance and warranty provision should be adjusted but the inventory does not need
to be adjusted. If management were to refuse to make the necessary amendments to trade debtors and
warranty provisions then the auditor’s report would contain a qualified opinion.
Note: It is not acceptable to offset the errors and state that no adjustments are required because the profit
effect is immaterial.
Pdf_Folio:437
Question 4.8
(a) Yes, disclose as a KAM. This is likely to be disclosed as a KAM because it is a complex judgment
involving a higher assessed risk of material misstatement, (significant risk), and it will have a significant
effect on the audit.
(b) No. This will not be disclosed as a KAM because it involves a disclosure that is industry wide and a
well-known risk that is recognised by the broader community.
(c) Yes, disclose as a KAM. This is likely to be disclosed as a KAM because it is a complex judgment about
the most appropriate basis for revenue recognition and is a matter of audit significance that meets all the
requirements for disclosure. It is an area of higher assessed risk of material misstatement, significant
auditor judgment relating to disclosures that involve significant management judgment, and it will have
a significant effect on the audit.
(d) No. This will not be disclosed as a KAM as it involves a disagreement with management about the
carrying value of an asset that will result in a modified auditor’s opinion.
Question 4.9
(a) Even though the auditor was unable to attend the physical count of inventories, they were satisfied as to
the existence/condition of inventories by other means. This is in accordance with ISA 501, paras 6–7,
with some of these other means including inspection of the subsequent sale documentation of specific
inventory items that were purchased prior to the physical inventory counting, as spelled out in ISA 501,
para. A13.
(b) For the auditor to have given an unmodified opinion, they would have had to be satisfied with the
appropriateness and adequacy of the disclosure by management of these circumstances. In effect, the
disclosure would have to show the nature and amount of the claim against the company as a contingent
liability in the notes to the financial statements.
(c) Again an unmodified opinion could be given in these circumstances provided the total claim against the
company is appropriately and adequately disclosed as a contingent liability in the notes to the financial
statements. Also, if the auditor is satisfied in all other respects, the auditor’s report will not be modified
for the non-provision of the amount of $100 000 (the amount for which the directors hope they will be
able to settle out of court) on the grounds that the misstatement of the item in isolation is considered
immaterial (it is significantly less than 5% of net operating profit). (Because of the nature of these
circumstances, it may be argued that these circumstances are qualitatively material.)
(d) An unmodified opinion is given because the potential understatement is not in isolation considered
material.
Question 4.10
(a) No. This will result in the disclosure of a KAM, rather than the inclusion of an Emphasis of Matter
paragraph.
(b) Yes. This is a significant subsequent event that occurs between the date of the financial statements and
the date of the auditor’s report and will result in the inclusion of an Emphasis of Matter paragraph.
(c) No. This will result in the auditor issuing an unmodified opinion and including a separate section under
the heading ‘Material Uncertainty Related to Going Concern’, rather than the inclusion of an Emphasis
of Matter paragraph.
Pdf_Folio:438
(c) Scope limitation — imposed by management If the issue remains unresolved and is material
it will result in the issuing of a qualified opinion.
Such an issue isolated to a specific debtor
would not be expected to be pervasive.
Question 4.13
(a) Standard (unmodified) The auditor should express an unmodified opinion and include a separate
section under the heading ‘Material Uncertainty Related to Going Concern’
(ISA 570 (Revised), para. 22).
Material Uncertainty The auditor is satisfied that there is adequate disclosure about the
Related to Going Concern uncertainty in the notes to the financial statements but wishes to bring this
to the attention of the user of the financial statements.
(b) Qualified or Adverse The auditor should express a qualified or an adverse opinion (ISA 570
(Revised), para. 23).
The auditor still has concerns about the adequacy of disclosure, which
means they are required to modify their opinion.
(c) Adverse The auditor should express an adverse opinion (ISA 570 (Revised), para. 21).
The basis of accounting used in the preparation of the financial statements
is inappropriate and will have a pervasive effect, meaning that an adverse
opinion is appropriate.
Question 4.14
(a) Disclaimer of opinion Due to the flood destroying all the accounting records towards the end of
the financial year, I would be unable to obtain sufficient appropriate audit
evidence on which to base an opinion. This would result in a disclaimer of
opinion as it would have a pervasive impact on the financial statements. This
is in accordance with ISA 705 (Revised).
(b) Unqualified opinion with As this is adequately disclosed in the notes to the financial statements an
an emphasis of matter unqualified opinion is appropriate. However, as the entity is facing significant
paragraph litigation, an emphasis of matter paragraph will bring to the users attention.
This is in accordance with ISA 706 (Revised).
P df_Folio:439
(continued)
(c) Unqualified An unqualified opinion is justified because the misstatement is not material.
This is in accordance with ISA 700 (Revised).
(d) Adverse An adverse opinion is justified as sufficient appropriate audit evidence has
been obtained and I have concluded that the uncorrected misstatement is both
material and pervasive to the financial statements. This is in accordance with
ISA 705 (Revised).
(e) Qualified This is an example of a disagreement with management resulting in the brand
names being materially misstated. A qualified audit opinion is justified because
sufficient appropriate audit evidence has been obtained, and I have concluded
that the uncorrected misstatements are material but not pervasive to the
financial statements. This is in accordance with ISA 705 (Revised).
(f) Unqualified This situation is an example of when an unmodified audit opinion is justified.
Therefore, an unqualified audit opinion is appropriate in accordance with
ISA 700 (Revised).
Question 4.15
(a) Qualified opinion. The audit opinion should be modified due to understatement of the provision for
long service leave being a material (affecting profit before tax by $30 million) but not pervasive
misstatement (affecting only the long service leave expense and the provision for long service leave).
Unless management agrees to the change, the material under-provision for long service leave will result
in a qualified opinion.
(b) Adverse opinion. Having identified this misstatement as material, the auditor must then further consider
whether the misstatement is of such a magnitude or so pervasive in the financial statements that an
adverse opinion needs to be expressed (the impact cannot be effectively communicated in a qualified
opinion). This is primarily due to the materiality of the trust liabilities and asset deficiency that have
not been reflected in the financial statements, meaning that multiple accounts in the balance sheet
and income statement are materially misstated, and therefore will result in an adverse opinion. The
seriousness of this qualification can be seen as the auditor, in issuing this form of modified opinion,
is effectively communicating that, in its present form, the entire financial statements are unreliable or
misleading.
Question 4.16
Some types of evidence are less prone to distortion by management. That is, if fraud were to exist, all
evidence controllable by management may contain similar distortion. It is therefore important to obtain
external evidence that is less likely to be controllable by managers — for example, evidence from sources
outside the entity, such as information on market share from industry groups, government data on tenders
granted, and so on.
Question 4.17
In this case the auditor needs to include the effect on their assessment of the risk of material misstatement
and their ability to obtain sufficient appropriate evidence (ISA 260 (Revised), para. 22).
If the situation of inadequate two-way communication cannot be resolved then the auditor needs to
take appropriate action, which could include modifying the audit report (scope limitation), obtaining legal
advice, communicating with third parties (e.g. regulator), and even withdrawing from the engagement
(ISA 260 (Revised), para. A53).
MODULE 5
Question 5.1
• A review provides limited assurance. The auditor does adequate work to report whether or not anything
came to their attention, which would lead them to conclude that the information being assured is not
Pdf_Folio:440
Audit Review
Half-yearly reports
• Most entities choose to have the half-yearly report reviewed rather than audited. The half-year review
is not as extensive as the annual audit. It involves limited procedures consisting mainly of enquiries of
selected management and staff of the entity, and some analysis of financial information. As the half-
yearly reporting is more limited than annual reporting, a lower level of assurance is appropriate.
• In reviewing the half-year financial report, auditors must follow those auditing standards applicable to
reviews. The review is undertaken so that auditors can report to members on whether they are aware of
anything, based on the review procedures they performed, that would suggest that the financial report
does not, in all material respects, meet legal requirements and financial reporting standards.
• When the review is completed, auditors write a review report explaining what they have done, giving
a statement drawn from their work. As a review requires less work than an audit, it would cost less for
the service, making it more cost effective for the entity.
Question 5.2
1. A review engagement is required because the bank requires a certain level of assurance, but it has
already been agreed that an external audit will not be required. A review provides limited assurance.
The auditor does adequate work to report whether or not anything came to their attention, which would
lead them conclude that the information being assured is not true and fair.
2. The title of the report or communication that Smith & Jones will prepare is an ‘INDEPENDENT
PRACTITIONER’S REVIEW ENGAGEMENT REPORT’
3. The types of procedures that Smith & Jones would be required to conduct in this review engagement
would be inquiry and analysis to address high risk areas where it was determined material misstatements
could arise and to address all material items in the financial statements. Some of the procedures
performed will be to compare year over year balances, considering the relationships between financial
statement data, and calculation of various financial statement ratios. Once unusual or significant
fluctuations are identified, the auditor then inquires and discusses with the client whether these
fluctuations and changes are plausible.
Question 5.3
ISAE 3000 International Standard on Assurance Engagements (Revised) Assurance engagements other
than audits or reviews of historical financial information is issued by the IAASB, and the most recent
revisions apply for assurance reports dated on or after December 15, 2015. It deals with assurance
engagements other than audits or reviews of historical financial information. It applies to both reasonable
assurance and limited assurance situations.
Because ISAE 3000 applies to assurance of information or reports other than historical financial
information reports, it does cover the situation where an entity has provided a CSR and wishes to gain
a review or audit of that information. Its application paragraph A8 specifically lists an engagement for the
assurance on a report of sustainability performance as an example where its use would be appropriate.
Pdf_Folio:441
Question 5.4
With respect to assurance on carbon issues, Huggins and Green et al. provide a discussion of the reasons
why accountants are well placed to deliver this service.
• Education and experience benchmarks for entry to the profession.
• Ongoing continuing professional development requirements.
• Competency requirements for providing particular services.
• Performance standards for particular engagements (in the case of emissions assurance: ISAE 3410,
which was approved in 2012).
• Quality assurance policies and procedures at both the engagement level and the firm level.
• A strong and detailed Code of Ethics.
• Public confidence in assured emissions information may further be enhanced by the reputations of the
leading accounting firms.
• The global reach of the multinational audit firm networks provides a logistically streamlined option for
multinational companies (Huggins & Green et al. 2011 pp. A5–A6).
Question 5.5
Providing assurance on environmental information differs from auditing financial statements in several
significant ways.
• In many environmental assurance engagements, it is not possible to prepare a verifiable assertion,
meaning it is difficult to prepare environmental information that is assurable, as there are no records
of events and operations to examine.
• There are few generally recognised standards for systems and controls to serve as criteria in evaluating
environmental management systems.
• As the concept of evidence in the area of environmental assurance engagements is not well developed,
assurance practitioners carrying out the same assessment separately would not necessarily carry out
similar procedures, or require the same amount or types of evidence to develop their findings. This
reflects a lack of generally accepted standards for the conduct of such services, and a lack of consistency
in the procedures of those who perform them.
• The results of such environmental assessments are commonly expressed as detailed reports of findings
and deficiencies, rather than as overall conclusions as to the extent that the stated subject matter
information conforms with certain criteria. This reflects a fact-finding, investigatory type of service,
as distinct from an assurance-providing service.
Question 5.6
As discussed in detail in module 5 of the study guide, there are potential conflicts of interest if an audit
firm also performs other work for a client. For example, an accounting firm could provide consulting
services on installation of a computer system, and then be engaged to audit the client’s accounting records
that were produced by that system. There is potential for the auditor to miss mistakes in the accounting
reports through either ignorance (not realising there was a fundamental error in the system that affected
the accuracy of the accounting reports) or bias (deciding not to pursue an issue that potentially was caused
by the accounting firm’s consulting work not being sufficiently rigorous).
Sustainability reporting (preparation of the report or assurance) would not create a conflict of interest
in most cases because the information being provided in the sustainability report is not integral to the
financial report being assured.
Pdf_Folio:442
Question 5.7
The auditor would:
• review the client’s implementation plan and the roll-out of the program
• review related training plans and programs
• interview key staff responsible for the implementation
• review compliance structures in place
• check the reports of internal compliance procedures relating to the Code of Conduct
• interview compliance officers
• check the implementation of the Code of Conduct at a sample of sites (through interviews with
management and employees).
To provide reasonable assurance under ISAE 3000 Assurance Engagements Other than Audits or
Reviews of Historical Financial Information on this type of claim, there would need to be a well-
developed internal compliance mechanism that the assurance practitioner could test at various levels in
the organisation. Otherwise, the auditor must cover a very large proportion of the company’s sites to feel
comfortable in providing a positive assurance of the client’s assertions.
The auditor needs to undertake a range of detailed data analysis procedures at the corporate level to
check the completeness and accuracy of the ‘total’ numbers, as well as check the reliability of the reported
data at a sample of sites. The number of sites increases substantially if the internal review process for the
sulphur dioxide data is weak. The auditor should review the text that accompanies the data to ensure that
the explanations given for the reduction in emissions reflect the evidence collected. For example, is the
reduction caused by a change in measurement technique rather than a real change in actual emission?
Question 5.8
A wide range of KPIs could be suggested, a key issue to consider is what the performance of the
organisation will be compared to and how can improvement be measured. Possible KPIs could include
the following.
Staff
• Staff turnover levels — high staff turnover indicates unhappy staff.
• Staff absentee rates — happy staff will be happy to come to work.
• Spending on staff training — improving staff skills.
• Mix of fulltime to part time staff — compared to industry averages, other organisations.
• Level of salaries and other benefits — compare to industry averages.
• Staff satisfaction surveys.
Customers
• Levels of repeat business.
• Customer satisfaction surveys.
• Levels of customer complaints.
Wider Community
• Donations to local not-for-profit enterprises.
• Sponsorship of events.
• Making the restaurants available for events at no cost to charities.
Environment
• Levels of recycled waste.
• Amount spent on energy bills.
• Capital investment on energy reducing equipment.
