ICAB PL Audit & Assurance cheat sheet

Reasonable assurance is a high but not absolute level of assurance; inherent limitations include sampling risk, estimation uncertainty, fraud concealment and reliance on evidence that is persuasive rather than conclusive.

Materiality has three linked levels: overall financial statement materiality, performance materiality (usually a percentage, commonly 50%-75%, of overall), and a clearly trivial threshold for accumulating misstatements.

The audit risk model is AR = IR x CR x DR; detection risk is the residual the auditor controls through the nature, timing and extent of procedures, and it moves inversely with assessed risks of material misstatement.

ISA 200 sets the objective of an audit: obtain reasonable assurance about whether financial statements are free from material misstatement and report in accordance with the auditor's findings.

Professional scepticism is an attitude of questioning and alertness to conditions indicating possible misstatement, including fraud; it is required regardless of prior good faith in management.

The three-party relationship underlying an audit is: practitioner, responsible party (management charged with governance) and intended users; an assurance engagement also requires a subject matter and suitable criteria.

An auditor's report provides reasonable assurance and is positive in form; a review engagement provides limited assurance and is negative in form ("nothing has come to our attention").

Independence requirements for listed entities prohibit providing certain non-assurance services, including bookkeeping, internal audit outsourcing and valuation services that are material or subject to significant judgement.

ISA 315 requires identifying and assessing risks of material misstatement at the financial statement level and the assertion level, then designing further audit procedures responsive to those risks.

Inherent risk factors include complexity, subjectivity, change, uncertainty and susceptibility to management bias or fraud; significant risks are those close to the upper end of the spectrum and require substantive procedures.

Analytical procedures are required in risk assessment (ISA 315) and in the overall review at completion (ISA 520); they are optional but common as substantive procedures.

A documented audit strategy covers scope, reporting objectives, timing, and direction of the audit; the audit plan translates the strategy into detailed procedures.

Performance materiality is set below overall materiality to reduce to an appropriately low level the probability that aggregate uncorrected and undetected misstatements exceed materiality for the financial statements as a whole.

For a first-year engagement, the auditor performs client acceptance or continuance procedures, including evaluating integrity of management, competence of the engagement team and compliance with ethical requirements.

The risk assessment must consider the entity's internal control, including the control environment, risk assessment process, information system, control activities and monitoring of controls.

Direction, supervision and review of the engagement team are planned according to the assessed risks, the team's competence and experience, and the complexity of the work.

ISA 315 identifies five components of internal control: control environment, the entity's risk assessment process, information system and communication, control activities, and monitoring of controls.

Tests of controls are performed only when the auditor intends to rely on operating effectiveness; otherwise substantive procedures alone must provide sufficient appropriate audit evidence.

Audit evidence is sufficient (quantity) and appropriate (relevance and reliability); reliability increases for evidence obtained directly by the auditor, from external sources, or from original documents rather than copies.

The six audit procedures are inspection, observation, external confirmation, recalculation, re-performance and analytical procedures; inquiry alone is never sufficient.

For controls tested in a prior period, the auditor must test the operating effectiveness at least once every third audit, and more frequently if risks are significant or the control has changed.

A control deficiency exists when a control is designed, implemented or operated so that it cannot prevent, or detect and correct, misstatements on a timely basis; a significant deficiency is less severe than a material weakness but merits attention of those charged with governance.

The auditor's response to assessed risk can be at the overall level (general changes to staffing, supervision, unpredictability) or the assertion level (substantive procedures, tests of controls, or a combination).

External confirmations are most reliable for bank balances and receivables; if management refuses to allow a confirmation, the auditor must inquire about the reason, evaluate implications, and consider a modified opinion if the refusal is unreasonable.

ISA 450 requires accumulating misstatements identified during the audit, excluding clearly trivial ones, and communicating them to management and, where appropriate, those charged with governance.

Uncorrected misstatements are evaluated individually and in aggregate against materiality; if the aggregate approaches materiality, the auditor considers whether the risk of undetected misstatements is reduced to an appropriately low level.

The auditor's report includes: title, addressee, opinion, basis for opinion, going concern (where applicable), key audit matters (listed entities), responsibilities of management and the auditor, and the signature, date and location.

The opinion is unmodified when the auditor concludes the financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework.

A qualified opinion is issued when misstatements are material but not pervasive, or when sufficient appropriate evidence cannot be obtained and the possible effects are material but not pervasive; an adverse opinion or disclaimer is used when effects are both material and pervasive.

The auditor's report is dated no earlier than the date on which the auditor has obtained sufficient appropriate audit evidence, including evidence that the financial statements have been approved by those charged with governance.

ISA 570 requires evaluating management's assessment of going concern over at least twelve months from the date of the financial statements (or a shorter period if justified); a material uncertainty is disclosed in a separate section of the report.

Subsequent events procedures cover the period from the date of the financial statements to the date of the auditor's report; facts discovered after that date require consideration of whether the financial statements need amendment.

The five fundamental principles of the IESBA Code are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

The conceptual framework requires identifying threats, evaluating their significance, and addressing them by eliminating the circumstances, applying safeguards, or declining the engagement.

The five threat categories are self-interest, self-review, advocacy, familiarity and intimidation; a self-review threat arises when the firm audits its own work, such as bookkeeping it prepared.

ISQM 1 requires a firm-level system of quality management addressing eight components, including governance and leadership, relevant ethical requirements, engagement performance, and monitoring and remediation.

ISQM 2 requires an engagement quality review for audits of listed entities and for engagements where the firm determines a review is needed; the reviewer must be objective and independent of the engagement team.

ISA 220 (Revised) assigns the engagement partner responsibility for overall quality of the engagement, including direction and supervision, review of documentation, and consultation on difficult or contentious matters.

Audit documentation must be sufficient to enable an experienced auditor with no previous connection to the engagement to understand the work performed, evidence obtained and conclusions reached; the file is assembled within 60 days of the report date.

Confidentiality continues after the end of the relationship; disclosure is permitted only with client consent, where required by law, or where there is a professional right or duty to disclose.