BPP Assurance Course Notes
BPP Assurance Course Notes
Certificate Level
Course Notes
For exams in 2019
ISBN: 9781509777211
1 Key to Icons
ISBN 9781509777211
A note about copyright
There is a constant need to update and enhance our study materials in line with both regulatory changes and new
insights into the exams.
Our course notes go through a rigorous production and checking exercise as they are updated annually. We are very
keen to remove as many numerical errors and narrative typos as we can but given the volume of detailed information
being changed in a short space of time we know that a few errors will sometimes get through our net. We apologise in
advance for any inconvenience that an error might cause. We continue to look for new ways to improve these study
materials, you can contact our ICAEW Courseware Head of Programmes at [email protected] with any
suggestions for improvements.
2 Contents
CONTENTS
Introduction 5
Types of assurance 9 1 1
Benefits and limitations of assurance 16 1 6
The audit overview 20 1 11
Obtaining an engagement 27 2 21
Planning 33 3 39
Contents 3
8. Ethical and professional behaviour 187 14 – 16 261
4 Contents
MODULE AIM
To ensure that students understand the assurance process and fundamental principles of
ethics, and are able to contribute to the assessment of internal controls and gathering of
evidence on an assurance engagement.
On completion of this module, students will be able to:
explain the concept of assurance, why assurance is required and the reasons for
assurance engagements being carried out by appropriately qualified professionals;
explain the nature of internal controls and why they are important, document an
organisation’s internal controls and identify weaknesses in internal control systems;
select sufficient and appropriate methods of obtaining assurance evidence and
recognise when conclusions can be drawn from evidence obtained or where issues
need to be referred to a senior colleague; and
understand the importance of ethical behaviour to a professional and identify
issues relating to integrity, objectivity, professional competence and due care,
confidentiality, professional behaviour and independence.
SPECIFICATION GRID
This grid shows the relative weightings of subjects within this module and should guide
the relative study time spent on each. Over time the marks available in the assessment
will equate to the weightings below, while slight variations may occur in individual
assessments to enable suitably rigorous questions to be set.
Weighting (%)
1 The concept, process and need for assurance 20
2 Internal controls 25
3 Gathering evidence on an assurance engagement 35
4 Professional ethics 20
Introduction 5
LINKS WITH OTHER PAPERS
The aim of the Certificate level Assurance module is to ensure that students understand
and can explain the concept of assurance. Explain the assurance process and the
methods of obtaining evidence to support conclusions. Understand the fundamental
principles of ethical behaviour and are able to contribute to the assessment of internal
controls and gathering of evidence on an assurance engagement.
The knowledge base that is put in place here will be taken further in the Professional
level Audit and Assurance module where the aim will be to develop the students’
understanding of the critical aspects of managing an assurance engagement (including
audit engagements): acceptance, planning, managing, concluding and reporting.
Students will be expected to have an understanding of the audit of not-for-profit entities
as well as non-specialised profit oriented entities.
EXAM
1½ hours
50 questions with equal marks, together adding up to 100 marks
The questions are of the following types:
Multiple choice – select 1 from 4 options A, B, C or D
Multiple response – select 2 or more responses from 4 or more options
Multi-part multiple choice – select 1 from 2, 3 or 4 options, for two or more
question parts
55% pass mark
Learning outcomes
Students will be able to explain the concept of assurance, why assurance is required and
the reasons for assurance engagements being carried out by appropriately qualified
professionals.
In the assessment, students may be required to:
• Define the concept of assurance
• Define the assurance process, including obtaining the engagement
• Define the concept of reasonable assurance
• State why users desire assurance reports and provide examples of the benefits
gained from them such as to assure the quality of an entity's published corporate
responsibility or sustainability report
• Compare the functions and responsibilities of the different parties involved in an
assurance engagement
• Compare the purposes and characteristics of, and level of assurance obtained
from, different assurance engagements
• Identify the issues which can lead to gaps between the outcomes delivered by the
assurance engagement and the expectations of users of the assurance reports, and
suggest how these can be overcome
TOPIC OVERVIEW
Why is assurance
What is assurance
important
Example of assurance
The expectations gap
engagements
Typical objective test questions will test your understanding of the relationship
between the parties involved in an audit, and also the subject matter and the
intended users (such as shareholders). Ensure that you can identify the role of
each element of an assurance engagement from an exam scenario.
SOLUTION
LEVELS OF ASSURANCE
The International Framework for Assurance Engagements identifies two types of
assurance engagement, a reasonable assurance engagement and a limited
assurance engagement.
The key differences between the two types of assurance engagement are:
The evidence obtained
The type of opinion given
LEVELS OF ASSURANCE
For each of the following assurance engagements, select what level of assurance you
would expect to be given.
Assessment of effectiveness of internal controls
A Reasonable
B Limited
Statutory audit
C Absolute
D Reasonable
Review of cash flow forecast
E Reasonable
F Limited
Audit
An audit is historically the most important type of assurance service in the UK.
Objective:
The objective of an audit is to enable the auditor to express an opinion on whether the
financial statements are prepared, in all material respects, in accordance with an
applicable financial reporting framework. This is often referred to as the financial
statements reflecting a 'true and fair view' of the business. Although there is no legal
definition of 'true' and 'fair', these terms are generally accepted as meaning the
following:
True: Information is factual and conforms to reality, not false. In addition the
information conforms to required standards and law. The accounts have been correctly
extracted from the books and records.
Fair: Information is free from discrimination and bias in compliance with expected
standards and rules. The accounts should reflect the commercial substance of the
company's underlying transactions.
Types of assurance
Examples of assurance
What is assurance Levels of assurance
engagements
Users
In the key assurance service of audit, the users are the shareholders of a company, to
whom the financial statements are addressed. In other cases, the users might be the
board of directors of a company or a subsection of them.
Benefits of assurance
Key benefit:
Independent and external professional verification.
Additional benefits:
May give confidence to other users (enhancing the credibility of the information)
Deterrent against fraud and error and reducing management bias
Draws attention to deficiencies or modifications in the prepared information
Leads to effective markets as investors have more faith and trust in financial
accounts and the underlying companies
BENEFITS OF ASSURANCE
Which of the following is not a benefit of an assurance report on a set of financial
statements?
C Reduces the risk that management may overstate the assets of the
company to show a better result
D Draws the attention of the user to deficiencies in the information
being reported upon
LIMITATIONS OF ASSURANCE
Which of the following is a limitation of the provision of assurance?
A An assurance engagement may deter fraud and error
B Assurance work is carried out by people who don't work for the entity and are
therefore unfamiliar with their systems
C Information may contain estimates and judgements
D Unqualified staff may be used on assurance engagements
The expectations gap could be defined as the difference between the expectations of
the users and the service being provided by the auditors. Common misconceptions are
that auditors are responsible for preparing the financial statements and identifying all
instances of fraud and error within the financial statements.
EXPECTATIONS GAP
Consider the following examples of the expectation gap below
'The financial statements are audited so this will guarantee that the company will
continue to trade for the foreseeable future'
'Auditors will detect all fraud during an audit of the financial statements'
'If the financial statements have been audited then the figures will be completely
accurate and the audit will provide absolute assurance to this fact'
There are a variety of ways which the expectation gap can be reduced, such as by
setting out the terms of the engagement in an engagement letter (see Topic 2).
Why is assurance
The expectation gap
important?
Benefit Limitations
Unsatisfactory Report
to management
Satisfactory
Restricted Full
substantive tests substantive tests
Overall review of
financial statements
Report to
management
Auditor's
report
ELEMENTS OF ASSURANCE
Criteria
It is most likely in this instance that the criteria would be accounting standards, so that
Jenny was assured that the financial statements were properly prepared and comparable
with other companies' financial statements.
Report
The nature of the report would be agreed between you and Jenny, however, it would be
a written report containing your opinion on the financial statements.
Evidence
You would have to agree the extent of procedures in relation to this assignment with
Jenny so that she knew the level of evidence you were intending to seek. This would
depend on several factors, including the degree of secrecy in the proposed transaction
and whether the directors of Bloggin Limited allowed you to inspect the books and
documents.
Subject matter
The most recent financial statements of Bloggin Limited are the subject matter.
Three party relationship:
Jenny (the intended user)
You (the practitioner)
The directors of Bloggin Limited as they produce the financial statements (the
responsible party)
LEVELS OF ASSURANCE
Assessment of effectiveness of internal controls
B Limited: Not enough evidence can be gathered to give the higher level of
assurance.
