CA ANZ Assurance common mistakes
CA ANZ Assurance · Understand the traps and how to avoid them.
When asked who bears responsibility for detecting fraud or for the adequacy of disclosures, the candidate answers that the auditor does, or that management and the auditor share it equally, instead of stating that management (and those charged with governance) bear primary responsibility while the auditor's duty is reasonable assurance and reporting.
Candidates conflate the auditor's assurance role with a guarantor role because the audit report is the visible output and the auditor is the one 'checking' the numbers, so responsibility intuitively attaches to the checker.
What to do instead
Before answering any responsibility question, write two columns headed 'Management/TCWG' and 'Auditor' and place each duty explicitly. Memorise the split: management prepares and presents the statements and designs controls; the auditor obtains reasonable, not absolute, assurance and reports on the statements and on fraud risks identified.
On a threat-to-independence scenario, the candidate names the threat (self-interest, self-review, advocacy, familiarity, intimidation) but stops there, failing to state whether the threat is at an acceptable level and what specific safeguard or action (decline, remove the individual, independent review, disclose to TCWG) is required.
The conceptual framework is taught as a labelling exercise, so candidates treat identification as the answer rather than as the first step of a three-step evaluation-and-response process.
What to do instead
Structure every answer as three sentences: 'The threat is X because [specific facts]. It is/is not at an acceptable level because [significance reasoning]. The appropriate response is [safeguard or refusal], and it should be documented and communicated to TCWG.' Practise on rotating-partner, long-association and fee-dependence scenarios.
When a scenario introduces a new client in a high-risk industry, a predecessor auditor, or a group with foreign components, the candidate jumps straight to designing substantive procedures without addressing client acceptance/continuance, independence clearance, engagement letter terms, or communication with the predecessor.
Candidates read the scenario as an 'audit procedures' question and treat pre-engagement steps as administrative background rather than as required, examinable decisions.
What to do instead
Adopt a fixed chronological checklist for every engagement scenario: acceptance/continuance decision and documentation, independence and competence of the team, engagement letter, predecessor communication and access to working papers, then planning. Explicitly state the accept/decline conclusion and the reason.
The candidate performs substantive testing on a population without first assessing and testing the design and implementation of relevant controls, or asserts that controls are 'tested' merely because the client describes them in an interview.
Candidates believe testing balances, so they favour detailed substantive work, and they mistake inquiry alone for evidence of operating effectiveness.
What to do instead
For each significant risk, state the assertion affected, whether the auditor intends to rely on controls, and if so the specific test of operating effectiveness (inspection, observation, re-performance, sampling). State that inquiry alone is insufficient and that design versus implementation versus operating effectiveness are three distinct steps.
The candidate treats the entity-level understanding as a narrative to summarise rather than linking it forward: the industry, regulatory, and IT environment, the applicable financial reporting framework, and the entity's system of internal control are described but never converted into identified risks of material misstatement at the assertion level.
Candidates answer 'understanding the entity' questions descriptively because the topic feels qualitative, and they do not practise the translation step from knowledge to risk.
What to do instead
End every understanding answer with a risk table: 'Factor observed → account/assertion affected → risk of material misstatement (high/moderate) → planned response.' Force at least two rows per scenario so the linkage becomes automatic.
The candidate describes an audit procedure vaguely ('review the ledger', 'discuss with management', 'check the invoices') without specifying the assertion addressed, the population and sample selection, the direction of testing, or the evidence source and reliability.
Candidates write procedures as they would speak them in practice, where shared context fills the gaps, and under time pressure they default to short generic verbs.
What to do instead
Write every procedure in a four-part template: source document/population → action verb (inspect, observe, confirm, recalculate, re-perform) → assertion targeted → evaluation criterion. For example, 'Select a sample of recorded sales from the sales journal and vouch to signed delivery dockets and customer purchase orders to test occurrence.'
When a sample exception is found or a misstatement is projected, the candidate concludes 'the population is misstated' or 'no further work needed' rather than evaluating the nature and cause, considering whether the sample size or method was appropriate, projecting the misstatement, and assessing whether the overall effect is material and whether the strategy must change.
Candidates treat sampling as a mechanical arithmetic step and do not connect exceptions back to risk assessment, materiality, and the iterative nature of the audit.
What to do instead
Practise the exception protocol: investigate the cause with the client, determine whether it is an anomaly or systemic, extend or re-perform testing if systemic, project to the population, aggregate with other misstatements, compare to materiality, and document the conclusion and any change to the audit plan.
The candidate treats the audit report as a fixed template and fails to modify it appropriately, for example missing a key audit matter for a listed entity, omitting an emphasis of matter or other matter paragraph where conditions are met, or keeping an unmodified opinion despite a scope limitation or a material misstatement.
Candidates memorise the standard report wording but not the decision tree that determines which report type and which additional sections are required by the scenario facts.
What to do instead
Build a decision tree and run every reporting scenario through it: is there sufficient appropriate evidence (scope)? Is the misstatement material and pervasive? Is the entity listed (KAM required)? Are there going-concern or other matters requiring a separate section? Then state the opinion type and the exact placement of each paragraph.
On legal liability scenarios, the candidate states that the auditor 'is liable' or 'is not liable' without identifying the cause of action (negligence, breach of contract, misleading conduct), the elements that must be proved including duty, breach, causation, and loss, and the applicable defences such as contributory negligence, lack of proximity, or proper documentation.
Candidates reduce liability to a fairness judgement about who should pay rather than applying the legal elements, and they underestimate how contemporaneous documentation supports a defence.
What to do instead
Answer in elements: identify the plaintiff and their relationship to the auditor (proximity), the standard of care expected, the alleged departure, the causal link to the plaintiff's loss, and available defences. Note the role of engagement letters, documented judgements, and quality management in limiting exposure.
The candidate answers an assurance engagement question using audit terminology and audit-level evidence, failing to distinguish a reasonable assurance engagement from a limited assurance review, or confusing agreed-upon procedures (factual findings, no assurance) with a compilation (no assurance) and a review.
Candidates over-learn the statutory audit and treat all assurance engagements as scaled-down audits, missing the differing levels of assurance, evidence thresholds, and report wording.
What to do instead
Maintain a three-column comparison table for reasonable assurance, limited assurance, and related services covering objective, level of assurance, evidence procedures, independence requirements, and standard report conclusion wording. Apply the column headings explicitly in the answer before drafting the conclusion.