ESAA Final Level Exam cheat sheet

Five fundamental principles of the IESBA Code: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Conceptual framework steps: identify threats, evaluate their significance, address them by eliminating the circumstance, applying safeguards, or declining/ending the engagement.

Threat categories: self-interest, self-review, advocacy, familiarity, intimidation; a threat is significant when a reasonable and informed third party would conclude it is not at an acceptable level.

Independence comprises independence of mind (state of mind) and independence of appearance (avoiding facts a reasonable third party would perceive as compromising objectivity).

Confidentiality persists after the professional relationship ends; disclosure is permitted only when required by law, permitted by law with client consent, or under professional duty.

A conflict of interest requires disclosure to affected parties, confidentiality separation (Chinese walls), and where necessary withdrawal from the engagement.

Safeguards cannot reduce a self-review threat to an acceptable level for an audit client when the firm created the accounting records or made management decisions.

Regulatory escalation ladders typically run: internal reporting, then regulator or oversight body; whistleblower protection statutes may shield good-faith disclosures.

Accounting equation: Assets = Liabilities + Equity; every transaction preserves the balance and debits equal credits.

Revenue recognition five steps (IFRS 15 / ASC 606): identify the contract, identify performance obligations, determine transaction price, allocate price to obligations, recognise revenue on satisfaction.

Accrual basis: recognise revenue when the performance obligation is satisfied and expenses when the obligation is incurred, irrespective of cash timing.

Lease classification under IFRS 16: a single lessee model recognising a right-of-use asset and lease liability at present value of lease payments; short-term and low-value exemptions apply.

Impairment test (IAS 36): compare carrying amount with recoverable amount, being the higher of fair value less costs of disposal and value in use.

Fair value hierarchy: Level 1 quoted prices in active markets, Level 2 observable inputs other than Level 1, Level 3 unobservable inputs.

Deferred tax arises from temporary differences between tax base and carrying amount; measure at tax rates expected to apply when the difference reverses.

Consolidation requires control: power over the investee, exposure to variable returns, and ability to use power to affect returns.

Contribution margin = Sales − Variable costs; contribution per unit = Unit selling price − Unit variable cost.

Break-even units = Fixed costs ÷ Contribution per unit; break-even revenue = Fixed costs ÷ Contribution margin ratio.

Margin of safety = (Budgeted sales − Break-even sales) ÷ Budgeted sales, expressed as a percentage.

Target profit volume = (Fixed costs + Target profit) ÷ Contribution per unit.

Standard costing variances: material price variance = (Standard price − Actual price) × Actual quantity purchased; usage variance = (Standard quantity − Actual quantity) × Standard price.

Labour rate variance = (Standard rate − Actual rate) × Actual hours; efficiency variance = (Standard hours for actual output − Actual hours) × Standard rate.

Return on investment = Operating profit ÷ Invested capital; residual income = Operating profit − (Required rate × Invested capital).

Balanced Scorecard perspectives: financial, customer, internal process, learning and growth; each perspective needs objectives, measures, targets and initiatives.

Transfer pricing rules: minimum transfer price for a division with spare capacity equals variable cost; with no spare capacity it equals variable cost plus opportunity cost.

Net present value = Σ [Cash flow_t ÷ (1 + r)^t] − Initial investment; accept projects with NPV greater than zero.

Internal rate of return is the discount rate at which NPV equals zero; the IRR rule agrees with NPV for conventional cash flows but can mislead with non-conventional flows or scale differences.

Weighted average cost of capital = (E ÷ V) × Ke + (D ÷ V) × Kd × (1 − tax rate), where V = E + D.

Cost of equity by CAPM: Ke = Risk-free rate + Beta × Market risk premium.

Dividend growth model: Ke = (D1 ÷ P0) + g, where D1 = D0 × (1 + g).

Working capital cycle = Inventory days + Receivable days − Payable days; a shorter cycle releases cash.

Interest rate risk management tools: forward rate agreements, interest rate futures, interest rate swaps, and caps, floors and collars.