Statutory audit
D Reasonable: Statutory audits give a high (reasonable) level of assurance, but this
assurance can never be absolute.
Review of cash flow forecast
F Limited: Most of the information is based on future estimates, therefore not
reliable enough to give reasonable assurance.
BENEFITS OF ASSURANCE
C Reduces the risk that management may overstate the assets of the
company to show a better result
D Draws the attention of the user to deficiencies in the information being
reported upon
An assurance engagement can never give absolute assurance that the accounts are
correct. The others are benefits.
LIMITATIONS OF ASSURANCE
C Information may contain estimates and judgements.
EXPECTATIONS GAP
Nature of the misunderstandings
'The financial statements are audited so this will guarantee that the company will
continue to trade for the foreseeable future'
– Misunderstanding the nature of audited financial statements
'Auditors will detect all fraud during an audit of the financial statements'
– Misunderstanding the type and extent of the work undertaken by auditors
'If the financial statements have been audited then the figures will be completely
accurate and the audit will provide absolute assurance to this fact'
– Misunderstanding the level of assurance provided by auditors
Learning outcomes
Students will be able to explain the concept of assurance, why assurance is required and
the reasons for assurance engagements being carried out by appropriately qualified
professionals.
In the assessment, students may be required to:
• Define the assurance process, including:
obtaining the engagement
engagement acceptance
the scope of the engagement
planning the engagement
performing the engagement
continuous risk assessment
• Recognise the need to plan and perform assurance engagements with an attitude
of professional scepticism and the exercise of professional judgement
TOPIC OVERVIEW
Obtaining an
Planning
engagement
Agreeing terms of an
Audit strategy and plan
engagement
ACCEPTING AN ENGAGEMENT
This section covers the procedures that the auditors must undertake to ensure that
their appointment is valid and that they are clear to act. This is covered in ISA (UK)
210 Agreeing the Terms of Audit Engagements.
Auditors are normally appointed on an annual basis and by shareholders' ordinary
resolution. In some circumstances, such as for a new organisation or breaching the audit
threshold for the first time, the directors may appoint auditors.
Appointment considerations
In gaining the information to determine whether they can accept the appointment, the
auditors would undertake a number of procedures.
The nominee auditors must carry out the following procedures (MANICS):
Identify whether the following statements are true or false. Jacob, Marley & Dickens is an
audit firm who are considering a new client, Christmas Chains Limited. Which of the
following factors must the audit firm consider when taking on this new client?
True False
Whether the firm has sufficient expertise to carry out the engagement
Whether the firm can make sufficient profit from the engagement
A letter of engagement sets out the objectives, scope and responsibilities of the audit.
It outlines the reporting framework and the form of any reports or opinions which may
be given.
Obtaining an engagement
Stability
Inspection
Observation
Enquiry
Analytical procedures
Computation
Professional judgement
ISA (UK) 200 requires the auditor to exercise professional judgement in planning and
performing an audit of financial statements, including, but not restricted to the following:
Materiality and audit risk
Extent and timing of audit procedures
Sufficient and appropriate audit evidence obtained
Evaluating management judgements
Drawing conclusions on the evidence obtained
PROFESSIONAL JUDGEMENT
Which THREE of the following factors may influence the judgement of the assurance
team as to what may constitute sufficient, appropriate audit evidence during an
engagement?
Materiality
Audit risk: The risk that the auditor expresses an inappropriate audit opinion when the
financial statements are materially misstated.
(FRC Ethical Standard, Glossary of terms)
Under ISA (UK) 200 Overall Objectives of the Independent Auditor and the Conduct of an
Audit in Accordance with International Standards on Auditing (UK), the auditor should
plan and perform the audit to reduce audit risk to an acceptably low level.
It is made up of three components as is illustrated by the below diagram:
AR = IR × CR × DR
Inherent risk
The risk of such misstatement is greater for some assertions and related classes of
transactions, account balances and disclosures than for others. For example:
Control risk
Control risk: The risk of a misstatement that could occur in an assertion about a class
of transactions, account balance or disclosure, and that could be material, either
individually or when aggregated with other misstatements, and not being prevented, or
detected and corrected, on a timely basis by the entity's internal control.
We shall look at controls in more detail in Topic 4 Internal Control Systems. In this topic
you will learn about the types of controls you might expect to see in a company, and
therefore be able to identify weaknesses or deficiencies, which indicate control risk.
Detection risk: The risk that the procedures performed by the auditor to reduce audit
risk to an acceptably low level will not detect a misstatement that exists and that this
error could be material, either individually or when combined with other factors.
The auditor manages overall audit risk by manipulating detection risk, the only element
of audit risk the auditor has control over. This because the more work the auditors carry
out, the lower detection risk becomes, although it can never be entirely eliminated due to
the inherent limitations of an audit.
SPEEDY BIKES
You have recently been appointed as the auditor of Speedy Bikes Ltd, a company that
was set up during the year and sells performance motorcycles. The company is keen to
have their audit finalised as soon as possible as they are looking to obtain funding from
their bank in the form of a business development loan. Their accounts are needed as
part of the loan application process.
The company had a bespoke software package written by the director's brother, Alex,
who is a keen amateur software writer. The package deals with all of the company's daily
accounting needs.
Most new motorcycles displayed in the showroom are on consignment from the main
manufacturers. The title transfers when the bike is sold on to a customer or used as a
demonstrator; up until that point Speedy Bikes can return it to the manufacturer at no
penalty.
The company also sells secondhand bikes; these are purchased from the public or taken
in as part exchange. The director of Speedy Bikes, Marc, has told you that they have the
largest collection of secondhand bikes in the South East held throughout their branches
and in some off-site warehouses, some of which have not been produced by the main
manufacturers for years and are now very rare.
Requirements
a) Identify the inherent risk factors from the above scenario.
b) Identify the control risks.
c) Identify the detection risks.
SOLUTION
SOLUTION
Assess the identified risks and link them to what can go wrong at the assertion level
Consider whether the risks are of a magnitude that could result in a material misstatement
IDENTIFYING RISKS
You are involved with the audit of Tantpro Ltd, a small company. You have been carrying
out procedures to gain an understanding of the entity. The following matters have come
to your attention.
The company offers standard credit terms to its customers of 60 days from the date of
invoice. Statements are sent to customers on a monthly basis. However, Tantpro Ltd
does not employ a credit controller, and other than sending statements on a monthly
basis, it does not otherwise communicate with its customers on a systematic basis. On
occasion, the receivables ledger clerk may telephone a customer if the company has not
received a payment for some time. Some customers pay regularly in accordance with the
credit terms offered to them, but others pay on a very haphazard basis and do not
provide a remittance advice. Receivables ledger receipts are entered onto the receivables
ledger but are not matched to invoices remitted. The company does not produce an aged
list of balances.
Requirement
Which of the following risks is most likely to arise out of the above scenario?
Inventory may be overstated.
SIGNIFICANT RISKS
Which two of the following are more likely to give rise to significant risk?
MATERIALITY
ISA (UK) 320 Materiality in Planning and Performing an Audit states that 'materiality and
audit risk are considered by the auditor when:
Identifying and assessing the risks of material misstatement;
Determining the nature, timing and extent of audit procedures; and
Evaluating the effect of uncorrected misstatements, if any, on the financial
statements and in forming the opinion in the auditor's report.'
(ISA (UK) 320, para.A1)
Materiality: a matter may be deemed to be material (by its size or nature) if its
omission or misstatement could influence the economic decisions of users taken on the
basis of the financial statements.
Materiality guidelines
The auditor must use their professional judgement when assessing and setting the level
of materiality for an engagement.
To set the materiality level they need to decide the level of error which would distort the
view given by the accounts. Because many users of accounts are primarily interested in
the profitability of the company, the level is often expressed as a proportion of profit;
however, the auditors will often calculate a range of values, such as those shown below,
and then take a weighted average of all the figures.
Revenue ½–1
Review of materiality
The level of materiality must be reviewed constantly as the audit progresses, and
changes may be required because:
Draft accounts are altered (due to material error and so on) and therefore
overall materiality changes
External factors may cause changes in risk estimates
Such changes may be caused by errors or misstatements found during testing.
MATERIALITY
For each of the following statements select whether they are true or false in respect of
the concept of materiality.
Materiality depends only on the monetary amount of an item.
