CA (Chartered Accountancy) Final: Advanced Auditing, Assurance and Professional Ethics Syllabus

Under SA 560, distinguish the auditor's responsibilities for events between the date of the financial statements and the date of the auditor's report versus facts discovered after the report date but before issuance.

For events up to the date of the auditor's report, the auditor must perform active procedures to identify subsequent events requiring adjustment/disclosure. After the report date but before the statements are issued, the auditor has no obligation to perform procedures, but if a fact becomes known that would have caused amendment, the auditor must discuss with management and take appropriate action (amend report/statements).

Define 'Key Audit Matters' (KAM) per SA 701 and state where they are reported.

KAM are those matters that, in the auditor's professional judgement, were of most significance in the audit of the current period's financial statements. They are selected from matters communicated with those charged with governance and are reported in a separate 'Key Audit Matters' section of the auditor's report. KAM are not a substitute for a modified opinion, disclosures, or for reporting going concern uncertainty.

For which entities is the communication of Key Audit Matters mandatory under SA 701?

Communication of KAM is required for audits of complete sets of general purpose financial statements of listed entities, and when the auditor otherwise decides (or is required by law/regulation) to communicate KAM in the auditor's report.

Under SA 705, list the three types of modified opinions and the circumstances giving rise to them.

1) Qualified opinion — misstatements are material but not pervasive, OR unable to obtain sufficient appropriate evidence but possible effects are material but not pervasive. 2) Adverse opinion — misstatements are both material and pervasive. 3) Disclaimer of opinion — unable to obtain sufficient appropriate evidence and possible effects could be both material and pervasive.

What does the term 'pervasive' mean in the context of modifications to the auditor's opinion (SA 705)?

Pervasive describes effects on the financial statements that, in the auditor's judgement: are not confined to specific elements, accounts or items; if so confined, represent or could represent a substantial proportion of the statements; or, in relation to disclosures, are fundamental to users' understanding of the financial statements.

Distinguish an 'Emphasis of Matter' paragraph from an 'Other Matter' paragraph under SA 706.

An Emphasis of Matter (EOM) paragraph refers to a matter appropriately presented or disclosed in the financial statements that, in the auditor's judgement, is of such importance that it is fundamental to users' understanding. An Other Matter (OM) paragraph refers to a matter not presented or disclosed in the financial statements that is relevant to users' understanding of the audit, the auditor's responsibilities, or the auditor's report. Neither affects the opinion.

Under SA 570, what disclosure and reporting follows when a material uncertainty related to going concern exists and is adequately disclosed?

The auditor expresses an unmodified opinion and includes a separate section headed 'Material Uncertainty Related to Going Concern' that draws attention to the disclosure in the financial statements and states that these events/conditions indicate a material uncertainty that may cast significant doubt on the entity's ability to continue as a going concern, and that the opinion is not modified in respect of the matter.

In a bank audit, what is the basis of income recognition on Non-Performing Assets (NPAs) under RBI norms?

Income from NPAs is not recognised on an accrual basis but is recognised only when actually realised (cash basis). Interest accrued and credited to income on an account that becomes NPA must be reversed if not realised.

State the RBI asset classification categories for bank advances and the basic NPA period.

Categories: Standard Assets, and Non-Performing Assets sub-classified into Sub-standard, Doubtful, and Loss assets. A term loan generally becomes an NPA when interest and/or principal remains overdue for more than 90 days. Sub-standard: NPA for ≤12 months; Doubtful: remained sub-standard for ≥12 months; Loss: identified as uncollectible by the bank/auditor/RBI inspection.

What is the minimum provisioning requirement on Standard Assets (general) and on the secured portion of a sub-standard asset for banks?

Standard assets carry a general provision (commonly 0.40% for most categories, with higher rates for specified sectors). The secured portion of a sub-standard asset generally requires 15% provision, while the unsecured portion requires 25%.

In the audit of an insurance company, what is the 'Unexpired Risk Reserve' (URR) and how is it created?

URR is a reserve in a general insurance company to cover liability for the unexpired period of risk on policies in force at the year-end (risk extending beyond the accounting year). It is created as a percentage of net premium — commonly 50% of net premium for most segments and 100% for marine hull business.

