Auditing, Internal Control and Professional Ethics
What the exam tests
Statutory audit logic, the auditor's report, internal control, and ethical independence. The exam tests ISA concepts and the Czech Act on Auditors (93/2009 Coll.), not detailed audit programme mechanics.
Core rules
- A statutory audit is required when at least two of three thresholds are met: total assets, net turnover, and average employees. The exact amounts are set by law and have been amended, so verify the current version before applying them.
- Audit risk = inherent risk × control risk × detection risk. Materiality is set by the auditor and guides the nature, timing, and extent of procedures. Evidence should be sufficient and appropriate; management representations alone are not enough.
- The auditor expresses an opinion in the auditor's report: unmodified, qualified, adverse, or disclaimer. The report also includes key audit matters where required and a conclusion on going concern.
- Internal control is built on control environment, risk assessment, control activities, information and communication, and monitoring. Segregation of duties, authorisation, reconciliations, and physical controls are core control activities.
- Ethics: independence in mind and appearance, integrity, objectivity, confidentiality, professional competence, and due care. Threats include self-interest, self-review, advocacy, familiarity, and intimidation. Safeguards must eliminate or reduce them.
Worked example
An audit firm prepares the client's statutory financial statements and also audits them. Preparing the statements creates a self-review threat because the audit team would test its own work. For a public-interest entity, this is generally prohibited. For a smaller entity, the firm must assess whether safeguards are effective; if not, it should decline the audit or resign. The reasoning is threat identification first, then evaluation of safeguards, then action.
Traps
Confusing an audit with a tax inspection; treating a qualified opinion as a clean opinion; setting materiality as a fixed percentage without judgement; relying only on a management representation letter; failing to document independence threats. Do not say that internal control guarantees the absence of fraud; it provides reasonable, not absolute, assurance.
Legal and Regulatory Framework for Accountants
What the exam tests
The statutes and institutions that surround accounting practice: the Accounting Act, tax and VAT laws, the Labour Code, the Public Registers Act, AML, GDPR, and professional bodies. The exam tests who may do what, retention, and liability.
Core rules
- Accounting is governed by Act 563/1991 Coll. and implementing decrees; tax by Act 586/1992 Coll.; VAT by Act 235/2004 Coll.; employment by Act 262/2006 Coll.; public registers by Act 304/2013 Coll.; statutory audit by Act 93/2009 Coll.
- The label 'accountant' is not a reserved profession in the same way as 'auditor' or 'tax adviser'. Auditors are regulated by KAČR; tax advisers by the Chamber of Tax Advisers. Professional certification by accounting bodies is voluntary unless an engagement requires it.
- Accounting records and documents must be retained for the statutory period; tax documents generally for 10 years from the end of the tax period. Payroll and social-insurance records have longer retention periods. Check the current wording and sector-specific rules.
- AML obligations apply to accountants as obliged persons: identify the client and beneficial owner, monitor transactions, and report suspicious transactions. GDPR restricts personal-data processing and requires a lawful basis and security.
- The statutory body remains responsible for the books and statements; an external accountant's engagement does not transfer that responsibility.
Worked example
A company's 2020 purchase invoice is selected for review in 2026. For accounting retention, the five-year period runs from the end of the accounting period to which the record relates, so the 2020 record is normally retained until the end of 2025; for tax purposes, the ten-year period runs from the end of the tax period, so it should be kept until the end of 2030. The practical rule is to retain for the longer applicable period. The reasoning is to apply each retention rule separately, not assume one period covers all.
Traps
Assuming an accountant needs a state licence; confusing an auditor's statutory responsibility with the directors'; destroying records at five years when a ten-year tax period still applies; ignoring AML identification for a one-off transaction; treating GDPR as only an IT issue. Do not assume that a professional-body certificate gives a legal monopoly.