Kazakhstan Auditor Attestation cheat sheet

International Standards on Auditing (ISAs) are issued by the IAASB and apply to audits of financial statements; ISAs are principle-based and require auditor judgment in applying them.

ISA 200 sets the overall objective: obtain reasonable assurance that financial statements are free from material misstatement, whether due to fraud or error, and report accordingly.

Materiality (ISA 320): misstatements are material if they could reasonably influence economic decisions of users; performance materiality is set below overall materiality to reduce aggregation risk.

Audit risk model: Audit Risk = Inherent Risk × Control Risk × Detection Risk; detection risk is the only component the auditor controls through the nature, timing and extent of procedures.

Risk assessment (ISA 315) precedes risk response (ISA 330); substantive procedures must always be performed for each material class of transactions, regardless of assessed control risk.

ISA 500 hierarchy of evidence reliability: auditor's direct observation > external evidence > internal evidence with effective controls > internal evidence alone > oral representations.

ISA 700/701: the auditor forms an opinion and, for listed entities, communicates key audit matters; modified opinions are qualified, adverse, or disclaimer (ISA 705).

ISA 560 subsequent events: auditor's responsibility extends to the date of the auditor's report; procedures after that date are limited unless facts become known before issuance.

Documentation (ISA 230): audit file assembled on a timely basis, ordinarily within 60 days of the report date; retention period is typically at least 5 years.

IAS 1 requires fair presentation and going-concern assessment; current/non-current classification applies unless a liquidity presentation is more relevant.

IFRS 15 five-step model: identify contract, identify performance obligations, determine transaction price, allocate price to obligations, recognize revenue when/as obligations are satisfied.

IFRS 16: lessees recognize a right-of-use asset and a lease liability at present value of lease payments; short-term and low-value leases are exempt.

IFRS 9: financial assets classified by business model and contractual cash-flow characteristics (amortized cost, FVOCI, FVTPL); expected credit losses applied forward-looking.

IAS 36 impairment: recoverable amount is the higher of fair value less costs of disposal and value in use; goodwill is tested annually and impairment is not reversed.

IAS 2: inventory measured at the lower of cost and net realizable value; cost includes purchase, conversion, and other costs to bring inventory to its present location and condition.

IAS 37: recognize a provision when a present obligation exists, an outflow is probable, and the amount can be reliably estimated; range of outcomes uses expected value or midpoint.

IFRS 3: goodwill = consideration transferred + non-controlling interest + previously held interest − net identifiable assets acquired; acquisition method required.

The Tax Code of the Republic of Kazakhstan (currently the Code dated 25 December 2017, as amended) governs taxes; the corporate income tax rate is generally 20%.

VAT standard rate is 12%; VAT registration is generally required once turnover exceeds the threshold set in the Tax Code (currently 20,000 MCI).

Personal income tax on employment income is generally 10%; social and pension contributions are withheld by the employer under separate rates.

Value added tax is an indirect tax; taxable turnover includes sales of goods, works and services in Kazakhstan and imports; exports are generally zero-rated with documentary confirmation.

Corporate income tax is computed on taxable income = gross annual income − deductions; tax periods are the calendar year, with advance payments during the year.

Withholding tax applies to income of non-residents from Kazakh sources; rates depend on income type and applicable double-tax treaties.

Tax audits are conducted by state revenue authorities; the Tax Code prescribes the procedure, duration, and appeal routes (higher authority, then court).

MCI (monthly calculation index) is the base for many thresholds, fines, and deductions; it is set annually by the budget law.

Civil Code: a transaction is void if it violates mandatory legal requirements or is made for an unlawful purpose; voidable transactions include those made under duress or mistake.

Contract formation requires offer and acceptance; a written contract is generally mandatory for transactions between legal entities exceeding the statutory threshold.

Business partnerships: a limited liability partnership's participants bear risk of loss only up to their contributions; a joint-stock company's shareholders bear risk up to their shares.

Labor Code: employment contract must be in writing; probationary period generally may not exceed 3 months (6 months for certain categories).

Working time norm under the Labor Code is generally 40 hours per week; overtime requires employee consent and is compensated at increased rates.

Termination grounds include agreement of parties, expiry of term, employee initiative (with notice periods), and employer initiative on enumerated grounds.

Limitation period under the Civil Code is generally 3 years from the day the person learned or should have learned of the violation of right.

Legal entities acquire rights and obligations through their bodies; the executive body acts without a power of attorney on behalf of the entity.

Accounting equation: Assets = Liabilities + Equity; double-entry bookkeeping records each transaction with equal debits and credits.

Current ratio = current assets / current liabilities; quick ratio = (current assets − inventories) / current liabilities.

Profitability: return on equity = net income / average equity; return on assets = net income / average total assets.

Leverage: debt-to-equity = total liabilities / total equity; interest coverage = EBIT / interest expense.

Working capital = current assets − current liabilities; a negative value signals potential liquidity pressure.

Cash conversion cycle = days inventory outstanding + days sales outstanding − days payables outstanding.

Revenue recognition in accounting follows the accrual basis; matching principle aligns expenses with related revenues in the same period.

Horizontal analysis compares line items across periods; vertical analysis expresses items as a percentage of a base figure (e.g., total assets).

IESBA Code: five fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behavior.

Threats to independence: self-interest, self-review, advocacy, familiarity, intimidation; safeguards must be applied or the engagement declined.

ISQM 1 requires a firm-level system of quality management addressing engagement performance, resources, governance, and monitoring.

ISQM 2 governs engagement quality reviews for listed entities and other engagements where required.

ISA 220 (Revised) assigns engagement partner responsibility for quality on each audit, including direction, supervision, and review.

Fees: a contingent fee for an audit engagement creates a self-interest threat and is generally prohibited; overdue fees may create a self-interest threat.

Rotation: engagement partner rotation is required for listed entities (typically every 5–7 years per applicable rules).

Confidentiality continues after the engagement ends; disclosure is permitted only with consent or where legally required.

CAATs (computer-assisted audit techniques) include data extraction, analytical testing, and sampling tools applied to client data.

Audit data analytics: full-population testing reduces sampling risk and can identify anomalies, duplicates, and outliers.

Automated controls (e.g., program change controls, access controls) are tested using re-performance, observation, and inspection of logs.

IT general controls (ITGCs) cover access management, program changes, IT operations, and backup/recovery; they underpin reliance on automated application controls.

Benford's law analysis is used to detect anomalous digit distributions in large numeric data sets.

Audit trail and log integrity: auditor should verify completeness and timeliness of system logs where the client relies on them.

Data security: auditor must protect client data collected during analytics and comply with confidentiality and data-protection requirements.

Robotic process automation and continuous auditing enable near-real-time monitoring; auditors should assess the design and operating effectiveness of such tools.

The Law of the Republic of Kazakhstan 'On Auditing Activity' (current version) governs audit activity, auditor certification, and audit organizations.

Audit activity is licensed/regulated by the authorized body; audit organizations must be members of a professional audit organization (self-regulatory body).

Auditors must hold a qualification certificate; certification requires passing a qualification examination and meeting experience requirements.

Audit organizations must comply with independence and quality-control requirements; the authorized body conducts external quality reviews.

Mandatory audit applies to specified entities (e.g., certain financial organizations, joint-stock companies, and entities above statutory thresholds).

Audit reports on mandatory audits are subject to publication requirements in cases specified by law.

The authorized body maintains registers of auditors and audit organizations; inclusion in the register is required to conduct audit activity.

Violations of audit legislation may result in administrative liability, suspension, or revocation of the license/certificate.