Audit
The audit process
Audit questions test the stages of an engagement: acceptance and continuance, planning, risk assessment, evidence gathering, evaluation and reporting. Understand audit risk as the combination of inherent risk, control risk and detection risk, and how the auditor responds by adjusting the nature, timing and extent of procedures.
Evidence and controls
Know the assertions (occurrence, completeness, accuracy, cutoff, classification, existence, rights and obligations, valuation, presentation) and which procedures address each. Understand internal controls, the control environment, and tests of controls versus substantive procedures. Sampling, materiality and the concept of sufficient appropriate evidence are core.
Traps
A frequent trap is confusing detection risk with the other risk components-detection risk is the only one the auditor controls directly. Another is treating inquiry alone as sufficient evidence; it is not. Watch for confusion between tests of controls and substantive testing, and between the auditor's report modifications (qualified, adverse, disclaimer) and the circumstances that trigger each.
Worked example
Audit risk = inherent risk x control risk x detection risk. If inherent risk is high and controls are weak, control risk is high, so the auditor must lower detection risk by performing more or better substantive procedures-increasing the extent of testing. Detection risk is set by the auditor; the other two are assessed.
Rule of thumb
Match the procedure to the assertion: existence needs confirmation or inspection; completeness needs tests from source documents to records; valuation needs independent evidence of amounts. If evidence is not sufficient and appropriate, the auditor cannot conclude the financial statements are fairly presented.
Ethics and Governance
Ethical frameworks
Ethics questions test the fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. Understand the conceptual framework for threats (self-interest, self-review, advocacy, familiarity, intimidation) and the safeguards that reduce them to an acceptable level.
Governance
Governance material covers the board's role, independence, the separation of chair and chief executive, audit and remuneration committees, internal control and risk management, and the rights and responsibilities of shareholders and directors. Know the difference between executive and non-executive directors and why independence matters.
Traps
Questions often present a scenario where a threat exists but the correct answer is to apply safeguards rather than decline the engagement outright-unless the threat cannot be reduced. Watch for confidentiality exceptions (legal or professional obligation) and for conflicts between commercial pressure and professional judgement. Distinguish a governance principle from a mandatory rule.
Worked example
An auditor is offered a large consulting engagement by an audit client. This creates a self-interest threat and potentially a self-review threat if the consulting affects the audit. The correct response is to evaluate the significance, apply safeguards such as using separate teams or declining the non-assurance work, and document the conclusion-not to accept automatically.
Rule of thumb
Identify the threat, assess its significance, apply safeguards, and if the threat cannot be reduced to an acceptable level, decline or withdraw. Independence in appearance matters as much as independence in fact.