What is the principal regulatory difference an auditor must verify when classifying an NBFC versus a banking company?

An NBFC is registered under the Companies Act and the RBI Act (Section 45-IA registration), cannot accept demand deposits, is not part of the payment/settlement system, and cannot issue cheques drawn on itself; deposit insurance (DICGC) is not available to NBFC depositors. The auditor verifies RBI registration, the principal business criteria (50-50 test of assets and income), and compliance with applicable NBFC Directions.

State the RBI '50-50 test' used to determine whether a company is an NBFC.

A company is treated as an NBFC carrying on financial activity as its principal business if: (a) its financial assets constitute more than 50% of total assets (netted off by intangible assets), AND (b) income from financial assets constitutes more than 50% of gross income. Both criteria must be satisfied.

What is the auditor's additional reporting duty under the NBFC Auditor's Report Directions?

In addition to the report under the Companies Act, the auditor must submit an exception report (Auditor's Report to RBI) to the Board, and a separate report directly to the RBI where, in the auditor's opinion, the company has not complied with the Net Owned Fund/registration requirements or specified RBI Directions (e.g., on income recognition, asset classification, provisioning, capital adequacy, prudential norms).

Define 'propriety audit' in the context of audit of Public Sector Undertakings / Government audit.

Propriety audit goes beyond verifying arithmetical accuracy and legal sanction; it scrutinises the wisdom, faithfulness and economy of transactions, examining whether expenditure conforms to broad principles of financial propriety—e.g., no expenditure more than the occasion demands, no order benefiting individuals at public expense, and money spent in the public interest.

What are the three E's examined in a performance/comprehensive audit of a PSU?

Economy (acquisition of resources of appropriate quality at lowest cost), Efficiency (maximising output for a given input or minimising input for a given output), and Effectiveness (extent to which objectives/intended results are achieved). Performance audit assesses whether the entity has used resources economically, efficiently and effectively.

Under SA 600, what are the principal auditor's responsibilities when using the work of component (other) auditors?

The principal auditor should perform procedures to obtain sufficient appropriate evidence that the component's work is adequate for the principal auditor's purposes: consider the professional competence of the other auditor, perform procedures to obtain evidence on the component's financial information, evaluate the other auditor's work, and discuss audit procedures/findings. The principal auditor need not refer to the other auditor's work in the report unless required by law; division of responsibility may be disclosed.

In the audit of Consolidated Financial Statements (CFS), what key adjustments must the auditor verify on consolidation?

Verify: elimination of the cost of the parent's investment against the parent's portion of equity in each subsidiary; computation and presentation of goodwill or capital reserve on consolidation; elimination of intra-group balances, transactions and unrealised profits/losses; computation of non-controlling (minority) interest; uniform accounting policies and same reporting date; and equity/proportionate accounting for associates and joint ventures.

What is the auditor's responsibility regarding components not audited by them in a CFS audit?

The parent's (group) auditor must determine the type of work to be performed on component financial information based on significance and risk, obtain and evaluate the work of component auditors, and may make reference to or assume responsibility for their work. The group auditor remains solely responsible for the audit opinion on the consolidated financial statements.

Define internal audit and distinguish it from operational audit.

Internal audit is an independent management/assurance function that evaluates and reports on the adequacy and effectiveness of internal control, risk management and governance processes. Operational audit is a future-oriented, systematic and independent appraisal of organizational activities focusing on efficiency, effectiveness and economy of operations, aiming to improve performance—broader than financial/compliance internal audit, concentrating on operations and management.

Which classes of companies are required to appoint an internal auditor under Section 138 of the Companies Act, 2013 read with the Rules?

Every listed company; every unlisted public company with paid-up share capital ≥ ₹50 crore, or turnover ≥ ₹200 crore, or outstanding loans/borrowings from banks/PFIs ≥ ₹100 crore, or outstanding deposits ≥ ₹25 crore (any one) during the preceding financial year; and every private company with turnover ≥ ₹200 crore, or outstanding loans/borrowings ≥ ₹100 crore (any one).

Define 'Management Audit' and state how it differs from a financial audit.

