ICAEW Assurance cheat sheet

ISA 200: reasonable assurance is a high but not absolute level of assurance; inherent limitations include sampling risk, estimation uncertainty and management fraud concealment.

Audit risk model: Audit risk = Risk of material misstatement (inherent risk × control risk) × Detection risk; detection risk is the only component the auditor controls directly.

Materiality benchmarks commonly applied: 5%–10% of profit before tax, 0.5%–1% of total revenue, 1%–2% of total assets, or 1%–5% of equity depending on the entity's users.

Performance materiality is set below overall materiality (often 50%–75% of it) to reduce the probability that uncorrected and undetected misstatements exceed materiality.

ISA 315 (Revised 2019) requires identification of risks of material misstatement at the assertion level and assessment of inherent risk on a spectrum using the factors of likelihood and magnitude.

Five management assertion categories for transactions: occurrence, completeness, accuracy, cut-off, classification; for balances: existence, rights and obligations, completeness, valuation and allocation.

ISA 700 series: unmodified opinion states the financial statements give a true and fair view (or present fairly, in all material respects) in accordance with the applicable framework.

Modified opinions under ISA 705: qualified or adverse for material misstatement (pervasive determines which); qualified or disclaimer for inability to obtain sufficient appropriate audit evidence.

Professional scepticism (ISA 200) means questioning contradictory evidence and reliability of documents; it is a mindset, not a separate procedure.

ISA 500: audit evidence must be sufficient (quantity) and appropriate (relevance and reliability); externally sourced evidence obtained directly by the auditor is more reliable than internal evidence.

Audit procedures per ISA 500: inspection, observation, external confirmation, recalculation, re-performance, analytical procedures and inquiry; inquiry alone is never sufficient.

ISA 530 sampling: sampling risk is the risk the auditor's conclusion based on a sample differs from the conclusion from the whole population; non-sampling risk arises from human error or inappropriate procedures.

For tests of controls, tolerable deviation rate sets sample size; for substantive tests, tolerable misstatement and expected misstatement drive sample size.

ISA 520 analytical procedures: required at planning (risk assessment) and at the overall review stage; substantive analytical procedures require a sufficiently precise expectation and a threshold for investigating differences.

ISA 505 external confirmations: positive confirmations request a reply in all cases; negative confirmations are only appropriate when risk is low and a large number of small balances is involved.

ISA 240: presumed fraud risk in revenue recognition must be rebutted with documented rationale if the auditor concludes it is not a risk; management override of controls is always a risk.

ISA 550 related parties: the auditor must identify related party relationships and transactions, inspect underlying contracts, and remain alert to transactions outside the normal course of business.

ISA 570 going concern: if material uncertainty exists that is adequately disclosed, the auditor gives an unmodified opinion with a separate Material Uncertainty Related to Going Concern section.