Question 5.9
In these circumstances, the disclosures should cover:
• sources of uncertainty (i.e. whether or not regulatory approval will be obtained)
• assumptions made relating to uncertainties (i.e. that regulatory approval will be obtained by the end of
the current financial year)
Pdf_Folio:443
Question 5.10
An internal audit’s key functions in risk management include:
• providing assurance on the design and effectiveness of risk-management processes
• evaluating risk management processes
• evaluating the reporting of key risks and controls
• evaluating the management of key risks, including the effectiveness of the controls and other responses
to them.
Question 5.11
• Although it is management’s responsibility to design internal controls to prevent, detect and mitigate
fraud, internal auditors can assess the effectiveness of the procedures that management has implemented.
• Internal auditors help management evaluate internal controls used to detect or mitigate fraud, and the
organisation’s assessment of fraud risk, and are involved in any fraud investigations.
• Establishing a culture of integrity is a critical component of fraud control, and management must set the
tone at the top. Internal auditors may advise management on methods to inculcate this culture.
• Internal auditors watch for potential fraud risks, assess the adequacy of related controls and make
recommendations for improvement.
• Internal auditors can benchmark statistics related to the probability of occurrence and consequences of
fraud.
• Internal auditors play an important role in fraud detection. For example, when developing their annual
audit plan, internal auditors consider the organisation’s assessment of fraud risk, and may periodically
make assessments of management’s fraud-detection capabilities.
• Internal audit skills relate to gathering evidence, analysing the breakdown in controls that could enable
a fraud, and making recommendations for improvement.
• Internal auditors may have a direct role in investigating fraud incidents or act as a resource to those
responsible for investigating.
Question 5.12
COSO (2013)
Activities components Justification
(b) Separation of duties Control activities This is a control activity that helps to keep
risks in an organisation to an acceptable level
(see principle 10).
(c) Expanded foreign operation Risk assessment This is an example of where the organisation
identifies and assesses changes that could
significantly impact the system of internal
control (see principle 9).
(d) Management’s questioning of Monitoring activities This is an example of where the management
reports that are different from of the organisation performs ongoing
their knowledge of operations evaluations to ascertain whether the
components of internal control are present
Pdf_Folio:444
and functioning (see principle 16).
(f) Establishment of a compliance Information and This is an example of where the organisation
register for improprieties communication generates relevant, quality information to
support the functioning of internal control
(see principle 13).
(g) The role of the internal auditor Monitoring activities This is an example of monitoring activity over
other controls. It involves the organisation
performing ongoing and separate evaluations
to ascertain whether the components of
internal control are present and functioning
(see principle 16).
(h) How authority and responsibility Control environment This shows how the organisation holds
for operating activities are individuals accountable for their internal
assessed control responsibilities (see principle 5).
(i) Gatekeeper at a factory Control activities This is an example of where the organisation
selects and develops control activities that
help to keep risks to the achievement of
objectives at acceptable levels (see
principle 10).
(j) Communication channels with Information and This is an example of where the organisation
customers communication communicates with external parties regarding
matters affecting the functioning of internal
control (see principle 15).
Question 5.13
(a) Confidentiality of information.
Controls could include:
• logical and physical security measures; for example, password (with regular password-changing
control and encryption of data
• information protection to safeguard the integrity of the files
• privacy issues relating to customer information.
Risks include:
• corrupt information being processed
• breach of confidentiality.
(b) Transaction integrity.
Controls could include:
• identity controls for authorised personnel
• processing controls to ensure accuracy and completeness
• authenticity, accuracy and reasonableness controls.
Risks include:
• unauthorised transactions being processed
• transactions processed incorrectly.
(c) Authorisation of payments.
Controls could include:
• established levels of approval for expenditure
• reconciliations of payments with creditor records
• identity and credit verification checks to prevent unauthorised use of credit cards.
Risks include:
• unauthorised payments made to unauthorised personnel
• incorrect payments made.
(d) Assurance of business credibility.
Controls could include:
• review processes to ensure changes to the business system accommodate all aspects of commercial
activities
Pdf_Folio:445
Question 5.14
This engagement is a compliance engagement — giving assurance that required processes have been
complied with. The following procedures should be carried out to check that the tender process has been
followed.
1. Full detailed project specifications should be produced. Obtain a copy of the project specifications and
review its contents to ensure that the scope of the engagement is sufficient to cover all aspects of the
project.
2. Invitations to tender must be publicly advertised. Obtain details of when and where the advertisement
was published and obtain a copy of the publication.
3. The receipt of tenders submitted must be documented and all submissions opened at the same time.
Request documentary evidence of the tender opening processes. It would be expected that the project
team would all be present at the opening of the tender submissions and would all sign the document
indicting their presence.
4. A project team of at least three must review and assess submissions, one of who must have appropriate
expertise, in this case IT project management experience. Obtain a schedule of the team members,
ensuring there are at least three people on list. Obtain copies of the resumes of the team members and
copies of appropriate IT qualifications.
5. Contracts will be awarded based on an assessment matrix which gives a score weighted across various
factors of functionality, financial stability of the supplier, track record, price, and future support. Obtain
copies of each of the tenders submitted and the appraisal documents used to assess each tender. Ensure
the appraisal documents are in line with the project’s specifications and ensure that each tender is scored
for each of the assessment areas. Check that the overall score has been correctly computed and that the
highest scoring tender was selected. Review minutes of team meetings to ensure the decision of the
team has been finalised in accordance with the required processes.
Question 5.15
An assurance engagement is defined as ‘an engagement in which an assurance practitioner aims to
obtain sufficient appropriate evidence in order to express a conclusion designed to enhance the degree
of confidence of the intended users other than the responsible party about the outcome of the measurement
or evaluation of an underlying subject matter against criteria’.
In the case of Bravo Bags, Brad Pope, CPA was engaged to issue a written conclusion. In order to express
that conclusion, he must obtaining sufficient and appropriate evidence in order to determine whether the
actual results indicated by Bravo Bags meets the lease agreement criteria. The results of the conclusion
will enhance the landlord’s confidence that Bravo Bags has met the requirements of the lease. Therefore,
the requirements of an assurance engagement are met as there is a practitioner (Brad Pope, CPA), who will
issue a conclusion on the subject matter (the lease agreement) to a user (the landlord).
Question 5.16
The Expense Report
Note the change in role here to internal auditor. This is a fairly simple compliance audit.
There are two different things that are being asked.
1. Design procedures for a compliance audit.
2. Perform an audit on the roll-out of the procedures.
Possible Approach to Compliance Audit
The main control objectives related to the compliance audit are to ensure that:
1. reimbursements are for legitimate and allowable purchases
2. purchases are supported by receipts
3. purchases are appropriately approved
4. purchases are recorded properly in the appropriate general ledger accounts.
Pdf_Folio:446
For Roll-Out
1. Enquire as to how roll-out of procedures was communicated to employees.
2. Interview a sample of employees to:
• verify the roll-out communication
• confirm that they are aware of the types of expenditures that are permitted under the policy.
3. Did they require all employees to sign the policy as written acknowledgment of their review. Can we
test this?
4. How are new employers handled?
5. Check that the accounts payable department and managers are aware of the policy.
6. Ensure that the policy has been kept current. The policy should be updated for any changes and reviewed
at least annually to ensure it is still valid. Is this being done?
Question 5.17
(a) Assurance could be provided on either:
• the systems that generate the briefing papers (these systems may be part of the information systems
that are evaluated as part of the financial statement audit)
• the contents of the briefing papers themselves.
(b) Some of the difficulties of providing assurance include the following.
• There would be a short time frame between the time the information is generated and the time by
which the assurance is required (before the board of directors’ meeting).
• Much of this information could be forward-looking (future-oriented) and would be hard to provide
assurance on.
• Such an assurance service would be costly.
• There would be comparative advantages for the financial statements auditor providing this assurance,
but independence concerns may arise with the auditor also providing these other services.
Question 5.18
1. Preparation of a report giving advice to a client on the introduction of a new system of internal controls.
This is a form of consultancy work provided recommendations and is therefore not an assurance
engagement. No assurance is provided and no opinion given.
2. A report giving an opinion on a school’s responses to a questionnaire required by the auditor general.
This is an assertion-based compliance engagement (ASAE 3100). The report is providing information to
the auditor general indicating the extent to which the organisation has complied with some regulatory
requirements. It is likely to be an audit rather than a review and therefore would require reasonable
assurance with a positive form opinion.
3. Preparation of the company’s tax returns. This is a compilation of a return from information provided
by the client. No assurance is provided and no opinion is given.
4. A report to management about the success of a marketing campaign. It is likely that this will be a report
of findings giving details of the extent to which revenue has increased after the marketing campaign. It
is unlikely that an opinion would be given about success unless success is very clearly defined to ensure
that it is an objective criterion against which to measure actual performance. Therefore, this is likely to
be agreed upon procedures engagement on which no assurance or opinion would be provided.
5. A report to directors in relation to half-year financial report for a listed company. This is an assertion-
based engagement providing an opinion on historical financial information and the work is likely to be
a review rather than an audit. These interim reports must be either audited or reviewed and therefore
most companies would have a review performed rather than a full audit. In the case of a review there
would be limited assurance provided in a negative form. The review may be performed either by the
company’s independent auditor (ASRE 2410) or another assurance practitioner (ASRE 2400).
6. An audit of a management report into the effectiveness of a company’s internal control system. This is an
assertion-based engagement giving an opinion on a report on the effectiveness of internal controls. This
work could be a review or an audit. Many organisations have their internal control processes audited,
in which case reasonable assurance would be provided in a positive form referring to the report rather
Pdf_Folio:447
than directly on the internal controls themselves.
Question 5.19
(a) Indicators for:
• Economy
– cost of buses
– cost of hourly maintenance service
– drivers’ salaries.
• Efficiency
– cost per bus service
– cost per client service
– cost per kilometre
– cost per client kilometre
– cost per bus hour.
• Effectiveness
– proportion of target population whose needs have been met
– proportion of clients satisfied with the service
– service reliability and on-time running.
(b) Criteria:
– targets against which results can be compared
– trends over time to see improvements
– comparative figures from similar organisations.
Question 5.20
Question 5.21
Measurement Source
(a) Efficiency
Gross/net cost per available hour/day Internal records/financial information
Gross/net cost per user Internal records/financial information
Labour hours per visitor Internal records
Labour hours per available hour/day Internal records
(b) Effectiveness
Total attendance/capacity Internal/box office records
Total days used/available days Internal records
Percentage increase in ticket revenue Box office records
Percentage increase in numbers attending Box office records
Pdf_Folio:448
Question 5.22
You might have listed any two of the following factors that may affect the selection of performance audits.
• Potential benefits, which can take many forms and include improvements in service/program delivery,
administrative and financial efficiencies, accountability and transparency, and performance assessment.
• Financial materiality related to annual expenditure, annual revenue and total assets.
• Risks to reputation and service delivery, including the visibility of the proposed audit topic and the
importance of its operations to parliament and the public.
• Priorities and capacity of the public sector auditor.
Question 5.23
Management system
Audit question or process Type of data
What is the wait time in the Patient management systems Time between patient registration (triage
emergency department? assessment) and examination (admission)
and discharge.
How is the customer call Call logs • Timeliness of answering incoming calls (wait
centre performing? times).
• Median duration of calls (top 5% and
bottom 5%).
• Percentage of calls not answered.
Note that there may be other systems, processes or sources of data that may be available to answer the
audit questions.
Question 5.24
1. TCSL must comply with the Department’s ‘Guidelines for procurement of medical equipment’ when
purchasing the accelerator. We are not provided with this document, but it is likely to contain rules
about approved suppliers, the tendering/purchasing process (including the type of supplier/equipment
documentation required), and so on. The auditor will gather evidence about TCSL’s purchases of the
linear accelerators and assess whether the guidelines were followed. If the guidelines are specified with
a great deal of detail, the audit will focus on ensuring that these guidelines were followed as specified.
If the guidelines are expressed loosely (e.g. ‘the firm should obtain a number of quotes’), the auditor
will need to use more judgment to assess compliance than if the guidelines are expressed precisely (e.g.
‘the firm will obtain three quotes’). The auditor will have to decide if the number of quotes obtained in
those circumstances is sufficient to satisfy the loosely expressed guidelines. Are two quotes sufficient?
If three quotes are required, the auditor could decide that two quotes are not sufficient, unless there are
extenuating circumstances (e.g. there are only two possible suppliers worldwide).
2. The performance audit examines economy, efficiency and effectiveness. The Auditor General would
consider criteria across all three dimensions. Some possibilities include the following.
• Economy. Cost of disposing of waste, cost of employees in waste disposal area; cost of transport of
waste; tipping fees; partition into general and clinical waste.
• Efficiency. Waste by weight, volume, and/or cost per patient, per department or ward (general and
clinical)
• Effectiveness. Extent of achievement of hospital’s planned improvements; total reduction in general
and clinical waste (volume, cost, method of disposal); effectiveness at sorting general and clinical
waste.
Pdf_Folio:449
Question 5.26
Compilation
• Level of assurance: None
• Opinion: There may be a report prepared to accompany the compiled statements which will state that the
information has been compiled from information and explanations provided, that the work performed
does not constitute a review or audit and that no opinion is given.
• Procedures: Compilations involve taking information provided by a client and summarising and
formatting the presentation of the information to meet a particular need. Examples of compilations
include the preparation of a financial report from a trial balance or other books and records for an
organisation or the compilation of a tax return from information provided.
Review
• Level of assurance: Limited assurance
• Opinion: The opinion will state that nothing has come to the practitioner’s attention to suggest that the
subject matter does not comply with the criteria. This is negative form assurance and gives a lower level
of comfort to the user than an audit.
• Procedures: Evidence gathered is largely restricted to obtaining representations from the management
team, or other responsible party and carrying out analytical procedures rather than detailed tests of
control and substantive procedures. This level of work will reduce engagement risk to a level that is
appropriate to the engagement.
Audit
• Level of assurance: Reasonable assurance
• Opinion: The opinion will state that in all material respects the subject matter complies with the criteria.
This is positive form assurance which clearly states to the users that the subject matter is free from
material error.