A True
B False
Materiality is set at the planning stage and that figure is used throughout the audit.
C True
D False
The materiality level based on revenue set by auditing standards is between ½% and 1%.
E True
F False
ANALYTICAL PROCEDURES
Heading/ratio Formula
Performance Profit before interest and tax
Return on capital employed Equity + net debt
Efficiency Revenue
Net asset turnover Capital employed
Draft Actual
20X7 20X6
£'000 £'000
Property, plant and equipment 32,560 31,850
Extracts from the draft statement of profit or loss for the year ended 30
September 20X7
Draft Actual
20X7 20X6
£'000 £'000
Revenue 43,150 40,750
13,970 11,710
SOLUTION
Budget Actual
£ £
Sales 1,350,000 1,339,588
Requirement
Which three of the following areas would you be most likely to investigate further as a
result of carrying out analytical procedures on the above? Briefly explain your answer.
Sales
Cost of sales
Depreciation
Motor expenses
Audit strategy: The formulation of the general strategy for the audit, which sets
the scope, timing and direction of the audit and guides the development of the
audit plan.
Audit plan: An audit plan is more detailed than the strategy and sets out the
nature, timing and extent of audit procedures.
Planning these procedures takes place over the course of the audit
Planning
Understanding the entity Analytical procedures Materiality Audit risk Audit strategy and plan
Matters to consider Professional Identify and assess the risks of Materiality definition Audit risk definition: Strategy (scope, timing and
scepticism and judgement material misstatement direction of the audit)
Material by nature vs by Audit risk = IR × CR × DR
Analytical procedures to gain an amount Plan (nature, timing and
understanding of the entity extent of audit procedures)
Guidelines:
Ratio analysis Profit before tax Objectives of audit planning
Revenue
Variance analysis Total assets
Investigation of unusual items
ACCEPTANCE CONSIDERATIONS
True False
Inspection
Observation
Enquiry
Analytical procedures
Computation
Although the auditor may use computation, particularly when carrying out analytical
procedures, it is not a required tool, whereas a combination of the procedures outlined
above is required by the ISA.
PROFESSIONAL JUDGEMENT
Materiality
Experience of prior audits
Reliability of the evidence
SPEEDY BIKES
Inherent risks
The company was set Inexperience is likely to lead to a higher number of errors in
up during the year the accounts.
New companies often struggle to survive due to liquidity
issues; this may mean that the company may not be a going
concern.
Reliant on audited The director may be tempted to overstate the profit and
accounts to secure assets of the company in order to present a better result to
funding the bank.
Small company The company appears to be small with not many staff; it is
therefore likely that there would not be enough people to
carry out control tests to prevent and detect errors.
Time pressured audit Marc has requested that the audit is completed as soon as
possible. This may put pressure on us to reduce the amount
of work we do due to time constraints.
AUDIT RISK
a) Control – the fact that there are few employees in the accounts department means
that segregation of duties will be limited (see topic 3 Internal Control Systems for
more details in this area).
b) Inherent – this is a naturally risky industry.
c) Detection – this is in essence the definition of detection risk.
d) Inherent – there is a risk that estimates may be inappropriate.
IDENTIFYING RISKS
Trade receivables may be overstated.
The key risk arising from the above information is that trade receivables may not be
carried at the appropriate value in the financial statements, as some may be
irrecoverable. Where receipts are not matched against invoices in the ledger, the balance
on the ledger may include old invoices that the customer has no intention of paying.
It is difficult to assess at this stage whether this is likely to be material. The trade
receivables balance is likely to be a material balance in the financial statements, but the
number of irrecoverable balances may not be material. Analytical procedures, for
example, to see if the level of accounts receivable has risen year on year, in a manner
that is not explained by price rises or levels of production, might help to assess this.
A key factor that affects the likelihood of the material misstatement arising is the poor
controls over the receivables ledger. The fact that invoices are not matched against
receipts increases the chance of old invoices not having been paid and not noticed by
Tantpro Ltd. It appears reasonably likely that the trade receivables balance is overstated
in this instance.
MATERIALITY
Materiality depends only on the monetary amount of an item.
B False
An item can be material by nature, as well as by monetary value.
Materiality is set at the planning stage and that figure is used throughout the audit.
D False
The planning materiality figure is likely to change as the audit progresses, errors are
found or the risk assessment changes.
The materiality level based on revenue set by auditing standards is between ½% and
1%.
F False
There are no figures specified by auditing standards.
* Have used cost of sales in place of purchases, which cannot be identified for
both years.
b) Risk of misstatement
The increase in gross profit margin could result from:
Cut-off errors in revenue, including sales made after the year end
Overstatement of value of closing inventory
Inconsistency in cost classification between the two years
The net profit margin has remained fairly constant over the period and as a
result:
This could strengthen the auditor's suspicion that costs have been
misclassified
The increase in inventory days could result from:
A falling off in demand for the company's products, meaning items of
inventory may be obsolete or unsaleable so their value may be overstated
Errors in year-end inventory counting
The increase in trade receivable days could indicate:
That some long overdue amounts are included that may not be recoverable,
so an allowance may be required
Cut-off errors at the year end, overstating sales and receivables
The increase in trade payable days could indicate:
That the company has cash flow problems and is struggling to pay its
liabilities as they fall due. This could raise doubt over the entity's status as a
going concern
Cut-off errors with posting of cash payments at the year end
Learning outcomes
Students will be able to explain the nature of internal controls and why they are
important, document an organisation's internal controls and identify weaknesses in
internal control systems.
In the assessment, students may be required to:
• State the reasons for organisations having effective systems of control
• Identify the fundamental principles of effective control systems
Identify the main areas of a business that need effective control systems
• Identify the components of internal control in both manual and IT environments,
including:
– the overall control environment
– preventative and detective controls
– internal audit
• Define and classify different types of internal control, with particular emphasis
upon those which impact upon the quality of financial information
• Show how specified internal controls mitigate risk, including cyber risks, and state
their limitations
TOPIC OVERVIEW
Information about
control
Limitation Examples
Human element
Collusion
Unusual transactions
Audit committee
The audit committee is an important aspect of the control environment of a company.
To monitor and
review
To implement policy effectiveness of
on supply of non- internal audit
audit services by department
external auditor
To monitor
To approve arrangements
remuneration and safeguarding the
engagement terms privacy of whistle
of external auditor blowers
To recommend
appointment,
reappointment and
removal of external
auditor
Business risk
Internal controls are implemented to minimise business risk. If the risk assessment
process is weak, then the resulting internal controls may not be effective.
The management of an organisation will need to ensure that they have considered the
elements of business risk using a risk assessment. This is the process of control that is
the entity's process for identifying business risks. In particular, they will focus on those
risks relevant to financial reporting objectives and deciding on the controls to reduce any
issues.
The risk assessment process will involve the following elements:
Decide upon actions (internal controls, insurances, changes in operations) to manage them
Control activities
Control activities: The policies and procedures that help ensure that management
directives are carried out.
The auditor will be concerned with understanding whether a control prevents an error
occurring or detects that an error has happened and corrects it. Control activities may
just be manual; however, where processes are computerised, there may also be specific
IT control activities in place.
Physical controls
Information processing
Review of performance
Authorisation
Information systems
Information systems consist of infrastructure (physical and hardware components),
software, people, procedures and data. It may be a simple, manual system such as
using a spreadsheet or a fully integrated, and more automated, information system (such
as Sage, Oracle or Netsuite).
General controls
General controls: Policies and procedures that relate to many applications and support
the effective functioning of application controls by helping to ensure the continued
proper operation of information systems.
Application controls
These are more specific in nature, but using the general controls as a basis. An example
would be taking the general control of the prevention of unauthorised access, and
creating the application control in sales where a credit note can only be raised by a
supervisor or a person not responsible for raising invoices (segregation of duties).
Cyber security
The security of data and information held on computers and databases ('cyber security')
has become more important in recent years. Organisations may face many forms of
cyber risks including:
Human threats – hacking of information, theft of information (from both internal
and external sources); in particular, political terrorism is a major risk
Fraud – the theft of funds and information by dishonest use of the computer system
Deliberate sabotage
Viruses and other forms of malware – worms, trojan horses, spyware
Denial of service (DoS) attacks – thus preventing the legitimate users of a service
from being able to use that service
The ICAEW published an updated Audit Insights: Cyber Security (2018) which made
recommendations to businesses, including:
Communication – between businesses, using networks to share understanding and
ideas
Organisational structures – entities need to allocate responsibility and
accountability for cyber security
Accountability – ensure that the Board takes cyber risks seriously and are
committed to maintaining and improving security across the business
Continuous improvement – cyber security is an ongoing process, therefore,
organisations need to ensure continuous development within the business and
across the industry
Preventative Detective
Each member of the finance team has
their own logon details and password.
