CA ANZ Assurance cheat sheet

Assurance engagement: a practitioner expresses a conclusion designed to enhance the degree of confidence of intended users other than the responsible party about the outcome of the evaluation of a subject matter against criteria.

Five elements of an assurance engagement: three-party relationship, appropriate subject matter, suitable criteria, sufficient appropriate evidence, and a written assurance report.

Reasonable assurance engagement expresses the conclusion in a positive form (e.g. 'gives a true and fair view'); limited assurance uses a negative form ('nothing has come to our attention').

Suitable criteria are relevant, complete, reliable, neutral and understandable; they may be established (law, standards) or specifically developed for the engagement.

Audit risk model: Audit risk = Inherent risk x Control risk x Detection risk; detection risk is the only component the auditor controls directly.

Reasonable assurance is not absolute assurance because of sampling risk, inherent limitations of internal control, and the nature of audit evidence (persuasive, not conclusive).

In Australia, Chapter 2M of the Corporations Act 2001 requires audited financial reports for disclosing entities, large proprietary companies and registered schemes; ASIC administers and enforces auditor obligations.

Independence and quality management standards in Australia/New Zealand derive from APESB (APES 110, APES 320, APES 325) and AUASB auditing standards (ASA series, equivalent to ISA).

APES 110 fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Conceptual framework: identify threats (self-interest, self-review, advocacy, familiarity, intimidation), evaluate their significance, then address them by eliminating circumstances, applying safeguards, or declining the engagement.

Independence comprises independence of mind (state of mind) and independence of appearance (avoiding facts and circumstances a reasonable third party would perceive as compromising objectivity).

Prohibited financial interests: a direct financial interest in an audit client held by the firm, engagement team or immediate family member cannot be safeguarded and must be disposed of or the individual removed.

Fees: an audit fee that is large relative to total firm revenue, or overdue fees from a client, creates self-interest threat; fee dependency safeguards include external quality review and disclosure.

Long association: familiarity and self-interest threats escalate with tenure; rotation of the engagement partner is required for listed entities (generally after five to seven years under APES 110).

Non-assurance services: a firm cannot assume management responsibility or perform a self-review of its own audit work; bookkeeping, internal audit outsourcing and valuation services for listed audit clients are restricted.

Legal liability: auditors may be liable in contract and tort (negligence) to the client; liability to third parties generally requires foreseeability, proximity and reliance; proportionate liability regimes and contribution between defendants apply in Australia.

Client acceptance and continuance evaluation covers client integrity (management and those charged with governance), competence and resources of the firm, ability to comply with ethical requirements, and significant matters arising from prior engagements.

Communication with the predecessor auditor requires client permission; without permission the auditor considers the effect on accepting the engagement and generally declines.

Engagement letter contents: objective and scope, responsibilities of auditor and management, applicable reporting framework, expected form of report, and fee/ billing arrangements.

Engagement planning is not a discrete phase; it is continuous and iterative, revised as new information emerges during the audit.

Materiality is set at planning (overall materiality, performance materiality, and a clearly trivial threshold) and is revised during the audit if the auditor becomes aware of information that would have changed the initial determination.

Performance materiality is set lower than overall materiality to reduce to an appropriately low level the probability that aggregate uncorrected and undetected misstatements exceed overall materiality.

The overall audit strategy sets scope, timing, direction and reporting objectives; the audit plan is more detailed and sets the nature, timing and extent of audit procedures.

Direction, supervision and review of engagement team members are planned and documented, with more extensive direction and supervision for complex or higher-risk engagements.

Risk assessment procedures: inquiries of management and others, analytical procedures, observation and inspection; these are performed to obtain an understanding, not to obtain conclusive evidence.

Understanding the entity covers industry and regulatory factors, business model and operations, accounting policies, objectives and strategies, and measurement and review of financial performance.

Internal control components (COSO): control environment, risk assessment process, information system and communication, control activities, and monitoring of controls.

The auditor must obtain an understanding of each of the five components and evaluate the design and implementation of controls relevant to the audit, but is not required to test operating effectiveness unless relying on them.

Significant risks are risks of material misstatement close to the upper end of the spectrum, including risks involving significant judgement, significant economic changes, complex transactions, and related-party or fraud risks.

Fraud risk: the auditor presumes a risk of fraud in revenue recognition and must evaluate management override of controls through journal entry testing, accounting estimates review, and evaluation of significant unusual transactions.

Risk of material misstatement at the assertion level = inherent risk x control risk; the auditor then designs further audit procedures to reduce audit risk to an acceptably low level.

IT general controls (access, program changes, program development, computer operations) support the reliability of automated application controls and are evaluated when the auditor plans to rely on IT.

Sufficient appropriate audit evidence: sufficiency is the measure of quantity; appropriateness is the measure of quality (relevance and reliability).

Reliability hierarchy: external evidence > internal evidence; evidence obtained directly by the auditor > indirect; documentary > oral; original > copies; evidence from independent sources > management representations.

Audit procedures: inspection of assets and documents, observation, external confirmation, recalculation, re-performance, analytical procedures, and inquiry (inquiry alone is never sufficient).

External confirmations: if management refuses permission, the auditor must inquire about reasons, evaluate implications, and perform alternative procedures; if refusal is unreasonable, consider the effect on the opinion.

