AAT Level 4 Audit and Assurance cheat sheet

External audit objective: express an opinion on whether financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework.

Reasonable assurance is a high but not absolute level of assurance; it is limited by sampling risk, inherent limitations of controls and the use of judgement and evidence persuasive rather than conclusive.

Assurance engagement elements: a three-party relationship (practitioner, responsible party, intended users), subject matter, suitable criteria, sufficient appropriate evidence and a written report.

Levels of assurance: reasonable (positive opinion, e.g. statutory audit) versus limited (negative assurance, e.g. review); agreed-upon procedures give no assurance, only factual findings.

Materiality limits the scope of an audit: misstatements below materiality need not be corrected individually but are accumulated and assessed in aggregate.

Statutory audit exemptions in the UK typically apply to small companies meeting two of three thresholds (turnover, balance sheet total, employees); public interest entities cannot be exempt.

Auditor duties under companies legislation include forming an opinion on the financial statements, reporting on consistency of the directors' report and identifying non-compliance with law.

Regulatory framework layers: statute (e.g. Companies Act), auditing standards (ISAs UK), ethical standards (IESBA/FPC) and oversight by the relevant professional or supervisory body.

The auditor's report is addressed to the members/shareholders, not to management, reflecting the accountability of directors to owners.

Five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Threat categories: self-interest, self-review, advocacy, familiarity, intimidation and (for management roles) self-review of own work.

Safeguards hierarchy: eliminate the circumstance, apply safeguards to reduce the threat to an acceptable level, or decline/withdraw from the engagement if no safeguard suffices.

Independence has two limbs: independence of mind (state of mind) and independence in appearance (avoiding facts that a reasonable third party would perceive as compromising objectivity).

Prohibited for audit clients: assuming management responsibilities, preparing financial statements that are then audited without safeguards, contingent fees, and certain non-audit services such as internal audit outsourcing on significant areas.

Long association: familiarity threat increases with tenure; rotation of the engagement partner is commonly required after a defined period for listed/public interest entities.

Confidentiality continues after the engagement ends; disclosure is permitted only with consent, where legally required, or where there is a professional right/duty to disclose.

Fees: lowballing and overdue fees create self-interest threats; a fee dependency on one client (commonly around 15% for listed entities) must be disclosed and managed.

Gifts and hospitality: acceptance can create self-interest or familiarity threats; the test is whether a reasonable third party would consider the auditor's judgement compromised.

Audit risk model: Audit risk = Inherent risk × Control risk × Detection risk; detection risk is the only component the auditor directly controls through the nature, timing and extent of procedures.

Inherent risk factors include complexity, subjectivity, susceptibility to fraud, related-party transactions and estimates; significant risks are those close to the upper end of the spectrum.

Business risk approach: understand the entity, its environment, internal control and its objectives to identify risks of material misstatement at financial statement and assertion level.

Assertions tested: occurrence, completeness, accuracy, cut-off, classification (transactions); existence, rights and obligations, completeness, valuation and allocation (balances).

Materiality benchmarks: profit before tax (commonly 5%), total revenue (0.5–1%), total assets (1–2%) or gross profit; the benchmark choice reflects the primary user focus.

Performance materiality is set below overall materiality to reduce to an acceptably low level the probability that aggregate uncorrected and undetected misstatements exceed materiality.

Clearly trivial threshold (often 5% of materiality) is used to filter misstatements that need not be accumulated.

The audit strategy sets scope, timing, direction and reporting; the audit plan is more detailed and converts strategy into the nature, timing and extent of procedures.

Planning is continuous, not a one-off stage; it is updated as new information arises during the engagement.

Five components of internal control (COSO): control environment, risk assessment, control activities, information and communication, and monitoring.

Control objectives map to assertions; a control either prevents, detects or corrects a misstatement in a transaction stream or balance.

Documentation methods: narrative notes, flowcharts, internal control questionnaires (ICQ) and internal control evaluation questionnaires (ICEQ).

