CA Inter Auditing and Ethics cheat sheet

An audit is an independent examination of financial information to express an opinion on whether it is prepared, in all material respects, in accordance with the applicable financial reporting framework.

SA 200 requires the auditor to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to report in accordance with the SAs.

Reasonable assurance is high-level assurance, not absolute, because of inherent limitations such as audit sampling, management estimates, judgment, and the possibility of collusion or concealment.

Management is responsible for preparing financial statements, maintaining internal control, and providing the auditor with all relevant information and access; the auditor is responsible for the opinion.

The scope of an audit is determined by the engagement terms, applicable law or regulation, and the SAs; it covers the financial statements and related disclosures for the period.

Professional skepticism means maintaining a questioning mind, being alert to contradictory evidence, and critically assessing evidence rather than assuming management is dishonest.

A scope limitation may lead to a qualified opinion or disclaimer depending on materiality and pervasiveness; a material misstatement may lead to a qualified or adverse opinion.

The auditor does not guarantee that all fraud or error will be detected, and an audit is not a substitute for management's responsibility for preventing and detecting fraud.

Assurance engagements include statutory audits and reviews; non-assurance engagements include agreed-upon procedures and compilation, which provide no audit opinion.

SA 300 requires the auditor to establish an overall audit strategy that sets the scope, timing, and direction of the audit, and to develop an audit plan.

Audit strategy considers the entity and its industry, reporting framework, locations and components, staffing and resources, materiality, timing, and communication with those charged with governance.

The audit plan describes the nature, timing, and extent of risk assessment procedures and further audit procedures at the assertion level.

Planning is iterative; the auditor updates the strategy and plan as the audit progresses and conditions change, documenting significant changes and reasons.

SA 320 requires determining overall materiality, performance materiality, and specific materiality for particular classes of transactions where needed; materiality is revised as the audit progresses.

An audit programme is a detailed list of audit procedures, often with responsibility and timing; it is tailored and flexible, not a rigid substitute for professional judgment.

Direction, supervision, and review of team members vary with complexity, risk, and competence; review ensures work meets quality standards.

The auditor considers using experts, component auditors, and IT specialists at the planning stage; time budget and resources are allocated consistent with risk.

Documentation of strategy, plan, materiality, and significant changes supports compliance with SA 300 and SA 230.

SA 315 requires risk assessment procedures including inquiries of management and others, analytical procedures, and observation or inspection; these alone do not provide sufficient appropriate audit evidence.

The auditor identifies and assesses risks of material misstatement at the financial statement and assertion levels by understanding the entity, its environment, and its internal control.

Internal control has five components: control environment, risk assessment process, information system and communication, control activities, and monitoring of controls.

A significant risk is an identified risk of material misstatement that requires special audit consideration; assessment considers likelihood, magnitude, and inherent risk factors.

Tests of controls evaluate operating effectiveness; if controls are not tested or not effective, the auditor designs substantive procedures responsive to assessed risks.

Audit risk model: audit risk = inherent risk x control risk x detection risk; detection risk is reduced by more effective or extensive audit procedures.

Deficiencies in internal control are communicated to management and, if significant, to those charged with governance in writing.

The auditor documents the understanding of controls, assessment of risks, and responses; reliance on prior-year controls must be updated.

Walk-through, inquiry, observation, and inspection help confirm understanding but do not by themselves prove operating effectiveness.

SA 500 requires sufficient appropriate audit evidence; sufficiency is the quantity of evidence, while appropriateness is its relevance and reliability.

Reliability is generally higher for external evidence, original documents, auditor-obtained evidence, and documentary evidence, but context and source matter.

Audit procedures include inspection, observation, inquiry, confirmation, recalculation, re-performance, and analytical procedures.

SA 505 confirmations: positive requests ask for a direct reply; negative requests ask for a reply only if the confirming party disagrees; non-responses and exceptions require follow-up.

SA 520 analytical procedures: develop an expectation, set a threshold, investigate significant differences, and corroborate management explanations.

SA 530 sampling: consider risk, population, and stratification; project misstatements and evaluate whether the sample supports the conclusion.

SA 540 estimates: understand the method and assumptions, test data, review subsequent events, and evaluate management bias.

SA 570 going concern, SA 550 related parties, SA 560 subsequent events, and SA 580 written representations are specific evidence areas.

SA 501 covers inventory attendance, litigation and claims, and segment information evidence.

Revenue: test occurrence, completeness, cut-off, and accuracy; examine contracts, shipping documents, returns, discounts, and GST records.

Trade receivables: confirm balances, review aging, test subsequent receipts, and assess allowance for expected credit losses or provisions.

Inventory: attend physical count, test existence and condition, compare cost with net realizable value, and assess obsolescence.

Property, plant and equipment: verify existence and ownership, test additions and disposals, depreciation, revaluation, impairment, and capital work in progress.

Investments: verify existence and ownership, classification and valuation, investment income, and related-party disclosures.

Borrowings and finance costs: test completeness, classification, interest accrual, covenants, security, and disclosure.

Payables and expenses: test completeness and cut-off using search for unrecorded liabilities, accruals, and subsequent payments.

Cash and bank: obtain bank confirmations, test reconciliations, cut-off, restrictions, and unreconciled items.

Provisions and contingencies: assess recognition, measurement, legal confirmations, and disclosure; equity: share capital, reserves, dividends, and compliance.

SA 230 requires audit documentation sufficient to enable an experienced auditor with no previous connection to understand the work performed, results, and significant matters.

