Ovlašteni revizor cheat sheet

IFRS conceptual framework: assets and liabilities are defined by present economic resource/obligation arising from past events, not by recognition thresholds; recognition follows relevance and faithful representation.

Measurement bases under IFRS: historical cost, fair value, value in use, current cost, and fulfilment value; IFRS 13 fair value is an exit price in an orderly transaction between market participants at the measurement date.

Revenue under IFRS 15 follows the five-step model: identify contract, identify performance obligations, determine transaction price, allocate price to obligations, recognise revenue on satisfaction of each obligation (over time or at a point in time).

IFRS 16 lessee: recognise right-of-use asset and lease liability at present value of lease payments; short-term (≤12 months) and low-value asset leases may be expensed on a straight-line basis.

Expected credit losses under IFRS 9 use a three-stage model: stage 1 twelve-month ECL, stage 2 lifetime ECL on significant increase in credit risk, stage 3 lifetime ECL on credit-impaired assets.

Croatian GAAP (HSFI) applies to entrepreneurs not required to apply IFRS; large and public-interest entities and consolidated statements follow IFRS as adopted by the EU.

Croatian statutory financial statements comprise balance sheet, profit and loss account, statement of changes in equity, cash flow statement (above small-entity thresholds), and notes; filing is with FINA in prescribed XML format.

Deferred tax under IAS 12 uses the temporary difference approach: recognise deferred tax on differences between carrying amount and tax base, except initial recognition of goodwill and certain non-tax-deductible items.

ISA 200: reasonable assurance is a high, not absolute, level; inherent limitations include sampling risk, estimation uncertainty, and the nature of evidence.

IESBA/Croatian Code of Ethics: five fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Independence threats: self-interest, self-review, advocacy, familiarity, and intimidation; safeguards include rotation, independent review, and removing the individual from the engagement.

ISA 700/701: the auditor expresses an unmodified opinion when statements give a true and fair view; KAM (ISA 701) is mandatory for listed entities.

Modified opinions under ISA 705: qualified (material but not pervasive), adverse (material and pervasive misstatement), and disclaimer (inability to obtain evidence, material and pervasive).

ISA 570 going concern: evaluate management's assessment for at least 12 months from the reporting date; disclose material uncertainty without modifying the opinion, or modify if the assumption is inappropriate.

ISA 220 quality management: engagement partner is responsible for overall quality, ethical compliance, acceptance and continuance, and direction, supervision and review of the engagement team.

Audit documentation (ISA 230): sufficient to enable an experienced auditor with no prior connection to understand the work performed, evidence obtained, and conclusions reached; assembly within 60 days of the report date.

ISA 315: identify and assess risks of material misstatement at financial statement and assertion level; significant risks are those requiring special audit consideration, including significant non-routine transactions and management estimates.

Audit risk model: AR = IR × CR × DR; detection risk is the auditor's lever and is inversely related to the assessed risks of material misstatement.

Materiality (ISA 320): benchmarks commonly used are 5% of profit before tax, 0.5–1% of total revenue, or 1–2% of total assets, adjusted for qualitative factors.

Performance materiality is set below overall materiality to reduce the probability that uncorrected and undetected misstatements exceed materiality.

COSO internal control components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

ISA 330: substantive procedures are mandatory for each material class of transactions, account balance and disclosure, regardless of assessed control risk.

Test of controls: if controls operate effectively, reduce substantive testing; document the operating effectiveness, the population, the sampling method, and the deviation evaluation.

ISA 610: using the work of internal audit requires evaluating objectivity, competence, and a systematic and disciplined approach, including quality control.

ISA 500: audit evidence is information used by the auditor to reach conclusions; it must be sufficient (quantity) and appropriate (relevance and reliability).

Reliability hierarchy: external independent evidence > internal evidence with effective controls > oral evidence; original documents > copies; auditor-observed evidence > management representation.

ISA 505 external confirmations: positive confirmations request a response in all cases; non-responses require alternative procedures; negative confirmations are used only in limited circumstances.

ISA 540 estimates: evaluate the method, assumptions, and data used by management; perform a retrospective review of prior estimates; obtain written representations on reasonableness.

ISA 560 subsequent events: perform procedures up to the date of the auditor's report; if facts become known after the report date but before issuance, discuss with management and consider reissuing.

ISA 450: accumulate misstatements other than trivial; communicate uncorrected misstatements to those charged with governance and obtain a written representation on their effect.

ISA 600 group audits: the group engagement partner is responsible for the direction, supervision and performance of the group audit and for the opinion on the group financial statements.