The financial controller reviews the
bank reconciliation on a monthly basis.
Only the HR Director can change
payroll base figures for each staff
member.
The purchasing team has read only
access to the sales data.
Controls over input, processing, data files and output may be carried out by IT
personnel, users of the system or a separate control group and may be programmed into
application software. The auditors may wish to test the following application controls.
MONITORING OF CONTROLS
Requirement
a) Consider who in an organisation would be required to monitor controls to ensure a
strong control environment.
b) Explain why such monitoring is useful in an organisation.
SOLUTION
Are purchase invoices checked to goods received notes before being passed for
payment?
Yes/No/Comments
A 'No' answer to that question clearly indicates a deficiency in the company's payment
procedures.
An example of the sales (revenue) cycle may include:
Internal control evaluation questionnaire: control questions
The sales (revenue) cycle
Is there reasonable assurance that:
a) All sales properly authorised?
b) All credit sales are made to reliable payers?
c) All goods despatched are invoiced?
d) All invoices are properly prepared?
e) All invoices are recorded in the accounting records?
RECORDING CONTROLS
Auditors will record the internal controls that they see.
Requirement
Consider the different methods that auditors can use to record the systems in place, and
note any advantages or disadvantages to their use.
Advantages Disadvantages
Narrative notes
Internal Control
Questionnaires (ICQs)
and checklists
Diagrams/flow charts
DOCUMENTING CONTROLS
Speedy Bikes has a simple accounting system with few controls that are not changed
regularly.
Requirement
What would be the best way of recording the controls in this system?
A Narrative notes
B Flow chart
C Questionnaire
D Decision tree
Monitoring of controls
Purpose
Reports to
Scope
Status
Qualifications
Internal audit
Compliance reviews
Special investigations
Limitation Examples
Expense of the control Cost may outweigh the benefit, eg physical security, extra
staff.
Unusual transactions Unusual transactions may not pass through the normal
systems and therefore may bypass the internal controls as
well.
TYPES OF CONTROL
APPLICATION CONTROLS
TYPES OF IT CONTROL
Examples of computer controls
RECORDING CONTROLS
Advantages Disadvantages
DOCUMENTING CONTROLS
A Narrative notes
Learning outcomes
Students will be able to explain the nature of internal controls and why they are
important, document an organisation's internal controls and identify weaknesses in
internal control systems.
• In the assessment, students may be required to:
• Identify internal controls for an organisation in a given scenario;
• Identify internal control deficiencies in a given scenario’
• Show how specified internal controls mitigate risk, including cyber risks, and state
their limitations
• Define and classify different types of internal control, with particular emphasis
upon those which impact upon the quality of financial information
• Identify, for a specified organisation, the sources of information which will enable a
sufficient record to be made of accounting or other systems and internal controls
Gathering evidence on an assurance engagement
Students will be able to select sufficient and appropriate methods of obtaining assurance
evidence and recognise when conclusions can be drawn from evidence obtained or
where issues need to be referred to a senior colleague.
In this assessment, students may be required to:
• Identify the different methods of obtaining evidence from the use of tests of
control, substantive procedures, including analytical and data analytics
• select appropriate methods of obtaining evidence from tests of control and from
substantive procedures for a given business scenario
TOPIC OVERVIEW
Calculating wages
Ordering, risks and Ordering, risks and
and salaries, risks
controls controls
and controls
Receive
payment
Document
order
Chase
payment
Send Send
invoice statement
Make
order
Account
for invoice Raise
invoice
Despatch
order
Raise
despatch note
ORDERING
It is vital that all customer orders are accurately recorded and in sufficient detail to
provide users with the information required to process valid transactions.
Risks and controls
Goods sold to customers Credit checks (from credit Review credit checks
with poor credit agency) for new customers performed for new
ratings/customers don't pay customers
Check customers' credit Review of customer
limit before accepting new balances compared to their
orders credit limits
Changes to customers' Review changes to
credit limits must be customer credit limits to
authorised by appropriate ensure supported by
management authorisation form/email
Regular review of from management
customers' credit limits by
senior staff
The sales clerk uses a software system which produces sales orders in sequential order
The sales clerk can amend credit limits on long standing customers
COMPLETE INVOICING
Which three of the following controls will help to mitigate the risk of goods being
despatched but not invoiced?
Invoice sent out but not Reconciliation of the sales Review of reconciliations
recorded ledger control account to Segregation of duties
sales ledger balances (recall between raising GDNs and
from Accounting paper) raising invoices
Sequence checks of invoices
posted to day books to
ensure no omissions
Wrong customer's Prepare and send out Review a sample of customer
account updated for sale customer statements statements
or cash received Retain customer remittance Trace a sample of
advices sales/receipts from the
invoice/remittance advice to
the day book and then on to
the individual customer
account
Sales recorded in wrong Review GDNs of sales around Reperform the client's review
period ('Cut-off') year end (for date) to ensure (as described left)
sales recorded in correct
period
Debts wrongly written All write-offs must be Review debts written off in
off authorised (by appropriate year to ensure supported by
management/financial authorising email/form
controller)
Totals from day books Review postings to the Review for day's missing
not posted to general general ledger to ensure one postings
ledger for each business day (if that Cast day books
is how often postings are
made)
The clerk could be siphoning off individual receipts and defrauding the company
Old outstanding invoices could be left unpaid
Sales might be recorded in the wrong supplier's accounts
Sales may not be recorded properly in the sales account
CASH COLLECTION
Risks and controls
The risks relating to cash and the controls that have been implemented to mitigate these
risks must be tested as part of the audit. Most businesses will settle amounts owed to
suppliers by bank transfer or BACS payments. Retail organisations and small businesses
may still have significant amounts of cash on site.
Invoicing
Credit control
DEFICIENCIES
The following describes the sales system in operation at Jinbob Co.
Requirement
For each process indicate whether it is a strength or a deficiency in the system.
Strength Deficiency
Revenue system
Send payment
Receive goods
Carry on
production
Raise goods
Record and received note (GRN)
account for invoice
Receive invoice
Accounts
department match
GRN to invoice
ORDERING
Organisations must monitor purchases carefully in order to maintain the required amount
of inventory for the business needs (manufacture, retail, wholesale etc) but equally, it
needs to ensure that the best price is achieved. Often buying items in bulk can result in
higher discounts than when a lower quantity is ordered, however, this may have an
adverse effect on the cash flow. There is also the risk that a member of staff purchases
items for their own private use using business funds.
PURCHASE FRAUD
The directors of Lyton Ltd have just uncovered a fraud being perpetrated by the store's
manager. He was in charge of ordering, had raised a number of false orders to non-
existent suppliers, raised GRNs in respect of non-existent deliveries and forwarded an
invoice to the accounts department, which was then paid.
Requirement
Which two of the following controls could have prevented this fraud?
Check of goods inward by person other than the person placing the order
Goods are misappropriated Recording arrival and Check outstanding POs are
for private use acceptance of goods being reviewed
Review outstanding Agree a sample of invoices
purchase orders (POs) to POs and GRNs
Goods accepted may not Comparison of GRN to POs Check a sample of GRNs to
have been ordered their matched POs
Locked stores
RECORDING INVOICES
Rhonda posts the invoices to the payables ledger.
Requirement
Which two of the following functions should Rhonda therefore not be involved with?
PAYMENT
All payments need to be verified for accuracy, and to confirm that the business is paying
valid purchase invoices. Invoices should be checked back to the original orders (to verify
order prices and confirm that the payment relates to a genuine business order) and to
the goods received by the entity. Any shortfalls in items received must be reflected in the
invoice.
Authorisation of payments
INVOICE PAYMENT
The auditor of Sunny plc has identified that there is no procedure to track purchase
invoice due dates.
Requirement
Which of the following is the most likely consequence which might arise as a result of
that weakness?