• Procedures: The auditor will plan the nature, timing and extent of procedures to provide sufficient
and appropriate evidence to ensure that engagement risk is reduced to an acceptably low level. These
procedures include: (1) obtaining an understanding of the engagement, (2) assessing risk, (3) responding
to those assessed risk, (4) performing procedures such as substantive tests and where necessary tests of
the effectiveness of internal controls, and (5) evaluating the evidence.
Pdf_Folio:450
(a) Integrity Outsiders might associate you with the illegal business.
(b) Objectivity There is a self-interest threat to objectivity. In Australia, given that the
fees generated by the audit client exceed 15% of the firm’s total fees,
an additional independent professional accountant must review the
work (APES 110, para. AUST 290.217).
The high fee revenue represents a self-interest threat.
(e) Professional competence and There may be a reason that this item is in a different location
due care (e.g. obsolescence).
(f) None If the loan is on normal lending procedures, terms and requirements,
it is immaterial to the audit client.
The loan may comprise an independence threat if it is made on
favourable terms.
(g) Objectivity This may lead to self-interest, familiarity and intimidation threats to
the objectivity of the assurance provider.
The practitioner’s relationship with the ex-colleague may comprise a
familiarity threat.
(h) Objectivity Self-interest and intimidation threaten objectivity — a bonus for early
completion is not allowed.
The bonus payment comprises a self-interest threat.
(i) Objectivity Self-review threat (for information system) and advocacy (for hiring
financial accountant) both threatening objectivity.
The practitioner has been involved in the selection of accounting
staff. Independence is compromised should those staff prove to be
incompetent or dishonest.
(k) Professional behaviour This is unacceptable professional behaviour that may bring other
member firms into disrepute.
Example 1.2
1. • Detailed independence policies that are documented and easily available in electronic format.
• Policies encouraging staff to consult on independence matters with relevant independence experts.
• Electronic databases of restricted investments (for staff members and their immediate families) —
staff and professionals to search their databases before acquiring a financial interest or financial
product.
• Partners and professional staff to confirm annually in writing that they have followed these policies
Automatic independence monitoring systems — partners and managers to regularly update their
investments, and those of their immediate family, into the monitoring system.
Pdf_Folio:451
Example 1.3
In this situation the auditor should exercise professional scepticism and perform appropriate follow-up
work. ISA 200, paragraph A24 notes that the auditor must not be satisfied with less-than-persuasive audit
evidence because of a belief that management and those charged with governance are honest and have
integrity. The representations of management are not a substitute for sufficient appropriate audit evidence,
and follow-up procedures should be carried out on these debtors.
Example 1.4
The following factors will affect the audit plan.
• Products such as computer parts may become obsolete due to changes in technology. This will result in
increased risk associated with inventory valuation.
• The bank loan being dependent on achieving a profit creates an incentive for management to make the
financial result look better than it is.
• Moving the manufacturing to China will mean that there will be additional foreign currency issues to
consider. Transportation costs must be correctly accounted for in inventory valuation, and goods in
transit might create some cut-off problems.
• The loss of sales due to poor quality might affect stock obsolescence and saleability of inventory.
• The small profit, combined with lost sales and Galaxy Ltd.’s dependence on earning a profit to maintain
its loan, indicate a potential going concern risk.
• The sales commission creates an incentive for sales staff to overstate sales by processing fictitious sales
or recording the next period’s sales in the current period.
• Converting the computer system increases the risk of errors through incorrect conversion or rejection of
data by the new system. Completing the conversion only one month before year-end increases the risk
of errors in the financial statements.
Example 1.5
• Performance audit
• Performance audit
• Performance audit
• Financial statement audit and/or performance audit
• Financial statement audit and performance audit†
• Performance audit
Note: It is worth noting that compliance with legislative and other requirements could be included in
either the financial statement audit or the performance audit, depending on the legislation or requirement.
If the legislation or requirement is related to financial reporting, then it will be included in the financial
statement audit report; if it is not, it would be included as part of the performance audit.
Example 1.6
While automation can represent opportunities for efficiency and effectiveness, unintentional or intentional
human errors in the implementation of automation represent risks that an auditor must understand and
address. For example, based on the inconsistencies and obstacles described above, the auditor needs
to consider the impact of potential failure of internal controls, specifically those controls related to IT.
Auditors should focus on understand the nature and impact of API/RPA, including through communica-
tions with management, so that audit planning could focus on risks identified.
Pdf_Folio:452
MODULE 2
Example 2.1
The following factors impact on the inherent risk of LRS Ltd.
Factors that increase inherent risk Factors that decrease inherent risk
• CEO wants more aggressive accounting policies • Significant experience in the hotel industry
• Wide disparity of operations • Existence of audit committee and independent
• Chairperson is also CEO chairperson
• Board and shareholders dominated by one family • Low debt–equity ratio
• Only one independent board member
• Credit restrictions
• Depressed share market
• Future public offering
Example 2.2
(a) The following facts increase inherent risks at the financial statement level.
• History of cutoff errors and there may be similar errors this year.
• Bonus scheme that is closely related to profitability.
• Going concern issues related to cash shortages, build-up of accounts payable and collection problems
with debtors.
• Pressure to improve balance sheet to make the organisation look more attractive in order to obtain
credit.
• Impact of drought and water restrictions on sales and profitability.
(b) The inherent risks at the assertion level for inventory are:
• slowdown in demand can cause a drop in prices and cause inventory write-downs
• incentives to overstate inventory numbers and valuation
• theft during the year and the implications for existence
• foreign exchange implications for valuation of inventory.
The inherent risks at the assertion level for trade debtors are:
• slowing in debtors collection and implications for the allowance for doubtful debts
• incentives to overstate debtors to increase profits and bonuses.
(c) The following facts increase control risk.
• Move away from centralised purchasing and the problem of different stores following different
policies.
• Making the control environment more complex with the range of different purchases.
• Reduced size of the internal audit department.
• Thefts during the year — control policies may not be working for part of the year.
• Credit controls over debtors not always operating.
The following facts decrease control risk.
• Improvements in security of inventory and policies related to goods received and releasing goods
from the storeroom.
Example 2.4
ISA 210 paragraph A30 outlines the circumstances when it is appropriate to remind the entity of the existing
terms of the engagement. The factors relevant to this case listed in ISA 210, paragraph A30 are:
• a significant change in nature or size of the entity’s business
• any indication that the entity misunderstands the objective and scope of the audit.
Therefore, it is necessary to send out an engagement letter because the company is expanding and the
statement by the CEO referring to the auditor’s ‘preparation of our financial statements’ indicates that
management misunderstands the objective and scope of an audit.
Pdf_Folio:453
Assertion Justification
1. Completeness The account balance is inventory, and an amount that should have been
recorded in inventory has not been included.
2. Existence As the items have been mistakenly counted twice, some items included in the
inventory sheets do not exist.
3. Completeness The definition of completeness as per ISA 315 includes ‘all related disclosures
that should have been included in the financial statements have been included’
(ISA 315, para. A129). The presentation assertion refers to ‘appropriately
aggregated’, ‘clearly described’ and ‘relevant and understandable’. If the
disclosures had been included, the presentation assertion would have been the
correct assertion.
4. Rights and obligations In this case, the company does not hold or control the asset (ISA 315,
para. A129). Existence is not the correct assertion as the inventory does, in
fact, exist.
5. Accuracy, valuation In this case, the inventory has not been included at an appropriate amount as
and allocation the resulting adjustment to net realisable value has not been made.
6. Occurrence This is a transaction, and as the items had not been shipped, the sale has not
yet occurred.
7. Accuracy This is a transaction that has not been recorded appropriately (see definition of
accuracy in ISA 315, paragraph A129).
Note that the first five parts of the question relate to assertions about account balances, and related
disclosures at the period end (ISA 315, para. A129(b)). The last two parts of the question relate to changes
of transactions and events, and related disclosures (ISA 315, para. A129(a)).
Example 2.6
When companies are close to break even, and there are large fluctuations in net profit, it is unlikely that net
profit before tax is the appropriate benchmark. Given sales or total assets are much less likely to fluctuate,
one of these can be a more appropriate benchmark.
Example 2.7
1. The audit plan will need to allow for additional testing of the monthly data sent to head office. The
materiality of the areas affected by the poor quality reporting needs to be determined as this will affect
the audit plan.
2. The audit plan should reflect that these facts could affect the nature, extent and timing of audit
procedures related to PPE and liabilities related to potential redundancies. In particular, the auditor
would need to consider how far these plans have gone and the implications for the valuation of PPE in
those countries. Potential employee costs, including redundancy payments, need to be considered.
3. The auditor would need to review the contract to assess the impact on the audit plan. Is the entity
complying with the contract and are there penalties for non-compliance? Are there exchange rate
implications?
4. The implications of these facts would need to be considered in revising the audit plan related to
contingent liabilities, inventory valuation, collection of debtors, brand name valuation and going
concern.
Example 2.9
• The members of the engagement team to be included when the meeting occurs.
• The extent of the discussion which will be affected by the roles, experience and information needs of
the engagement team.
• Determining whether the meeting should be face-to-face, by telephone or computer link.
• Preparation expected prior to the meeting.
• Determining whether the meeting should be a brainstorming session or a presentation by a senior staff
member with follow-up discussion.
Pdf_Folio:454
Example 2.11
Technique to assess
General control Specific control Purpose of control control
System develop- • User participation in • Assure that system meets • Review manuals
ment system design user needs • Review the system
• Preparation of documenta- • Provide explanation of documentation
tion on system description system design
Operations • Operator manuals and • Ensure proper and efficient • Review manuals and
instructions use of IT observe operations
• Control features to monitor • Ensure that data are • Review organisational
data and system changes controlled and changes functions and
authorised procedures
Example 2.12
General Control Concerns
Segregation of Functions
The use of IT generally implies that, due to increased processing speed, fewer people will be required to
carry out data-processing activities. In CWC’s case, there is a concentration of functions and knowledge,
which means many conventional controls, based on the segregation of incompatible functions, are no longer
possible. In particular, Jing has too much control and a significant amount of authority over the IT system
and individual e-commerce application programs. Jing seems to be performing the role of an IT manager
who is also responsible for writing application programs. Jing also seems to be performing the tasks that
would normally be carried out by a systems analyst. These functions are incompatible and should be
segregated. It represents a serious control problem that can only be corrected by employing more staff.
People involved with running IT systems should be organisationally independent of user departments.
Jing wrote the application programs that initiate the transfer of credit card receipts to CWC’s bank account
and reconcile credit card deposits with individual customer sales accounts. When one considers that Jing
is also expected to manually prepare and complete CWC’s bank reconciliation, a control issue again arises
regarding incompatible functions.
Jing should not be involved in maintaining the local area network and the website. This represents a
serious control issue — especially given Jing’s other duties.
Pdf_Folio:455
Example 2.15
Risks include:
• decreased profitability
• holding excess inventory
• potential for slow collection/recovery from debtors (there is strong competition among suppliers, so
retailers have more choice, and the suppliers may have to accept slower payments from them as a result).
From an audit planning perspective, this has implications for the valuation of both inventory and trade
debtors. There are also potential going concern issues to be considered.
Example 2.16
Failure to deliver products on time is likely to cause loss of customer satisfaction and erosion of market
share in a competitive market. This is likely to lead to a loss of revenues and profits. From an audit
perspective, it may lead to going concern problems. It also has implications for the impairment of non-
current assets and collectability of trade debtors.
Example 2.17
From the above ratios, it can be seen that the ROA has increased from 10% to 12%. In general, this could be
due to either an increase in asset turnover or net profit margin. In this case, it must be net profit margin (as
asset turnover is constant). The increase in net profit margin is not due to a higher gross profit margin
(i.e. constant at 30%), so it must be due to reduced operating expenses. In this case, it is likely the
Pdf_Folio:456
Example 2.18
• There is a trend upwards for both trade debtors and inventory as a percentage of total assets, and both
figures are higher than for competitors. Inventory and debtors turnover rates should be followed up.
• COGS is higher than for competitors but it is improving for MNO Ltd over the four-year period.
• Interest is a higher percentage than for competitors but non-current liabilities are generally smaller.
• Depreciation is decreasing and is lower than for competitors but so are non-current assets.
• Profit after tax is considerably lower than for competitors (as a percentage of expenses). This should be
considered in relation to the information obtained as part of the strategic analysis of MNO Ltd.
• There has been an increase in returns. The reasons should be ascertained.
Example 2.20
The outliers significantly above the straight line may indicate overbillings and those below the straight line
may represent underbillings. These outliers represent items of interest to be investigated. The ADA links
each invoice to the underlying data which will enable efficient and effective follow-up by the auditor.
Example 2.21
This scenario is a good example of the types of problems faced in a small business environment. The
following issues have been identified as issues of relevance to the auditor.
• One of the main issues is clearly segregation of duties. Elizabeth undertakes all of the accounting-related
tasks. She has little accounting training, and there are not many checks on her work.
• The company uses a reputable software package, but there must be concerns about the general
control environment, which may override any controls built into the software. Many people use easily
recognisable passwords, such as their children’s or their pets’ names. Thus, it is possible that people can
get onto the system. The manuals are there for all to use. These should be stored securely.
• The accounting records are not well safeguarded. The office is behind temporary partitions, and all staff
and customers would potentially have access to the computer and supporting documents that would be
maintained in the office.
• Inventory, which is likely to be their major asset, is not well safeguarded. Additional stock is sitting
on shelves behind temporary partitions, and again would be accessible to all staff and any customers
wandering through.
• It is not very clear from the case study as to how much reliance can be placed on the integrity
and competence of the husband and wife owners/managers.
The audit approach that would most likely be undertaken is a primarily substantive audit. The weak-
nesses in the general control environment would be considered to be pervasive, which means that the
control environment would not be considered reliable for providing audit evidence, and therefore tests
of application controls will not be undertaken. The auditor will extend their level of substantive testing,
particularly in the area of their major asset, inventory.
MODULE 3
Example 3.1
1. The assertions at most risk of material misstatement will be existence and accuracy, valuation and
allocation.