Written representations (ISA 580) are dated as near as practicable to, but not after, the date of the auditor's report and do not substitute for other audit evidence.

Croatian corporate income tax (porez na dobit): standard rate 18%; reduced rate 10% applies to taxpayers with annual revenue up to EUR 1,000,000 (as set by the applicable annual threshold).

VAT (PDV): standard rate 25%; reduced rates of 13% and 5% apply to specified supplies (e.g., 13% for accommodation and certain food services, 5% for books, medicines, and certain social services).

VAT registration threshold for small taxpayers is EUR 60,000 in a calendar year; below that, a voluntary registration is possible.

Profit tax base: accounting profit adjusted for non-deductible expenses, tax-exempt income, and tax reliefs; losses may be carried forward for five years.

Transfer pricing: related-party transactions must be at arm's length; documentation is required for taxpayers above the statutory thresholds, with a master file and local file.

Withholding tax on dividends, interest and royalties paid to non-residents is generally 15%, reduced under double tax treaties; EU parent-subsidiary directive may exempt dividends.

Tax audit (nadzor): the Tax Administration may reassess within the statute of limitations; taxpayers have the right to appeal to the independent second-instance body and to the Administrative Court.

Fiscalisation: invoices must be issued through the fiscalisation system with a certified electronic device or software solution; non-compliance triggers penalties.

Croatian Companies Act (Zakon o trgovačkim društvima): limited liability company (d.o.o.) minimum share capital EUR 2,500; joint-stock company (d.d.) minimum share capital EUR 25,000.

Management board (uprava) in a d.o.o. represents the company; supervisory board (nadzorni odbor) is mandatory above statutory thresholds (e.g., 200 employees, or listed status).

Shareholders' assembly decisions: ordinary majority unless the Act or articles require a qualified majority (e.g., amendments to the articles, capital changes).

Directors' duties: duty of care and duty of loyalty; business judgment rule protects informed, disinterested decisions taken in good faith.

Auditor appointment: the general meeting appoints the statutory auditor; the auditor must be independent and registered with the Croatian Audit Public Oversight Committee.

Corporate governance code (Hrvatska: Kodeks korporativnog upravljanja) applies on a comply-or-explain basis to listed companies on the Zagreb Stock Exchange.

Bankruptcy (stečaj): opened when the debtor is insolvent or over-indebted; management must file within 21 days of the occurrence of the grounds.

Related-party transactions: disclosure and, where material, approval by the supervisory board or general meeting is required to protect minority shareholders.

Contribution margin = sales − variable costs; contribution margin ratio = contribution margin / sales; break-even point (units) = fixed costs / contribution per unit.

Relevant costing: include only future, incremental cash flows; exclude sunk costs and allocated fixed costs that do not change with the decision.

Capital budgeting: NPV = Σ CFt / (1 + r)^t − initial investment; accept if NPV > 0; IRR is the rate at which NPV = 0.

WACC = (E/V) × Ke + (D/V) × Kd × (1 − tax rate); CAPM: Ke = Rf + β × (Rm − Rf).

Financial ratios: current ratio = current assets / current liabilities; quick ratio excludes inventory; debt-to-equity = total debt / total equity.

DuPont decomposition: ROE = net profit margin × asset turnover × equity multiplier; separates profitability, efficiency and leverage.

Variance analysis: price variance = (standard price − actual price) × actual quantity; quantity variance = (standard quantity − actual quantity) × standard price.

Cash flow statement (indirect method): start from net profit, add back non-cash items (depreciation, provisions), adjust for working capital changes and investing/financing flows.

CAAT (computer-assisted audit techniques): test data, parallel simulation, embedded audit modules, and data extraction and analysis tools (e.g., IDEA, ACL).

Audit data analytics: population-level testing, full-population reconciliation, journal entry testing, Benford's law analysis, and duplicate payment detection.

IT general controls (ITGC): access management, change management, IT operations, backup and recovery, and program development controls.

Application controls: input (validation, edit checks), processing (batch totals, run-to-run controls), and output (distribution, reconciliation) controls.

ISAE 3402 / SOC 1 reports: service organisation controls relevant to financial reporting; type 1 covers design at a point in time, type 2 covers operating effectiveness over a period.

Data integrity risks: incomplete extraction, truncated fields, duplicate records, and time-zone or currency mismatches; reconcile record counts and control totals before analysis.

Cybersecurity and GDPR: personal data processing requires a lawful basis; audit access to personal data must respect confidentiality and data minimisation.

Continuous auditing and remote access: secure VPN, logging, and evidence of the source system's reliability; document the extraction parameters and the completeness check.