CA Final Paper 3: Advanced Auditing cheat sheet

Materiality (SA 320): overall materiality = benchmark × % (e.g., 5% PBT, 0.5–1% revenue, 1–2% total assets); performance materiality = 50–75% of overall; clearly trivial threshold typically 3–5% of overall materiality.

Audit risk model: AR = IR × CR × DR; DR is the auditor's lever, inversely related to acceptable detection risk and directly driving extent of substantive procedures.

Risk assessment procedures (SA 315): inquiry of management/others, analytical procedures, and observation/inspection; required regardless of assessed risk.

Significant risk = risk of material misstatement requiring special audit consideration; factors include fraud risk, related-party transactions, complex/related estimates, and significant unusual transactions.

SA 300: planning is continuous; must establish overall audit strategy (scope, timing, direction) before developing the detailed audit plan.

Group audits (SA 600): component materiality is set lower than group materiality; component auditor thresholds and scope are documented in the group audit plan.

Fraud risk (SA 240): rebuttable presumption of revenue recognition fraud risk; management override is a mandatory significant risk.

Going concern (SA 570): evaluate management's assessment for at least 12 months from the date of financial statements; assess adequacy of disclosures if material uncertainty exists.

Sufficiency relates to quantity; appropriateness relates to relevance and reliability; both are influenced by risk of material misstatement and quality of evidence.

Reliability hierarchy (SA 500): external > internal; original > copy; auditor-obtained > client-provided; documentary > oral; observation limited to point in time.

SA 505 external confirmations: positive confirmation requests are required where risk is high; non-responses require alternative procedures, not automatic acceptance.

SA 501: inventory physical count attendance is mandatory where inventory is material; if attendance impracticable, alternative procedures and modified opinion consideration.

SA 510: opening balances-review predecessor auditor's workpapers where permitted; if unable to obtain sufficient evidence, consider qualified opinion or disclaimer on opening balances.

SA 540 accounting estimates: evaluate methods, assumptions, data, and management bias; perform one or more of review of subsequent events, test of management's process, or independent estimate.

SA 550 related parties: obtain understanding of relationships; inspect board minutes and confirmations; identify transactions outside normal course of business.

Written representations (SA 580) are not a substitute for other evidence; date them as near as practicable to, and not after, the auditor's report date.

SA 230: audit documentation must be sufficient for an experienced auditor with no previous connection to the audit to understand the work performed, evidence obtained, and conclusions reached.

Documentation retention: not less than 7 years from the date of the auditor's report (or, if none, from the date the engagement ceased).

Significant matters file: record discussions of significant matters with management, TCWG, and others, including dates and participants.

SA 240 documentation: fraud risk assessment, procedures performed, and communications to management/TCWG must be documented.

SA 450: accumulate misstatements other than clearly trivial; communicate uncorrected misstatements to TCWG with individual and aggregate effect.

Analytical procedures (SA 520): required in risk assessment and final review; investigate fluctuations above defined threshold and document explanations.

SA 530 sampling: project misstatements from sample to population; if projected misstatement exceeds tolerable misstatement, reassess sampling risk and consider additional procedures.

Documentation of consultations: record the matter, persons consulted, conclusions reached, and how conclusions were implemented.

SA 700/701: unmodified opinion with KAM section required for listed entities; KAM selected from matters communicated to TCWG and significant to the audit.

SA 705 modifications: qualified opinion (material but not pervasive), adverse opinion (material and pervasive due to misstatement), disclaimer (material and pervasive due to inability to obtain evidence).

SA 706 emphasis of matter (EOM) and other matter (OM) paragraphs do not modify the opinion; EOM is used when a matter is appropriately presented/disclosed and fundamental to users' understanding.

SA 560 subsequent events: perform procedures up to the date of the auditor's report; no obligation to perform procedures after that date unless facts become known.

SA 570 going concern: if material uncertainty disclosed adequately, include a separate section under the going concern heading; if not disclosed, modify opinion.

SA 260: communicate with TCWG the auditor's responsibilities, planned scope and timing, significant findings, and written representations requested.

SA 265: communicate significant deficiencies in internal control in writing to TCWG on a timely basis; non-significant deficiencies may be communicated orally.

Key audit matters are not required for audits of entities other than listed entities, but may be included voluntarily.

SAE 3400: engagements to examine prospective financial information; report on whether assumptions provide a reasonable basis and whether the information is properly prepared.

SAE 3402: assurance reports on controls at a service organisation; Type 1 covers suitability of design, Type 2 covers design and operating effectiveness.

SRS 4400: agreed-upon procedures engagement; report states factual findings and expressly disclaims an opinion or assurance conclusion.

SRS 4410: compilation engagements; no assurance is expressed; report indicates no audit or review was performed.

SRE 2400: review of historical financial statements; limited assurance (negative assurance) based primarily on inquiry and analytical procedures.

SA 800: special purpose frameworks-report includes an emphasis of matter paragraph describing the special purpose framework.

SA 805: single financial statements or specific elements/accounts; materiality is determined for the specific element rather than the whole financial statements.

SA 810: engagements to report on summarized financial statements; report states whether the summary is consistent with the complete financial statements.

Section 139: auditor appointed for 5 years (first auditor by Board within 30 days, else by members in EGM within 90 days); ratification at each AGM is no longer required after the 2017 amendment.

Section 141(3): disqualifications include indebtedness exceeding ₹5 lakh, business relationship, relative holding securities exceeding ₹1 lakh face value, and full-time employment elsewhere.

