Audit, Assurance and Internal Control
This domain tests risk-based audit and control evaluation. Candidates must plan evidence, assess risk, and conclude whether financial statements are free from material misstatement. Questions often ask what procedure to perform, what evidence is most reliable, or whether a deficiency is significant.
Core rules
- Audit risk is inherent risk times control risk times detection risk. Detection risk is managed by the nature, timing, and extent of audit procedures.
- Materiality is assessed for the financial statements as a whole and for particular classes of transactions. Performance materiality is lower than overall materiality to reduce aggregation risk.
- Evidence must be sufficient and appropriate. External confirmations and inspection of original documents are generally more reliable than internal oral representations.
- Tests of controls evaluate operating effectiveness; substantive procedures detect material misstatements. Controls cannot eliminate the need for substantive work.
- The COSO internal control framework covers control environment, risk assessment, control activities, information and communication, and monitoring.
- Fraud risk requires professional scepticism, consideration of management override, and procedures addressing revenue recognition and journal entries.
Worked example
Profit before tax is 5 million. The auditor sets overall materiality at 5% of profit before tax, or 250,000. Performance materiality is 75% of overall materiality, or 187,500. Clearly trivial threshold is 5% of overall materiality, or 12,500. A control deficiency allows a clerk to create and approve vendor payments. The deficiency is significant because it permits unauthorised payments and affects the purchase-to-pay cycle. The auditor tests compensating controls, expands substantive testing, and reports the deficiency to those charged with governance. If management override is possible, journal-entry testing is required even when other controls appear effective.
Traps that cost marks
Do not treat management representations as a substitute for other evidence. Do not lower detection risk by simply increasing sample size without targeting risk. Do not confuse a deficiency in design with a deficiency in operating effectiveness. Do not assume internal audit work can replace the external auditor's judgement. Do not ignore fraud risk in revenue recognition.