2. The overstatement can only be achieved by including debtors that do not exist in the trade debtors’
balances or by overstating the valuation — for example, by understating the allowance for doubtful
debts.
3. The appropriate response will then be to gather evidence that the trade debtor exists (e.g. an external
debtor’s confirmation) and that the client has valued these correctly (e.g. undertaking procedures such
as concentrating the auditor’s attention on amounts that are well overdue). This will enable the auditor
to see whether there should be an allowance for these in determining the appropriate amount for the
allowance for doubtful debts.
Pdf_Folio:457
Example 3.5
Using CAATs testing for all transactions would look better.
As you can see from this example, a major benefit of using CAATs is that you can now test the total
population, allowing you to claim this in your report. This can add more weight to your observations and
make it easier for you to communicate to the business how you reached your conclusion.
Example 3.6
If the software control is working, employee A’s transaction will be accepted, and employee B’s transaction
will be rejected and written to an error or exception report.
Example 3.7
Test data could be used to do the following.
• Identify the controls contained in the program (program controls).
• Prepare transactions designed to test the program controls. These transactions should contain errors such
as invalid employee numbers, incorrect pay rates, calculations contrary to the union agreement, negative
leave entitlements and abnormally large entitlements.
• Process transactions using the client’s annual leave pay program. Ensure that the version of the program
the client usually uses in production is tested. The auditor should consider the adequacy of library
controls and other general controls that ensure the correct version of the program is used.
• Obtain a printout of the details of the processing of the transactions through the client’s program. It is
expected that transactions containing errors will be excluded from processing and written to an error or
exception report for follow-up.
• Compare the auditor’s prior expectations and check that the errors were all identified. If the output is
in accordance with the auditor’s expectations, then this gives the auditor greater confidence that the
program is working as they believe, and that they can rely upon key controls.
Example 3.8
Order Order Order Unit Vendor GL
number type date Store Quantity Unit Description price Received code code
dPf_Folio:458
Example 3.9
Company That Rents Storage Space
1. In this situation, multiplying the number of square metres available by the charge per month per square
metre would provide an accurate estimate of revenue.
2. When the storage space is not fully occupied, then it is necessary to adjust each month’s estimated
revenue by the occupancy rate, which is likely to be based on past history.
Hotel in a Tourist Destination
1. Due to the variability, the construction of the model for the reasonableness test becomes much more
complicated.
Example 3.10
1. It first needs to be acknowledged that the numbers used in calculating the 20X9 ratios are unaudited,
so they need to be interpreted with caution.
From Table 1, ‘Huggins Ltd results for 20X6–20X9’: An improvement in company trends between
20X6 and 20X9 is shown. Net profit as a percentage of sales increased in 20X8 and 20X9 after a drop
from 20X6 to 20X7.
However, there are large changes between 20X6 and 20X7 in all the other ratios, except for inventory
as a percentage of sales and sales commission as a percentage of sales.
Further, abrupt changes occurred between 20X7 and 20X8 in:
• debtors turnover
• PP&E as a percentage of sales
• inventory as a percentage of current assets
• PP&E as a percentage of total assets
• working capital.
Abrupt changes occurred between 20X8 and 20X9 in:
• debtors turnover
• the current ratio
• repairs expense as a percentage of sales.
Gradual trends or small changes in these ratios, but not the fluctuations shown in Table 1, would
be expected. Trade debtors, inventory and PP&E should be given special audit attention for 20X9.
From Table 2, ‘Competitor analysis for 20X8’: The competitor analysis is undertaken on 20X8
data, as these are the latest competitor data available.
Inventory turnover is slower than for competitors.
Also, debtors turnover is slower than for competitors, raising potential issues related to the
accuracy, valuation and allocation assertion for receivables.
Inventory as a percentage of sales, inventory as a percentage of current assets, and PP&E as a
percentage of total assets appear high for Huggins Ltd compared to its two competitors.
Huggins Ltd’s ratio for PP&E as a percentage of sales appears unusually high.
These ratios may be indicative of overstated inventory and PP&E accounts.
2. (a) It would be very unlikely that substantive analytical procedures could be used to eliminate tests
of detail for trade debtors. It is unlikely that substantive analytical procedures will be sufficiently
effective in assessing the risk of material misstatements for specific assertions for this account
Pdf_Folio:459
balance. It is also very unlikely that a sufficiently precise expectation or an acceptable amount of
Example 3.11
1. Bonus plans and share ownership can create incentives for managers and other employees to manage
earnings. The fact that the CEO is concurrently chairperson of the board of directors is likely to
exacerbate the situation. Auditors need to be aware of the motives of potential employees when such
incentives are in place.
2. (a) This method overstates inventory, reduces cost of goods sold and increases profit.
(b) This method overstates sales and trade debtors, and increases profit.
(c) This method understates liabilities and expenses/inventory and increases profit.
(d) This method understates cost of goods sold and liabilities (accounts payable) and increases profit.
3. (a) (i) Check the pre-numbered stock count sheets.
(ii) Observe the physical stocktake and compare the perpetual inventory records to the count sheets.
(b) (i) List the sales transactions of a few days before and after the financial year-end, and check that
the accounting entries associated with them are recorded in the correct period.
(ii) Check the debtors’ confirmations.
(c) (i) Examine the subsequent payments to suppliers.
(ii) Examine the orders not matched with vendor invoices.
(d) (i) Examine the creditors’ confirmations.
(ii) Examine the subsequent payments to suppliers.
Example 3.12
There are two issues with inventory valuation; firstly confirming that the inventory physically exists and
that the count is correct, and secondly verifying that the inventory is correctly valued and that adequate
provision has been made for damage or obsolescence.
The generalised accounting software (GAS) package can assist with both of these tasks. Audit team
members will check the client’s count of some inventory items. Time and cost reasons mean that it is only
economic for the auditors to check a sample, and provided that there are not a significant number of errors
and other problems, then the auditor may assume that the other item counts are also correct. The GAS
package can be used to identify the sample to check. This would normally be the items with the x% of
highest unit values and those with the highest y% of total values.
Similarly, it may be used to identify irregularities in the inventory master file, for example, items with
negative quantity or negative unit value, and slow-moving items or items which have not been issued for
(say) two months, which may indicate that they are out of season and possibly may be no longer fashionable
next (say) winter.
Example 3.13
The auditor will probably undertake a positive debtors’ confirmation procedure to obtain evidence relating
to the accuracy, valuation and allocation assertion for the trade debtors’ balance.
Example 3.14
Under MUS, the understatement would have reduced the number of sampling units from 1000 to 10.
Therefore, this debtor is less likely to be selected than it would if there was not an understatement error.
Pdf_Folio:460
Example 3.16
1.(a) General controls, particularly access controls, are especially important in a business-to-business e-
commerce system. Access can be limited to those approved suppliers, and the performance of the
hub manager is important. If the accepted supplier is not doing their job (e.g. not delivering on time
or goods delivered are not up to the expected standard) the risk is limited, as Pet Ltd would not
transfer payment until it was satisfied that it had received what it had ordered. If Pet Ltd was not
satisfied with what it was receiving, it would withdraw from using this hub.
(b) Greater. The risks are much lower in being associated with a business-to-business e-commerce hub
than with a business-to-consumer e-commerce system, especially in relation to controls over access.
This is because of the hub manager’s control procedures and the fact that Pet Ltd will become familiar
with the reliability of the suppliers, as there will be an expectation of a continuing relationship
with the suppliers that are approved for a business-to-business e-commerce hub. With business-to-
consumer e-commerce, the likelihood of continuing business is significantly less.
2.(a) Test data involve the auditor preparing simulated transaction data. This is designed to test the program
controls in the system. The test data will include both correct data and incorrect data. The test
transactions can be entered through the system in an online mode, or more commonly, they can
be run through the program in an offline environment on a copy of the client’s inventory file.
(b) The easiest way to discuss test data is through the program controls that should be resident in such
systems. Such program controls include terminal device edit, reasonableness and other validation
tests, for example:
i. checking inventory number to authorised list of inventory numbers
ii. a reasonableness check on agreed cost price, number of inventory items on hand or total cost.
3. You might have included any three of the following exception reports relating to accuracy, valuation
and allocation assertion for inventory:
i. total cost significant, date of last usage greater than x months ago
ii. total cost significant, total usage year-to-date small
iii. total cost significant, date of last purchase greater than x months ago
iv. total cost significant, total purchases year-to-date small.
Note that there may be other exception reports that relate to the accuracy, valuation and allocation
assertion.
These reports would be used to help the auditor identify inventory that has a higher risk of obsolescence.
Example 3.17
1. On the basis of the information provided, the auditor would reassess the risk of material misstatement,
from ‘low’ to ‘high’, for Clark Ltd in relation to related party transactions. The reason for this is that
information gathered during the course of the audit suggests that Clark Ltd may be selling profitable parts
of the business (lucrative segment) to related parties, specifically the joint venture between Wing Chan
and the Clark family. At the same time, they are bringing into Clark Ltd additional ventures that are risky
and for which the business rationale is unclear. (The synergies between a company importing swimming
pools and pool chemicals and uranium exploration are unclear.) It is also possible that the parties involved
with this transaction are associated with related parties, as Wing Chan has a number of mining interests in
Australia (the owners of these mining interests need to be identified by the auditor). The incentive to do this
appears to be the fact that the Clark family is considering selling their shareholding in Clark Ltd to China
Overseas Company. Therefore, the possibility is that the family is going to strip the company of lucrative
assets and load it up with assets and ventures that have been unprofitable.
2. The auditor needs to understand the rationale for the transactions that have occurred, which appear to be
outside the normal course of the Clark Ltd business, and not just accept management’s suggested business
rationale. The auditor should carefully consider the terms of the sale of the pool chlorine line segment and
carefully examine any records, documents and/or contracts of sale that can be provided about this matter.
In particular, the related parties’ auditing standard (ISA 550, para. A22) requires the auditor to concern
themselves with any contracts and agreements that are not in the entity’s normal course of business.
This may also lead the auditor to re-evaluate fraud risk factors that may be present in the form of
fraudulent financial reporting and may have been undertaken to deceive. The auditor should enquire
Pdf_Folio:461
MODULE 4
Example 4.1
(a) Adjust. The financial statements for the year ended 30 June 20X9 should be adjusted. The circum-
stances making up this event occurred before balance date. The company now has a quantifiable amount
that it can include as an expense and a liability, and this should be included in the accounts.
(b) Disclose. The financial statements for the year ended 30 June 20X9 should disclose the intention to
take over the private engineering partnership. This is a significant event that could be expected to affect
the decision-making process of the financial statements user, and as such, it needs to be disclosed.
(c) Disclose. It could be expected that this fire and the potential financial loss (which may be material)
would be a significant event that could be expected to affect the decision-making process of the
financial statements user. As such, it needs to be disclosed.
(d) None. Neither adjustment nor disclosure is appropriate. Company plans are not an explicit part of the
financial statements. Selective disclosure of goals and plans would be misleading.
Pdf_Folio:462
Profitability
Revenue has fallen by approximately 6% which may reflect difficult trading circumstances, but gross profit
margin has fallen significantly from 47% to 40% and profit before tax to revenue has fallen from 13% to
2%. This indicates that at the gross profit level the company is struggling to maintain margins either through
maintaining selling prices or controlling costs. This will put significant pressure on cash flows. This has
translated into lower profit before tax. More detail on specific expense categories is required to complete
the analysis.
Non-Current Assets
There has been significant expenditure on non-current assets (increase of 35.6%) which has not been
translated into higher sales (reduced by 5.6%), again putting pressure on cash flows. The details contained
in the audit file with regard to the specific assets purchased, their timing and how they were financed is
needed to get an understanding of the new assets. Depreciation policy should be carefully reviewed to
ensure useful lives appear appropriate.
Liquidity
The current ratio indicates that the company may not be able to meet its short-term commitments when
they fall due as it has declined from a healthy 2.18 times to 0.55 times. It should be maintained above 1.
The quick ratio indicates that the entity’s liquid assets no longer cover current liabilities (reduced from
1.09 times to 0.19 times). It appears that the entity’s liquidity situation is deteriorating, indicating that the
future viability of the company may be in doubt. The auditor should compare the entity’s ratios with the
industry average to assess Jobstone’s liquidity relative to close competitors.
Pdf_Folio:463
3. Debtors
(i) 2 510 2 510 (2 510) 2 510
1 476 1 476 1 476 (1 476)
(ii) 2 080 2 080 (2 080) 2 080
The objective of the summary schedule is to be able to assess the aggregate errors to compare them to
materiality. This also has a benefit in that some of the errors may offset one another, and the summary
schedule enables the auditor to gain a better overall perspective.
In relation to a determination of whether the financial statements are materially misstated, a determi-
nation of final materiality would firstly need to be performed. The most common method would be by
using final net profit. Assuming 5% of net profit was appropriate, then materiality would be set as $5000.
In this case, it is the same as planning materiality which was determined during audit planning. As the
total misstatements are more than $5000, the total aggregated misstatements indicate that the financial
statements are materially misstated.
Example 4.4
(a) Factors that should be taken into account by the auditor in forming an opinion include:
• other current and non-current liabilities (including contingent liabilities) besides the disputed bank
loan
• the likelihood of receiving regulatory approval for sale of the anti-obesity drug within the coming
12 months
Pdf_Folio:464
Example 4.6
The events or conditions are as follows.
• Paying suppliers late. This suggests cash flow problems and/or poor management of creditors.
• Demands from suppliers for cash on delivery. This creates additional cash flow problems because SS
does not have the ability to receive and sell goods before paying suppliers. The additional cash flow
problems will require SS to raise or source cash (probably at a cost) from a bank (i.e. requesting bank
overdrafts or increasing it) or by delaying payments to other parties and/or accelerating cash receipts by
discounting goods. These actions are likely to increase costs and reduce profits.
• Correspondence between SS and the bank. The cash flow problems appear to be ongoing since 20X6.
SS’s cash position appears to be deteriorating, with no positive action taken.
• Change of auditor. A change in auditor is not by itself a sign that there are going concern problems.