Section 143(3): auditor's report must state whether proper books of account are kept, whether branch returns are adequate, and whether loans/deposits are within limits.

Section 143(12): fraud reporting-auditor must report to the Board/audit committee within 2 days; if no action within 45 days, report to the Central Government (via Secretary, MCA) within 15 days thereafter.

Section 144: prohibited non-audit services include accounting and bookkeeping, internal audit, design of financial information systems, actuarial services, investment advice, and management services.

Section 148: cost audit applies to specified classes of companies; auditor appointed by the Board with prior approval of members by ordinary resolution.

Section 139(8): casual vacancy-filled by Board within 30 days if due to resignation (and approved by members within 3 months); otherwise by members within 90 days.

Section 146: auditor has right to attend general meetings and be heard on matters concerning the accounts.

Fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Independence: conceptual framework-identify threats (self-interest, self-review, advocacy, familiarity, intimidation), evaluate, and apply safeguards or decline the engagement.

Section 141(3)(e) Companies Act: auditor disqualified if a relative is a director or key managerial personnel; Section 141(3)(d) disqualifies indebtedness over ₹5 lakh.

Fee dependence: if fees from one client exceed 15% of total gross fees for two consecutive years, disclose and consider safeguards (ICAI Council Guidelines).

Rotation: listed companies and prescribed classes-individual auditor 5 years, audit firm 10 years (Section 139(2)); cooling-off period of 5 years.

Confidentiality: information acquired during engagement may not be disclosed without authority unless required by law or professional duty.

Advertising: solicitation of clients is prohibited; responding to tenders and inclusion in directories is permitted subject to ICAI guidelines.

Communication with predecessor auditor: required before accepting a new engagement; obtain permission from client to review predecessor's workpapers.

SQC 1: firm must establish quality control policies for leadership responsibilities, ethical requirements, acceptance and continuance, human resources, engagement performance, and monitoring.

Engagement quality control (EQC) review: required for audits of listed entities and those where the firm determines it is needed; reviewer must be independent of the engagement team.

Peer review: mandatory for firms with audit assignments; cycle generally 3 years; review report issued by an independent reviewer registered with ICAI.

Documentation of quality control: retain records of acceptance/continuance decisions, EQC reviews, and monitoring results.

Leadership responsibility: firm's CEO or managing partner must assume ultimate responsibility for the quality control system.

Monitoring: ongoing consideration and evaluation of the system, including periodic inspection of completed engagements.

Consultation: firm must establish protocols for consultation on difficult or contentious matters and document the conclusions.

Bank audit: statutory auditors appointed by members; RBI guidelines require concurrent audit for large branches and quarterly review; LFAR (Long Form Audit Report) mandated for bank branches.

NBFC audit: statutory audit under Companies Act; additional reporting under RBI Master Directions; registration with RBI required; systemically important NBFCs (asset size ≥ ₹500 crore) have enhanced governance.

Insurance audit: IRDAI regulations require statutory auditors to be appointed with prior approval of IRDAI; audit committee oversight; solvency margin reporting.

Provisioning norms: banks follow RBI IRAC norms (standard, sub-standard, doubtful, loss assets) for NPA classification and provisioning.

Co-operative societies: audit by statutory auditor; multi-state co-operative societies under MSCS Act; concurrent audit for urban co-operative banks.

Regulatory reporting: banks must report CRAR, NPA ratios, and liquidity ratios; auditors verify compliance with RBI prudential norms.

Insurance: auditors report on solvency margin, actuarial valuation of liabilities, and compliance with IRDAI investment regulations.

Internal audit (IA) objective: provide independent assurance on risk management, control, and governance; IA reports functionally to the audit committee.

IIA Standards: IA must be independent and objective; chief audit executive reports to the audit committee; quality assurance and improvement program (QAIP) required.

Risk-based internal audit: plan based on risk assessment; prioritize high-risk areas; allocate resources accordingly.

Internal financial controls (IFC): Section 143(3)(i) requires auditor to report on adequacy and operating effectiveness of IFC for companies; guidance note issued by ICAI.

Audit committee: composition-at least 3 directors, majority independent; chairperson independent; oversees financial reporting, internal audit, and auditor independence.

Enterprise risk management (ERM): framework (COSO) includes governance, risk appetite, risk assessment, risk response, and monitoring.

Corporate governance: SEBI LODR requires quarterly compliance reports, independent directors, and whistle-blower policy.

Internal audit reporting: report to audit committee; follow-up on management actions; track closure of observations.

CAAT (Computer-Assisted Audit Techniques): used for testing controls, substantive testing, and analytical procedures; examples include ACL, IDEA, and SQL queries.

Data analytics: use of data extraction, transformation, and analysis to identify anomalies, patterns, and exceptions; can provide full population testing.

Audit trail: Companies (Accounts) Rules require audit trail in accounting software from FY 2023-24; auditors must report on the audit trail feature.

Cybersecurity: auditors assess information security controls, access management, and incident response; SA 315 requires understanding of IT environment.

Blockchain: audit considerations include existence, ownership, and valuation of digital assets; smart contract risks.

RPA (Robotic Process Automation): used in audit for repetitive tasks; auditor must assess the reliability of automated tools.

Cloud computing: auditor evaluates service organisation controls (SAE 3402) and data privacy compliance.

Artificial intelligence: audit of AI models includes data quality, model risk, and algorithmic bias; assurance on AI governance.