Audit, Assurance and Internal Control
The assurance framework
Understand the objective of an audit: reasonable assurance that financial statements are free from material misstatement, whether due to fraud or error, expressed in an opinion. Know the concepts of materiality, audit risk (inherent, control and detection risk), professional scepticism, and the expectation gap.
Risk-based approach
Revise the stages: engagement acceptance and independence, planning and risk assessment, understanding the entity and its internal control, identifying and assessing risks of material misstatement at the assertion level, designing responses, obtaining evidence, and forming the opinion. Know the five assertions for classes of transactions and account balances, and the audit procedures available: inspection, observation, enquiry, confirmation, recalculation, re-performance and analytical procedures.
Internal control
Apply the control environment, risk assessment, control activities, information and communication, and monitoring components. Know the limitations of internal control, including collusion and management override. Understand the difference between a control deficiency, significant deficiency and material weakness.
Reporting
Know the types of opinion: unmodified, qualified, adverse and disclaimer, and when each arises. Understand key audit matters, going concern considerations and subsequent events.
Traps
Questions conflate the responsibilities of management and the auditor, treat detection risk as controllable by the auditor alone, or assume more testing eliminates all risk. Watch for sampling language confusing tolerable misstatement with materiality.
Worked rule of thumb
Audit risk = inherent risk x control risk x detection risk. If inherent and control risk are high, detection risk must be set low, meaning more substantive testing and larger samples.