Purchasing power parity and interest rate parity link spot and forward exchange rates; the forward rate reflects the interest rate differential between currencies.

Gearing measures: debt-to-equity = Debt ÷ Equity; debt-to-total capital = Debt ÷ (Debt + Equity).

Audit risk model: Audit risk = Inherent risk × Control risk × Detection risk; detection risk is controlled by the auditor through the nature, timing and extent of procedures.

Assertions for classes of transactions and balances include occurrence, completeness, accuracy, cut-off, classification, existence, rights and obligations, valuation and allocation.

Substantive procedures include tests of detail and substantive analytical procedures; analytical procedures are also required in the risk assessment and overall review stages.

Materiality is set at an overall level plus performance materiality; performance materiality is set below overall materiality to reduce the probability that uncorrected aggregate misstatements exceed it.

Sampling risk is the risk the auditor's conclusion based on a sample differs from the conclusion from the whole population; non-sampling risk arises from human error or inappropriate procedures.

COSO internal control components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Control activities include segregation of duties, authorisation, reconciliations, physical controls, and information processing controls (application and general IT controls).

Audit report opinion types: unmodified, qualified, adverse, and disclaimer; a key audit matter section is required for listed entities under ISA 701.

Going concern: the auditor evaluates management's assessment for at least twelve months from the reporting date and considers the adequacy of related disclosures.

Porter's Five Forces: threat of new entrants, bargaining power of buyers, bargaining power of suppliers, threat of substitutes, and competitive rivalry.

PESTLE analysis categories: political, economic, social, technological, legal, environmental.

Ansoff product-market matrix: market penetration, market development, product development, and diversification (related or unrelated).

Value chain activities split into primary activities (inbound logistics, operations, outbound logistics, marketing and sales, service) and support activities.

Risk response options: avoid, reduce (mitigate), transfer (share), and accept (retain); the chosen response depends on risk appetite and tolerance.

Risk assessment combines likelihood and impact; a risk map plots inherent and residual risk after controls.

Board governance principles: independence, separation of chair and CEO, audit committee of independent non-executive directors, and clear delegation of authority.

Stakeholder mapping by power and interest determines engagement strategy: high power and high interest require close management.

General IT controls cover access management, change management, IT operations, and backup and recovery; application controls cover input, processing and output.

Input controls: field checks, format checks, range checks, validity checks, and batch totals; processing controls include run-to-run totals and file reconciliation.

Data analytics types: descriptive (what happened), diagnostic (why), predictive (what will happen), and prescriptive (what action to take).

Data quality dimensions: completeness, accuracy, validity, consistency, uniqueness, and timeliness.

SQL clauses execute in the logical order FROM, WHERE, GROUP BY, HAVING, SELECT, ORDER BY.

Key population and completeness testing in analytics: reconcile the dataset to the general ledger or source system control totals before performing tests.

Cloud shared responsibility model: the provider secures the infrastructure, while the customer secures data, identities, and configuration.

Segregation of duties in ERP systems is enforced through role design and periodic user access reviews; conflicting access combinations must be identified and remediated.

Cybersecurity controls: multi-factor authentication, least privilege, encryption at rest and in transit, logging and monitoring, and patch management.

Taxable income = Accounting profit ± permanent differences ± temporary differences − Tax losses and reliefs.

Permanent differences (e.g., non-deductible fines) affect the effective tax rate but do not create deferred tax; temporary differences do.

VAT is an indirect tax collected on behalf of the tax authority; output tax less input tax equals the amount payable or recoverable.

Taxable supplies typically include standard-rated and zero-rated supplies; exempt supplies generally do not allow input tax recovery.

Transfer pricing: transactions between related parties must be at arm's length; common methods are comparable uncontrolled price, resale price, cost plus, and profit split.

Contract formation requires offer, acceptance, consideration, intention to create legal relations, and capacity; a counter-offer terminates the original offer.

An agent binds a principal only when acting within actual or apparent authority; undisclosed agency may allow the principal to sue on the contract.