However, one possible reason for the change in auditor is difficulties between the client and the previous
auditor about the appropriate treatment of certain items and/or audit report qualifications. The change
in auditor might be late in the year, hampering the audit firm’s ability to conduct appropriate procedures
for client acceptance (such as conversations with SS’s bank and previous auditor).
Example 4.12
(a) The auditor would have to be satisfied with all the disclosures contained in the financial statements of
Idealic (Australia) Pty Ltd. Although the auditor may not be able to confirm balances that Idealic
(Australia) Pty Ltd have with Idealic (SA) Pty Ltd, they should attempt to gain evidence from
alternative procedures. In particular, the auditor would need to gain evidence to support the related
party transactions (the significant inter-entity transactions), ensure that the related party disclosures
were appropriate, and expect that the entity would disclose, as an after balance-date event, that one of
their major trading partners had been required to halt operations as a result of the withdrawal of staff
for a period of time after balance date. If the auditor is satisfied in all these areas, they may be in a
position to issue an unmodified opinion.
(b) Disclaimer of opinion. On the basis of the information provided, it does not appear that the consolidated
entity will have access to the accounts of the South American subsidiary in order to prepare
consolidated accounts. Because of the significance of this scope limitation, which has occurred as
a result of circumstances beyond the control of the entity, the auditor will have to issue a disclaimer
of opinion. This is despite the fact that Idealic (SA) Pty Ltd is in a break-even situation and, therefore,
not contributing to consolidated profit.
Example 4.19
(a) Suggested improvements are as follows.
• Letter should be addressed to the audit committee with copies to Ms Poon and Mr Sullivan.
• Letter refers to ‘major weaknesses’; however, in reality, all weaknesses are usually reported. The
matters in this letter do not appear to be particularly ‘major’.
Pdf_Folio:465
Other matters that the auditor may consider to include in the communication with those charged
with governance are:
The general approach and overall scope of the audit
The selection of, or changes in, significant accounting policies and practices that have, or could have,
a material effect on the entity’s financial report
The potential effect of any significant risks and exposures
Audit adjustments
Material uncertainties that may cast doubts on the entity’s ability to continue as a going concern
Disagreements with management
Expected modifications to the auditor’s report
Any other matters agreed on in the terms of the audit engagement.
(To reduce the risk of litigation some firms report all matters, even though some may be minor.
Minor matters are generally included in an appendix to the main body of the letter.)
MODULE 5
Example 5.1
Note: The following answer is constructed on the basis of the Diabetes Victoria’s 2018 concise financial
report. The independent auditor’s report on this concise financial report is standard and so this suggested
solution will apply to most independent auditor reports on concise financial reports.
Pdf_Folio:466
In the auditor’s opinion section, it is stated that ‘in our opinion, the accompanying concise financial
report of … complies with Australian Accounting Standard AASB 1039 Concise Financial Reports’.
Therefore, the auditor will be undertaking the audit in order to determine any material non-compliance
with this standard.
(b) The procedures that will be undertaken in respect of the audit of the concise financial report will usually
be of three forms. For information that is taken directly from the full annual report, such as financial
information, the procedures will include testing that the information in the concise financial report
is derived from, and is consistent with information contained in the full financial report. For other
information that was not directly derived from the full financial report, such as the accompanying
discussion and analysis of the financial information, the procedures will include examination, on a
test basis, of evidence supporting the amounts and other disclosures. Third, other information in the
annual report will be read to determine whether it contains any material inconsistencies with the
concise financial report. For the Independent Auditor’s report to the members of Diabetes Victoria,
the auditor’s procedures are outlined in the third paragraph under the subheading ‘Information Other
than the Financial Report and Auditor’s Report Thereon’.
(c) The opinion that will be offered is that the concise financial report of the audit client complies with (or
departs from) Australian Accounting Standard AASB 1039 Concise Financial Reports.
(d) Compliance framework. It can be seen that the form of the audit opinion (i.e. it includes the words
‘complies with’) is that which is issued under a compliance framework rather than the type of opinion
that would be issued under a fair presentation framework. Compliance engagements will be discussed
later in this module.
Example 5.2
Relevant Partly This relates to what the organisation is trying to achieve, which is to
improve the quality of service to emergency patients. It is important to
find measures that fully capture the ‘quality’. There is a need to measure
the effectiveness of the treatment beyond asking the patient for an
assessment. While there are difficulties in measuring the effectiveness
of the treatment (e.g. correctness of diagnosis, quality of bandaging or
survival/improvement in condition of heart-attack patients), it is often better
to try to measure important objectives imperfectly rather than ignore them.
Quantifiable Partly Yes/No questions for satisfaction fail to register differences between
someone just satisfied compared to someone very satisfied. While such
questions can be quantified as 0/1, this is probably inadequate to provide
the information required. Additionally, the customer satisfaction questions
are not well defined. For example, what is meant by ‘quality of treatment’?
Attributes may be interpreted differently by different people.
Verifiable No Are the measures collected in such a way that allows other people to
check or validate the measures? Given the data is collected by different
staff, depending on who is on duty, comparison over time may be difficult
because of inconsistency in the method of recording. It is unlikely that the
measures would be statistically valid as any two or more days each week
can be used to collect the data. Busy days are probably avoided. The data
is likely to be unreliable
(continued)
P df_Folio:467
Free from No There are no independent reviews of the performance measures and,
bias depending on how the measures are used, there may be incentives to bias
the results. Some of the measures (e.g. patients seen within 30 minutes
of arrival) can lead to dysfunctional activities (e.g. treating less critical
cases first as they may take less time to assess). The length of time to
discharge may result in early discharge, telling patients to go home and
return if symptoms return or sending patients in wards home earlier to
allow emergency patients to go to the wards.
Balanced No While the questions asked are relevant to the hospital’s service provision,
it is likely that other measures could be introduced for the sake of
completeness. Outcomes other than satisfaction are probably relevant. The
measures should probably be reviewed and revised at the end of the first
period. It would be difficult to attribute improvements in life expectancies
to changes in the hospital emergency procedures, as many other hospital
and community programs could influence life expectancies.
Cost-effective No While measures are collected only two days per week, time data on service
must be collected and customer satisfaction questions must be asked
and the answers recorded. The system is time-consuming and likely to be
uneconomical. Existing information should be considered for suitability
before designing new measures.
Time-based Partly The data is reported only every six months, making it difficult to take timely
and timely corrective action. Two of the questions are time-based.
Example 5.3
The following report draws on the case facts to provide an assurance report in accordance with ISAE 3000
(Revised), paragraph 69. Items in the following list are cross referenced to the standard.
(a) Independent Assurance Report
(b) To the Management of RST Ltd
(c) We have reviewed RST Ltd’s disclosure of its balanced scorecard targets and actuals for each of its
divisions and the reliability and relevance of the financial and non-financial performance measures
presented for each division, for the year ended 30 June 20X9. This assurance engagement was designed
to provide reasonable assurance.
(d) The balanced scorecards of RST Ltd were examined for conformity with criteria provided by
International Performance Management Ltd.
(e) N/A
(f) N/A
(g) The determination of the measures to include in each division’s scorecard report, and the completeness
and accuracy of the reported results, are the responsibility of RST Ltd’s management. Our responsibil-
ity is to express an opinion, based on our assurance engagement, of the conformity of the performance
measures with the relevance and reliability criteria of the International Performance Management Ltd.
(h) Our assurance engagement was performed in accordance with the International Standards on Assurance
Engagements (ISAE 3000 (Revised)).
(i) The assurance firm applies an International Standard on Quality Control (ISQC), ISQC 1 Quality
Control for Firms That Perform Audits and Reviews of Financial Statements, and Other Assurance
and Related Services Engagements.
(j) The assurance firm complies with the independence and other ethical requirements of the International
Ethics Standards Board for Accountants’ (IESBA’s) Code of Ethics for Professional Accountants.
(k) Our assurance engagement included:
1. obtaining an understanding of the strategic objectives and goals of RST Ltd and each of its divisions
2. assessing whether the selected performance measures relate to the chosen strategy for each division
3. assessing the procedures used to produce the reported results
4. selectively testing the reported results
5. performing such other procedures as we considered necessary in the circumstances.
Pdf_Folio:468
Example 5.4
There needs to be:
• an executive summary that includes:
– the audit objectives and coverage
– the audit criteria used
– the overall conclusions
– a list of specific recommendations.
• an introduction that includes:
– the audit content
– the audit approach
– the audit criteria
– the audit scope.
There should also be a separate section on planning procurement activities, conducting procurement,
record keeping, monitoring and reviewing. Each section should systematically set out the issues addressed,
the audit work done, the conclusions reached and specific recommendations. Examples of best practice
should likely be included in each section. Subsections could be used where appropriate; for example,
conducting procurement could have tender processes, ensuring non-discrimination and procurement
support.
A final section should outline the main findings and conclusions of the audit. Any assumptions made
should be included. For example, the conclusion that a costs swing of between 10% and 40% can be made
is very broad. Where exactly will the savings be made and what are the circumstances/assumptions for a
specific amount of savings?
Example 5.5
Risks Improvements
(a) Systems are inadequate to keep pace with Review the current systems in place and establish
growth, and risk in the business has increased areas for improvement. This could include
with the taking on of more debt. Not severe considering implementing a new and more suitable
in the short term but, in the longer term, may system. The COSO framework and/or the AS/NZS
lead to difficulties in recording and managing ISO 31000 Risk Management — Principles and
the business’ transactions, activities and Guidelines framework could be used to aid this
growth. This may, therefore, cause the collapse review.
of this business.
(b) There is no management agreement in place Implement a management agreement to manage the
to manage the arrangement with the building arrangement with the building manager.
manager. As a result, the business manager
may fail to perform according to expectations.
This risk could be classified as severe because
the management of the buildings is a key source
of revenue. This could also cause damage
to reputation.
(c) Current KPIs do not address student complaints. Introduce KPIs around student complaints, and
This risk will be severe in the medium to introduce mechanisms to action performance below
longer term because students will seek other target. Produce a communications plan to manage
accommodation. relations and expectations.
P df_Folio:469
Example 5.10
It appears that ‘yes’ or ‘no’ judgments were made as to relevance and appropriateness. As it could be
argued that there are degrees of relevance and appropriateness, these judgments could have been made on
a finer scale (e.g. a seven-point scale moving from ‘highly relevant’ to ‘not relevant’).
Example 5.15
(a) Accountability in the public sector requires the parliament to allocate resources to departments and
government agencies. It then approves the uses to which these resources are put and specifies the
expected outcomes of the programs or initiatives. The accountability process also includes the relevant
departments and agencies reporting back to parliament on the use of the allocated resources and
results achieved.
Performance audits are carried out by or on the behalf of the auditor-general to provide assurance to
parliament that public resources have been used appropriately.
(b) The audit objectives in these circumstances would be:
• to assess the economy, efficiency and effectiveness of supplying food and food distribution services
to SDF personnel to identify possible areas of improvement.
(c) The audit criteria for assessing the economy, efficiency and effectiveness of current administrative
arrangements would include the:
• clarity and comprehensiveness of the SDF policy guidelines
• adequacy of SDF’s coordination of food rationing and distribution arrangements
• adequacy of procedures and planning guidelines for food rationing and distribution at the three
service levels
• extent to which performance information and benchmarking would assist with the management
of messes — whether managed internally or provided by private contractor’s existence and adequacy
of management systems to evaluate SDF’s catering contracts.
(d) Economy. In this instance, economy is concerned with the purchase and supply of the appropriate
quantity and quality of food, and the use of human and physical resources at the appropriate times and
at the lowest reasonable cost. Some of the indicators that would help ensure economy would include:
• reduction in cost per unit measure of food provisions and food-related services provided
• benchmarking of SDF’s food provisioning costs against the costs of private providers and against
providers that have contracts outside the SDF
• reduction in cost of contracts with private providers.
Efficiency. In this instance, efficiency is concerned with the productive use of financial, human and
physical resources to both purchase and supply food to SDF personnel. In effect, efficiency is trying to
Pdf_Folio:470
Example 5.16
(a) This is a matter of judgment; arguments can be extended both for and against the proposition that Peter
has cast the scope of the examination too widely. For instance:
Not all grounds/games/rest spells This would be so even if all teams played each other twice, and
are comparable (e.g. roofing, variation in playing conditions would be present even if only one
lighting, temperature) and, so, location was used. Perhaps there is more validity to the argument
there is inequity in the draw. concerning the need for an equal number of rest days between matches
for all teams, as this is something within the league’s control.
Certain dates exist when There is transparency about the dates and teams involved in that these
particular teams have to play are annual events, and presumably the draw, leaving aside these special
each other, so the draw is not circumstances, is random. Although it is likely to be within the league’s
random. control to abandon these special events, the public interest in creating a
random draw in its purest sense would need to be balanced against the
tradition, rivalry and spectacle that likely builds around these ‘special
events’.
(b) Peter might have examined past statistics relating to the frequency of particular teams playing each
other, correspondence from the league’s constituents, its motives for retaining rules that give other
than a random chance of each team playing other teams at particular locations, an inventory of the
various characteristics of available grounds, press coverage of the issues and any litigation surrounding
the draw. This evidence is all of a non-financial nature, whereas in a traditional audit, the majority
of evidence is financial in nature. Peter would need to consider the specific types of evidence
available upon which to base his opinion, and this type of evidence might be appropriate only for
Pdf_Folio:471
Example 5.17
Note: The reporting requirements for Manna Pty Ltd are consistent with the practitioner’s compilation
report set out in Appendix 2, Illustration 1, of ISRS 4410 (Revised) Compilation Engagements with the
exception of the following three requirements.
1. A description of the practitioner’s responsibilities in compiling the financial information, including that
the engagement was performed in accordance with ISRS 4410 (Revised). There should be a statement
to the effect that:
We performed this compilation engagement in accordance with ISRS 4410 (Revised).
2. Explanations that, since a compilation engagement is not an assurance engagement, the practitioner is
not required to verify the accuracy or completeness of the information provided by management for the
compilation, and accordingly the practitioner does not express an audit opinion or a review conclusion
on whether the information is prepared in accordance with the applicable financial reporting framework.
