SOEL Auditor Exam cheat sheet

Three-party audit relationship: auditor, responsible party, intended users; the responsible party is not the auditor's client in a principal-agent sense.

Reasonable assurance = high but not absolute assurance; it permits a material (not remote) risk of undetected misstatement.

Materiality is a matter of professional judgment; misstatements are material if they could reasonably influence economic decisions of intended users.

Audit risk model: AR = IR × CR × DR; detection risk is the only component the auditor controls directly.

Governance bodies (board, audit committee) oversee the financial reporting process and the external auditor's independence and appointment.

Internal audit reports functionally to the audit committee and administratively to management; functional reporting preserves independence.

Inherent limitations of an audit: judgment, sampling, fraud concealment, and reliance on evidence that is persuasive rather than conclusive.

An audit of financial statements is not a guarantee of going concern, absence of fraud, or effectiveness of internal control unless separately reported.

Engagement acceptance requires assessing integrity of client, competence of team, and compliance with ethical requirements before signing.

Audit strategy sets scope, timing, direction, and resources; the audit plan is more detailed and evolves as the engagement progresses.

Risk assessment procedures include inquiry, analytical procedures, and observation/inspection; they are not sufficient alone as substantive evidence.

Significant risks are those close to the upper end of the spectrum or requiring special audit consideration, often involving significant judgment or related-party transactions.

Understanding the entity's internal control covers the control environment, risk assessment, control activities, information/communication, and monitoring.

Analytical procedures are required at the planning stage and in the overall review at the conclusion of the audit.

Fraud risk assessment must presume risks of fraud in revenue recognition unless rebutted and document the rebuttal rationale.

Performance materiality is set below overall materiality to reduce the probability that uncorrected and undetected misstatements exceed materiality.

Sufficiency relates to quantity of evidence; appropriateness relates to relevance and reliability; both are needed to support the conclusion.

Reliability hierarchy: external evidence > internal evidence; original documents > copies; auditor-obtained evidence > client-provided evidence.

Inspection, observation, inquiry, confirmation, recalculation, re-performance, and analytical procedures are the core evidence-gathering procedures.

Inquiry alone is never sufficient; it must be corroborated by other procedures because it is the least reliable procedure.

Tests of controls support the assessed level of control risk; substantive procedures detect material misstatements at the assertion level.

Substantive procedures are always required for material classes of transactions, account balances, and disclosures regardless of control reliance.

Sampling risk is the risk the auditor's conclusion based on a sample differs from the conclusion from the entire population.

Cutoff testing verifies that transactions are recorded in the correct accounting period, typically around the reporting date.

Unmodified opinion = financial statements give a true and fair (or present fairly) view in accordance with the applicable framework.

Modified opinions: qualified (material but not pervasive misstatement or scope limitation), adverse (material and pervasive misstatement), and disclaimer (material and pervasive scope limitation).

The auditor's report includes an opinion section, basis for opinion, going concern section when relevant, key audit matters (where required), and other responsibilities sections.

Key audit matters are those of most significance in the audit, selected from matters communicated to those charged with governance.

Emphasis of Matter and Other Matter paragraphs do not modify the opinion and must be clearly labeled as not modifying it.

Management is responsible for preparing financial statements; the auditor's report must state this and describe the auditor's responsibilities.

Follow-up on prior-year findings requires tracking management's remediation and assessing whether the deficiency persists.

If management corrects a misstatement identified during the audit, the auditor still evaluates whether the process that produced it indicates a control deficiency.

Auditing standards (e.g., ISAs) are principle-based and require documentation of significant judgments and conclusions reached.

The auditor must comply with all relevant ethical requirements, including independence rules applicable to the engagement.

Engagement quality review (EQR) is required for listed entities and other engagements where quality risk is high.

Documentation must be sufficient for an experienced auditor with no prior connection to the engagement to understand the work performed and conclusions.

Non-compliance with laws and regulations (NOCLAR) requires the auditor to understand the act, evaluate its effect, and respond appropriately.

Professional skepticism is an attitude of questioning and a critical assessment of evidence; it is required throughout the engagement.

The auditor must communicate with those charged with governance about significant findings, disagreements, and the planned scope of the audit.

Retention of engagement documentation is governed by firm policy and applicable regulation; it must be completed on a timely basis before the report is issued.

Fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behavior.

Independence comprises independence of mind (state of mind) and independence in appearance (avoiding facts that a reasonable third party would perceive as compromising).

Self-interest, self-review, advocacy, familiarity, and intimidation are the five threats to independence.

Safeguards may eliminate or reduce threats to an acceptable level; if no safeguard is available, the engagement must be declined or terminated.

Contingent fees create a self-interest threat and are prohibited for audit engagements.

Long association with a client creates a familiarity threat; rotation requirements apply to engagement partners and EQ reviewers.

Confidentiality continues after the professional relationship ends and is not time-limited.

A cooling-off period is required before a former engagement partner can join a client in a key management or governance role.

Working papers must be sufficient to enable an experienced auditor to understand the nature, timing, extent, results, and conclusions of procedures.

Documentation must be assembled on a timely basis; the final audit file is normally completed within 60 days after the report date.

After the final file is assembled, no documents may be deleted; additions must be documented with the reason, date, and person responsible.

A quality control system includes leadership responsibilities, ethical requirements, acceptance/continuance, human resources, engagement performance, and monitoring.

Engagement quality review evaluates significant judgments and the conclusions reached; the reviewer must be objective and independent of the engagement team.

Monitoring is an ongoing process of evaluating the firm's quality control system, including periodic inspection of completed engagements.

Documentation of significant matters includes the reasoning behind judgments and the basis for conclusions reached on difficult or contentious matters.

Review of working papers by a more senior team member is a quality control procedure, not a substitute for the engagement quality review.