AU-M key terms

All the information an auditor gathers to support conclusions and the audit opinion. It must be sufficient in quantity and appropriate in quality, meaning relevant to the assertion tested and reliable in its source.

The claims management makes about each account balance, transaction class, and disclosure, such as existence, completeness, valuation, rights and obligations, and presentation. Auditors design procedures that test whether each assertion is fairly stated.

The chance that financial statements contain errors large enough to mislead users before the audit begins. It combines inherent risk from the nature of the business with control risk that internal controls fail to prevent or detect problems.

The susceptibility of an assertion to material error assuming no related controls exist. It rises with complex transactions, estimates, related-party dealings, and industries facing rapid change or economic pressure.

The risk that a material misstatement will not be prevented or detected on a timely basis by the entity's internal controls. Auditors assess it to decide how much substantive testing is needed.

The risk that audit procedures fail to catch a misstatement that exists. It is managed by the auditor through the nature, timing, and extent of testing, and it moves inversely to the assessed risks of misstatement.

A planning framework expressing audit risk as the product of inherent risk, control risk, and detection risk. Auditors use it to set detection risk at a level that keeps overall risk acceptably low.

The threshold above which omissions or misstatements could influence decisions of users relying on the financial statements. It is set during planning, often revised as the audit proceeds, and drives the scope of testing.

A lower amount than overall materiality, set so that uncorrected and undetected misstatements together do not exceed the materiality threshold. It guides sample sizes and the evaluation of identified errors.

The policies, processes, and systems a company uses to safeguard assets, produce reliable records, and comply with laws. Auditors evaluate these controls to understand how misstatements might arise and be caught.

Splitting responsibilities so one person cannot both commit and conceal an error or fraud. Custody of assets, recording transactions, and authorizing them should sit with different people where practical.

A procedure that checks whether a control operated effectively throughout the period. Examples include inspecting approvals, observing procedures, and reperforming reconciliations, often supported by sampling.

Tests designed to detect material misstatements at the assertion level, including detailed tests of transactions and balances and analytical procedures. They are required regardless of the assessed level of control risk.

Evaluations of financial information by comparing recorded amounts with expectations from prior periods, budgets, or industry data. Significant unexplained differences prompt further inquiry and may indicate misstatement or unusual conditions.

Tracing one or a few transactions through the entire process from origination to reporting. It confirms the auditor's understanding of the flow of information and the controls actually in place.

The documented path that lets a transaction be followed from source documents through journals to the financial statements and back again. A broken trail weakens evidence reliability and complicates testing.

The document setting out the nature, timing, and extent of audit work, including staffing and time budgets. It is developed after risk assessment and updated as new information emerges during the engagement.

A written agreement with the client that defines the scope, responsibilities of both parties, fees, and the basis of the audit. It reduces misunderstanding and should be updated when circumstances change.

An attitude of questioning and alertness to conditions suggesting possible misstatement, whether from error or fraud. It means not accepting evidence at face value and corroborating management explanations independently.

The possibility that intentional misstatement, asset misappropriation, or improper revenue recognition distorts the statements. Auditors must presume revenue recognition fraud risk and inquire about fraud during planning.

Applying procedures to less than the whole population so each sampling unit has a chance of selection, enabling conclusions about the population. Sampling risk and non-sampling risk must both be controlled.

The possibility that a sample leads to a different conclusion than testing the entire population would produce. It can be reduced by enlarging the sample or using a more efficient selection method.

A statistical method that estimates the rate at which a characteristic, such as a control deviation, occurs in a population. Results are compared with a tolerable rate to judge whether controls can be relied upon.

A selection method that treats each currency unit in a population as a sampling unit, so larger balances have a higher chance of selection. It is well suited to testing overstatement in receivables and inventory.

Using software to examine complete datasets for patterns, anomalies, and relationships, such as duplicate payments or unusual journal entries. It can cover full populations and target risk more precisely than manual sampling.

Tools and scripts auditors use to extract, sort, and analyze client data directly from systems. They support testing of full populations, recalculation, and identification of exceptions for follow-up.

Controls over the technology environment as a whole, including access management, change control, backups, and operations. They support the reliable functioning of automated application controls and reports.

Controls built into specific software processes, such as input validation, matching routines, and automated calculations. They operate consistently but depend on general IT controls to remain trustworthy.

Freedom from relationships and interests that a reasonable observer would see as compromising objectivity. It covers both actual independence and the appearance of independence, and it underpins the credibility of the audit opinion.

The state of mind that allows an auditor to reach conclusions without bias, conflict of interest, or undue influence from others. Threats to it must be identified and either eliminated or reduced to an acceptable level.

The duty to keep client information secure and avoid disclosing or using it without proper authority. It continues after the engagement ends and applies to staff and third parties with access.

The auditor's formal conclusion on whether the financial statements are presented fairly in all material respects. It may be unmodified, qualified, adverse, or a disclaimer depending on the nature of the issues found.

A report to those charged with governance describing control deficiencies and improvement opportunities found during the audit. It is separate from the audit opinion and often includes practical recommendations.

The two dimensions of evidence quantity and quality. Sufficiency is how much evidence is gathered; appropriateness is its relevance and reliability, with external documents generally more reliable than internal ones.

Direct written response from a third party, such as a bank or customer, verifying a balance or term. External confirmations are strong evidence of existence but may not address completeness or valuation.

The informed decisions auditors make when evidence is incomplete or ambiguous, applying experience and standards rather than fixed rules. It must be documented with the reasoning and facts relied upon.

An independent review of engagement work, often required for listed entities or high-risk audits, before the report is issued. It checks significant judgments, independence, and whether conclusions are properly supported.