ICAB CL Assurance cheat sheet

Materiality is the threshold below which misstatements do not affect users' economic decisions; performance materiality is set lower to reduce the aggregate risk that uncorrected and undetected misstatements exceed materiality.

Audit risk = inherent risk × control risk × detection risk. Detection risk is the only component the auditor controls; it falls as substantive procedures increase in extent or persuasiveness.

Sufficient appropriate evidence depends on two dimensions: quantity (sufficiency) and relevance plus reliability (appropriateness). External evidence is more reliable than internal; documentary more reliable than oral.

The audit opinion decision rule: unmodified if financial statements are materially correct; qualified if misstatement is material but not pervasive; adverse if material and pervasive; disclaimer if scope limitation is material and pervasive.

Sampling risk is the risk conclusions based on a sample differ from conclusions from the whole population; non-sampling risk arises from human error, wrong procedures, or misinterpretation of evidence.

In a test of controls, deviations are the exception rate; the tolerable deviation rate is compared with the upper deviation rate to decide whether reliance on the control is supported.

Going concern: if material uncertainty exists but disclosure is adequate, issue an unmodified opinion with a separate Material Uncertainty Related to Going Concern section; if disclosure is inadequate, qualify or issue adverse opinion.

Subsequent events: adjusting events provide evidence of conditions existing at the reporting date and require adjustment; non-adjusting events reflect conditions arising after that date and require disclosure only if material.

The IFAC Code of Ethics uses a threats-and-safeguards framework: identify threats (self-interest, self-review, advocacy, familiarity, intimidation) and respond by eliminating the circumstance, applying safeguards, or declining the engagement.

Independence comprises independence of mind (state of mind permitting unbiased conclusions) and independence in appearance (avoidance of facts a reasonable third party would perceive as compromising objectivity).

The IESBA fee provisions treat fees that are large relative to total fee income, or contingent fees for assurance engagements, as self-interest threats requiring evaluation and possible safeguards.

A professional accountant must comply with the fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Confidentiality persists after the professional relationship ends; disclosure is permitted only when required by law, permitted by client authority, or required by professional duty or legal process.

ISA 220 (Revised) requires the engagement partner to take responsibility for quality management at the engagement level, including direction, supervision, review, and consultation on difficult matters.

ISQM 1 requires a firm-level system of quality management addressing eight components, including governance and leadership, relevant ethical requirements, engagement performance, and monitoring and remediation.

The IAASB's International Standards on Auditing apply to audits of historical financial information; ISAE 3000 governs assurance engagements other than audits of historical financial information.

Objectivity is a state of mind; independence is required for audit and review engagements but for other assurance engagements the Code requires independence from the subject matter where the engagement is not at arm's length.

Analytical procedures are required at the planning stage (risk assessment) and in the overall review at the conclusion of the audit; they are optional as substantive procedures.

Internal control components: control environment, the entity's risk assessment process, the information system and communication, control activities, and monitoring of controls.

Tests of controls support a reduced assessed control risk only when evidence shows controls operated effectively throughout the period of reliance; a walkthrough alone is insufficient for this purpose.

The three tiers of audit documentation: the permanent file (statutory documents, contracts), the current file (working papers for the year), and the completion memorandum.

Professional scepticism is an attitude of questioning and being alert to conditions indicating possible misstatement due to error or fraud, and critically assessing evidence.

Fraud risk factors: incentive or pressure, opportunity, and rationalisation or attitude. Management override of controls is presumed a fraud risk in every audit.

The auditor's report order: title, addressee, opinion, basis for opinion, going concern (if applicable), key audit matters (listed entities), responsibilities of management, responsibilities of the auditor, other reporting responsibilities, signature, date, address.

Review engagements provide limited assurance, expressed negatively ('nothing has come to our attention'); audits provide reasonable assurance, expressed positively.

The IESBA Code's conceptual framework requires evaluating threats from a reasonable and informed third-party test: would a reasonable third party, aware of all facts, conclude the threat is at an acceptable level?

A long association with an audit client creates a familiarity threat; for listed entity audits, engagement partner rotation is required after seven years with a cooling-off period.

Non-assurance services: a firm cannot assume management responsibility, and for listed audit clients certain services (e.g., accounting records and financial statements) are prohibited where they create a self-review threat.

The Code permits disclosure of confidential information where there is a professional duty to disclose, such as during a quality review or responding to an inquiry from a professional body.

ISQM 2 requires engagement quality reviews for audits of listed entities and for engagements where the firm determines a review is needed based on risk.

Professional competence requires attaining and maintaining knowledge and skill at the level needed, including keeping up to date with technical and professional developments.

The IAASB's ISSA 5000 provides a global baseline for sustainability assurance engagements, applying to both limited and reasonable assurance.

Threats to objectivity include self-interest, self-review, advocacy, familiarity, and intimidation; the appropriate response may be eliminating the interest, applying safeguards, or declining the engagement.

Firms must establish policies for dealing with differences of opinion within the engagement team, ensuring conclusions are documented and the engagement report is not issued until the matter is resolved.