Audit
The Audit domain tests whether you can apply risk-based assurance methodology in an EU public-sector setting. Questions combine the vocabulary of international auditing standards with the INTOSAI framework (ISSAI 100–400) used by the European Court of Auditors, and with the EU budgetary cycle: statement of assurance, legality and regularity, and sound financial management.
Audit risk and materiality
- Audit risk = risk of material misstatement (inherent risk × control risk) × detection risk. Detection risk is the only component the auditor controls: a lower acceptable audit risk forces lower detection risk and more substantive work.
- Materiality is professional judgement, set at overall, performance and clearly-trivial levels; it is not a fixed percentage of turnover.
- Assertions - existence, completeness, accuracy, cut-off, classification, rights and obligations, valuation - determine which procedure answers which question.
Evidence and internal control
- Evidence must be sufficient (quantity) and appropriate (relevance and reliability). Reliability ranking: auditor's direct external evidence, external documentary, internal documentary, oral.
- Procedures: inspection, observation, external confirmation, recalculation, re-performance, analytical procedures; inquiry alone is never sufficient.
- COSO components: control environment, risk assessment, control activities, information and communication, monitoring. Typical manual controls: segregation of duties, authorisation, reconciliation, safeguarding of assets, IT general controls.
The EU public-audit layer
- ISSAI 200 covers financial audit principles, 300 performance audit, 400 compliance audit.
- The statement of assurance covers the reliability of the accounts and the legality and regularity of underlying transactions.
- Sound financial management means economy, efficiency and effectiveness - a performance concept, distinct from legality and regularity, which are compliance concepts.
- Single audit relies on other auditors' and management's work after assessing competence and objectivity.
Worked example
Inherent risk 0.80, control risk 0.50, acceptable audit risk 0.05. Required detection risk = 0.05 ÷ (0.80 × 0.50) = 0.125. Only 12.5% of the risk may remain undetected, so the auditor increases the extent of substantive testing, moves testing closer to year-end or seeks more persuasive external evidence. If acceptable audit risk were 0.10, detection risk doubles to 25% and less testing suffices.
Traps
- Inverting the risk relationship, e.g. treating high inherent risk as a reason to do less substantive testing.
- Setting materiality mechanically and forgetting performance materiality when sizing samples.
- Reading a clean opinion as proof of value for money.
- Accepting management inquiry as sufficient appropriate evidence.
- Extrapolating a sample error to the population when the sample is unrepresentative or the error is anomalous.