Auditing and Assurance: Risk, Evidence, and the Audit Opinion
Core concepts
Auditing tests the auditor's ability to obtain sufficient appropriate evidence to express an opinion on financial statements. Candidates must know the audit process: engagement acceptance, planning and risk assessment, understanding internal controls, substantive testing, and reporting. Key concepts include audit risk (inherent, control, detection), materiality, professional scepticism, the five assertions (occurrence, completeness, accuracy, cut-off, classification for transactions; existence, rights, completeness, valuation for balances), and the components of the auditor's report.
Traps
Questions often test the inverse relationship between detection risk and substantive testing: lower detection risk requires more testing. Watch for confusion between the auditor's responsibility and management's responsibility for fraud prevention. Confirm that independence threats (self-interest, self-review, advocacy, familiarity, intimidation) map to the correct safeguards. A modified opinion is required when misstatements are material but not pervasive (qualified) versus pervasive (adverse or disclaimer). Do not confuse a scope limitation (disclaimer/qualified) with a misstatement.
Worked example
An auditor assesses inherent risk as high and control risk as high. Detection risk must therefore be set low, meaning the auditor performs more substantive procedures and larger sample sizes. If the client refuses to allow confirmation of receivables, that is a scope limitation; if the effect could be material and pervasive, the auditor issues a disclaimer of opinion.
Rule of thumb
Audit risk = inherent risk x control risk x detection risk; the auditor controls only detection risk.