Purchase system
Employees paid for work Leavers notified to payroll Check that leavers form exists
they haven't done by supervisor via standard and was submitted in a timely
form fashion for leavers
Hours worked reviewed by Review evidence (ie
management signature) of review by
appropriate management
Timesheets or clocking Review/observation of
in/out used to record hours timesheets or clocking in/out
worked Review timesheets for
Timesheets signed by supervisor signature
supervisors
TIMESHEETS
The following system of time records exists at Shepherd Ltd. Staff members are required
to fill in a manual timesheet as they arrive, stating the time of arrival, and as they leave,
stating the time of departure. Staff members are then paid an hourly rate on the basis of
this record.
Requirement
Which two of the following outcomes could arise from this system?
Employees may be paid at an inappropriate rate
Employees may be paid for work they have not done
Employees are paid for the hours they have worked
Employee deductions may be inappropriate
Gross and net pay are not Reconciliations between pay Review reconciliation for
accurately recorded on and deductions from one evidence of review by
payroll period to the next management
(differences caused by Trace a sample of months'
leavers, joiners, overtime) payroll to journal entries
Controls over calculations
as above
Wages paid are not Bank reconciliations Review bank reconciliations
correctly recorded in bank performed and reconciling for evidence of review by
and cash records items investigated management
Trace a sample of months'
payroll to journal entries
Wages and salaries not Reconciliation performed Check this reconciliation has
recorded accurately on the between nominal ledger been done, reviewed by
nominal ledger codes and payroll appropriate management
and any discrepancies
investigated
Wrong amounts are paid to Agree gross earnings and Agree sample from tax
HM Revenue and Customs tax deducted to tax returns returns to bank statement
(HMRC) showing payment
People who are not Cash (rare) Observation of payment
employees are paid Segregate duties between process
those preparing pay packets Review records of
and distributing them employees signing for
Cash stored in safe wages
Employees must show ID to Review reasons for wages
claim pay packet being unclaimed and what
Employees must sign to was done next
confirm they have received
wages
Bank transfer
Bank transfer lists agreed to Agree a sample of bank
payroll (previously transfers to payroll records
authorised) Review for signatures to
Cheques and bank transfer show authorisation
lists authorised Review control account
Wages and salary control entries
accounts used – reviewed
each month to ensure
cleared (would highlight
where employee bank
details wrong and bank
returns payment)
LEAVERS
Which two of the following control activities will reduce the risk of employees who have
left being made up a pay packet which is collected by the leaver or an accomplice?
Strength Deficiency
Payroll system
CONTROLS
The sales clerk can amend credit limits on long standing customers
Any adjustments to credit limits and discounts must be authorised by a senior member of
staff (such as a manager). The fact that the sales clerk can perform this task is not an
example of a control, but rather demonstrating that there is a weakness in the system of
internal controls. The software should be set up to prevent such actions and ensure that
management must authorise such changes to the price prior to fulfillment.
Software listing sales orders in sequential order will assist in ensuring that all sales orders
are dealt with and are fulfilled. The sales clerk can run a credit check as a control to
establish whether or not the customer is likely to be able to pay for items purchased on
credit. Also, the supervisor should review the contents of the report (or the system
'scores' the customer based on the credit report) to enable credit to be granted where
appropriate.
IRRECOVERABLE DEBTS
Obtaining a credit reference for new customers
Authorisation of new customers by a senior staff member
COMPLETE INVOICING
Pre-numbering of invoices helps to ensure that invoices raised are sent out and recorded,
but does not necessarily ensure that all goods despatched are invoiced.
The other controls all contribute to ensuring that all despatched goods are invoiced.
RECEIPT RECORDING
The clerk could be siphoning off individual receipts and defrauding the company. (This is
a fraud called 'teeming and lading', which can be successful if the outstanding balance on
the account does not look unusual and the actions of the receivables ledger clerk are not
checked.)
Old outstanding invoices could be left unpaid. This is because if the invoices are not
matched, so that it is not clear which invoices are outstanding, and yet the overall
balance outstanding looks reasonable, older invoices, which should be being chased up
by the company, may not be paid and ultimately may be forgotten about.
DEFICIENCIES
Deficiency (because the customer's credit status is not checked before the order is
processed)
Strength (because the invoices are generated from goods despatched information)
Strength (because production is kept up to date by weekly review of outstanding orders)
PURCHASE FRAUD
Approved list of suppliers
Check of goods inward by person other than the person placing the order
Given that the store's manager is entitled to make orders, pre-numbered order forms and
safekeeping of order forms would have made no difference in this case.
GOODS RECEIVED
Matching of purchase invoices with GRNs
RECORDING INVOICES
Reconciliation of the payables ledger to the control account
Authorisation of payments
PAYMENTS
Stamping PAID on invoices that have been paid
Authorisation of payments
Although checking supplier statements will help, the timing differences between the
statement date and payments made may mean that this method is not foolproof.
TIMESHEETS
Shepherd Ltd has a simple control over how much work is being done by its employees.
Therefore, employees may be paid for the hours they have not worked.
However, it is a very simple control, which relies on the integrity of the employees in
recording the correct times they arrived and left the premises. There does not appear to
be a supervisory control ensuring that employees are writing the correct times. Nor is
there any provision for times when the employees are not working, for example, lunch
hour or slack periods. Therefore, it is possible that despite the presence of this control,
employees may be paid for work they have not done.
LEAVERS
Check that each employee only collects one pay packet
Authorisation of payroll by someone outside of payroll with knowledge of leavers
Comparison of the payroll with the pay packets will only be effective if the payroll has
been properly updated for the leaver. Supervision by a member of staff who knows all
the staff will be necessary if the employees are not required to show identification to pick
up wages, but will not necessarily stop a leaver picking up a wage packet if the
supervisor does not know the staff member has left.
Strength Deficiency
1 Strength. The fact that employees cannot access the factory to work without
updating the time records automatically is a strength in the system.
2 Deficiency. It appears that the recruitment process is casual and there is not
necessarily any written documentation resulting from the appointment of an
employee. This could lead to errors in pay rates and payroll production that could
be eliminated if written notice of an employee's start was given to the payroll
department.
3 Strength. The fact that employees are required to return their cards when they
leave means that they are effectively excluded from the time recording system and
in practice cannot continue to be paid after they have left.
4 Strength. The fact that the payroll has parameters beyond which it seeks
authorisation means that mistakes should be corrected before the payroll is
finalised. In addition, there are application controls over correction of the payroll,
strengthening this control.
Learning outcomes
Students will be able to explain the concept of assurance, why assurance is required and
the reasons for assurance engagements being carried out by appropriately qualified
professionals.
In the assessment, students may be required to:
• Define the assurance process including
– keeping records of the work performed
– obtaining evidence
– evaluation of results of assurance work
• Recognise the characteristics of fraud and distinguish between fraud and error
Students will be able to select sufficient and appropriate methods of obtaining assurance
evidence and recognise when conclusions can be drawn from evidence obtained or
where issues need to be referred to a senior colleague.
In the assessment, students may be required to:
• Recognise when the quantity (including factors affecting sample design) and
quality of evidence gathered is of a sufficient and appropriate level, after taking
account of sampling risk, to draw conclusions on which to base a report
• Recognise the strengths and weaknesses of the different methods of obtaining
evidence
• Compare the reliability of different types of assurance evidence
TOPIC OVERVIEW
Purpose and form of Sufficient appropriate Procedures to obtain Analysis and evaluation
documentation audit evidence evidence of errors
Purpose of documentation
Example Ltd 1
3
4 7 AD
6 E
Payables
8
5 3.3.X4
Date: 16.2.X4
31 December 20X3 2
10
11 Work done
Selected a sample of trade payables as at 31 December and reconciled the supplier's statement
to the year end payables ledger balance. Vouched any reconciling items to source documentation
10
3
13 Results See E /2
One credit note, relating to Woodcutter Ltd, has not been accounted for.
An adjustment is required.
One other error was found, which was immaterial, and which was the fault of the supplier.
14
In view of the error found, however, we should recommend that the client management checks
supplier statement reconciliations at least on the larger accounts. Management letter point.
15 Conclusion
After making the adjustment noted above, payables ledger balances are fairly stated
as at 31 December 20X3.
Documenting
Audit evidence: Information used by the auditor in arriving at the conclusions on which
the auditor's opinion is based.
Sufficient Appropriate
(Quality)
● Source and reliability of Quality of evidence will also affect the Quantity of evidence
information available
For example, when management include an item of property, plant and equipment in the
financial statements they assert that the item exists and they have the right to the
asset and that the balance is complete and appropriately valued.