Documentation includes identifying characteristics of items tested, who performed the work and when, who reviewed it, and the review date.

Significant judgments, conclusions, and departures from SAs, with reasons, are documented.

Audit file assembly after the report date is completed on a timely basis; SA 230 indicates normally within 60 days of the report date.

After final assembly, changes require documentation of the reasons, who made them, and when; original evidence is not deleted.

Working papers are the property of the auditor, confidential, and retained per law and firm policy; ICAI guidance commonly refers to seven years.

The permanent file holds continuing information; the current file holds current-year working papers and evidence.

Electronic documentation needs access controls, backups, and confidentiality safeguards.

SA 560: subsequent events that adjust conditions existing at year-end require adjustment; non-adjusting events require disclosure; the auditor is active through the report date.

SA 570: assess the appropriateness of going concern, evaluate management plans, and consider material uncertainty disclosures; a disclaimer is required if the going concern basis is inappropriate.

SA 580: obtain written representations near the report date on responsibilities, completeness, fraud, and related parties; they do not substitute for other evidence.

SA 450: accumulate misstatements, evaluate their aggregate effect, communicate to management and those charged with governance, and request correction.

SA 220: engagement quality control review is required for listed entity audits and other appropriate engagements before report issuance.

Completion procedures include review of financial statements and report, consistency checks, final materiality evaluation, and conclusion that evidence is sufficient.

SA 260 communicates significant matters with those charged with governance; SA 265 communicates significant deficiencies in internal control.

The auditor evaluates uncorrected misstatements and considers whether they are material individually or in aggregate.

SA 700 report includes title, addressee, opinion, basis for opinion, responsibilities, auditor signature, date, place, and applicable framework.

An unmodified opinion states that the financial statements present fairly, in all material respects, in accordance with the applicable financial reporting framework.

A qualified opinion is issued when a misstatement or scope limitation is material but not pervasive, using except for wording.

An adverse opinion is issued for a material and pervasive misstatement; a disclaimer is issued for a material and pervasive inability to obtain evidence.

SA 701 key audit matters are required for listed entities and when law or regulation requires; key audit matters are not a substitute for a modified opinion or emphasis of matter.

SA 706 emphasis of matter draws attention to a matter appropriately presented or disclosed that is fundamental to users; other matter refers to matters not presented in the financial statements.

SA 570 material uncertainty related to going concern is presented in a separate section; a disclaimer is required if the going concern basis is inappropriate.

The report date must not be earlier than the date sufficient evidence is obtained and the financial statements are approved; the auditor signs and dates the report.

SA 710 comparatives and SA 720 other information require specific procedures and reporting.

Cooperative societies: audit is under cooperative law; auditor eligibility, appointment, powers, and report are governed by state or multi-state law.

Trusts and NGOs: audit focuses on restricted and unrestricted funds, donations, application of income, and compliance with the trust deed and tax or FCRA rules.

Foreign contribution audits check FCRA registration, designated bank account, purpose restrictions, and separate books.

Government and PSU audit: CAG mandate under the DPC Act; includes regularity, propriety, performance, and compliance audits.

Partnership and LLP: verify the partnership deed or LLP agreement, capital accounts, profit-sharing, drawings, and compliance with applicable audit thresholds.

Sole proprietorship: no general statutory audit unless tax, GST, or specific law requires; focus on capital, drawings, and revenue recognition.

Clubs, hospitals, and educational institutions: consider special laws, fund accounting, grants, and member or regulator reporting.

Branch audits require consideration of local law, component reporting, and group audit instructions.

Banking Regulation Act 1949 section 30 requires annual audit of banking company accounts; auditor appointment and conduct are subject to RBI and statutory requirements.

Advances are classified as standard, substandard, doubtful, and loss; NPA norms generally use the 90-day overdue criterion, subject to RBI directions.

Income on NPAs is recognized on a realization basis; provisions depend on classification, security, and RBI provisioning norms.

LFAR is a long-form audit report covering advances, deposits, investments, reconciliation, internal controls, and other RBI-specified areas.

Deposits: test completeness, KYC and AML compliance, interest accrual, unclaimed deposits, and reconciliation with ledgers.

Investments: check classification as HTM, HFT, or AFS, valuation, mark-to-market, SLR and CRR compliance, and income recognition.

Cash and balances with RBI: verify physical cash, currency chest, reconciliations, and insurance or security arrangements.

Off-balance-sheet items: guarantees, letters of credit, derivatives, and contingent liabilities need completeness and disclosure testing.

Use of concurrent audit, inspection reports, and RBI returns supports risk assessment; fraud risk and cyber controls are key.

Fundamental ethical principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behavior.

Independence has two dimensions: independence of mind and independence in appearance; both are required for audit engagements.

Threats include self-interest, self-review, advocacy, familiarity, and intimidation; identify, evaluate, and address them with safeguards or decline the engagement.

Contingent fees for audit engagements are prohibited because they create self-interest and advocacy threats.

SA 210 engagement letter covers scope, responsibilities of management and auditor, framework, expected form of report, and access to information.

Predecessor auditor communication is required before accepting a new audit engagement, with client consent, to identify issues.

Companies Act rotation: listed companies and prescribed classes have auditor rotation and cooling-off periods; partner rotation also applies.

Non-audit services that involve management functions or create self-review threats are restricted for audit clients, especially listed entities.

Confidentiality may be breached when required by law, permitted by law, or for quality review or professional proceedings.

x

x

x

x

x

x