There should be a statement to the effect that since a compilation engagement is not an assurance
engagement, we are not required to verify the accuracy or completeness of the information you provided
to us to compile these financial statements. Accordingly, we do not express an audit opinion or a review
conclusion on whether these financial statements are prepared in accordance with IFRS for SMEs.
3. A report title is another element that is missing and should be clearly identified.
Pdf_Folio:472
P df_Folio:473
The five essential elements of the Westerways assurance engagement are provided in the table below.
Element Westerways assurance engagement
Three-party • Assurance practitioner — Ray Campbell, Audit specialist for Campbell Lee Taylor (CLT)
relationship • Users — shareholders of Westerways — Len Lewis, Joy and Mark Valenti, Ms Verity
Samson and Mrs Bambi Bagg; creditors/suppliers of finance — Westerways Bank
• Responsible party — Board of directors of Westerways — Len Lewis (chairman), and Joy
and Mark Valenti
dPf_Folio:474
FACTOR COMMENTS
Explain relevant The company is in the retail industry and is governed by the companies legislation and
industry, regulatory other standard legislation for retail, such as occupational health and safety legislation
and other external and trade practices legislation. Its financial reporting framework is the standard
factors, including the framework for limited companies.
applicable financial In fact, the company is in at least two different sections of the retail industry,
framework homemakers’ hardware and domestic-ware, including gifts. The industry is not
changing other than through changes in technology, for example in the release of new
merchandise for gardening. In hardware, it competes with the big hardware stores in
the capital city, with the supermarkets, which sell only some of the merchandise, and
with the large stores that focus on industry and agricultural buyers. In its domestic-
ware, it is in competition with various small specialty shops for gifts, china, cutlery, etc.
Westerways has an unusual mix of merchandise and has no direct competitors.
The business depends heavily for its success on the particular talents of its owner-
managers, particularly in the domestic-ware division. As the business expands, they will
have to employ staff with the appropriate skills in selection of appropriate merchandise.
Explain nature of entity: The company buys from wholesalers and manufacturers, locally and overseas. In its
• operations domestic ware side, its buyer influences the suppliers through her interest in design.
The company sells the merchandise and it provides sales support services in the form
of advice in the store to customers. It has just made available a delivery service, using
a new van, for favoured customers.
• ownership and Westerways is a limited company with only five shareholders, executive directors
governance Mark and Joy Valenti, who hold 50% jointly, chairman Len Lewis with 30% and two
private investors with 10% each. There are no known related parties, other than the
companies of Len Lewis. The board of directors comprises Len Lewis, Chairman, and
Mark and Joy Valenti, executive directors. Under an arrangement, the Secretary of one
of Len Lewis’s companies acts as Secretary to the Westerways Board.
• investments made or During the year the company purchased a delivery van. There are apparently no
planned immediate plans for major investments, but we should expect the expansion to a third
store in the next two years.
• structure Mark handles management of the hardware division and Joy the domestic-ware
division. In each of the two stores, in charge of the sales and inventory function there is
a Supervisor and a Deputy Supervisor. There is an Administrator at the Arnton store
in charge of accounting and an Assistant Administrator at the Tannam store. The
effectiveness of management must be dependent to some extent on the cooperation
between Mark and Joy, who are effectively joint managing directors.
• financing There is a loan with the company’s bank secured on the Arnton premises and a leasing
agreement with the landlord of the Tannam premises, which are rented. There is an
agreement with the bank to go into overdraft when needed, as for example for the
payment of taxes and dividends in March.
Explain and evaluate There have been no unusual features of the company’s accounting policies.
management’s Accounting estimates include depreciation and net realisable values of slow-moving
selection and inventory, and with increasing credit sales a need for an estimate of the allowance for
application of doubtful debts.
accounting policies However, the company is now receiving refunds on purchases under bulk purchase
agreements with an increasing number of suppliers. Under these agreements, they
receive about a month in arrears credit for refund of part of the cost of purchases in
accordance with formulae. These amounts are checked roughly by the Administrator.
They are brought to account on a cash basis.
P df_Folio:475
Evaluate the processes Prime performance measures are: gross profits by product range; costs as a
for measurement percentage of sales; sales per square metre of floor space; customer satisfaction; and
and review of the financial results with comparison with budget.
client’s financial These, it seems, do not themselves present any risks of material misstatement
performance, including from management fraud. The risk arises from any interest of the owner-managers in
their implications overstating profit (e.g., to make the business look better as a sale prospect, or to earn
for risk of material higher dividends) or understating profit (e.g., to avoid profits tax or to avoid paying
misstatement of the dividends to the outside shareholders).
audited financial
statements
Implications for the An interesting and successful business that should not cause undue problems in our
current year’s audit audit of the financial statements.
FACTOR COMMENTS
Discussion of analysis See the attached analytical review workings, based on the audited data provided for
previous two years and the annualised data for the current year.
• Comments on trends:
– There has been rapid growth, with for 20X9 likely to be 2.6 times 20X7 sales and
net profit from trading up in that time also by about 2.5 times.
– In that time, assets have increased by 1.4 times.
Below is a discussion of the conclusions from our use of ratio analysis.
• Solvency:
– The quick ratio deteriorated between 20X7 and 20X8. It was budgeted to return
towards 20X7 figures in 20X9 but is likely to fall short of this because of the van
purchase and will be about 0.31, which prima facie is low. Note also that trade
debtors are becoming a larger part of the assets here.
– The current ratio has been sliding since 20X6 and seems likely to be about 1.21 at
31st December, against a budgeted ratio of 1.26.
– The debt to equity ratio shows that the creditors have a higher interest in the
business than the shareholders. This indicates that the shareholders should leave
more profit in the business. On the other hand, a large part of the liability is the
proposed dividend, a further part is taxation and much of the remainder is non-
interest-bearing trade payable.
dPf_Folio:476
Implications for the • These tables suggest that the audit will need to focus on:
audit – Inventory quantities and valuation, because this is the preponderant asset and the
business is heavily dependent on having good merchandise for sale.
– Although it is a relatively small figure, the trade debtors, with review of the
allowance for doubtful debts.
– Because of the continuing risk of management fraud in a business of this nature,
to increase or decrease profit to meet objectives, we should also recognise risks
in:
∘ occurrence and completeness of sales,
∘ completeness of expenses and liabilities.
There remains also the possibility of petty employee fraud and we must be sure to
do an adequate assessment of this type of risk, conduct appropriate tests for its
occurrence and statements any suspicions to management.
F Kerr 6/10/X9
Fiona Kerr
P df_Folio:477
Shareholders’ equity
Efficiency
Net profit Operating profit before tax 0.1046 0.0859 0.1052 0.1130
margin
Sales
Return on Operating profit before tax 0.2759 0.1982 0.1494 0.1096
total assets
Total assets
Return Net profit after tax 0.7743 0.4694 0.3135 0.2184
on share-
holders’
equity
Ordinary shareholders’
equity
Sales
Percentage of expenses
and net profit to sales
dPf_Folio:478
* Care needs to be taken if using the 20X6 ratios for comparison purposes as the values for 20X6 cannot be averaged as this was
the first year of operation and ratios for this period are based on 9 months rather than a full year of operation
PL3-PMA
Client Westerways Pty Ltd
COMMENTS
Discussion of source of As discussed in relation to analytical review procedures, we have used annualised
data results for the full year based on budget data for nine months and the full year
and the nine months actual data. This suggests that the operating profit for the
full year will exceed budget and will be about $212 000. The statement of assets
and liabilities will accordingly be similar to budget, with net current assets slightly
lower because of the purchase of the delivery van. The calculations below use the
annualised figures rather than an average taking into account previous years, which
would give a slightly lower materiality.
Operating profit base Use 5% to 10% of annualised before tax profit, which is $11 0061 to $22 122.
method As audit risk is apparently low, we should consider a figure towards the high end of
this figure, or at least not lower than the mid-point.
P df_Folio:479
Allocation of planning Calculation of proportion of each asset to total assets of $768 568 gives: Inventory
materiality to 0.38; Trade debtors 0.02; Prepayments 0.005; Cash and deposits 0.11; Non-current
components assets 0.48. On this basis, materiality would be allocated approximately Inventory
• discussion $4 560; Trade debtors $240; Prepayments $60; Cash and deposits $1 320; Non-
current assets $5 760. In view of the relative difficulty of auditing these components,
judgment will be used to allocate much more to inventory and some to trade payable.
F Kerr
9/10/X9
Fiona Kerr
dPf_Folio:480
B Banks
6 Oct 20X9
BBanks
MODULE 3
Task 3.1: Cost of sales and inventory
COST OF SALES
INVENTORY
allocation
dPf_Folio:482
P df_Folio:483
dPf_Folio:484
MODULE 4
Task 4.1 and 4.2: Audit Tests and Conclusions
Finding number a) Audit test(s) that b) Discussion of possible action by auditors
and summary detected the finding
1 Damaged inventory This was discovered in Following the lower of cost and net realisable value
requiring reduction discussions with staff rule, the inventory should be reduced in value from
from cost to net which revealed a roof $12 000 to $9 000, the management’s estimate of the
realisable value leak rather than through net realisable value. The management have agreed to
any formal audit tests. this adjustment and so the auditor should be able to
Having heard about give an unqualified opinion.
the leak, the auditors While it is possible that the inventory will have to be
exercised their initiative reduced further in value for sale, the amount of any
and considered what additional loss does not seem likely to be material, and
the effects might have so there is no need for the auditors to depart from their
been on the financial unqualified opinion.
statements.
2 Injury to customer, Examination of Minutes This must clearly be disclosed as a contingent liability.
resulting in of Meetings of the It is unclear what if any dollar amount to give because
possible legal directors. of the fact that legal action has not so far been taken.
action, possibly If the management refused to disclose it, the auditors
requiring would have to give a qualified opinion.
disclosure of a
contingent liability.
P df_Folio:485
MODULE 5
Task 5.1: Suitable content for Westerways sustainability report
(a) Sustainability reports may cover a range of topics as outlined in the GRI Standards but should focus
on the topics most important to the sustainability of the business. Suitable content for Westerways
sustainability report is shown below. Note: this is not a complete list and is provided as a guide only.
• Economic measures
– Economic performance — economic value generated and distributed.
– Procurement practices — timber procurement policy to ensure timber products are sourced legally
and in an environmentally friendly manner.
• Environmental measures
– Materials — consumer packaging designed to minimise environmental impact and reduce the use
of non-recyclable materials.
– Reclaimed products and packaging — battery, paint and electronic waste collection services.
– Reduction in energy consumption — renewable energy installations (e.g. solar) and lighting
efficiencies (e.g. LED lighting).
– Supply chain policies — ethical sourcing of inventory and environmental impact of consumer
packaging.
• Employment — human rights
– New employees hired and employee turnover.
– Workplace health and safety — improvements in safety performance and reduction in work-
related injuries.
– Training and education — average hours of training per year per employee and usage of
performance evaluations and reward systems.
– Diversity of governance body and employees — gender, age and number of indigenous employees.
– Equal opportunity — number of women employed and in leadership roles and comparison of
salaries between men and women for management and employees.
• Local communities
– Nature, scope and effectiveness of any programmes and practices that assess and manage the
impacts of operations on communities.
– Education programs for customers to help them make better sustainable living choices.
– Education programs to help the community to create waterwise gardens.
Pdf_Folio:486
Ray’s discussion with the Valentis would have included the following matters.
1. The five essential elements of a sustainability report assurance engagement conducted in accordance with the
International Framework for Assurance Engagements.
Three-party relationship • Assurance practitioner — Ray Campbell, Audit specialist for Campbell Lee
Taylor (CLT))
• Users — shareholders of Westerways — Len Lewis, Joy and Mark Valenti,
Ms Verity Samson and Mrs Bambi Bagg; creditors/suppliers of finance —
Westerways Bank; employees — workplace health and safety, training and
education, diversity and equal opportunity; wider community — environmental
practice, and education programs; customers — health and safety and privacy
of data.
• Responsible party — Board of directors of Westerways — Len Lewis (chairman),
and Joy and Mark Valenti.
Pdf_Folio:487
Evidence Ray Campbell has to gather sufficient, appropriate audit evidence to form an
opinion as to whether the sustainability report is fairly presented and free of
material misstatements, also ensuring it is reported in accordance with GR
Standards.
Assurance report A written assurance report containing a clearly expressed conclusion about the
subject matter information. The conclusion indicates whether the information in
the sustainability report is fairly presented, free of material misstatements and
reported in accordance with the GRI Standards. The wording will differ depending
the level of assurance—i.e. a reasonable or limited assurance engagement.
2. The appropriate assurance standard that will provide guidance to Ray when performing the assurance
engagement on Westerways sustainability report is the International Standard on Assurance Engagements
ISAE 3000 Assurance Engagements Other Than Audits or Reviews of Historical Financial Information. This
standard emphasises the procedures used for gathering evidence and assurer independence.
3. The procedures Ray is likely to perform to provide assurance on Westerways sustainability report include:
• assessment of whether the report provides a reasonable and balanced presentation of performance
• assessment of the extent to which the report preparer has applied the GRI Reporting Framework
• assessment of disclosure risks
• procedures to check the accuracy, plausibility and relevance of the sustainability measures reported
• result in an opinion or set of conclusions that is publicly available in written form, including a statement from
the assurance practitioner on their relationship to the report preparer.
4. The expected benefits of having their sustainability report assured include those listed above for Task 5.1
(b), but most importantly, assurance adds credibility to the sustainability report. GRI (2013)1 list the following
reasons why business have their sustainability reports assured.
• Increased recognition, trust and credibility — stakeholders are provided with a greater sense of confidence in
the disclosures.
• Improved board and CEO level engagement — disclosures and data which are believed to be trustworthy and
credible are more likely to be used for internal decision making.
• Reduced risk and increased value — credible disclosures are more likely to be relied on.
• Strengthened internal reporting and management systems — external assurance helps to confirm that internal
systems and controls are robust.
