Norwegian Auditor Practical Exam (Statsautorisert revisor) cheat sheet

ISA 315 requires identifying and assessing risks of material misstatement at both financial statement and assertion level; significant risks are those close to the upper end of the spectrum and require substantive procedures regardless of controls.

Materiality: overall materiality is often set at 0.5%-1% of profit before tax, 1%-2% of total assets, or 0.5%-1% of revenue; performance materiality is typically 50%-75% of overall materiality depending on assessed risk and history of misstatements.

ISA 500 evidence must be sufficient (quantity) and appropriate (relevance and reliability); external documentary evidence from independent third parties is more reliable than internal evidence, and original documents beat copies.

ISA 700/701: the audit report states an opinion in the first section, a Basis for Opinion, and Key Audit Matters for listed entities; the opinion is modified (qualified, adverse, disclaimer) only when the matter is material and, for qualification, not pervasive.

ISA 560 subsequent events: the auditor has an active duty to perform procedures up to the date of the audit report; after that date, no duty to perform inquiry unless facts become known, then discuss with management and consider reissuing.

ISA 570 going concern: evaluate management's assessment covering at least 12 months from the reporting date; a material uncertainty that is adequately disclosed leads to an Emphasis of Matter/separate section, not a modified opinion.

ISA 240 fraud: presume a risk of fraud in revenue recognition and obtain corroborating evidence for management representations; journal entry testing and review of accounting estimates for bias are mandatory procedures.

ISA 450 accumulates uncorrected misstatements; communicate all misstatements to management and request correction, and communicate material uncorrected misstatements to those charged with governance.

ISA 600 group audits: the group engagement partner is responsible for the direction, supervision and review of component auditors' work and must be satisfied the group audit opinion is supported.

IFRS 15 five-step model: identify the contract, identify performance obligations, determine the transaction price, allocate the price to obligations, and recognise revenue when (or as) each obligation is satisfied.

IFRS 16: lessees recognise a right-of-use asset and a lease liability at the present value of lease payments; short-term leases (12 months or less) and low-value assets may be expensed.

IFRS 9 expected credit loss model: loss allowance equals the 12-month ECL unless credit risk has increased significantly, then lifetime ECL applies; simplified approach uses lifetime ECL for trade receivables.

IFRS 3: acquisition method, goodwill measured as consideration transferred plus non-controlling interest plus fair value of previously held interest, less net identifiable assets acquired.

IAS 36 impairment: recoverable amount is the higher of fair value less costs of disposal and value in use; goodwill is tested annually and an impairment of goodwill is never reversed.

IAS 37: a provision is recognised when there is a present obligation from a past event, a probable outflow, and a reliable estimate; a contingent liability is disclosed unless the outflow is remote.

Norwegian GAAP (regnskapsloven) requires accrual-based recognition with a realisation principle for gains; NRS standards supplement the law, and NRS 8 applies to small entities while IFRS is mandatory for listed entities.

IAS 12: deferred tax is recognised on temporary differences using the expected reversal method at the tax rate expected when the difference reverses; deferred tax assets are recognised only to the extent recovery is probable.

IAS 21 and consolidation: foreign operations are translated using closing rate for assets and liabilities, average rate for income and expenses, with exchange differences recognised in other comprehensive income.

IESBA Code: the five fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Independence comprises independence of mind (state of mind) and independence in appearance (avoiding facts a reasonable third party would perceive as compromising); both must be satisfied.

The conceptual framework: identify threats (self-interest, self-review, advocacy, familiarity, intimidation), evaluate their significance, and address them by eliminating the circumstance, applying safeguards, or declining the engagement.

Prohibited non-assurance services for public interest entities include preparing accounting records and financial statements, internal audit outsourcing, and tax services that create a self-review threat unless clearly immaterial.

Long association: for public interest entities, the engagement partner's seven-year rotation with a two-year cooling-off period applies under the IESBA Code; key audit partners are also subject to rotation.

Fees: a contingent fee for an audit is prohibited; if total fees from one client exceed 15% of the firm's total fees for two consecutive years, a disclosure and safeguards apply for public interest entities.

