Chartered Institute of Public Finance and Accountancy (CIPFA) Audit and Assurance Syllabus

Define 'materiality' and how it is typically calculated using benchmarks.

Materiality is the magnitude of an omission or misstatement that could influence the economic decisions of users. Common benchmarks: $\tfrac{1}{2}\%\text{–}1\%$ of revenue/gross expenditure, $1\%\text{–}2\%$ of total assets, or $5\%\text{–}10\%$ of profit before tax.

What is 'performance materiality' and why is it set?

Performance materiality is an amount set lower than overall materiality (e.g. 50%–75% of it) to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality.

Distinguish 'materiality by value' from 'materiality by nature' in the public sector.

Materiality by value relates to the monetary size of a misstatement. Materiality by nature relates to items material regardless of amount — e.g. related party transactions, directors'/members' remuneration, fraud, or breaches of statutory authority (regularity).

Define 'internal control' and state its five components under the COSO/ISA 315 framework.

Internal control is the process designed to provide reasonable assurance over reliability of reporting, effectiveness/efficiency of operations and compliance. Five components: Control environment, Risk assessment process, Control activities, Information & communication, and Monitoring of controls.

List the main TYPES of control activities an auditor looks for.

Authorisation, Performance reviews, Information processing (application and general IT controls), Physical controls (over assets and records), and Segregation of duties.

What are the inherent limitations of any internal control system?

Human error/judgement, collusion between staff, management override of controls, controls being designed for routine (not unusual) transactions, and the cost of a control exceeding its benefit.

Distinguish 'tests of controls' from 'substantive procedures'.

Tests of controls evaluate the operating effectiveness of controls in preventing/detecting misstatements. Substantive procedures detect material misstatements directly at the assertion level, and comprise tests of detail and substantive analytical procedures.

Define 'segregation of duties' and the key functions that should be separated.

Dividing responsibilities so no one person controls a whole transaction. Separate: Authorisation, Custody (of assets), Recording, and Reconciliation/review — sometimes summarised as ACRR.

Under ISA (UK) 240, how is responsibility for preventing and detecting fraud allocated?

Primary responsibility for prevention and detection of fraud rests with those charged with governance and management. The auditor is responsible for obtaining reasonable assurance that the financial statements as a whole are free from material misstatement due to fraud or error.

Distinguish 'fraud' from 'error' in an audit context.

Fraud is an intentional act involving deception to obtain an unjust or illegal advantage. Error is an unintentional misstatement (including omission) in the financial statements. The distinguishing factor is intent.

Name the two types of fraud the auditor is concerned with under ISA (UK) 240.

(1) Fraudulent financial reporting (manipulating the statements, e.g. overstating revenue); (2) Misappropriation of assets (theft of the entity's assets, e.g. payroll or procurement fraud).

What are the three elements of the 'fraud triangle'?

Incentive/Pressure (a reason to commit fraud), Opportunity (e.g. weak controls or override ability), and Rationalisation/Attitude (an attitude that justifies the dishonest act).

Why is professional scepticism essential when considering fraud?

Because fraud involves concealment, the auditor must maintain an attitude of professional scepticism — questioning mind, alert to conditions indicating possible misstatement, and critical assessment of evidence — recognising that records and representations may not be reliable, despite past experience of management honesty.

State the requirement of ISA (UK) 500 regarding audit evidence.

The auditor must design and perform audit procedures to obtain sufficient appropriate audit evidence to draw reasonable conclusions on which to base the audit opinion.

Distinguish 'sufficiency' from 'appropriateness' of audit evidence.

Sufficiency is the measure of the quantity of evidence (affected by risk and quality). Appropriateness is the measure of its quality — its relevance and reliability in supporting the audit conclusions.

Rank, from most to least reliable, common sources of audit evidence.

Generally most reliable: auditor's own direct knowledge/observation; then external (third-party) evidence; then internal evidence under effective controls; then internally generated evidence and oral representations from management (least reliable). Documentary and original evidence beat oral and photocopies.

List the procedures used to obtain audit evidence (the 'AEIOU'/standard set).

Inspection (of records/assets), Observation, External confirmation, Recalculation, Reperformance, Analytical procedures, and Inquiry.

What are the assertions about classes of transactions and events (e.g. income/expenditure)?

Occurrence, Completeness, Accuracy, Cut-off, and Classification (plus Presentation).

