Audit and Assurance
Audit and Assurance tests risk-based auditing under ISAs: how the auditor assesses risk, designs procedures, gathers sufficient appropriate evidence and reports. Expect scenario questions where you must spot the risk, name the assertion and select a response.
Core rules
- Audit risk model: audit risk = inherent risk × control risk × detection risk. Detection risk is the auditor's lever; it moves inversely with the extent of substantive work.
- ISA 315: understand the entity, its environment and its internal control, including IT risks, before assessing risk.
- ISA 330: design responses that address the assessed risk at assertion level, using tests of controls and substantive procedures.
- Evidence: external evidence beats internal; documentary beats oral; original beats a copy. Inquiry alone is never sufficient.
- ISA 570: evaluate going concern for at least twelve months from the reporting date and challenge management's cash-flow assumptions.
- Reporting: ISA 700 unmodified opinion, ISA 705 modifications, ISA 701 key audit matters for listed entities.
Worked example
Profit before tax is 480,000,000 KZT. Applying a 5% benchmark gives overall materiality of 24,000,000 KZT. Performance materiality at 75% is 18,000,000 KZT, and the clearly trivial threshold at 5% of overall materiality is 1,200,000 KZT. The reasoning matters more than the numbers: a profit benchmark suits users focused on earnings, but where profit is volatile, revenue at 0.5–1% or total assets at 1–2% is more stable. Materiality is a judgement, not a fixed formula.
Traps
- Confusing detection risk with inherent risk; only detection risk is managed by the auditor.
- Treating a key audit matter as a modification of the opinion.
- Relying on a management representation where corroborating evidence is available.
- Missing the going-concern implication of a covenant breach disclosed late.