AU-M cheat sheet

Audit risk model: AR = IR × CR × DR; detection risk is the only component the auditor controls directly.

Reasonable assurance is a high but not absolute level of assurance; absolute assurance is not attainable due to inherent limitations of an audit (judgment, sampling, fraud concealment).

Materiality: misstatements are material if they individually or in aggregate could influence the economic decisions of users taken on the basis of the financial statements.

Professional skepticism: an attitude of questioning mind and critical assessment of evidence, including questioning contradictory evidence and reliability of documents.

Auditor's responsibilities: obtain reasonable assurance about whether financial statements are free from material misstatement, whether due to fraud or error; express an opinion; report in accordance with standards.

Management responsibilities: preparation and fair presentation of financial statements, design and implementation of internal control, and providing the auditor with all relevant information and access.

Inherent limitations of an audit: use of judgment, use of sampling, difficulty in detecting fraud, and the possibility that management may conceal information.

Types of engagements: audit (reasonable assurance), review (limited assurance), agreed-upon procedures (no assurance, factual findings), and compilation (no assurance).

The auditor's opinion is not a guarantee of future viability or efficiency of management.

Planning activities include: establishing materiality, identifying high-risk areas, understanding the entity and its environment, and designing the nature, timing, and extent of procedures.

Risk assessment procedures: inquiries of management and others, analytical procedures, observation and inspection; these are required to identify and assess risks of material misstatement.

Significant risks are risks of material misstatement that, in the auditor's judgment, require special audit consideration (e.g., complex transactions, related parties, fraud risk).

Materiality levels: overall materiality (financial statements as a whole), performance materiality (lower than overall to reduce aggregation risk), and specific materiality for particular classes of transactions.

Analytical procedures are required in the planning stage (risk assessment) and in the final review stage (overall review), but are optional as substantive procedures.

The auditor must obtain an understanding of the entity's internal control relevant to the audit, including the five components: control environment, risk assessment, control activities, information and communication, and monitoring.

Audit strategy vs. audit plan: strategy sets the scope, timing, and direction; plan details the nature, timing, and extent of procedures.

Direction, supervision, and review: the engagement partner is responsible for the overall quality of the engagement and must review work performed by less experienced team members.

COSO internal control components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Control activities include: authorization, segregation of duties, physical controls, reconciliations, and information processing controls (application controls).

Tests of controls are performed to evaluate the operating effectiveness of controls; they are required if the auditor intends to rely on controls to reduce substantive testing.

Inquiry alone is not sufficient to test the operating effectiveness of a control; the auditor must use inspection, observation, or re-performance.

If controls are not operating effectively, the auditor must reassess control risk and increase substantive procedures.

Deficiencies in internal control: a deficiency exists when a control is designed, implemented, or operated in a way that does not enable timely prevention or detection of misstatements.

Significant deficiency: a deficiency or combination of deficiencies that is less severe than a material weakness but important enough to merit attention by those charged with governance.

Material weakness: a deficiency or combination of deficiencies such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

Segregation of duties: no single person should control all aspects of a transaction (authorization, custody, recording, reconciliation).

Sufficiency and appropriateness: sufficiency is the measure of quantity; appropriateness is the measure of quality (relevance and reliability).

Reliability hierarchy: external evidence > internal evidence; original documents > copies; evidence obtained directly by auditor > indirect; documentary > oral.

Audit procedures: inspection, observation, external confirmation, recalculation, re-performance, analytical procedures, and inquiry.

External confirmation is a direct written response from a third party to the auditor; if no response, the auditor should perform alternative procedures.

Analytical procedures: evaluate financial information through analysis of plausible relationships; effectiveness depends on the reliability of data and the precision of expectations.

Substantive procedures include tests of details (of transactions, balances, disclosures) and substantive analytical procedures.

Audit documentation must be sufficient to enable an experienced auditor with no previous connection to the audit to understand the work performed, evidence obtained, and conclusions reached.

