Auditing and Assurance
Core concepts
Assurance engagements enhance confidence in information. Candidates must understand the audit risk model: audit risk equals inherent risk times control risk times detection risk. Inherent and control risk are risks of the entity; detection risk is controlled by the auditor through the nature, timing and extent of procedures. Higher assessed risk requires more reliable, more persuasive evidence, often obtained closer to period end or from external sources.
Know the stages: engagement acceptance and independence checks, planning and materiality, risk assessment, design of further procedures (tests of controls and substantive procedures), evaluation of misstatements, and reporting. Understand audit evidence qualities (sufficiency and appropriateness), the difference between tests of controls and substantive testing, and the use of confirmations, observation, inquiry, recalculation, and analytical procedures. Inquiry alone is rarely sufficient.
Memorize the structure of the auditor's report: opinion first, then basis for opinion, then key audit matters where required, and going concern or other matters as applicable. Know the types of opinion: unmodified, qualified (except for), adverse, and disclaimer, and the conditions that trigger each. Ethics topics include independence, threats (self-interest, self-review, advocacy, familiarity, intimidation) and safeguards.
Traps
- Confusing detection risk (auditor-controlled) with inherent risk (entity-driven).
- Believing that a lower materiality threshold reduces detection risk automatically.
- Treating inquiry as sufficient evidence for a significant risk.
- Issuing a disclaimer when the auditor concludes misstatements are material but not pervasive.
- Ignoring a scope limitation when choosing the opinion type.
Worked example / rule of thumb
Rule of thumb: pervasive or not? If a misstatement or limitation is material but not pervasive, qualify. If it is both material and pervasive, use an adverse opinion for misstatement or a disclaimer for limitation. Example: an auditor cannot obtain evidence for a subsidiary representing 60 percent of total assets; the effect is material and pervasive, so a disclaimer is appropriate. If the same issue affected only inventory of 8 percent of assets, a qualified opinion would fit.