The auditor's evidence must be relevant to the particular financial statement assertion
the auditor is trying to test.
There are three categories: assertions about classes of transactions, assertions about
account balances and assertions about presentation and disclosure.
INVENTORY ASSERTIONS
Which one of the following assertions would the auditor be least concerned about in
relation to the audit of inventory?
A Completeness
B Allocation and valuation
C Rights and obligations
D Existence
The auditor will decide whether they wish to gather evidence using tests of controls
and/or substantive procedures. However some substantive procedures must always be
conducted because of the inherent limitations in any internal control system.
Note that the auditor would only ever attempt to gather evidence using tests of controls
if they felt the entity's internal controls were strong.
Tests of detail:
Procedures to detect
material misstatement
(eg physical inspection of
assets)
USING 'AEIOU'
Using the mneumonic AEIOU, the table below has given some examples, as well as
strengths and weaknesses in the various audit procedures.
Requirement
Complete the information by filling in the missing gaps
Procedures Example Strengths and weaknesses
Note. That analytical procedures are purely substantive procedures. Enquiry and
inspection can be used as either a test of control or a substantive procedure. Although
observation is closely linked at times to inspection, observation can be a substantive
procedure, for example when considering some inventory tests, such as observing the
inventory count completed by the client.
Source Source
SAMPLING
The overall aim of the audit is for the auditor to give an opinion as to whether the
financial statements are free from material misstatement (presented fairly).
The auditor does not test everything and so they need to decide the extent of testing
they will perform.
Audit sampling involves the application of audit procedures to less than 100% of
items within a population of audit relevance such that all sampling units have a chance of
selection in order to provide the auditor with a reasonable basis on which to draw
conclusions about the entire population.
Population is the entire set of data from which a sample is selected and about which
an auditor wishes to draw conclusions.
The auditor must always carry out substantive (detailed) tests on material items. These
include examining material journal entries to supporting evidence. Also by agreeing the
financial statements to the underlying books and accounting records.
SOLUTION
Tolerable misstatement
Tests of detail
For tests of detail, the auditor should project the monetary misstatements found in the
sample to the population and compare this to the tolerable misstatement.
Where a misstatement has been established as an anomaly, it should be excluded when
projecting sample misstatements to the population (but still needs to be considered, in
addition to the projection of the non-anomalous misstatements, when assessing
misstatements against tolerable misstatement).
SOLUTION
SOLUTION
AUDIT CONCLUSIONS
Danielle has carried out a receivables circularisation on Donothing plc.
Requirement
Identify whether the following conclusions drawn by her are correct or not.
CONSIDERATION OF MATERIALITY
Which two of the following should be determined as material uncorrected
misstatements?
A An isolated misposting between two supplier accounts which is below materiality
B A misstatement which is below materiality and results in director's bonus targets
being met
C An immaterial misstatement of assets which results in a debt covenant being
breached
D The monthly bank reconciliation was not prepared in August as the cashier was on
holiday
Concluding on evidence
RELIABILITY
B A photocopy of a client's bank statement is more reliable than the original
document.
C The strength of a client's internal controls has no impact on the reliability of audit
evidence.
INVENTORY ASSERTIONS
A Completeness
b) The projected error is above the tolerable misstatement limit. This means that
further evidence is needed.
This could be done by:
Extending the sample tested in the procedure and then reperforming the
extrapolation, or
Designing and performing additional substantive procedures.
If the further evidence allows the auditor to conclude that the actual misstatement
in the population does not exceed tolerable misstatement, then the auditor will
conclude that no adjustment is necessary, although the misstatement of £9,000
will be noted on a schedule of unadjusted misstatements. If the further evidence
indicates that there is a misstatement that exceeds tolerable misstatement then
the auditor will ask the client to make an adjustment to the financial statements.
CONSIDERATION OF MATERIALITY
B, C Although these two items are below the monetary amount set as materiality, the
particular circumstances surrounding their occurrence (ie their nature) make them
material misstatements. D relates to a test of controls.
Learning outcomes
Students will be able to select sufficient and appropriate methods of obtaining assurance
evidence and recognise when conclusions can be drawn from evidence obtained or
where issues need to be referred to a senior colleague.
In the assessment, students may be required to:
• Identify the different methods of obtaining evidence from the use of tests of
control, substantive procedures, including analytical procedures and data analytics
• Identify the situations within which the different methods of obtaining evidence
should and should not be used
• Select appropriate methods of obtaining evidence from tests of control and from
substantive procedures for a given business scenario
• Recognise issues arising while gathering assurance evidence that should be
referred to a senior colleague
Substantive testing
Statement of profit or
Non-current assets Payables
loss
Current assets −
Non-current liabilities
inventory
Unsatisfactory Report
to management
Satisfactory
Restricted Full
substantive tests substantive tests
Overall review of
financial statements
Report to
management
Auditor's
report
ASSETS
NON-CURRENT ASSETS
Non-current assets are among the material items on the statement of financial position.
There will be a number of key assertions:
Ownership (rights and obligations)
Existence
Valuation (including original cost, replacement or revalued amount, depreciation)
Completeness (omissions of non-current assets)
Classification (correctly presented in the financial statements, eg checking that
items included in non-current assets should not be included in the statement of
profit or loss instead, such as repairs and maintenance)
Presentation and disclosure
At 31 December 20X8
Cost or valuation 2,900,000 600,000 3,500,000
Accumulated depreciation (360,000) (240,000) (600,000)
Carrying amount 2,540,000 360,000 2,900,000
At 31 December 20X7
Cost or valuation 2,000,000 600,000 2,600,000
Accumulated depreciation (400,000) (180,000) (580,000)
Carrying amount 1,600,000 420,000 2,020,000
Additions
Depreciation
Disposals
Inventory count
Before
Planning
– Review working papers for the previous year to identify risks and familiarise
yourself with the inventories
– Determine arrangements with management in advance
– Establish what arrangements have been made for inventories held by or for
third parties
– Review client's inventory count instructions
– Consider the need for an expert
Determine procedures to cover a representative selection of inventories
During
Inventory valuation
Inventory must be valued at the lower of cost and net realisable value (NRV) in
accordance with IAS 2 Inventories.
Cost
The cost of an item of inventory is the cost to acquire or produce the item including all
directly attributable costs.
The auditor should:
a) Record the basis of valuation used
b) Test material costs
Agree to supplier invoices
Ensure first in, first out (FIFO) or appropriate basis is being used
Verify/recalculate quantities used in WIP/finished goods
Where this is an audit risk, the auditor should perform audit procedures to determine
whether the NRV is lower than cost.
Such tests include the following:
a) Compare the selling prices of goods sold after the year end per the sales invoices
against their purchase invoices.
b) Review order book for evidence of goods being sold post year end and to
determine the sales price achieved post year end.
c) Discuss any inventory lines which suffered write downs last year to determine
whether they are still held at the year end.
d) Calculate the gross profit margin at which goods are sold post year end and
analytically review this compared to the gross profit margin for the current year.
Consider whether a fall in margin may indicate that some inventory is being sold
for less than cost.
Receivables
The major risks of misstatement of the receivables balance in the financial statements
are due to:
Irrecoverable debts
Disputes with customers (leading to slow payment or non-payment)
The following sources of information can be used:
Receivables ledger information
Confirmations from customers
Cash payments received after the year end
You have obtained the following results from the receivables balances circularised during
your audit.
Requirement
Detail the subsequent audit procedures you would perform on each of these balances.
Balance per
Balance per sales circularisation Reason for
ledger response difference
£ £
Alternative procedures
Examine the account to see if the balance outstanding represents specific invoices and
confirm their validity to despatch notes
Obtain explanations for invoices remaining unpaid after subsequent ones have
been paid
Irrecoverable debts
Tests for irrecoverable and doubtful debts include:
Understanding why the debt has an allowance against it
Reviewing correspondence with the customer
Reviewing cash received after date
Recalculating any general allowances
Investigating overdue debts without allowances
Comparing the allowance in previous years to actual bad debts
Bank
Key ways in which the bank and cash balance may be misstated include:
Rights/obligations – not all the bank accounts or balances have been disclosed.
Valuation – reconciliation errors or transposed figures from the bank statement,
which can over or understate the cash balance at year end.
Completeness/existence – cash items not being included in the year end balance
(especially a risk with petty cash or cash in transit balances).
Presentation – cash accounts may be netted off against each other, so instead of
showing a bank overdraft (for example in relation to the main current account) and
a positive bank balance (for example on the deposit account), these balances are
shown as a net balance on the face of the statement of financial position.