Norwegian auditor law (revisorloven) requires authorisation by Finanstilsynet, membership in a recognised audit association, and annual continuing education of at least 120 hours over three years.

Statutory audit is a reserved activity: only authorised auditors and registered audit firms may sign audit reports; the auditor is formally appointed by the general meeting and reports to it.

Confidentiality continues after the engagement ends; disclosure is permitted only where required by law, permitted by the client, or where there is a professional duty or right to disclose.

Norwegian Aksjeloven: the board of directors (styret) must have at least one member; public limited companies (ASA) require at least three members, and the general meeting elects the board unless otherwise provided.

The general meeting (generalforsamling) is the supreme authority; it approves the annual accounts, appoints the auditor, and elects the board; the ordinary meeting must be held within six months of the financial year-end.

The board has a duty of care and oversight: it must ensure proper organisation, establish internal control and risk management systems, and monitor the company's financial position.

The CEO (daglig leder) manages day-to-day operations and reports to the board; matters of unusual importance or major significance must be submitted to the board.

Aksjeloven chapter 8 provides that the board must act if equity falls below a sound level; if equity is less than half of share capital, the board must convene a general meeting and propose remedial measures.

The Norwegian Corporate Governance Code (Norsk anbefaling) applies on a comply-or-explain basis to listed companies; it addresses board independence, audit committee composition, and nomination committees.

Audit committee (revisjonsutvalg): required for public interest entities; it must consist of board members, at least one with audit expertise, and it oversees the financial reporting process and the auditor's independence.

Related-party transactions: the board must ensure arm's-length terms; significant transactions with shareholders or directors require disclosure and, where relevant, independent valuation.

The auditor's report is addressed to the general meeting; the auditor has a duty to report to the board on significant findings and to notify the board of any suspicion of criminal offences or irregularities.

Norwegian corporate tax rate is 22% on general income; the audit of tax expense must reconcile current tax, deferred tax and the effective tax rate against the statutory rate.

The exemption method (fritaksmetoden) exempts 97% of dividends and capital gains on qualifying shares for corporate shareholders; the remaining 3% is taxable, affecting deferred tax on share investments.

Tax depreciation follows the tax law's declining-balance schedules (saldogrupper) and may differ from accounting depreciation, creating temporary differences and deferred tax.

Loss carryforwards can be offset against future profits indefinitely; the deferred tax asset recognition requires assessment of probable future taxable profits.

Transfer pricing: Norwegian controlled foreign company and arm's-length rules require documentation for cross-border related-party transactions; the auditor evaluates the reasonableness of intercompany pricing.

Tax provisions and uncertain tax positions are evaluated under IFRIC 23 and IAS 12; the auditor assesses whether the recognition and measurement of tax liabilities are appropriate.

VAT (merverdiavgift): standard rate 25%, reduced rates 15% for food and 12% for certain services; the auditor checks that output VAT is correctly calculated and input VAT is deductible.

Tax reporting to authorities: the annual tax return is filed electronically; the auditor's confirmation of the financial statements supports the taxable income reported and the company's tax position.

The Norwegian Tax Administration (Skatteetaten) may request audit documentation; confidentiality rules and the auditor's duty to report suspected tax evasion must be balanced with professional obligations.

COSO internal control framework: five components are control environment, risk assessment, control activities, information and communication, and monitoring activities; the auditor evaluates design and implementation before testing operating effectiveness.

The audit risk model: audit risk = inherent risk x control risk x detection risk; the auditor sets detection risk inversely to the assessed risks of material misstatement.

Tests of controls support a lower assessed control risk only when controls are designed and operating effectively; otherwise substantive procedures must be increased.

IT general controls (ITGC) cover access management, change management, IT operations and program development; deficiencies in ITGC may prevent reliance on automated controls.

Automated controls and application controls (input, processing, output) are tested for completeness and accuracy of the data processed; the auditor may use computer-assisted audit techniques (CAAT).

Analytical procedures: compare ratios and trends against budgets, prior periods and industry data; investigate significant fluctuations and obtain corroborating evidence for unusual relationships.

