Auditing and Assurance: Risk, Evidence and Opinions
Audit questions follow the logical flow of the engagement: acceptance and engagement (client integrity, independence, engagement letter), planning (understanding the entity, materiality, risk assessment), evidence gathering, evaluation of misstatements, and reporting. Understand the audit risk model: audit risk = inherent risk × control risk × detection risk. Detection risk is the auditor's lever - it falls as substantive testing increases.
Evidence must be sufficient and appropriate; appropriateness concerns relevance and reliability. External evidence is generally more reliable than internal, and auditor-generated evidence more reliable than client-generated. Know the assertions (existence, rights and obligations, completeness, valuation, cut-off, classification) and match procedures to them - for example, confirmations address existence, while cut-off testing addresses period allocation.
A common trap is confusing internal control deficiencies with material weaknesses, or assuming the auditor tests every transaction. Auditors give reasonable, not absolute, assurance due to sampling, judgement, and the inherent limitations of controls including collusion and management override. Another trap is the opinion type: unmodified, qualified (material but not pervasive), adverse (material and pervasive), or disclaimer (inability to obtain evidence, material and pervasive).
Worked rule of thumb: If a misstatement is material but confined to one area, qualify; if it pervades the financial statements as a whole, go adverse (misstatement) or disclaim (scope limitation). Always state the effect on the opinion and the paragraph placement.