Auditing and Attestation
Auditing and Attestation tests risk-based planning, evidence, internal control, sampling, and reporting. Candidates must connect assertions to procedures and distinguish a control deficiency from a material misstatement.
Risk, materiality, and evidence
- Audit risk = inherent risk × control risk × detection risk; lower detection risk requires more persuasive evidence.
- Assertions include existence, completeness, rights and obligations, valuation, cutoff, and classification.
- Materiality is set for the financial statements as a whole and often at a lower performance materiality level for accounts and classes of transactions.
- Evidence quality rises with independence of source and directness. External confirmation is stronger than inquiry alone; observation covers only the moment observed.
- Procedures include inspection, observation, inquiry, confirmation, recalculation, reperformance, and analytical procedures.
Internal control and sampling
- The COSO framework covers control environment, risk assessment, control activities, information and communication, and monitoring.
- Segregate authorization, custody, recording, and reconciliation. A control relying on one person is weaker.
- Attribute sampling tests control deviation rates; monetary-unit sampling tests balances. Project sample misstatement to the population before comparing with tolerable misstatement.
Worked example
A population has a book value of 500,000. A sample with book value 50,000 is audited at 48,500, showing a 1,500 overstatement. The projected misstatement is (1,500 / 50,000) × 500,000 = 15,000. Tolerable misstatement is 25,000. The projection is below tolerable, so it is not material by size alone. The auditor still investigates the cause, considers qualitative factors such as fraud or covenant effects, and documents the evaluation. If the projection plus an allowance for sampling risk exceeded tolerable misstatement, the auditor would expand testing or request adjustment.
Traps
Applying the sample misstatement rate to the sample only, rather than projecting, is wrong. Treating an immaterial projected misstatement as automatically acceptable ignores qualitative materiality. Inquiry alone is not sufficient evidence. Testing controls does not eliminate substantive testing. Documentation must be prepared on a timely basis, not reconstructed after the report date.