Company law fundamentals: directors owe duties of care, loyalty, and good faith; the corporate veil is lifted only in limited circumstances such as fraud.

Employment law: wrongful dismissal concerns breach of contract, while unfair dismissal concerns statutory fairness of the reason and procedure.

Ethical decision frameworks: identify facts, stakeholders, relevant principles, alternatives, and consequences before concluding.

Professional competence requires attaining and maintaining knowledge and skills; due care requires acting diligently in accordance with applicable standards.

Advocacy threat arises when a professional promotes a client's position to the point that objectivity is compromised, such as acting as an advocate in litigation.

Familiarity threat arises from long association or close personal relationships; safeguards include rotation of engagement partners and independent quality review.

Intimidation threat arises from pressure such as threats of dismissal or litigation; safeguards include disclosure to governance and consulting professional bodies.

Fees: contingent fees for audit engagements create self-interest threats and are prohibited where they depend on the outcome of the audit.

Gifts and hospitality must be evaluated against whether a reasonable third party would consider them to impair judgement; trivial and inconsequential gifts are acceptable.

Regulatory compliance programs: risk assessment, policies and procedures, training, monitoring and testing, and escalation and remediation.

Property, plant and equipment: initial measurement at cost, subsequent measurement at cost or revaluation model; depreciation is allocated over the useful life.

Intangible assets with indefinite useful lives are not amortised but tested for impairment annually.

Financial instruments: amortised cost applies where the business model is hold-to-collect and cash flows are solely payments of principal and interest.

Provisions are recognised when a present obligation exists from a past event, an outflow is probable, and the amount can be reliably estimated.

Contingent liabilities are disclosed unless the outflow is remote; contingent assets are disclosed only when an inflow is probable.

Statement of cash flows categories: operating, investing, and financing; interest and dividends are classified consistently with policy.

Earnings per share: basic EPS = Profit attributable to ordinary shareholders ÷ Weighted average number of ordinary shares.

Subsequent events: adjusting events provide evidence of conditions existing at the reporting date; non-adjusting events are disclosed if material.

Absorption costing includes fixed production overhead in product cost; marginal costing treats fixed overhead as a period cost.

Difference in profit between absorption and marginal costing = Change in inventory units × Fixed overhead absorption rate per unit.

Overhead absorption rate = Budgeted overhead ÷ Budgeted activity level (labour hours, machine hours, or units).

Activity-based costing assigns overheads to cost pools driven by activities, then to products using cost drivers such as setups, orders, and inspections.

Flexed budget compares actual results with the budget adjusted to actual activity level; a static budget comparison mixes volume and price effects.

Fixed overhead variances: expenditure variance = Budgeted fixed overhead − Actual fixed overhead; volume variance = (Budgeted hours − Standard hours for actual output) × Standard rate.

Relevant costs for decisions are future, incremental cash flows; sunk costs and allocated fixed costs are irrelevant.

Limiting factor analysis ranks products by contribution per unit of scarce resource.

Divisional performance measures: ROI can encourage suboptimal investment decisions, while residual income and EVA align more closely with value creation.

Payback period is the time to recover the initial investment; it ignores cash flows after payback and the time value of money.

Discounted payback uses discounted cash flows; profitability index = Present value of cash inflows ÷ Initial investment.

Systematic risk is measured by beta and cannot be diversified; unsystematic risk is firm-specific and can be diversified away.

Dividend policy theories: Modigliani-Miller irrelevance (no taxes or transaction costs), bird-in-hand, and tax-preference arguments.

Business valuation methods: discounted cash flow, dividend valuation, price-earnings multiples, and net asset value.

Cash management models: Baumol (deterministic demand) and Miller-Orr (stochastic cash flows with upper and lower control limits).

Money market hedge uses borrowing or lending in the foreign currency to lock in an exchange rate; forward contracts fix the rate directly.

Interest rate parity: forward rate ÷ spot rate = (1 + domestic rate) ÷ (1 + foreign rate).

