Audit and Assurance
This domain tests the purpose, process and reporting of external assurance, mainly statutory audit.
What assurance is
An assurance engagement involves three parties (practitioner, responsible party, intended users), a subject matter, suitable criteria, sufficient evidence and a written conclusion. Statutory audit gives reasonable (not absolute) assurance that financial statements are free from material misstatement, giving a 'true and fair' opinion under the Companies Act 2006 and ISA (UK) 700. Limited assurance (e.g. review) gives a negative conclusion. The expectation gap arises because users believe an audit guarantees accuracy or detects all fraud; it does not - auditors plan to detect material misstatements, including fraud, with professional scepticism.
Risk and materiality
Audit risk = inherent risk × control risk × detection risk. ISA (UK) 315 requires understanding the entity, its environment and internal control, then identifying significant risks. Materiality (ISA (UK) 320) is the amount that could influence users' decisions; common benchmarks are 5% of profit before tax or 1% of revenue. Performance materiality is set lower to give a margin for undetected misstatements.
Evidence and reporting
ISA (UK) 500 requires sufficient appropriate evidence - sufficient (quantity) and appropriate (relevance and reliability). External evidence is more reliable than internal; auditor-generated more than client-generated. The auditor evaluates misstatements, obtains written representations, and reports by exception on other matters.
Worked example
A retailer has revenue £20m, profit before tax £1m, inventory £3m. Benchmark 5% PBT gives materiality £50,000; performance materiality at 75% = £37,500. Inventory is a significant risk due to obsolescence and counting. Detection risk must be low: attend the year-end count, test valuation to net realisable value, and review post-year-end sales. If a £40,000 overstatement is found, it exceeds performance materiality but is below overall materiality; accumulate it and assess with other misstatements.
Traps
Do not say auditors 'guarantee' accounts; do not confuse materiality with performance materiality; do not treat detection risk as controllable by the client; do not forget that the auditor's report is addressed to shareholders, not directors.