Management audit is a comprehensive and constructive examination of an organization's management—its structure, plans, objectives, means of operation and use of human and physical facilities—to appraise the efficiency and effectiveness of management at all levels. Unlike financial audit (which verifies accounts for an opinion on financial statements), management audit is forward-looking, advisory, and evaluates managerial performance and decision-making rather than historical financial accuracy.

Define 'due diligence' and name common types.

Due diligence is an investigative, careful appraisal/review of a business or its assets undertaken before a transaction (acquisition, merger, investment, lending) to confirm material facts and assess risks. Common types: financial, tax, legal, commercial/operational, environmental, information systems/technology, and human resources due diligence.

What is the purpose of 'hidden liabilities' and 'overvalued assets' review in due diligence?

To uncover liabilities not appearing in the books and to identify assets stated above realisable value, so the buyer/investor can adjust the consideration. Hidden liabilities examples: pending litigation/claims, product warranties, unfunded retirement benefits, guarantees given. Overvalued assets examples: uncollectible receivables, obsolete/slow-moving inventory, fictitious/over-valued fixed assets, deferred revenue expenditure carried as assets.

Distinguish 'investigation' from an 'audit'.

An audit is a routine, periodic examination to express an opinion on financial statements within a defined scope and framework. An investigation is a special, purpose-driven, in-depth examination for a specific objective (e.g., suspected fraud, proposed purchase, lending), often beyond a single period, not bound by materiality in the same way, may require conclusive evidence, and its scope is determined by the engaging party's specific objective.

Define 'forensic accounting' and state its two main components.

Forensic accounting is the application of accounting, auditing and investigative skills to examine financial records for use in legal proceedings. Its two components are: (1) investigative/forensic services—detecting and investigating fraud and quantifying losses, and (2) litigation support—providing assistance and expert evidence in legal disputes (e.g., expert witness, damage quantification).

Name the basic steps in a forensic accounting / fraud investigation engagement.

Initialisation (understand objective, accept engagement); develop the plan/hypothesis; obtain relevant evidence (documents, electronic data, interviews); perform analysis (data analytics, ratio/trend analysis, lifestyle checks, fund tracing); validate findings against the hypothesis; and report findings (a clear, objective report capable of withstanding legal scrutiny), with possible court testimony.

What is the impact of an automated/IT environment on audit risk and the auditor's approach?

In a CIS/automated environment, there is a lack of visible audit trail, uniform processing (consistent but systematic errors are repeated), concentration/segregation issues, potential for unauthorised access and data manipulation, and dependence on system reliability. The auditor must understand IT general controls (ITGC) and application controls, may need to test controls (since substantive-only may be impractical for electronically initiated transactions), and often uses CAATs.

Distinguish IT General Controls (ITGC) from Application Controls.

ITGC are pervasive controls over the IT environment that support the effective functioning of application controls—covering access security, program change management, program development, and computer/IT operations. Application controls are specific to individual applications/business processes and ensure completeness, accuracy, validity and authorisation of transactions—e.g., input validation/edit checks, processing controls, output controls, and authorisation controls.

Define CAATs and give examples of their use in auditing.

Computer Assisted Audit Techniques (CAATs) are tools and techniques using the computer as an audit tool to examine large volumes of data. Uses include: tests of details of transactions and balances, analytical procedures, tests of general and application controls, sampling, recalculation, and re-performance. Examples: test data, integrated test facility (ITF), parallel simulation, and audit software (generalised audit software such as IDEA/ACL).

What is 'data analytics' in audit, and how does it differ from traditional sampling?

Audit data analytics is the science and art of discovering and analysing patterns, deviations and inconsistencies, and extracting other useful information in data underlying or related to the audit, through analysis, modelling and visualisation. Unlike sampling (which tests a subset and extrapolates), data analytics can analyse 100% of a population, enabling identification of anomalies, outliers and exceptions across the entire data set for more focused testing.

In the audit of items related to tax (Tax Audit under Section 44AB), what does the auditor report and in which forms?

Under Section 44AB, a Chartered Accountant audits and reports on prescribed particulars. The audit report is in Form 3CA (where accounts are already audited under any other law) or Form 3CB (in other cases), and the statement of particulars is in Form 3CD. The auditor verifies and reports particulars such as method of accounting, depreciation, amounts disallowable, payments to specified persons, TDS compliance, etc.