1
GRI 2013, ‘The external assurance of sustainability reporting’, GRI Research & Development Series, accessed September 2019,
https://www.globalreporting.org/resourcelibrary/GRI-Assurance.pdf.
Pdf_Folio:488
INDEX 489
data analytics and data visualisation to audit sampling 184, 185 Australian Charities and Not-for-Profit
assess fraud 158–60 audit software 197 Commission Act 2012 48, 52
performing 152–3 audit strategy 160 Australian National Audit Office
planning 152–3 developing of 160–3 (ANAO) 49, 334
relevance and reliability of data 53 financial statement assertions 161 Australian National Registry of
software 156 substantive procedures 162–3 Emissions Units Act 2011 305
techniques 157, 185 tests of controls 161–2 Australian pronouncements 9
using for risk assessment 153–8 audit trail 118 Australian Securities and Investments
audit documentation 94, 216 audit working papers 217–20 Commission (ASIC) 7–8, 22, 23,
audit file organisation 216–17 auditing 58–9 33, 201, 212, 215, 284
examples of audit working papers accounting estimates 126–7 Australian Securities and Investments
217–20 in Australia 7–10 Commission Act 2001 7
security and confidentiality of client internationalisation of 5–7 Australian Securities Exchange
data 216 in New Zealand 10–1 (ASX) 9
audit evidence 70, 171 standards 68 Australian standards 226
evaluation of 220–5 Australian Water Accounting Standard
Auditing Accounting Estimates and
misstatements identified during the (AWAS) 308
Related Disclosures 127
audit 220–2 authorisation 111
auditor 293
sufficiency and appropriateness of automatic audit 61
ASA 700 series 298
222–5 automatic notarisation 61
Auditor-General for Australia 334
audit fieldwork average collection period 145
CSR disclosures 303
accounting 229 average payment period 145
Institute of Internal Auditors 315–17
analytical procedures 239–43 AWA Ltd v. Daniels t/a Deloitte Haskins
internal 326–7
characteristics 228 & Sells (1995) 16 ACSR 644 281
ISAE 3400 states 312
engagement quality control review AWAS see Australian Water
ISRE 2410 Review of Interim Accounting Standard
247–8
Financial Information Performed by AWAS 2 Assurance Engagements on
evidence 228
the Independent Auditor of the General Purpose Water Accounting
final considerations 248–51
Entity covers 296 Reports 308
fraud 230–1
letter report 367
going concern 232–5
public sector 342, 347, 360, 364
litigation and claims 231–2 backup and recovery procedures 115
review report, AUASB guidance 297
management representation letter bank confirmation requests 194
auditor independence batch totals 118
235–6
for audit of financial statements before-and-after report 119
materiality see materiality
74–7 better practice guides (BPGs) 361
parties 229–30
for audit of SMEs 77 big data 59
subsequent events 236–9
auditor and audit firm rotation 75–7 blockchain 60–2, 111
working papers 245–6
audit file organisation 216–17 and United States legislation 75 BOM see Bureau of Meteorology
audit firm rotation 75–7 auditor responsibilities, going concern BPGs see better practice guides
audit innovation continuum 56 130 bribery frauds 124
audit judgments 36 auditor rotation 75–7 Bureau of Meteorology (BOM) 307
audit materiality 95 Auditor-General 49–50 Delivery of Extreme Weather Services
audit of financial information Auditor-General Act 1997 49, 334, 343 338
auditor independence for 74–7 auditors 121, 151 business models 54, 104
professional conduct and ethics 77–9 auditor’s expert, using work of 214 business operations, entity 103–4
professional scepticism and judgment auditor’s report business risk 99, 106
79–3 modified 262–77 identifying 107
regulatory environment 72 unmodified 251–62 business-to-business e-commerce 205
audit planning auditor’s responsibilities business-to-consumer e-commerce 205
conclusions and reporting 100 subsequent events 237
developing 88–1 audits CAATs see computer-assisted audit
documentation 94 auditor 293 techniques
financial statement assertions 91–4 Australian perspective 294–6 CADB see Companies Auditors
guidance materials for SMEs 86–7 components of financial statement Disciplinary Board
impacts on 97 293 Carbon Credits (Carbon Farming
materiality 95–9 financial statements 40 –1, 291–3 Initiative) Act 2011 305
overall audit strategy 87–8 of specialised areas 41 Carey Ltd (Carey) 238
overview 87, 89 international auditing standards 291 Center for Audit Quality (CAQ) 34
performing 100 AusGroup Limited 271 CER see clean energy regulator
phases of 99–102 Australian Accounting Standards Board channel stuffing 122
risk assessments 101 (AASB) 283 Chartered Accountants Australia and
audit procedure 40, 160, 173–5 Australian Auditing and Assurance New Zealand (CAANZ) 10
for related parties 208–11 Standards Board (AUASB) 8–9, check digits 118
audit program 89, 90 52 check-digit test 118
Audit Reports in Australia 2005–2015 standard-setting process 8 clean energy regulator (CER)
275 Australian Auditing Standards Australia’s carbon emissions 305,
audit risk 37, 69, 106, 141 (ASAs) 52 314
model 69
Pdf_Folio:490
Australian Auditor-General 49 clearly trivial 220
490 INDEX
client data, security and confidentiality Corporations Amendment (Corporate engagement terms 84
of 216 Reporting Reform) Act 2010 299 enquiries of management, risk
client money audit 330 Corporations Legislation Amendment assessment 134
client relationships 19–20 (Audit Enhancement) Act 2012 enquiry, analytical procedures 143
Climate Balance Pty Ltd 306 75, 76 entity 102
climate-related risk 130–1 corruption frauds 124 business model 104
climate-risk disclosure 54–5 COSO see Committee of Sponsoring business operations 103–4
cloud computing 115–17 Organizations of the Treadway financial performance 108–10
cluster analysis 154 Commission financing 105
Code of Ethics for Professional COSO’s Internal Control — Integrated industry conditions 102
Accountants 11 Framework (2013) 321–4 investments 104–5
Committee of Sponsoring Organizations CPA Australia 9 nature of 103–5
of the Treadway Commission criteria 336 objectives, strategies and related
(COSO) assurance engagement 30–2 business risks 105–7
in Australia and New Zealand 324 report on customer satisfaction 31 regulatory environment 103
in US 321 Crown authority 11 risk assessment process 110
internal audit function 318 CSR reports see corporate social selection and application of
Internal Control — Integrated responsibility reports accounting policies 105
Framework 321–4 cutoff errors 93 EQCR see engagement quality control
common-size statements 148–50 cutoff tests 93 review
communication 277–80 cyber frauds 124 error correction and data resubmission
victim of through cyber attack 125 118
Companies Auditors Disciplinary Board
cyber-sell sales systems 325 error log 118, 119
(CADB) 9
errors 70
Companies limited by Guarantee and
Incorporated Associations: damaged inventory 285 ethical principles 11–18
Reporting and Auditing/Review data analytics 59–60, 151–79 code 12–18
Obligations 47 data entry and program controls 115 ethical requirements 19
comparative information 264 data entry manuals 117 European Commission (EC) 76
DDD Motor Sales Ltd 299 evidence 32–8, 69
completeness
debt–equity ratio 147 evidence-gathering techniques 177
and accuracy of data 118
descriptive analytics 150 extended external reporting (EER) 303
of data 117
detection risk 37, 69 extent, quantity 38
compliance engagements 43–4
deviation 176 external confirmations 193
component auditors 211–12
direct engagements 25–6 External Reporting Board (XRB) 10,
computer operation controls 115
disclaimer of opinion 265, 270–2 11
computer-assisted audit techniques
dummy entity 181
(CAATs) 177
dummy transactions 180 factual misstatements 242
in e-commerce environment 206
DuPont analysis 148 familiarity 13
integrated test facility 181–4
Farm Management Deposits (FMD)
substantive testing using 197–201
e-commerce environment Scheme 358
test data 180–1
advanced audit data analytic fieldwork 171
tests of controls 178–84
techniques 206–8 file identification labels 119
traditional audit vs. 179 file run and control instructions 119
continuous audit in 206–8
conceptual framework 11, 13 substantive testing in 206 financial audits 50
2018 Concise Financial Report 294 tests of controls in 205–6 financial information
confidentiality 13 types 205 and non-financial 307
conflict of interest situation 75 using CAATS in 206 concept of materiality 293
conflicts of interest 14 E-ffervescence.com Ltd 250 ISAE 3400 311
console messages 119 EBIT (earnings before interest and tax) primary standards 295
contingency plans 115 145 reviews of interim 296, 298
contingent asset 231 EBITDA (earnings before interest, tax, small- and medium-sized entities
contingent liability 231 depreciation and amortisation) 298–9
continuous auditing 43, 325–6 145 Financial Markets Conduct Act 2013
in e-commerce environment 206–8 economy 335 257
control activities, internal control 111 EER see extended external reporting financial materiality 347
control environment, internal control effectiveness 336–7, 341 financial performance, entity 108–10
110 efficiency 335–6 financial report audit 41
control risk 37, 69, 72–135 Egral Ltd 281 Financial Reporting Act 1993 10
control totals 118 Emphasis of Matter 262–3 Financial Reporting Council (FRC) 7,
corporate governance assurance 44 Emphasis of Matter paragraph 292 72, 283
Corporate Law Economic Reform engagement letter 83, 85 financial reporting frauds 122–3
Program (Audit Reform and engagement partner 19, 73 financial statement assertions 91–4,
Corporate Disclosure) Act 2004 engagement performance 20–2 172
74 engagement quality control review financial statements 40, 74
corporate social responsibility (CSR) (EQCR) 22, 247–8 audits of 40–1
reports 303–4 engagement review process 21 firm 73
Corporations Act 2001 7, 73, 75, 236, engagement risk 27 FMD Scheme see Farm Management
285, 294
Pdf_Folio:491
engagement teams 20, 73 Deposits Scheme
INDEX 491
forecast 312 IESBA Code see International Ethics International Auditing and Assurance
framework 27–8 Standards Board for Accountants Standards Board (IAASB) 6–7,
for audit quality 23–5 Code 73, 314
Framework for Audit Quality; Key IFAC see International Federation of international auditing standards 291
Elements that Create an Accountants International Ethics Standards Board for
Environment for Audit Quality 23, IFIAR see International Forum of Accountants (IESBA) 6–7, 76,
35 Independent Audit Regulators 260
Franklin Spleen group 327 IFRS see International Financial International Federation of Accountants
fraud 82, 121–6 Reporting Standard; International (IFAC) 6, 86
cyber 124 Financial Reporting Standards International Financial Reporting
data analytics and data visualisation IIA see Institute of Internal Auditors Standards (IFRS) 48, 311
158–60 IIRC see International Integrated International Forum of Independent
financial reporting 122–3 Reporting Council Audit Regulators (IFIAR) 6
misappropriation of assets 123–4 inability 265 International Framework for Assurance
red flags 124 Income Tax Assessment Act 1936 327 Engagements (the Framework) 4,
risk factors 124–6 Income Tax Assessment Act 1997 327 5, 11
types of 122 independence 73 assurance engagements 25, 28–40
use of software robots 126 policies and procedures 17 attestation and direct engagements
fraud brainstorming 121 indicators 336 25–6
fraud triangle 125 inducements 15 ethical principles 11–8
FRC see Financial Reporting Council INFO 222 22 quality control standards 18–5
future-oriented information assurance information processing 111 reasonable and limited assurance
42 information system and communication engagements 26–7
111 scope of 27–8
GAS see generalised audit software inherent risk 37, 69, 71–135
gearing ratios 147 International Integrated Reporting
input controls 117 Council (IIRC) 310
general IT controls 113 Institute of Internal Auditors (IIA) 315
general ledger account balance analysis International Organisation of Supreme
Institute of Public Accountants (IPA)
157 Audit Institutions (INTOSAI)
10
general ledger account reconciliation 342, 361, 365
integrated test facility (ITF) 181
157 International Organization of Employers
test data vs. 181–4
generalised audit software (GAS) (IOE) 307
integrity 12
197–200 international standards 45, 226
intended users 29–30
functions of 199 International Standards for the
internal audit 42–3
GFC see global financial crisis Professional Practice of Internal
assurance service 318–21
Global Economic Crime and Fraud Auditing (Standards) (IIA 2017)
carrying out the engagement 319
Survey 124 316
control 317
global financial crisis (GFC) 103 International Standards on Assurance
definition 315, 316
global reporting initiative (GRI) 307 Engagements (ISAEs) 7
engagement planning 319
external assurance 306 application of 51–2
function 315
and IOE 371 International Standards on Auditing
governance 317
GRI G4 Guidelines 305 (ISAs) 7, 45, 68, 72, 201
Institute of Internal Auditors 315
sustainability reports 306 application of 45–50
Internal Audit Engagement Planning
going concern basis 129, 233 audit requirements 47–8
319
going concern risk 129–30, 135 Australia 49
International Standards for the
auditor responsibilities 130 future developments 48
Professional Practice of Internal
management responsibilities 130 Hong Kong 50
Auditing (Standards) (IIA 2017)
greenhouse gas (GHG) statements public sector perspective 49–50
316
304–5 small and medium-sized entities
purpose 318
GRI see global reporting initiative (SMEs) perspective 46–9
reporting 320
gross margin ratio 145 structure of 46
risk-management 317
GS 001 Concise Financial Reports 294
types 317 International Standards on Quality
GS 016 Bank Confirmation
internal auditors 212–13 Control 5
Requests 194
internal control 86, 278 International Standards on Related
components 109–12 Services (ISRSs) 7
haphazard selection 185
control activities 111 application of 52
hash totals 118
human resources 20 control environment 110 International Standards on Review
entity’s risk assessment process 110 Engagements (ISREs) 7
IAASB see International Auditing and information system and application of 51
Assurance Standards Board communication 111 intimidation 14
IAS 10 Events after the Reporting Period monitoring of controls 112 INTOSAI see International
236, 241 in SMEs 112–13 Organisation of Supreme Audit