Key performance indicators used in business analysis include gross margin, EBITDA margin, return on equity, current ratio, and inventory turnover; the auditor evaluates whether trends are consistent with the business environment.

Segregation of duties: incompatible functions such as authorisation, custody, recording and reconciliation should be separated; compensating controls apply where segregation is not practicable.

Data analytics and audit software: sampling risk and non-sampling risk must be managed; the auditor documents the population, sampling method and evaluation of exceptions.

ISQM 1 requires a firm-level system of quality management addressing engagement performance, ethical requirements, acceptance and continuance, human resources, and monitoring and remediation.

ISQM 2 governs engagement quality reviews (EQR) for listed entities and other engagements where required; the reviewer must be objective and independent of the engagement team.

ISA 230 documentation: the audit file must be assembled within 60 days of the audit report date and retained for at least five years; documentation must enable an experienced auditor to understand the work performed.

The auditor's report must include the title, addressee, opinion, basis for opinion, responsibilities of management and the auditor, and the signature, date and location.

Reporting to authorities: the auditor must notify Finanstilsynet of circumstances that may lead to withdrawal or of matters relevant to the firm's authorisation; suspicious transactions are reported to Økokrim under anti-money laundering rules.

Audit quality indicators include engagement quality review findings, monitoring results, independence confirmations, and continuing education compliance; these support the firm's quality objectives.

Working papers must record who performed the work, when, and who reviewed it; significant judgements and conclusions, including the rationale for the opinion, must be documented.

The engagement letter sets out the scope, responsibilities, and the basis of the audit; changes to the engagement terms require documented agreement by both parties.

ISA 315 requires identifying and assessing risks of material misstatement at both financial statement and assertion level; significant risks are those close to the upper end of the spectrum and require substantive procedures regardless of controls.

Materiality: overall materiality is often set at 0.5%-1% of profit before tax, 1%-2% of total assets, or 0.5%-1% of revenue; performance materiality is typically 50%-75% of overall materiality depending on assessed risk and history of misstatements.

ISA 500 evidence must be sufficient (quantity) and appropriate (relevance and reliability); external documentary evidence from independent third parties is more reliable than internal evidence, and original documents beat copies.

ISA 700/701: the audit report states an opinion in the first section, a Basis for Opinion, and Key Audit Matters for listed entities; the opinion is modified (qualified, adverse, disclaimer) only when the matter is material and, for qualification, not pervasive.

ISA 560 subsequent events: the auditor has an active duty to perform procedures up to the date of the audit report; after that date, no duty to perform inquiry unless facts become known, then discuss with management and consider reissuing.

ISA 570 going concern: evaluate management's assessment covering at least 12 months from the reporting date; a material uncertainty that is adequately disclosed leads to an Emphasis of Matter/separate section, not a modified opinion.

ISA 240 fraud: presume a risk of fraud in revenue recognition and obtain corroborating evidence for management representations; journal entry testing and review of accounting estimates for bias are mandatory procedures.

ISA 450 accumulates uncorrected misstatements; communicate all misstatements to management and request correction, and communicate material uncorrected misstatements to those charged with governance.

ISA 600 group audits: the group engagement partner is responsible for the direction, supervision and review of component auditors' work and must be satisfied the group audit opinion is supported.

IFRS 15 five-step model: identify the contract, identify performance obligations, determine the transaction price, allocate the price to obligations, and recognise revenue when (or as) each obligation is satisfied.

IFRS 16: lessees recognise a right-of-use asset and a lease liability at the present value of lease payments; short-term leases (12 months or less) and low-value assets may be expensed.

IFRS 9 expected credit loss model: loss allowance equals the 12-month ECL unless credit risk has increased significantly, then lifetime ECL applies; simplified approach uses lifetime ECL for trade receivables.

IFRS 3: acquisition method, goodwill measured as consideration transferred plus non-controlling interest plus fair value of previously held interest, less net identifiable assets acquired.

IAS 36 impairment: recoverable amount is the higher of fair value less costs of disposal and value in use; goodwill is tested annually and an impairment of goodwill is never reversed.

IAS 37: a provision is recognised when there is a present obligation from a past event, a probable outflow, and a reliable estimate; a contingent liability is disclosed unless the outflow is remote.

