ACCA AAA cheat sheet

IFAC Code structure: three parts - complying with the Code, the International Independence Standards, and the conceptual framework (threats and safeguards).

IESBA conceptual framework steps: identify threat, evaluate its level, address it by eliminating the circumstance, applying safeguards, or declining/ending the engagement.

Five threat categories: self-interest, self-review, advocacy, familiarity, intimidation.

Independence comprises independence of mind (state of mind) and independence of appearance (avoiding facts a reasonable third party would perceive as compromising).

Public interest entity definitions and the listed-entity independence rules (key audit partner rotation, fee and employment restrictions) are set by local regulation adopting IESBA provisions.

ISA 200: reasonable assurance is high but not absolute assurance; inherent limitations include sampling risk, estimation uncertainty and fraud concealment.

Professional scepticism is an attitude of questioning mind, alertness to contradictory evidence and critical assessment of audit evidence.

Objectivity prohibits allowing bias, conflict of interest, undue influence of others, or gifts/hospitality to override professional judgements.

Self-interest threat examples: financial interest in client, overdue fees significant to the firm, contingent fees, excessive reliance on one client's fee income.

Self-review threat arises when the firm previously performed a service whose results the audit will evaluate, e.g. preparing the financial statements or designing the accounting system.

Advocacy threat: promoting client shares, acting as legal advocate in a dispute, or representing the client in negotiations on the client's behalf.

Familiarity threat: long association of senior staff with the client, close family member in a key client position, or accepting gifts/hospitality.

Intimidation threat: threats of litigation, pressure to reduce work below the level required by ISAs, or dominant client personnel.

Contingent fees for audit engagements are prohibited; for non-assurance services they are permitted only where the fee is not material and no advocacy or self-review threat arises.

Fee dependency safeguard: for non-PIE audits, disclosure to those charged with governance and external quality control review when recurring fees from one client exceed 15% of total firm fees for consecutive years.

Confidentiality may be breached where permitted by law (legal disclosure) or required by law (e.g. money-laundering reporting), or with client consent.

ISQM 1 requires a system of quality management addressing eight components, including risk assessment process, governance and leadership, and engagement performance.

ISQM 2 governs engagement quality reviews: required for listed entities and for engagements where the firm determines an EQR is needed based on risk.

ISA 220 (Revised): the engagement partner takes overall responsibility for quality on the engagement and for direction, supervision and review.

Engagement quality reviewer must be objective, not a member of the engagement team, and must have sufficient authority and experience.

ISQM 1 requires monitoring and remediation: cyclical inspection of completed engagements, root cause analysis of deficiencies, and evaluation of findings.

Practice management: engagement acceptance requires assessing client integrity, competence and resources of the firm, and compliance with ethical requirements.

Archiving: audit documentation must be assembled on a timely basis, ordinarily not more than 60 days after the auditor's report date (ISQC/ISA 230).

Documentation retention is typically at least five years from the date of the auditor's report, per firm policy and local regulation.

Materiality: performance materiality is set below overall materiality to reduce the probability that uncorrected and undetected misstatements exceed materiality.

Audit risk = inherent risk × control risk × detection risk; detection risk is the only component the auditor controls.

ISA 315 (Revised): the risk assessment identifies significant risks, including significant risks related to accounting estimates and management override.

ISA 540 (Revised): estimates require evaluation of method, assumptions, data and management bias; a range of reasonable outcomes is used to assess reasonableness.

ISA 700: the auditor expresses an opinion on whether the financial statements give a true and fair view (or are presented fairly) in accordance with the applicable framework.

ISA 705 modifications: qualified opinion (material but not pervasive), adverse opinion (material and pervasive), disclaimer (material and pervasive inability to obtain evidence).

ISA 701: key audit matters are required for listed entities and are selected from matters communicated with those charged with governance.

ISA 570 going concern: the auditor evaluates management's assessment for at least 12 months from the reporting date; significant doubt requires disclosure and an emphasis of matter or material uncertainty paragraph.

ISA 240: presumed fraud risk in revenue recognition; management override of controls is a presumed significant risk.

ISA 800: special purpose frameworks - opinion addresses whether the financial statements are prepared in accordance with the special purpose framework.

ISA 805: single financial statements or specific elements, accounts or items - the auditor considers materiality for those elements separately.

ISA 810: reports on summarised financial statements - the auditor evaluates whether the summary is consistent with the audited financial statements.

ISAE 3000 (Revised): assurance engagements other than audits or reviews of historical financial information - reasonable or limited assurance.

ISAE 3402: service organisation reports - Type 1 covers description and suitability of controls; Type 2 adds operating effectiveness over a period.

ISRS 4400 (Revised): agreed-upon procedures - factual findings only, no assurance expressed, use restricted to specified parties.

ISRS 4410 (Revised): compilation engagements - accountant assists management in preparing financial statements, no assurance expressed.

Due diligence and forensic assignments: scope agreed with the engaging party; reporting is to the engaging party, not the general public.

Review engagement (ISRE 2400): limited assurance expressed as a conclusion on whether anything has come to the auditor's attention causing belief the statements are not prepared in all material respects in accordance with the framework.