Audit, Assurance and Risk Management
Scope and standards
Audit is reasonable, not absolute, assurance under ISAs as adopted by ICAP. The chain runs ISA 210 (engagement terms), ISA 315 Revised (understanding the entity, its IT environment and internal controls - the risk-assessment engine), ISA 320 (materiality), ISA 330 (responses), ISA 500/540 (evidence and accounting estimates), ISA 550 (related parties), ISA 560/570 (subsequent events, going concern), ISA 600 (group audits), ISA 700/701/705 (reporting, key audit matters, modifications) and ISA 720 (other information). Quality is governed by ISQM 1 at firm level and ISQM 2 for engagement quality reviews. Risk content covers COSO ERM, the three lines model, fraud under ISA 240, AML/CFT reporting and cyber/business continuity risk.
Traps
'Auditors are responsible for detecting all fraud' is false - they plan to obtain reasonable assurance. KAMs cannot be used to sidestep a modification: if a matter is material and unresolved, modify under ISA 705. On going concern, distinguish a material uncertainty (disclosure) from inappropriate use of the going concern basis (adverse opinion). Materiality is a judgement, not a pass/fail threshold for individual errors.
Rule of thumb
Set and justify materiality: 0.5-1% of revenue, 5% of profit before tax, or 1-2% of total assets. For a listed manufacturer with volatile earnings, 0.75% of revenue is defensible - state the benchmark, the percentage and why.