The following sources of information can be used to verify the amount of cash balances
held on hand and at bank at the year end:
Cash book
Confirmations from the bank (the bank confirmation letter(s) will list the bank
accounts held by the client, and also detail the balance of each account at the
financial year end)
Bank statements
Bank reconciliations carried out by the client
SOLUTION
Assets
Petty cash:
Physical count
Usually supplier statements are used rather than circularising suppliers; however, in
some circumstances confirmations may be deemed necessary.
Positive replies will be required where:
Suppliers' statements are unavailable or incomplete
There are weaknesses in internal controls surrounding payables
Deliberate understatement is suspected
There are unusual transactions
PAYABLES – ASSERTIONS
Which of the following assertions is the external auditor least concerned with when
testing the payables balance?
A Completeness
B Allocation and valuation
C Rights and obligations
D Existence
Method Considerations
Liabilities
Revenue
Perform analytical procedures:
– Obtain a breakdown of revenue per product or per month and compare to
the prior year – investigate any significant differences.
– Calculate the gross profit and compare to the prior year – investigate any
significant differences.
Vouch a sample of items in revenue to sales invoices/details of contracts.
Consider whether the level of revenue reported in the financial statements is
reasonable based on your understanding of the business during the year.
Revenue is linked to receivables and so the auditor should consider the effect any
adjustments to receivables will have on revenue (especially relating to errors in
cut-off).
Purchases
Perform analytical procedures (as per revenue above).
Vouch a sample of purchases to purchase invoices.
Consider the impact of any adjustments to inventory and payables on purchases
(especially relating to cut-off).
Payroll costs
Perform analytical procedures:
– Compare the level of payroll costs year on year.
– Perform a proof in total calculation on payroll costs – calculate the estimated
payroll costs based on prior year costs adjusted for numbers of staff and pay
rates in the current year.
Perform tests of detail, for example vouch the number of hours worked to
timesheets and wages rates to personnel records.
Agree pay as you earn (PAYE) and national insurance contribution (NIC) payments
to bank statements.
Expenses
Perform analytical procedures:
– Compare the level of expenses year on year.
Vouch expenses to purchase invoices.
Verify that expenses such as depreciation, inventory write down and irrecoverable
debts expense will be covered via audit procedures performed on the statement of
financial position balances.
Analytical procedures
Vouch to supporting
documentation
TESTING RECEIVABLES
D Review of monies received from customers post year end
PAYABLES – ASSERTIONS
D Existence – companies are least likely to overstate their liabilities.
Learning outcomes
Students will be able to explain the concept of assurance, why assurance is required and
the reasons for assurance engagements being carried out by appropriately qualified
professionals.
In the assessment, students may be required to:
• Define the assurance process, including
– concluding and reporting on the engagement
– reporting to the engaging party
Students will be able to select sufficient and appropriate methods of obtaining assurance
evidence and recognise when conclusions can be drawn from evidence obtained or
where issues need to be referred to a senior colleague
In the assessment, students may be required to:
State the reasons for preparing and keeping documentation relating to an
assurance engagement
Identify the circumstances in which written confirmation of representations from
management should be sought and the reliability of such confirmation as a form of
assurance evidence
Recognise when the quantity (including factors affecting sample design) and
quality of evidence gathered is of a sufficient and appropriate level, after taking
account of sampling risk, to draw conclusions on which to base a report
TOPIC OVERVIEW
Purpose of written
Types of opinion
representations
Other reports
General matters
Some representations made by management are general while others relate to specific
matters. Representations may be critical in obtaining sufficient, appropriate evidence.
ISA (UK) 580 Written Representations deals with the auditor's responsibility when
obtaining such representations.
General representations made by management include providing confirmation that they
have:
Fulfilled their responsibilities for the preparation of financial statements in
accordance with the applicable financial reporting framework
Provided the auditor with all relevant information and access to all books and
records
Recorded and reflected all transactions in the financial statements
The written representations are dated as near as possible to, but not after, the date of
the auditor's report on the financial statements.
[Entity letterhead]
(To Auditor) (Date)
This representation letter is provided in connection with your audit of the financial
statement of ABC Company for the year ended December 31, 20X8 for the purpose
of expressing an opinion as to whether the financial statements are presented fairly,
in all material respects, (or give a true and fair view) in accordance with
International Financial Reporting Standards.
We confirm that (to the best of our knowledge and belief, having made such
inquiries as we considered necessary for the purpose of appropriately informing
ourselves):
Financial Statements
We have fulfilled our responsibilities, as set out in the terms of the audit
engagements dated [insert date], for the preparation of the financial
statements in accordance with International Financial Reporting Standards; in
particular the financial statements are fairly presented (or give a true and fair
view) in accordance therewith.
Significant assumptions used by us in making accounting estimates, including
those measures at fair value, as reasonable. (ISA (UK) 540)
Related party relationships and transactions have been appropriately
accounted for and disclosed in accordance with the requirements of
International Financial Reporting Standards. (ISA (UK) 550)
All events subsequent to the date of the financial statements and for which
International Financial Reporting Standards require adjustment or disclosure
have been adjusted or disclosed. (ISA (UK) 560)
The effects of uncorrected misstatements are immaterial, both individually and in
the aggregate, to the financial statements as a whole. A list of the uncorrected
misstatements is attached to the representation letter. (ISA (UK) 450)
Any other matters that the auditor may consider appropriate.
Confirmation that management has fulfilled its responsibility for the preparation of
the financial statements
Confirmation that management has recorded and reflected all transactions in the
financial statements
Written representations
TYPES OF OPINION
Type of engagement Evidence-gathering The assurance report
procedures
Reasonable assurance Sufficient and appropriate A high level of assurance
engagement evidence is obtained by: (less than absolute
eg statutory audit assurance). Description of
Obtaining an understanding
the engagement, and a
of the engagement
positive statement of the
Assessing risks conclusion.
Responding to assessed
risks
Performing further
procedures using a
combination of inspection,
observation, confirmation,
recalculation,
reperformance, analytical
procedures and enquiry.
Limited assurance Sufficient and appropriate A meaningful level of
engagement evidence (lower level) is assurance. Description of
eg review of half-year obtained as part of a the engagement, and a
accounts systematic engagement negative form of
process that includes obtaining statement of the
an understanding of the conclusion.
subject matter and other
engagement circumstances,
but in which procedures are
deliberately limited relative to
a reasonable assurance
engagement.
These procedures may include
only enquiry and analytical
procedures.
Explicit opinions
In respect of the state of the company's affairs at the end of the financial year
The information given in the strategic report and the directors' report is
consistent with the financial statements
Returns from branches not visited have been received and are adequate for the
purposes of the audit
Accounts agree to the underlying records
Information and explanations have been received (and full access has been given to the
auditors)
Directors' transactions have all been correctly disclosed (emoluments and benefits agree
to supporting evidence, and any loans or other transactions with directors have been
correctly disclosed)
Expectations gap: The difference between the apparent public perceptions of the
responsibilities of auditors and the legal and professional reality.
AUDITOR’S REPORTS
Which two of the following matters are reported on by exception only?
A Where a written representation letter has not been obtained from management
B Where proper accounting records have not been kept
C Where there are misstatements which have not been corrected
D Where all information and explanations deemed necessary have not been obtained
Auditor’s reports
Content of auditor’s
Types of opinion Other reports
reports
Date
Auditor's address and
signature
AUDITOR’S REPORTS
B Where proper accounting records have not been kept
D Where all information and explanations deemed necessary have not been obtained
Learning outcomes
Students will be able to understand the importance of ethical behaviour to a professional
and identify issues relating to integrity, objectivity, professional competence and due
care, confidentiality, professional behaviour and independence.