Analytical procedures are required as risk assessment procedures and in the overall review at the end of the audit; they are optional as substantive procedures but useful for large-volume, predictable transactions.

Audit documentation must be sufficient to enable an experienced auditor with no previous connection to the audit to understand the procedures performed, evidence obtained, and conclusions reached.

Working papers: assemble the final audit file within 60 days of the report date; after assembly, no deletion, and additions are permitted only with documented reasons.

Management representations are required in writing for matters such as management's responsibility for the financial report and completeness of information; representations are not a substitute for other audit evidence.

Sampling risk is the risk that the auditor's conclusion based on a sample differs from the conclusion if the entire population were tested; non-sampling risk arises from factors unrelated to sample size.

Statistical sampling uses random selection and probability theory to measure sampling risk; non-statistical sampling relies on auditor judgement to design and evaluate the sample.

Attribute sampling is used for tests of controls (deviation rate); variables sampling, including monetary unit sampling, is used for substantive tests of balances.

Monetary unit sampling (probability-proportional-to-size) selects items with probability proportional to their monetary amount, making it effective for overstatement tests and low-error populations.

Sample size for tests of controls increases as tolerable deviation rate decreases, as expected deviation rate increases, and as the desired confidence level increases.

Projected misstatement: for a stratified or monetary unit sample, misstatement found in a sample is projected to the population; the tolerable misstatement threshold determines whether the population is acceptable.

A misstatement identified in a sample is treated as an exception until the auditor obtains evidence it is not representative; anomalies require documentation and may be excluded from projection.

Data analytics (full-population testing, journal entry testing, Benford's law, duplicate payment and outlier analysis) can reduce sampling risk but introduces risks of data completeness, integrity and interpretation.

Subsequent events: adjusting events provide evidence of conditions existing at reporting date; non-adjusting events indicate conditions arising after reporting date and require disclosure if material.

Going concern: evaluate management's assessment, perform procedures to identify events or conditions that may cast significant doubt, and consider whether disclosures are adequate; opinion implications depend on the adequacy of disclosure.

Written representations are dated as near as practicable to, but not after, the date of the auditor's report; the report date is the date the auditor has obtained sufficient appropriate evidence.

Contingencies: obtain evidence about the completeness of management's identification of litigation and claims through inquiry, review of minutes, correspondence with legal counsel, and review of legal expense accounts.

Overall review: the engagement partner performs a review of the working papers and considers whether the financial report is consistent with the auditor's understanding of the entity.

Evaluate uncorrected misstatements individually and in aggregate against materiality; communicate all misstatements other than clearly trivial ones to management and those charged with governance.

Related parties: identify relationships and transactions, inspect underlying contracts, and evaluate whether transactions were conducted on normal commercial terms and adequately disclosed.

Subsequent discovery of facts after the report date: if facts existed at the report date and would have changed the opinion, the auditor advises the client to revise the report and issues a new report; if the client refuses, take action to prevent reliance on the report.

Unmodified opinion: the financial report gives a true and fair view (or is presented fairly, in all material respects) in accordance with the applicable financial reporting framework.

Modified opinions: qualified (material but not pervasive misstatement or limitation), adverse (material and pervasive misstatement), and disclaimer (material and pervasive limitation of scope).

Key audit matters (KAMs) are required in the auditor's report for listed entities; KAMs are selected from matters communicated with those charged with governance and are described in the auditor's report.

Emphasis of matter and other matter paragraphs do not modify the opinion; they draw attention to matters appropriately presented or disclosed, or to matters relevant to users' understanding of the audit.

The auditor's report includes: title, addressee, opinion, basis for opinion, going concern (when applicable), KAMs (when applicable), responsibilities of management and the auditor, and signature, date and auditor's address.

Communication with those charged with governance covers the auditor's responsibilities, planned scope and timing, significant findings, significant difficulties encountered, and independence matters.

The auditor must report to ASIC certain matters under section 311 of the Corporations Act 2001, including suspected contraventions and inability to obtain sufficient evidence.

The auditor's report date cannot be earlier than the date the financial report was approved by those charged with governance and the auditor obtained sufficient appropriate evidence.

Related services include agreed-upon procedures (AUP) and compilation engagements; they provide no assurance, and the report states that no assurance is expressed.

AUP engagement: the practitioner performs procedures agreed with the engaging party and reports factual findings; the report is restricted to the parties who agreed to the procedures.

Review engagement (ASRE 2410): limited assurance on a financial report, expressed negatively; procedures are primarily inquiry and analytical procedures, not tests of controls or substantive tests.

ASRE 2405 applies to reviews of historical financial information other than a financial report; ASAE 3000 is the general standard for assurance engagements other than audits or reviews of historical financial information.

Assurance over non-financial information (sustainability, greenhouse gas, service organisation controls) uses ASAE 3000/3410; the practitioner applies the same five elements and the same reasonable/limited assurance distinction.

Service organisation reports: a type 1 report covers the suitability of the design of controls at a point in time; a type 2 report covers design and operating effectiveness over a period.

Comfort letters and other special-purpose assurance engagements are governed by the terms of the engagement and the applicable AUASB standard; the scope and criteria are agreed with the engaging party.

Forensic and other investigative engagements are not assurance engagements; the practitioner's report is restricted and does not express an opinion on the financial report.