Treasury controls: segregation of duties between dealing, settlement, and recording; counterparty limits; and daily cash position reporting.

Audit planning includes understanding the entity and its environment, identifying and assessing risks, and designing responses; the engagement letter sets scope and responsibilities.

Risk assessment procedures: inquiries of management, analytical procedures, and observation and inspection; they do not by themselves provide sufficient appropriate evidence.

Sufficiency relates to quantity of evidence; appropriateness relates to relevance and reliability. External evidence is generally more reliable than internal evidence.

Audit documentation must be sufficient for an experienced auditor with no previous connection to the audit to understand the work performed and conclusions reached.

Written representations are required from management and, where appropriate, those charged with governance; they are not a substitute for other evidence.

The auditor communicates significant deficiencies in internal control in writing to those charged with governance on a timely basis.

Subsequent events review covers the period from the date of the financial statements to the date of the auditor's report, extended to the date the statements are issued.

The engagement quality control review is performed before the report is issued for listed entities and other high-risk engagements.

Internal audit independence: the chief audit executive reports functionally to the audit committee and administratively to senior management.

SWOT analysis pairs internal strengths and weaknesses with external opportunities and threats to inform strategic fit.

BCG matrix: stars (high growth, high share), cash cows (low growth, high share), question marks (high growth, low share), and dogs (low growth, low share).

Porter's generic strategies: cost leadership, differentiation, and focus (cost focus or differentiation focus); being stuck in the middle typically erodes returns.

Core competence characteristics: valuable, rare, difficult to imitate, and non-substitutable (VRIN).

Corporate governance codes typically require an annual governance statement, board evaluation, and disclosure of compliance or explanation of non-compliance.

Risk appetite is the amount of risk an organisation is willing to accept; risk tolerance is the acceptable variation around that appetite.

Three lines model: operational management (first line), risk and compliance functions (second line), and internal audit (third line).

Business continuity: recovery time objective is the maximum tolerable downtime; recovery point objective is the maximum tolerable data loss.

Scenario analysis and stress testing assess the impact of extreme but plausible events on strategic objectives.

CAAT techniques: test data, parallel simulation, embedded audit modules, and audit software for data extraction and analysis.

Continuous auditing uses automated controls and analytics to provide assurance in or near real time.

Data visualisation choices: bar charts for comparison, line charts for trends, scatter plots for correlation, and heat maps for density.

Benford's law predicts the frequency of leading digits in naturally occurring datasets; deviations may indicate manipulation or fraud.

Joining datasets: an inner join returns matching records only; a left join returns all records from the left table plus matches.

Data governance roles: data owner (accountable for quality and access), data steward (day-to-day quality), and data custodian (technical storage and security).

Robotic process automation is suited to high-volume, rule-based, repetitive tasks with structured inputs.

Artificial intelligence governance requires model validation, bias testing, explainability, and audit trails of model changes.

IT disaster recovery metrics: mean time to recovery and mean time between failures inform resilience planning.

Tax avoidance is arranging affairs within the letter of the law to reduce tax; tax evasion is illegal and involves concealment or misrepresentation.

General anti-avoidance rules allow tax authorities to disregard arrangements whose sole or main purpose is to obtain a tax advantage.

Capital allowances spread the tax deduction for capital expenditure over time; accounting depreciation is generally not deductible.

Withholding taxes are deducted at source on payments such as dividends, interest, and royalties; double tax treaties reduce or eliminate them.

Tax residency is typically determined by place of incorporation, central management and control, or days of physical presence.

Consideration must be sufficient but need not be adequate; past consideration is generally not valid.

Exclusion and limitation clauses are construed strictly against the party relying on them and cannot exclude liability for fraud or death or personal injury caused by negligence.

Partnership law: general partners have unlimited liability, limited partners have liability limited to capital contributed, and a limited liability partnership gives members limited liability.

Insolvency tests: cash-flow insolvency (inability to pay debts as they fall due) and balance-sheet insolvency (liabilities exceed assets).