Auditing Standards and Methodology
The framework
Kazakhstan audit practice is anchored in the Law "On Audit Activity" and in the International Standards on Auditing (ISA) adopted for use in the Republic. Candidates must know the ISA structure: quality management and engagement-level standards, risk assessment (ISA 315), audit evidence (ISA 500), and reporting (ISA 700 series). A recurring theme is the audit risk model: inherent risk × control risk × detection risk = audit risk. Detection risk is the only component the auditor controls, through the nature, timing and extent of procedures.
Concepts you must hold
Understand materiality (overall, performance, and clearly trivial thresholds), the risk-based approach, professional scepticism, and the distinction between reasonable and limited assurance. Know the difference between tests of controls and substantive procedures, and between analytical and detailed substantive testing. Sampling methodology (ISA 530) and the treatment of misstatements (ISA 450) appear regularly.
Traps in questions
- Confusing inherent risk (susceptibility before controls) with control risk (risk controls fail to prevent/detect).
- Assuming more substantive testing reduces inherent risk - it only reduces detection risk.
- Treating an emphasis-of-matter paragraph as a modification of opinion. It is not; only qualified, adverse, or disclaimer opinions are modifications.
- Forgetting that going-concern uncertainty is normally reported via a separate section, not automatically a qualified opinion.
Rule of thumb
If a question asks what the auditor should do when risk of material misstatement rises and controls are weak, the answer is almost always: increase the extent of substantive procedures, shift timing toward period-end, and use more reliable (external, corroborated) evidence - never "reduce the audit scope."