What is the basic threshold for compulsory tax audit under Section 44AB for a business (with the enhanced digital-transactions limit)?

A person carrying on business must get accounts audited if total sales/turnover/gross receipts exceed ₹1 crore in the previous year. This threshold is enhanced to ₹10 crore where aggregate cash receipts and cash payments do not exceed 5% of the respective totals (i.e., at least 95% of transactions are non-cash/digital). For professionals, the limit is gross receipts exceeding ₹50 lakh.

What is a 'special purpose audit report' / special report and when is it issued under SA 800-series?

A special report is an auditor's report on financial statements prepared in accordance with a special purpose framework (e.g., cash basis, tax basis, regulatory basis, or terms of a contract), governed by SA 800. The auditor must describe the special purpose framework, the responsibility for it, and include an Emphasis of Matter paragraph alerting users that the statements are prepared on a special purpose basis and may not be suitable for another purpose.

State the five Fundamental Principles of professional ethics under the ICAI Code of Ethics.

1) Integrity — straightforwardness and honesty in all professional and business relationships; 2) Objectivity — not allowing bias, conflict of interest or undue influence to override judgements; 3) Professional Competence and Due Care — maintaining knowledge/skill and acting diligently per technical and professional standards; 4) Confidentiality — respecting confidentiality of information acquired; 5) Professional Behaviour — complying with relevant laws/regulations and avoiding conduct that discredits the profession.

Name the categories of threats to compliance with the fundamental principles in the Conceptual Framework of the Code of Ethics.

Five threats: (1) Self-interest threat — financial or other interest inappropriately influencing judgement; (2) Self-review threat — re-evaluating one's own previous judgement; (3) Advocacy threat — promoting a client's position to the point objectivity is compromised; (4) Familiarity threat — close/long relationship leading to too much sympathy; (5) Intimidation threat — being deterred from acting objectively by actual or perceived pressures.

How does the Conceptual Framework approach to ethics work, and what are 'safeguards'?

The professional accountant identifies threats to compliance with the fundamental principles, evaluates their significance, and addresses them by eliminating the circumstances, applying safeguards to reduce them to an acceptable level, or declining/ending the engagement. Safeguards are actions (individually or in combination) that effectively reduce threats to an acceptable level—e.g., those created by the profession/legislation/regulation and those within the firm's own systems and the work environment.

What is meant by 'professional misconduct' under the Chartered Accountants Act, 1949, and where are the relevant provisions found?

Professional misconduct is defined in Section 22 of the Chartered Accountants Act, 1949 to include any act or omission specified in the Schedules to the Act. The First Schedule and Second Schedule (each with parts relating to members in practice, members in service, and other members) enumerate specific acts of professional and 'other' misconduct, with the Council/Disciplinary Directorate empowered to inquire and impose penalties.

Under the ICAI Code, what is the rule on 'confidentiality' after the client relationship ends, and the exceptions to confidentiality?

The duty of confidentiality continues even after the professional/business relationship ends. Disclosure is permitted when: it is required by law (e.g., production of documents in legal proceedings, disclosure of an offence); it is authorised by the client/employer; or there is a professional duty/right to disclose (not prohibited by law)—such as complying with quality/peer review, responding to an ICAI inquiry, protecting the member's interests in legal proceedings, or complying with technical/professional standards.

What is the auditor's documentation requirement under SA 230 (assembly and the '60-day' rule)?

SA 230 requires the auditor to prepare audit documentation sufficient to enable an experienced auditor, with no previous connection, to understand the nature, timing and extent of procedures, results and evidence obtained, and significant matters and conclusions. The final audit file must be assembled on a timely basis, ordinarily not more than 60 days after the date of the auditor's report; after assembly, documentation must not be deleted before the end of the retention period.

Under SA 240, what is the auditor's responsibility relating to fraud, and the distinction between fraud and error?

The distinguishing factor between fraud and error is whether the underlying action is intentional (fraud) or unintentional (error). SA 240 requires the auditor to maintain professional skepticism, identify and assess risks of material misstatement due to fraud (treating revenue recognition as a presumed fraud risk and addressing management override of controls), obtain evidence about those risks, and respond appropriately. Primary responsibility for prevention/detection of fraud rests with those charged with governance and management.