In the assessment, students may be required to:
• State the role of ethical codes and their importance to the profession
• Recognise the differences between a rules-based ethical code and one based upon
a set of principles
• Recognise how the principles of professional behaviour protect the public and
fellow professionals
• Identify the key features of the system of professional ethics adopted by IESBA
and ICAEW
• Identify the fundamental principles underlying the IESBA and ICAEW Code of Ethics
• Identify the following threats to the fundamental ethical principles and the
independence of assurance providers: self-interest threat, self-review threat,
management threat, advocacy threat, familiarity threat and intimidation threat
• Recognise the importance of integrity and objectivity to professional accountants,
identifying situations that may impair or threaten integrity and objectivity
• Identify safeguards to eliminate or reduce threats to the fundamental ethical
principles and the independence of assurance providers
• Suggest courses of action to resolve ethical conflicts relating to integrity and
objectivity
• Suggest how a conflict of loyalty between the duty a professional accountant has
to their employer and the duty to their profession could be resolved
• Recognise the importance of confidentiality and identify sources of risks of
accidental disclosure of information
• Respond appropriately to the request of an employer to undertake work outside
the confines of an individual's expertise or experience
• Identify steps to prevent accidental disclosure of information
• Identify situations in which confidential information may be disclosed
• Define independence and recognise why those undertaking an assurance
engagement are required to be independent of their clients
TOPIC OVERVIEW
Importance of
Professional ethics Threats and safeguards
confidentiality
Rules or framework?
UK guidance is mainly in the form of a framework. The ICAEW could have taken a rules-
based approach to ethics. This would have involved creating a large book of rules, trying
to cover every possible ethical scenario that could be faced, with an answer to every
single ethical problem.
In the modern day business environment it would be very difficult to include rules on all
situations a member may encounter. There would also be scope for manipulating the
rules.
So instead, a principles-based approach was adopted which allows the individual to
decide what behaviour is appropriate and to exercise professional judgement on a
case-by-case basis.
The ICAEW Code of Ethics is designed to give guidance on what behaviour is considered
ethical. It is not legally binding but gives advice on how to comply with the law.
True False
ETHICAL CODES
Fundamental principles
The fundamental principles are:
Integrity
Objectivity
Professional competence and due care
Confidentiality
Professional behaviour
Independence
Independence is a key concept for assurance teams; it is required by the ICAEW Code of
Ethics that members of assurance teams be independent of assurance clients.
Threats to independence should be assessed and safeguards to address those threats
should be put into place.
If no safeguards are available, it may be appropriate to eliminate the interest or decline
(or discontinue) the engagement.
It is important that auditors are seen to have independence of mind and independence in
appearance.
ICAEW Code
The ICAEW Code should be followed at all times by all professional accountants in all
aspects, for example keeping the books for a local tennis club or charity.
Professional accountants should follow the spirit of the guide as well as the letter of the
guidance.
The ICAEW Code implements the IEBSA Code above so that following the former it
ensures compliance with the latter.
Self-interest threat
Self-review threat
Advocacy threat
Familiarity threat
Intimidation threat
Managerial threat
Self-interest threat
Financial interests
Immediate family means a spouse (or equivalent) or dependent.
Direct financial interest: One which is owned directly by and under the control of an
individual or entity or beneficially owned through a collective investment vehicle, estate,
trust or other intermediary over which the individual or entity has control, or the ability to
influence investment decisions.
Indirect financial interest: One beneficially owned through a collective investment
vehicle, estate, trust or other intermediary over which the entity has no control or ability
to influence investment decisions.
Private 10 15
Self-review threat
Where the assurance firm provides other services to the client, such as
Taxation services
The preparation of tax returns is allowed, provided management takes
responsibility for its contents. Tax calculations used in the preparation of
accounts may not be prepared for public-interest entities; they may be
prepared for non-public interest entities as long as appropriate safeguards
are applied.
Corporate finance
Generally assurance firms are not allowed to provide corporate finance
services to their clients (as the self-review threats which arise cannot be
reduced to an acceptable level by safeguards).
Internal audit services
Where an assurance firm provides internal audit services to a client, there is
a risk that the firm assumes management responsibilities. Therefore, audit
firms may not provide internal audit services which relate to the accounting
records to public interest entities. For other entities they may only be
provided where appropriate safeguards are implemented.
Valuation services
Audit firms shall not carry out valuations which have a material effect on a
public interest entities financial statements or valuations which involve a
significant degree of subjectivity and have a material effect on the financial
statements.
Advocacy threat
An advocacy threat may arise where the assurance firm assists in the legal defence of a
client or acts as their advocate. The FRC Ethical Standard forbids such support where the
item may be material in the financial statements. The firm must appraise the risk and
implement safeguards to reduce the threat to an acceptable level.
Familiarity threat
A familiarity threat arises where the audit firm and its staff are over-familiar with the
client. There is a risk of a loss of professional scepticism in this situation. Independence
may be threatened where the staff have worked for a long time with a client, or there
are relationships between the client and the assurance firm including:
Family or personal relationship
Employment with assurance the client
Recent service with assurance client
a) Where the engagement quality control reviewer becomes the audit engagement
partner the combined service in these two positions should not be more than seven
years.
b) When an audit client becomes a listed company, the engagement partner should
only continue in the position for another two years where four or more years have
already been served by that individual.
Management threat
An important factor in whether a management threat exists is whether there is 'informed
management' at the client.
Informed management is where the auditors believe that the member of management
designated by the audit client to receive the results of a non-audit service provided by
the auditor has the capability to make independent management judgements and
decisions on the basis of the information provided.
ETHICAL THREATS
In each of the following cases, indicate the principal threat that the assurance firm is
facing.
a) Peter Perkins recently resigned as finance director of Assiduous Ltd. Peter joined
the assurance firm that provides the audit to Assiduous after his notice period of
six months.
b) Artifice Ltd has intimated to the engagement partner that a qualified auditor's
report would be unacceptable in the current year because the company is
considering a flotation.
c) Anonymous Ltd has requested that the audit team not be changed from the
previous year as they got on well with client staff.
SAFEGUARDS TO CONFIDENTIALITY
What types of procedures do you think should be in place?
AUTHORISED DISCLOSURES
The ICAEW Code of Ethics identifies three circumstances where the professional
accountant is or may be required to disclose confidential information:
Where disclosure is permitted by law and is authorised by the client or the
employer
Where disclosure is required by the law
Where there is a professional duty or right to disclose, when not prohibited by law
Money Laundering
It is a criminal offence not to disclose a suspicion of money laundering.
It is a criminal offence to tip off a suspected money launderer.
Accountants should:
Report suspicions to their Money Laundering Reporting Officer (MLRO
Not tip off their client
Complete all relevant training
All firms must have a MLRO, who will be responsible for making such disclosures. Staff
carrying out audit work must make a report to that MLRO when a suspicion of money
laundering arises; therefore an audit team member will never be required to make a
report to the authorities personally. Making a report to the MLRO is a defence against the
criminal offence of failing to report a suspicion of money laundering.
Examples of money laundering in this context could include (but are not limited to):
Keeping customer overpayments
Offences under the Companies Act that are criminal (such as making a loan to a
director – so that the director is in possession of the proceeds of the company's crime)
Offences that involve a saved cost (such as failure to meet environmental
regulations relating to disposal and dumping waste instead)
MONEY LAUNDERING
What issues may give rise to suspicions of money laundering?
ACTIONS
During the course of an assurance engagement, Aleem, a member of the assurance team
from Goose Brothers & Co, discovers that Dave Milton, the owner of D Manufacturing
Ltd, has told certain customers to write cheque payments out in favour of DM, rather
than the full company name. Mr Milton has then been amending the cheques to read D
Milton, and paying them into his personal account rather than the company's, reducing
the company's overall tax liability.
Confidentiality
Importance of
Authorised disclosure
confidentiality
Money laundering
ETHICAL THREATS
a) Self review
b) Intimidation
c) Familiarity (however, unless any of the members of the team have been on the
team for a significant period of time or have close personal relationships with any
client staff, this risk is probably insignificant)
COURSES OF ACTION
You should refer to the training partner.
You have no experience or training to undertake this work. The risks attached to the
audit tests being carried out are high. The person allocating the work must have
allocated you in error.
SAFEGUARDS TO CONFIDENTIALITY
Do not discuss client matters with any party outside of the accountancy firm (for
example friends and family, even in a general way).
Do not discuss client matters with colleagues in a public place.
Do not leave audit files unattended (at a client's premises or anywhere else).
Do not leave audit files in cars or in unsecured private residences.
Do not remove working papers from the office unless strictly necessary.
Do not work on electronic working papers on systems that do not have the
requisite protection.
ACTIONS
D The appropriate thing is to make a report to the MRLO.
C is inappropriate because it could constitute a crime to warn Dave Milton that a report
has been made about his money laundering.
A is therefore also inappropriate.
B might be an appropriate act, but it is better practice for assurance team members
always to make reports to the MRLO and let them take responsibility for determining
whether a report should be made.