ICAB CL Assurance common mistakes
ICAB CL Assurance · Understand the traps and how to avoid them.
Writing the audit conclusion and opinion first, then forcing the evidence and risk assessment to fit it, rather than letting the evidence gathered drive the conclusion.
Candidates carry over an instinct from essay-style exams to 'have a position' and treat the scenario as a prompt for advocacy; under time pressure a pre-formed opinion feels efficient because it lets them skip evaluating contrary evidence.
What to do instead
Before writing any conclusion, list the specific evidence items in the scenario and mark each as supporting, contradicting, or silent. Draft the conclusion only after that table is complete, and state explicitly which evidence drove the judgement and which was insufficient. Practise two or three scenarios where the 'obvious' answer is overturned by one late detail.
Treating 'assurance' as a synonym for 'audit' and answering questions about other assurance engagements (review, agreed-upon procedures, compilation, internal control reporting) with audit-level language such as reasonable assurance, materiality thresholds, and positive opinion.
Most study time goes to statutory audit, so the default vocabulary is audit vocabulary; the distinctions between reasonable and limited assurance, and between attestation and direct engagements, are learned as definitions rather than as working rules.
What to do instead
Build a one-page comparison grid with rows for level of assurance, nature of procedures, form of conclusion, and independence requirements, and columns for audit, review, AUP, and compilation. For every practice question, first name the engagement type out loud, then answer using only the vocabulary that type permits.
Identifying a risk or weakness in the scenario but never linking it to a specific assertion, procedure, and evidence source, so the answer describes the problem without showing how assurance would address it.
Candidates answer the question they find easiest (what is wrong here) instead of the question asked (how would you obtain evidence over it); the assertion framework is memorised as a list rather than used as an analytical tool.
What to do instead
Adopt a fixed three-column habit for every risk identified: assertion at risk, procedure that responds, evidence that procedure produces. Write answers in that order even when the question does not demand it, and check that no risk is left without a matching procedure.
Applying materiality mechanically as a single percentage of revenue or profit without considering qualitative factors, user sensitivity, or the purpose of the engagement, and then failing to revise it when new information emerges.
Textbook benchmarks are easy to recall and give a false sense of precision; the judgement element and the requirement to reassess as the engagement progresses are the parts most often skipped in revision.
What to do instead
For each scenario, state the benchmark, the percentage, the resulting figure, and at least one qualitative factor that could lower it. Add a line on when materiality would be revised and what trigger in the scenario would cause that. Practise justifying a lower materiality for a regulator-facing or covenant-sensitive entity.
Designing substantive procedures that only confirm figures already produced by the client (re-performing a calculation from the same data) instead of obtaining independent or external evidence, and calling the result sufficient appropriate evidence.
Recalculation is quick and feels rigorous, so it dominates answers; sufficiency and appropriateness are treated as a single idea rather than two separate tests of quantity and quality.
What to do instead
For every procedure proposed, label the source of evidence as internal, external, or generated by the auditor, and note its reliability. Where all proposed procedures are internal, add at least one external or corroborative source. State explicitly why the mix is sufficient in quantity and appropriate in quality.
Describing professional scepticism and ethics as attitudes in the abstract ('the auditor must be sceptical and independent') without naming the specific threat, the affected principle, the safeguard, and the residual risk that remains.
Ethical requirements are learned as a list of threats and safeguards but exam scenarios test whether the candidate can apply the conceptual framework to a concrete set of facts, and abstract statements are easier to write under time pressure.
What to do instead
Use a fixed four-step template for every ethics scenario: identify the threat by type, name the fundamental principle at risk, propose a specific safeguard (not 'disclose it'), and state whether the safeguard reduces the threat to an acceptable level or whether the engagement must be declined. Rehearse with self-interest, self-review, and familiarity scenarios.
Citing regulatory or professional requirements from memory in vague terms ('the standards require documentation') without naming the source, the specific obligation, or the consequence of non-compliance.
Candidates revise the substance of standards but not their architecture, so they cannot distinguish an international standard from local law, or an ethical requirement from a quality management requirement, and hedge to avoid being wrong.
What to do instead
Keep a short index of the frameworks in scope (audit standards, quality management standards, ethics code, local companies and audit legislation) with one line each on what it governs. In answers, name the framework and the specific obligation, and add the practical consequence of breaching it, such as invalidity of the report or disciplinary exposure.
Answering questions about independence, rotation, or quality management as if the rules applied only to the engagement partner, ignoring firm-level responsibilities, engagement quality reviews, and the eligibility of the firm itself.
The individual auditor's perspective dominates revision, and firm-level quality management is treated as a separate topic rather than as the framework within which every engagement sits.
What to do instead
For each scenario, run a two-level check: firm-level (acceptance and continuance, resources, monitoring, eligibility, fee dependence) and engagement-level (partner and team independence, review, documentation). Write both levels before concluding, and flag any scenario where the firm, not the individual, is compromised.
Producing answers that are technically correct in isolation but do not respond to the verb in the question, for example explaining when the question asks to evaluate, or listing when the question asks to recommend and justify.
Under time pressure candidates write everything they know about the topic, and revision rarely includes practice in decoding command words and allocating marks to the required depth.
What to do instead
Before writing, underline the command word and the number of marks, and convert marks into the number of distinct points required. Draft a skeleton of that many points first, then write. In practice, mark your own scripts against the command word rather than against the model answer.
Running out of time by over-writing the first long scenario and leaving later questions, particularly the regulatory and ethics ones, answered in a sentence or not at all.
Earlier questions feel safer and candidates keep adding points to them; there is no practised time budget per mark, so the paper is not paced against the clock.
What to do instead
Set a per-mark time budget from past papers and rehearse it: allocate minutes per mark, write the planned number of points only, and move on. Answer the ethics and regulatory questions you can complete quickly before returning to expand earlier answers, and simulate full papers under timed conditions at least twice.