Norwegian GAAP (regnskapsloven) requires accrual-based recognition with a realisation principle for gains; NRS standards supplement the law, and NRS 8 applies to small entities while IFRS is mandatory for listed entities.

IAS 12: deferred tax is recognised on temporary differences using the expected reversal method at the tax rate expected when the difference reverses; deferred tax assets are recognised only to the extent recovery is probable.

IAS 21 and consolidation: foreign operations are translated using closing rate for assets and liabilities, average rate for income and expenses, with exchange differences recognised in other comprehensive income.

IESBA Code: the five fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.

Independence comprises independence of mind (state of mind) and independence in appearance (avoiding facts a reasonable third party would perceive as compromising); both must be satisfied.

The conceptual framework: identify threats (self-interest, self-review, advocacy, familiarity, intimidation), evaluate their significance, and address them by eliminating the circumstance, applying safeguards, or declining the engagement.

Prohibited non-assurance services for public interest entities include preparing accounting records and financial statements, internal audit outsourcing, and tax services that create a self-review threat unless clearly immaterial.

Long association: for public interest entities, the engagement partner's seven-year rotation with a two-year cooling-off period applies under the IESBA Code; key audit partners are also subject to rotation.

Fees: a contingent fee for an audit is prohibited; if total fees from one client exceed 15% of the firm's total fees for two consecutive years, a disclosure and safeguards apply for public interest entities.

Norwegian auditor law (revisorloven) requires authorisation by Finanstilsynet, membership in a recognised audit association, and annual continuing education of at least 120 hours over three years.

Statutory audit is a reserved activity: only authorised auditors and registered audit firms may sign audit reports; the auditor is formally appointed by the general meeting and reports to it.

Confidentiality continues after the engagement ends; disclosure is permitted only where required by law, permitted by the client, or where there is a professional duty or right to disclose.

Norwegian Aksjeloven: the board of directors (styret) must have at least one member; public limited companies (ASA) require at least three members, and the general meeting elects the board unless otherwise provided.

The general meeting (generalforsamling) is the supreme authority; it approves the annual accounts, appoints the auditor, and elects the board; the ordinary meeting must be held within six months of the financial year-end.

The board has a duty of care and oversight: it must ensure proper organisation, establish internal control and risk management systems, and monitor the company's financial position.

The CEO (daglig leder) manages day-to-day operations and reports to the board; matters of unusual importance or major significance must be submitted to the board.

Aksjeloven chapter 8 provides that the board must act if equity falls below a sound level; if equity is less than half of share capital, the board must convene a general meeting and propose remedial measures.

The Norwegian Corporate Governance Code (Norsk anbefaling) applies on a comply-or-explain basis to listed companies; it addresses board independence, audit committee composition, and nomination committees.

Audit committee (revisjonsutvalg): required for public interest entities; it must consist of board members, at least one with audit expertise, and it oversees the financial reporting process and the auditor's independence.

Related-party transactions: the board must ensure arm's-length terms; significant transactions with shareholders or directors require disclosure and, where relevant, independent valuation.

The auditor's report is addressed to the general meeting; the auditor has a duty to report to the board on significant findings and to notify the board of any suspicion of criminal offences or irregularities.

Norwegian corporate tax rate is 22% on general income; the audit of tax expense must reconcile current tax, deferred tax and the effective tax rate against the statutory rate.

The exemption method (fritaksmetoden) exempts 97% of dividends and capital gains on qualifying shares for corporate shareholders; the remaining 3% is taxable, affecting deferred tax on share investments.

Tax depreciation follows the tax law's declining-balance schedules (saldogrupper) and may differ from accounting depreciation, creating temporary differences and deferred tax.

Loss carryforwards can be offset against future profits indefinitely; the deferred tax asset recognition requires assessment of probable future taxable profits.

Transfer pricing: Norwegian controlled foreign company and arm's-length rules require documentation for cross-border related-party transactions; the auditor evaluates the reasonableness of intercompany pricing.

Tax provisions and uncertain tax positions are evaluated under IFRIC 23 and IAS 12; the auditor assesses whether the recognition and measurement of tax liabilities are appropriate.

