ACCA Pakistan Audit and Assurance (AA) Syllabus

Give an example of a self-review threat.

When an auditor reviews work they themselves previously performed, e.g. auditing financial statements the firm helped prepare, or evaluating a system the firm designed.

Give an example of an advocacy threat.

When the firm promotes a client's position, e.g. representing the client in litigation or promoting its shares, so objectivity may be compromised.

What safeguards reduce the threat of high audit fee dependence from one client?

If recurring fees from one client exceed 15% of total firm fees, safeguards include pre- or post-issuance review by an external accountant, reducing dependency, and disclosing to those charged with governance.

What is the safeguard for a long association (familiarity) threat on a listed client engagement partner?

Rotation of the engagement partner; for listed/public interest entities the partner should be rotated after a set period (commonly seven years) with a cooling-off period.

What matters should be considered before accepting a new audit engagement?

The firm's competence and resources; independence and ethical issues; client integrity; and contacting the existing/outgoing auditor for any reasons not to accept (after obtaining client permission).

What is the purpose of the engagement letter and what does it confirm?

It records and confirms the terms of the engagement: the objective and scope of the audit, the auditor's and management's responsibilities, the applicable framework, and the form of reports. It reduces the risk of misunderstanding.

What is 'preconditions for an audit' under ISA 210?

The use by management of an acceptable financial reporting framework, and management's agreement to the premise on which an audit is conducted (its responsibility for the financial statements, internal control, and providing the auditor with access to information).

Why must the auditor obtain an understanding of the entity and its environment (ISA 315)?

To identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and assertion levels, providing a basis for designing and implementing responses.

State the audit risk model formula.

Audit Risk = Inherent Risk x Control Risk x Detection Risk.

Define inherent risk.

The susceptibility of an assertion to a misstatement that could be material, before consideration of any related controls.

Define control risk.

The risk that a material misstatement will not be prevented, or detected and corrected, on a timely basis by the entity's internal control.

Define detection risk and how the auditor controls it.

The risk that the auditor's procedures will not detect a material misstatement. The auditor controls it by adjusting the nature, timing and extent of audit procedures (more/less testing) in response to assessed inherent and control risk.

What is the relationship between detection risk and the other components of audit risk?

Inverse: if inherent and control risk are assessed as high, detection risk must be set low (more work) to keep overall audit risk acceptably low, and vice versa.

Define materiality.

Information is material if its omission or misstatement could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements; it depends on size and/or nature.

Give common benchmarks used to calculate materiality.

Approximate guideline ranges: 0.5%-1% of revenue, 1%-2% of total assets, and 5%-10% of profit before tax.

What is performance materiality?

An amount set lower than overall materiality to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole.

What is the purpose of audit documentation (working papers)?

To provide evidence of the basis for the auditor's opinion and evidence that the audit was planned and performed in accordance with ISAs; it also assists planning, supervision, review, and accountability.

What is the standard for sufficiency of documentation under ISA 230?

Documentation should be sufficient to enable an experienced auditor, with no previous connection to the audit, to understand the nature, timing and extent of procedures, the results and evidence obtained, and significant matters and conclusions reached.

For what period and how long must final audit files be retained and assembled?

The final audit file should be assembled on a timely basis, ordinarily within 60 days of the auditor's report, and retained for a minimum period, ordinarily no shorter than five years from the date of the auditor's report.

List the five components of internal control under the COSO/ISA 315 framework.

The control environment; the entity's risk assessment process; the information system and communication; control activities; and monitoring of controls.

Give examples of types of control activities.

Authorisation, performance reviews, information processing controls (application and general IT controls), physical controls over assets, and segregation of duties.

What is segregation of duties?

Dividing responsibilities for authorising transactions, recording them, and maintaining custody of related assets among different people to reduce the risk of error and fraud.

What is the difference between a test of controls and a substantive procedure?

A test of controls evaluates the operating effectiveness of controls in preventing/detecting misstatements; a substantive procedure detects material misstatements directly at the assertion level (tests of detail and substantive analytical procedures).

Give two examples of tests of controls over the sales/revenue cycle.

Inspecting a sample of sales orders for evidence of credit approval; and re-performing/checking that despatch notes are matched to invoices and sequentially numbered (completeness control).

What is a deficiency in internal control, and a significant deficiency?

A deficiency exists when a control is unable to prevent/detect and correct misstatements, or a necessary control is missing. A significant deficiency is one of sufficient importance to merit the attention of those charged with governance.

What must the auditor do with identified significant deficiencies in internal control?

Communicate them in writing to those charged with governance (and management) on a timely basis, typically via a report to management (management letter) describing the deficiency, its potential effect, and recommendations.

List the financial statement assertions about classes of transactions and events.

Occurrence, completeness, accuracy, cut-off, and classification (and presentation).

List the financial statement assertions about account balances at period end.

Existence, rights and obligations, completeness, accuracy/valuation and allocation (and classification/presentation).

Define audit sampling and the two general approaches.

Applying procedures to less than 100% of items in a population so that all sampling units have a chance of selection, enabling a conclusion about the whole population. The two approaches are statistical sampling and non-statistical (judgemental) sampling.

What procedures should an auditor perform to gain assurance over inventory existence and condition?

Attend the physical inventory count to observe management's count procedures, perform test counts (floor-to-sheet and sheet-to-floor), inspect for damaged/obsolete items, and confirm cut-off of goods received and despatched.