IAS 37 Provisions, Contingent Liabilities internal control system 324 Institutions
and Contingent Assets 232, 241 principles 322 inventory turnover ratio 146
Idealic Pty Ltd 267 internal controls audit 43, 321–5 investments 104–5
identifying risks 138 internal labels 119 IOE see International Organization of
IESBA see International Ethics International Accounting Standards Employers
Standards Board for Accountants
Pdf_Folio:492
Board (IASB) 48 IPA see Institute of Public Accountants
492 INDEX
ISA 200 Overall Objectives of the ISA 610 (Revised) Using the Work of Independent Auditor of the Entity
Independent Auditor and the Internal Auditors 47, 212 51, 296–8, 300
Conduct of an Audit in Accordance ISA 700 (Revised) Forming an Opinion ISRS 4400 Engagements to Perform
with International Standards on and Reporting on Financial Agreed-Upon Procedures
Auditing 26, 45 Statements 251, 276 Regarding Financial Information
ISA 220 Quality Control for an Audit of ISA 701 Communicating Key Audit 52, 366
Financial Statements 18, 20, 73, Matters in the Independent ISRS 4410 (Revised) Compilation
245 Auditor’s Report 276 Engagements 52
ISA 230 Audit Documentation 94, 216 ISA 705 (Revised) Modifications to the IT application controls 180
ISA 240 Appendix 1 125 Opinion in the Independent IT environment 113
ISA 240 The Auditor’s Responsibilities Auditor’s Report 243, 251, 276 controls in 119
Relating to Fraud in an Audit of ISA 706 (Revised) Emphasis of Matter IT general controls (ITGCs) 177
Financial Statements 121, 122, Paragraphs and Other Matter ITF see integrated test facility
230, 242, 285 Paragraphs in the Independent ITGCs see IT general controls
ISA 250 (Revised) Consideration of Auditor’s Report 262, 276
Laws and Regulations in an Audit of ISA 710 Comparative Information — Jobstone Ltd 240
a Financial Report 103, 131, 132, Corresponding Figures and journal entry analytics 157
172, 242 Comparative Financial Statements judgmental misstatements 242
ISA 260 (Revised) Communication with 251, 264, 276
Those Charged with Governance ISA 720 (Revised) The Auditor’s KAMs see key audit matters
285 Responsibilities Relating to Other KAP see key audit partner
ISA 265 Communicating Deficiencies in Information 259, 276
key audit matters (KAMs) 255–9
Internal Control to Those Charged ISA 800 (Revised) Special key audit partner (KAP) 76
with Governance and Management Considerations — Audits of
kickback 124
277, 285 Financial Statements Prepared in
ISA 300 Planning an Audit of Financial Accordance with Special Purpose
Statements 47, 72, 100 Frameworks 47, 291, 294 LCEs see less complex entities
ISA 315 Identifying and Assessing the ISA 805 (Revised) Special leadership responsibility 18–19
Risks of Material Misstatement Considerations — Audits of Single less complex entities (LCEs) 86
through Understanding the Entity Financial Statements and Specific letter of engagement 84
and Its Environment 68, 99, 102, Elements, Accounts or Items of a letter of enquiry 232
105, 106 Financial Statement 291, 295 letter of subordination 235
ISA 320 Materiality in Planning and ISA 810 (Revised) Engagements to letter of support 235
Performing an Audit 220, 251 Report on Summary Financial limit or reasonableness test 119
ISA 330 The Auditor’s Responses to Statements 291, 295 limit test 118
Assessed Risks 159, 230 ISAE 3000 (Revised) Assurance limited assurance engagements 27
ISA 402 Audit Considerations Relating Engagements Other than Audits or liquidity ratios 147
to an Entity Using a Service Reviews of Historical Financial long-term liabilities 147
Organization 47 Information 27, 41, 51, 300, 315, lower assessed level of control risk
ISA 450 Evaluation of Misstatements 365 approach 88
Identified during the Audit 96, ISAE 3400 The Examination of
220, 242, 251 Prospective Financial Information management representation letter
ISA 501 Audit Evidence — Specific 51 235–6
Considerations for Selected Items ISAE 3402 Assurance Reports on management responsibilities, going
232, 241 Controls at a Service Organisation concern 130
ISA 505 External Confirmations 193 51, 332 management’s experts, using work of
ISA 510 Initial Audit Engagements — ISAE 3410 Assurance Engagements on 214–16
Opening Balances 47 Greenhouse Gas Statements 51, matching information, in key data fields
ISA 520 Analytical Procedures 187, 304, 315 154
239, 242 ISAE 3420 Assurance Engagements to material misstatements 82–3, 99, 173,
ISA 530 Audit Sampling 185 Report on the Compilation of Pro 220
ISA 540 (Revised) Auditing Accounting Forma Financial Information identifying risks of 96–8
Estimates and Related Disclosures Included in a Prospectus 51, 313, material uncertainty 254–5
127 315 materiality 37
ISA 540 (Revised) Auditing Accounting ISAs see International Standards on judgments 95
Estimates, Including Fair Value Auditing and pervasiveness 243–5
Accounting Estimates, and Related ISO 31000 Risk Management — technical review 245
Disclosures 55, 229, 241 Guidelines 324 misappropriation of assets frauds
ISA 550 Related Parties 104, 208, 229, ISQC 1 Quality Control for Firms that 123–4
242 Perform Audits and Reviews of misstatement 69
ISA 560 Subsequent Events 236, 241 Financial Statements, and Other in financial statements, risk of 140
ISA 570 (Revised) Going Concern Assurance and Related Services identified during audit 220–2
233, 241, 276 Engagements 18, 73 mitigating circumstances 234
ISA 580 Written Representations 236, ISRE 2400 (Revised) Engagements to mitigating factors 234
241 Review Historical Financial monetary unit sampling (MUS) 202–3
ISA 600 Special Considerations — Statements 51, 298, 300 monitoring systems 22–3
Audits of Group Financial ISRE 2410 Review of Interim Financial Murray-Darling Basin Plan 307
Statements 47, 211
Pdf_Folio:493
Information Performed by the MUS see monetary unit sampling
INDEX 493
National Greenhouse and Energy PIEs see public interest entities record counts 118
Reporting Act 2007 305 port and marine cash-generating unit Reduced Disclosures Requirement
National Greenhouse and Energy (‘CGU’) 271 (RDR) 283
Reporting Scheme (NGERS) 305 positive confirmation request 193 registered greenhouse and energy auditor
nature, audit procedure 38 possible fraud, indicators of 231 (RGEA) 305
negative confirmation requests 194 potential audit implications 135 regression analysis 155
net profit margin 145 predictive analytics 150 Regulation of Great Barrier Reef Marine
New Zealand Auditing and Assurance predominantly substantive testing Park Permits and Approvals 359
Standards Board (NZAuASB) 10 approach 88 regulatory environment 72
NGERS see National Greenhouse and prescriptive analytics 150 related party transaction risk 210
Energy Reporting Scheme process mining 157 related-party risk 128–9
NOCLAR see non-compliance with processing controls 118 related-party transactions 104
laws and regulations professional accountants 15, 79 Renewable Energy (Electricity) Act 2000
non-assurance services 366–73 in public practice 14–16 305
agreed-upon procedures 366–7 professional accounting bodies 9–10 reporting responsibilities 280–7
compilation engagements 368–73 professional behaviour 13 responsible party 29
non-audit services 74, 261 professional competence and due care review engagement 41, 295–300
non-compliance 73 12 RGEA see registered greenhouse and
non-compliance with laws and professional conduct 17 energy auditor
regulations (NOCLAR) 16, 82, and ethics 77–9 risk analysis decision tree 154
103, 131–4, 278 professional judgment 35–8, 79, 80, 99 risk assessment 100, 134
non-financial data professional scepticism 33–5, 73, analytical procedures see analytical
in substantive analytical procedures 78–83, 99, 127, 128 procedures
188 profitability ratios 145 audit data analytics see audit data
non-financial reports 303–11 projected misstatements 243 analytics (ADA)
non-financial reports assurance 41–2 projected to the population 203 data analytics techniques for 153,
NZAuASB see New Zealand Auditing projecting the errors 203 154
and Assurance Standards Board projection 312 methods used for 134–60
proper authorisation 117 procedures 82
objectivity 12 public interest entities (PIEs) 76 strategic analysis see strategic
observation and inspection, risk public sector 49–50 analysis
assessment 134 auditor 333 risk of material misstatement 70
OnTrend Appliances Ltd (OnTrend) audit relationship 333 robotic process automation (RPA)
326 audits 50 56–8
organisational and management controls performance auditing 333–66 implementation of revenue audit 57,
114 purpose-written programs 199 58
other matter paragraph 262–5 rounding test 119
output controls 119 qualified opinion 265, 268–70 RPA see robotic process automation
overall audit strategy 86–8 quality control (QC) 18–25 run to run controls 118
overall materiality 95, 98 client relationships 19–20
vs. performance materiality 98–9 engagement partner 19 SA 800 (Revised) Special
overarching standard 300–3 engagement performance 20–2 Considerations — Audits of
ethical requirements 19 Financial Statements Prepared in
payroll database 154, 155 framework for audit quality 23–5 Accordance with Special Purpose
peer analysis 157 human resources 20 Frameworks 294
performance audit 50 leadership responsibility 18–19 sampling techniques, for testing controls
agencies 343 monitoring 22–3 184–6
elements 344–5 quality of engagement performance evaluation of 185–6
module 370 21 selection of 185
process 346–66 quality control for audits 73–4 Sarbanes-Oxley Act 2002 (US) 42, 75,
structure 343–4 acceptance and continuance of client 291, 321, 331
performance engagements 44–5 relationships 74 SDF see Starlights Defence Force
performance indicators 338 assignment of engagement teams 74 second partner review 248
performance materiality 98 engagement performance 74 segregation of duties 111, 157
vs. overall materiality 95 team members’ compliance with self-interest threat 13
performance reviews 111 ethical requirements 73–4 self-managed superannuation fund
performed as risk assessment procedures (SMSF) 330
186 random selection 185 self-review threat 13
period-end window dressing 128 range test 118 Senate Economics References
pervasiveness 243–5 ratio analysis 144–8 Committee 54
PEST (Political, Economic, Social and RDR see Reduced Disclosures sequence test 118
Technological) analysis 138 Requirement shareholders reporting 282–3
PESTEL (political, economic, social, reasonable and informed third party 14 significant risks 121
technological, environmental and reasonable assurance engagements simulated transactions 180
legal) analysis 138, 139 26–7, 68 small- and medium-sized enterprises
physical controls 111 reasonableness (logic) test 118 (SMEs) 46–9, 143, 163–8
physical risks 54 reasonableness of data 118 audit approach for 164
physical safeguards 115
Pdf_Folio:494
reasonableness tests 144, 189–90 CPA Australia 307
494 INDEX
financial information 298–9 purpose-written programs 199 tests of transactions and account
going concern 234 utility programs and systems balances 192–7
International Financial Reporting management programs 199–201 attendance at physical inventory
Standards 369 sufficiency 171 counts 195
smart contracts 111 of evidence 82 bank confirmation requests 194
SMEs see small and medium-sized quantity 32 direction of testing 195
enterprises suitable criteria 31 external confirmations 193
SMSF see self-managed suspicious transactions 158 negative confirmation requests 194
superannuation fund SWOT (Strengths, Weaknesses, positive confirmation request 193
Southern Slumberland (SS) 255 Opportunities and Threats) analysis types 193–7
special audits 50 137 Therapeutic Goods Act 1989 103
specific business risks 135 system software 115 three-party relationship 29–30
SRE 2410 Review of Financial systematic selection 185 three-way match procedure 157
Statements Performed by the systems and processes, assurance 42–3 Tier 2 reduced disclosure requirements
Independent Auditor of the Entity systems development, and program 292
298 maintenance controls 114 Tier 2 requirements 283
Starlights Defence Force (SDF) 358 tiered approach, audit requirements 48
strategic analysis Task Force on Climate-Related Financial time-series regression 155
PEST (political, economic, social and Disclosures (TCFD) 54, 131, 304 timing, evidence 38
technological) analysis 138, 140 TCFD see Task Force on traditional audit vs. computer-assisted
PESTEL (political, economic, social, Climate-Related Financial audit techniques 179
technological, environmental and Disclosures transaction codes 118
legal) analysis 138, 140 Tech Mpire Limited Annual Report 2018 transition risks 54
SWOT (strengths, weaknesses, 255 true and fair view 40, 253
opportunities and threats) analysis technical review 245 turnaround documents 117
137 terms of engagements types of auditor’s reports 252
techniques 136–42 changes to terms 84–6
value-chain analysis 140 preconditions 83–4 utility programs and systems
strategic risks 135 test data 179–81 management programs 199–201
substantive analytical procedures 186 devising and applying 182 advantages and disadvantages of 200
designing and performing 187–8 vs. integrated test facility 181–4
examples of effective 188 tests of controls 86 value chain analysis 140, 142
level of assurance obtained 187 assertion-level controls 174, 175 vendor database 154, 155
nature of 186–7 auditor 175 Victorian Auditor-General’s Office
relationship with other audit computer-assisted audit techniques (VAGO) 50
procedures 190–1 178–84 visualisation 155, 156
reliability of the data 188–9 in e-commerce environment 205–6
suitability of 187–8 financial statement-level 174, 175 WASB see Water Accounting
use of non-financial data in 188 objectives of 175–6 Standards Board
use of reasonableness tests 189–90 procedures 176–8 Water Accounting Standards Board
substantive procedures 70, 162–3 sampling techniques for 184–6 (WASB) 307
substantive procedures, sampling small-to-medium enterprises 174, WNS Holdings Ltd (WNS) explored
techniques in 202–5 175 58
evaluation of 203–5 tests of details 191 working papers 245–6
monetary unit sampling 202–3 designing and performing 192 written assurance report 38–40
substantive testing 100, 197–201 nature of 191–2 written representations 235
in e-commerce environment 206 tests of transactions and account
generalised audit software 197–9 balances 192–7 XRB see External Reporting Board
Pdf_Folio:495
INDEX 495