VAT (merverdiavgift): standard rate 25%, reduced rates 15% for food and 12% for certain services; the auditor checks that output VAT is correctly calculated and input VAT is deductible.

Tax reporting to authorities: the annual tax return is filed electronically; the auditor's confirmation of the financial statements supports the taxable income reported and the company's tax position.

The Norwegian Tax Administration (Skatteetaten) may request audit documentation; confidentiality rules and the auditor's duty to report suspected tax evasion must be balanced with professional obligations.

COSO internal control framework: five components are control environment, risk assessment, control activities, information and communication, and monitoring activities; the auditor evaluates design and implementation before testing operating effectiveness.

The audit risk model: audit risk = inherent risk x control risk x detection risk; the auditor sets detection risk inversely to the assessed risks of material misstatement.

Tests of controls support a lower assessed control risk only when controls are designed and operating effectively; otherwise substantive procedures must be increased.

IT general controls (ITGC) cover access management, change management, IT operations and program development; deficiencies in ITGC may prevent reliance on automated controls.

Automated controls and application controls (input, processing, output) are tested for completeness and accuracy of the data processed; the auditor may use computer-assisted audit techniques (CAAT).

Analytical procedures: compare ratios and trends against budgets, prior periods and industry data; investigate significant fluctuations and obtain corroborating evidence for unusual relationships.

Key performance indicators used in business analysis include gross margin, EBITDA margin, return on equity, current ratio, and inventory turnover; the auditor evaluates whether trends are consistent with the business environment.

Segregation of duties: incompatible functions such as authorisation, custody, recording and reconciliation should be separated; compensating controls apply where segregation is not practicable.

Data analytics and audit software: sampling risk and non-sampling risk must be managed; the auditor documents the population, sampling method and evaluation of exceptions.

ISQM 1 requires a firm-level system of quality management addressing engagement performance, ethical requirements, acceptance and continuance, human resources, and monitoring and remediation.

ISQM 2 governs engagement quality reviews (EQR) for listed entities and other engagements where required; the reviewer must be objective and independent of the engagement team.

ISA 230 documentation: the audit file must be assembled within 60 days of the audit report date and retained for at least five years; documentation must enable an experienced auditor to understand the work performed.

The auditor's report must include the title, addressee, opinion, basis for opinion, responsibilities of management and the auditor, and the signature, date and location.

Reporting to authorities: the auditor must notify Finanstilsynet of circumstances that may lead to withdrawal or of matters relevant to the firm's authorisation; suspicious transactions are reported to Økokrim under anti-money laundering rules.

Audit quality indicators include engagement quality review findings, monitoring results, independence confirmations, and continuing education compliance; these support the firm's quality objectives.

Working papers must record who performed the work, when, and who reviewed it; significant judgements and conclusions, including the rationale for the opinion, must be documented.

The engagement letter sets out the scope, responsibilities, and the basis of the audit; changes to the engagement terms require documented agreement by both parties.

ISQM 1 requires a firm-level system of quality management addressing engagement performance, ethical requirements, acceptance and continuance, human resources, and monitoring and remediation.

ISQM 2 governs engagement quality reviews (EQR) for listed entities and other engagements where required; the reviewer must be objective and independent of the engagement team.

ISA 230 documentation: the audit file must be assembled within 60 days of the audit report date and retained for at least five years; documentation must enable an experienced auditor to understand the work performed.

The auditor's report must include the title, addressee, opinion, basis for opinion, responsibilities of management and the auditor, and the signature, date and location.

Reporting to authorities: the auditor must notify Finanstilsynet of circumstances that may lead to withdrawal or of matters relevant to the firm's authorisation; suspicious transactions are reported to Økokrim under anti-money laundering rules.

Audit quality indicators include engagement quality review findings, monitoring results, independence confirmations, and continuing education compliance; these support the firm's quality objectives.

Working papers must record who performed the work, when, and who reviewed it; significant judgements and conclusions, including the rationale for the opinion, must be documented.

The engagement letter sets out the scope, responsibilities, and the basis of the audit; changes to the engagement terms require documented agreement by both parties.