Auditing and Attestation: Risk, Evidence, and Reporting
The audit risk model drives everything
AUD questions reward candidates who can move fluidly between the risk model, evidence decisions, and the report. Recall that audit risk = inherent risk × control risk × detection risk. Inherent and control risk are the client's risks; the auditor responds to them by setting detection risk, which moves inversely with the amount and quality of substantive testing. A common trap: questions imply that the auditor reduces control risk by testing controls. The auditor only assesses control risk; testing tells you whether the assessment is supported.
Evidence and assertions
Link procedures to assertions. Inspection, observation, inquiry, confirmation, recalculation, reperformance, and analytical procedures each provide different persuasiveness. External confirmation is strong for existence and rights, weak for valuation. Inquiry alone is never sufficient. Watch for questions that swap occurrence (recorded transactions happened) with completeness (all transactions recorded) - testing from source documents to the ledger tests completeness; ledger to source tests occurrence.
Reports and opinions
Know the conditions for each opinion: unmodified, qualified (material but not pervasive), adverse (material and pervasive), and disclaimer (scope limitation that is material and pervasive). Emphasis-of-matter and other-matter paragraphs do not change the opinion. For issuers, the integrated audit requires opinions on both the financial statements and internal control over financial reporting.
Worked rule of thumb
If a misstatement is material but confined to one account, it is qualified. If it permeates the statements as a whole, it is adverse. A scope limitation follows the same logic but yields a disclaimer when pervasive.