ACCA AA cheat sheet

ISA 200: reasonable assurance is a high but not absolute level of assurance; inherent limitations include sampling risk, judgement, and reliance on management representations.

Audit risk model: Audit risk = Inherent risk × Control risk × Detection risk; detection risk is the only component the auditor controls directly.

Materiality (ISA 320): misstatements are material if they could reasonably influence the economic decisions of users taken on the basis of the financial statements.

Performance materiality is set below overall materiality to reduce to an acceptably low level the probability that aggregate uncorrected and undetected misstatements exceed materiality.

ISA 240: an auditor cannot obtain absolute assurance that financial statements are free from material misstatement due to fraud, because fraud involves concealment and collusion.

Threats to independence per the IESBA Code: self-interest, self-review, advocacy, familiarity, intimidation; safeguards must be applied or the engagement declined.

Five fundamental principles of ethics: integrity, objectivity, professional competence and due care, confidentiality, professional behaviour.

ISA 700: the auditor's report expresses an opinion on whether the financial statements give a true and fair view (or are presented fairly, in all material respects) in accordance with the applicable framework.

Companies legislation typically requires auditors to be appointed by members and to be independent of the entity; resignation requires a statement of circumstances connected with it.

ISA 315: the auditor must obtain an understanding of the entity, its environment, and its internal control sufficient to identify and assess risks of material misstatement.

Significant risks are risks of material misstatement judged close to the upper limit of the audit risk spectrum; they often relate to complex transactions, judgement, or fraud.

ISA 520: analytical procedures are required at the planning stage (risk identification) and at the overall review stage; they are optional as substantive procedures.

Audit strategy sets the scope, timing, direction, and resources; the audit plan is more detailed and sets the nature, timing, and extent of procedures.

Inherent risk is assessed before considering related controls; control risk is the risk that a misstatement will not be prevented or detected and corrected on a timely basis.

ISA 570: going concern assessment covers at least 12 months from the date of the financial statements; the auditor evaluates management's assessment and considers whether a material uncertainty exists.

Direction, supervision, and review: the engagement partner reviews work of less experienced members and significant judgements, including areas of higher risk.

ISA 300: planning is a continuous and iterative process, not a discrete phase completed before fieldwork begins.

COSO components: control environment, risk assessment, control activities, information and communication, monitoring activities.

Segregation of duties separates custody of assets, authorisation, and record-keeping so no single person can both perpetrate and conceal an error or fraud.

Preventive controls stop errors before they occur (e.g. authorisation); detective controls identify errors after they occur (e.g. bank reconciliations).

ISA 315 identifies general IT controls (access, change management, operations) and application controls (input, processing, output).

Tests of control provide evidence on operating effectiveness; if controls are not effective, the auditor must increase substantive procedures.

A walk-through test traces one transaction through the system to confirm the auditor's understanding of the control environment.

A deficiency in internal control exists when a control is designed, implemented, or operating such that it cannot prevent, or detect and correct, misstatements on a timely basis.

Significant deficiencies in internal control are communicated in writing to those charged with governance (ISA 265).

ISA 500: sufficiency is the quantity of evidence; appropriateness is the relevance and reliability of evidence.

Reliability hierarchy: external evidence > internal evidence; evidence obtained directly by the auditor > indirect; original documents > copies.

Assertions: occurrence, completeness, accuracy, cut-off, classification, and presentation for classes of transactions; existence, rights and obligations, completeness, valuation, and presentation for balances.

ISA 505: external confirmations are reliable evidence; if a third party does not respond, alternative procedures are required.

ISA 530: sampling risk arises when the auditor's conclusion based on a sample differs from the conclusion from the whole population; non-sampling risk arises from human error or inappropriate procedures.

ISA 560: subsequent events between the date of the financial statements and the date of the auditor's report require adjustment (conditions existing at year-end) or disclosure (conditions arising after year-end).

ISA 620: if an auditor uses the work of an expert, the auditor remains responsible for the opinion and evaluates the expert's competence and objectivity.

ISA 210: the engagement letter confirms the terms of the engagement; it is a written agreement between the auditor and management, not a substitute for a signed engagement contract.

ISA 700: the auditor's report includes the opinion, basis for opinion, and key audit matters (for listed entities under ISA 701).

ISA 705 modified opinions: qualified (material but not pervasive), adverse (material and pervasive, financial statements as a whole are misstated), disclaimer (inability to obtain sufficient evidence that is material and pervasive).

ISA 705 requires a 'Basis for Qualified/Adverse/Disclaimer' section immediately after the opinion paragraph.

ISA 701: key audit matters are those of most significance in the audit, selected from matters communicated with those charged with governance; required for listed entities.

ISA 570: if a material uncertainty exists and is adequately disclosed, the auditor includes an 'Emphasis of Matter' or 'Material Uncertainty Related to Going Concern' section; the opinion is unmodified.

ISA 700: the auditor's report must be dated no earlier than the date on which the auditor has obtained sufficient appropriate audit evidence, including evidence that the financial statements have been approved.

ISA 260: significant findings from the audit are communicated to those charged with governance, including the auditor's views on qualitative aspects of accounting practices.

ISA 710: comparative information may be presented as corresponding figures or comparative financial statements; the auditor's procedures differ depending on which approach applies.