Written representations from management are required (e.g., responsibility for financial statements, completeness of information); they are not a substitute for other audit evidence.

Cut-off procedures test that transactions are recorded in the correct accounting period.

Sampling risk: the risk that the auditor's conclusion based on a sample may differ from the conclusion if the entire population were tested.

Non-sampling risk: the risk that the auditor reaches an erroneous conclusion for any reason not related to sampling (e.g., inappropriate procedures, misinterpretation).

Statistical sampling uses probability theory to measure sampling risk; non-statistical sampling relies on auditor judgment.

Attribute sampling is used for tests of controls (rate of deviation); variables sampling is used for substantive tests (monetary misstatement).

Sample size increases with: higher desired confidence level, lower tolerable deviation rate (or tolerable misstatement), and higher expected deviation rate (or expected misstatement).

Projected misstatement: for monetary unit sampling, the misstatement found in the sample is projected to the population.

Data analytics in audit: used for risk assessment, journal entry testing, trend analysis, and anomaly detection; the auditor must evaluate the reliability and completeness of the data used.

Computer-assisted audit techniques (CAATs) include data query, stratification, and sampling routines.

When a deviation is found in a sample, the auditor should evaluate the nature and cause, and may increase the sample size or perform alternative procedures.

Auditor's report elements: title, addressee, opinion, basis for opinion, going concern (if applicable), key audit matters (if applicable), responsibilities of management and auditor, and signature, date, and address.

Opinion types: unmodified, qualified (except for), adverse, and disclaimer. Qualified/adverse/disclaimer require a basis for opinion section.

Qualified opinion: misstatements are material but not pervasive, or the auditor is unable to obtain sufficient appropriate evidence but the possible effects are material but not pervasive.

Adverse opinion: misstatements are both material and pervasive. Disclaimer: inability to obtain sufficient evidence and possible effects are material and pervasive.

Key audit matters (KAM) are required for listed entities; they are those matters that were most significant in the audit and are communicated to those charged with governance.

Going concern: if substantial doubt exists, the auditor includes an emphasis of matter or a material uncertainty paragraph; if the use of going concern basis is inappropriate, the auditor expresses an adverse opinion.

Communication with those charged with governance: significant findings, deficiencies in internal control, and independence matters must be communicated.

The auditor's report is dated no earlier than the date on which the auditor has obtained sufficient appropriate evidence, including evidence that the financial statements have been approved by those with authority.

Fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behavior.

Independence comprises: independence of mind (state of mind) and independence in appearance (avoidance of facts that a reasonable third party would perceive as compromising independence).

Prohibited relationships: financial interests (direct or material indirect), loans, close business relationships, and key audit partner rotation requirements.

Threats to independence: self-interest, self-review, advocacy, familiarity, intimidation, and management participation.

Safeguards: education and training, quality control reviews, and rotation of engagement team members.

Contingent fees are prohibited for audit engagements; they create self-interest threats.

Confidentiality: the auditor must not disclose information acquired as a result of professional relationships without proper authority, unless required by law.

Objectivity: the auditor must not compromise professional or business judgment because of bias, conflict of interest, or undue influence of others.

IT general controls (ITGC): controls over the IT environment that support the reliable functioning of application controls (e.g., access security, change management, backup and recovery).

Application controls: controls specific to a particular application (e.g., input validation, processing controls, output controls).

Automated controls are generally more reliable than manual controls, but their effectiveness depends on the integrity of the IT environment.

Audit software and CAATs: tools used to extract, analyze, and test data from client systems; they can increase the efficiency and effectiveness of audit procedures.

Data reliability: the auditor must consider the completeness, accuracy, and validity of data used in audit procedures, especially when using data analytics.

Cybersecurity risk: the auditor should consider the entity's exposure to cyber risks and whether they could lead to material misstatement.

IT risks include: unauthorized access, program changes, data loss, and system downtime.

When the entity uses a service organization, the auditor may use a service auditor's report (SOC 1) to obtain evidence about controls at the service organization.