Walk-through tests confirm the auditor's understanding by tracing one or a few transactions through the system; they are not tests of operating effectiveness.

Tests of control assess operating effectiveness across the period; they support a lower assessed control risk and reduce substantive testing.

Inquiry alone is insufficient evidence of control effectiveness; observation, inspection and re-performance provide stronger evidence.

Segregation of duties separates authorisation, custody, recording and reconciliation to reduce the opportunity for error or fraud.

If controls are not operating effectively, the auditor increases substantive procedures and revises the assessed risk of material misstatement.

IT general controls (access, change management, backup) underpin application controls; weaknesses in general controls may prevent reliance on automated controls.

Sufficient (quantity) and appropriate (relevance and reliability) evidence supports the audit opinion; higher risk requires more or better evidence.

Reliability hierarchy: external evidence > internal evidence; documentary > oral; original > copy; auditor-obtained > client-provided; evidence from a well-controlled system > poorly controlled.

Procedures: inspection, observation, external confirmation, recalculation, re-performance, analytical procedures and inquiry; inquiry alone is never sufficient.

Substantive tests comprise tests of detail (transactions and balances) and substantive analytical procedures; both address assertions directly.

Direction of testing: vouching from recorded entries to supporting documents tests existence/occurrence; tracing from source documents to records tests completeness.

Cut-off testing examines transactions around the year end to confirm they are recorded in the correct period (occurrence/completeness).

External confirmation of receivables and bank balances is strong evidence; non-responses require alternative procedures such as subsequent cash receipts testing.

Sampling risk and non-sampling risk both affect conclusions; statistical sampling quantifies sampling risk, non-statistical sampling relies on judgement.

Audit documentation must be sufficient to enable an experienced auditor with no previous connection to the engagement to understand the work performed and conclusions reached.

Subsequent events: adjusting events provide evidence of conditions existing at the reporting date; non-adjusting events arise after that date and may require disclosure.

Going concern: the auditor evaluates management's assessment, considers the appropriateness of the going concern basis and whether a material uncertainty requires disclosure.

Written representations are obtained near the completion date; they support but do not replace other evidence and cannot substitute for evidence the auditor could obtain.

Review procedures at completion include analytical review, review of the financial statements for consistency and review of the audit file by a more experienced auditor.

Uncorrected misstatements are accumulated and evaluated in aggregate against materiality, considering both quantitative and qualitative effects.

Modified opinions: qualified (material but not pervasive), adverse (material and pervasive) and disclaimer (inability to obtain sufficient appropriate evidence, material and pervasive).

The auditor's report ordinarily includes the opinion, basis for opinion, going concern statement, key audit matters (listed entities) and other reporting responsibilities.

Emphasis of Matter and Other Matter paragraphs do not modify the opinion; they draw attention to appropriately disclosed matters or to other responsibilities.

Communication with those charged with governance covers significant findings, independence matters and material weaknesses in internal control before the report is signed.

Internal audit objective: provide independent, objective assurance and consulting activity designed to add value and improve an organisation's operations.

Internal audit reports to those charged with governance (audit committee) and management; it assesses risk management, control and governance processes.

External versus internal audit: external is independent of the entity and reports to shareholders; internal is employed by or engaged by the entity and reports internally.

Value for money uses the three Es: economy (acquiring inputs at least cost), efficiency (outputs from inputs) and effectiveness (achieving objectives).

Internal audit can assist the external auditor only where it is objective and competent and where the external auditor re-performs or evaluates the work; it cannot be relied upon without assessment.

Other assurance engagements include reviews of interim financial information, agreed-upon procedures, compilation engagements and reports on controls (e.g. service auditor reports).

Agreed-upon procedures produce a report of factual findings with no assurance; the report is restricted to the specified parties.

A review engagement provides limited assurance through inquiry and analytical procedures, expressed as negative assurance.

Internal audit recommendations should be tracked to implementation; follow-up testing confirms whether management action has remedied the control weakness.