ISA 200: reasonable assurance is a high but not absolute level of assurance; inherent limitations include sampling risk, judgement, and reliance on management representations.

Audit risk model: Audit risk = Inherent risk × Control risk × Detection risk; detection risk is the only component the auditor controls directly.

Materiality (ISA 320): misstatements are material if they could reasonably influence the economic decisions of users taken on the basis of the financial statements.

Performance materiality is set below overall materiality to reduce to an acceptably low level the probability that aggregate uncorrected and undetected misstatements exceed materiality.

ISA 240: an auditor cannot obtain absolute assurance that financial statements are free from material misstatement due to fraud, because fraud involves concealment and collusion.

Threats to independence per the IESBA Code: self-interest, self-review, advocacy, familiarity, intimidation; safeguards must be applied or the engagement declined.

Five fundamental principles of ethics: integrity, objectivity, professional competence and due care, confidentiality, professional behaviour.

ISA 700: the auditor's report expresses an opinion on whether the financial statements give a true and fair view (or are presented fairly, in all material respects) in accordance with the applicable framework.

Companies legislation typically requires auditors to be appointed by members and to be independent of the entity; resignation requires a statement of circumstances connected with it.

ISA 315: the auditor must obtain an understanding of the entity, its environment, and its internal control sufficient to identify and assess risks of material misstatement.

Significant risks are risks of material misstatement judged close to the upper limit of the audit risk spectrum; they often relate to complex transactions, judgement, or fraud.

ISA 520: analytical procedures are required at the planning stage (risk identification) and at the overall review stage; they are optional as substantive procedures.

Audit strategy sets the scope, timing, direction, and resources; the audit plan is more detailed and sets the nature, timing, and extent of procedures.

Inherent risk is assessed before considering related controls; control risk is the risk that a misstatement will not be prevented or detected and corrected on a timely basis.

ISA 570: going concern assessment covers at least 12 months from the date of the financial statements; the auditor evaluates management's assessment and considers whether a material uncertainty exists.

Direction, supervision, and review: the engagement partner reviews work of less experienced members and significant judgements, including areas of higher risk.

ISA 300: planning is a continuous and iterative process, not a discrete phase completed before fieldwork begins.

COSO components: control environment, risk assessment, control activities, information and communication, monitoring activities.

Segregation of duties separates custody of assets, authorisation, and record-keeping so no single person can both perpetrate and conceal an error or fraud.

Preventive controls stop errors before they occur (e.g. authorisation); detective controls identify errors after they occur (e.g. bank reconciliations).

ISA 315 identifies general IT controls (access, change management, operations) and application controls (input, processing, output).

Tests of control provide evidence on operating effectiveness; if controls are not effective, the auditor must increase substantive procedures.

A walk-through test traces one transaction through the system to confirm the auditor's understanding of the control environment.

A deficiency in internal control exists when a control is designed, implemented, or operating such that it cannot prevent, or detect and correct, misstatements on a timely basis.

Significant deficiencies in internal control are communicated in writing to those charged with governance (ISA 265).

ISA 500: sufficiency is the quantity of evidence; appropriateness is the relevance and reliability of evidence.

Reliability hierarchy: external evidence > internal evidence; evidence obtained directly by the auditor > indirect; original documents > copies.

Assertions: occurrence, completeness, accuracy, cut-off, classification, and presentation for classes of transactions; existence, rights and obligations, completeness, valuation, and presentation for balances.

ISA 505: external confirmations are reliable evidence; if a third party does not respond, alternative procedures are required.

ISA 530: sampling risk arises when the auditor's conclusion based on a sample differs from the conclusion from the whole population; non-sampling risk arises from human error or inappropriate procedures.

ISA 560: subsequent events between the date of the financial statements and the date of the auditor's report require adjustment (conditions existing at year-end) or disclosure (conditions arising after year-end).

ISA 620: if an auditor uses the work of an expert, the auditor remains responsible for the opinion and evaluates the expert's competence and objectivity.

ISA 210: the engagement letter confirms the terms of the engagement; it is a written agreement between the auditor and management, not a substitute for a signed engagement contract.

ISA 700: the auditor's report includes the opinion, basis for opinion, and key audit matters (for listed entities under ISA 701).

ISA 705 modified opinions: qualified (material but not pervasive), adverse (material and pervasive, financial statements as a whole are misstated), disclaimer (inability to obtain sufficient evidence that is material and pervasive).

ISA 705 requires a 'Basis for Qualified/Adverse/Disclaimer' section immediately after the opinion paragraph.

ISA 701: key audit matters are those of most significance in the audit, selected from matters communicated with those charged with governance; required for listed entities.

ISA 570: if a material uncertainty exists and is adequately disclosed, the auditor includes an 'Emphasis of Matter' or 'Material Uncertainty Related to Going Concern' section; the opinion is unmodified.

ISA 700: the auditor's report must be dated no earlier than the date on which the auditor has obtained sufficient appropriate audit evidence, including evidence that the financial statements have been approved.

ISA 260: significant findings from the audit are communicated to those charged with governance, including the auditor's views on qualitative aspects of accounting practices.

ISA 710: comparative information may be presented as corresponding figures or comparative financial statements; the auditor's procedures differ depending on which approach applies.