What are the assertions about account balances at period end (e.g. assets/liabilities)?

Existence, Rights and obligations, Completeness, Accuracy/valuation and allocation (plus Classification and Presentation).

Which substantive procedures primarily test the EXISTENCE of inventory and the VALUATION of receivables?

Existence of inventory: attendance at the physical inventory count. Valuation of receivables: review of after-date cash receipts, ageing analysis and assessment of the allowance for doubtful debts (recoverability).

What is the principal substantive procedure to confirm the COMPLETENESS of trade payables/liabilities?

A search for unrecorded liabilities: reviewing after-date payments and unprocessed invoices/goods received notes, and reconciling to suppliers' statements — completeness is the key risk for liabilities (understatement).

Define 'substantive analytical procedures' and give an example.

Evaluations of financial information through analysis of plausible relationships among data, including comparison with expectations. Example: building an expectation of payroll cost by multiplying average staff numbers by average pay and comparing to recorded cost, investigating differences.

Under ISA (UK) 620, what must the auditor evaluate before relying on an auditor's expert?

The expert's competence, capabilities and objectivity; obtain an understanding of the field of expertise; agree the scope of work; and evaluate the adequacy of the expert's work (including assumptions, methods and source data) as audit evidence.

Does using the work of an expert reduce the auditor's responsibility for the opinion?

No. If the auditor concludes the expert's work is adequate, the auditor takes full responsibility for the opinion. Reference to an expert in an unmodified report is not normally made; if referenced to explain a modification, it must state it does not reduce the auditor's responsibility.

Under ISA (UK) 610, what factors determine whether the external auditor can use the work of internal audit?

The internal audit function's level of objectivity/organisational status, its level of competence, and whether it applies a systematic and disciplined approach (including quality control). The external auditor must also evaluate and re-perform some of the specific work used.

Distinguish external audit from internal audit by primary objective and reporting line.

External audit: independent statutory opinion on financial statements for external users; appointed by/reports to members or an external body. Internal audit: appraisal of risk management, control and governance for management/those charged with governance; an internal function reporting to the audit committee/board.

State the purpose of audit documentation under ISA (UK) 230 and the 'experienced auditor' test.

Documentation provides evidence of the basis for the opinion and that the audit was planned and performed per ISAs. The test: an experienced auditor, with no prior connection, should understand the nature, timing and extent of procedures, results, evidence obtained, and significant matters and conclusions reached.

Within what period must the final audit file be assembled, and for how long retained, under ISQM/ISA (UK) 230?

The administrative assembly of the final audit file should be completed on a timely basis, ordinarily not more than 60 days after the date of the auditor's report. Retention is ordinarily for a minimum of 5 years from the date of the report.

What are the basic elements of an unmodified (clean) auditor's report under ISA (UK) 700?

Title; addressee; Opinion section; Basis for Opinion; (Material uncertainty re going concern if applicable); Key Audit Matters; respective responsibilities of management/those charged with governance and of the auditor; other reporting responsibilities; signature; auditor's address; and date.

Name the three types of modified audit opinion and when each is given.

Qualified ('except for') — material but not pervasive misstatement or inability to obtain evidence; Adverse — material AND pervasive misstatement; Disclaimer of opinion — material AND pervasive inability to obtain sufficient appropriate evidence (scope limitation).

Complete the matrix: nature of matter (material-not-pervasive vs material-and-pervasive) against the type of opinion.

Misstatement, material but not pervasive = Qualified; material and pervasive = Adverse. Inability to obtain evidence, material but not pervasive = Qualified; material and pervasive = Disclaimer of opinion.

What is an 'Emphasis of Matter' paragraph and how does it differ from a modified opinion?

An Emphasis of Matter paragraph draws users' attention to a matter appropriately presented/disclosed in the statements that is fundamental to understanding. It does NOT modify the opinion — the opinion remains unmodified; it merely highlights, e.g. a significant uncertainty over litigation.

Distinguish an 'Emphasis of Matter' from an 'Other Matter' paragraph.

Emphasis of Matter refers to a matter presented or disclosed IN the financial statements. Other Matter refers to a matter NOT presented in the statements but relevant to users' understanding of the audit, the auditor's responsibilities, or the report (e.g. prior period figures audited by another auditor).

What are 'Key Audit Matters' (ISA (UK) 701) and where are they reported?

Those matters that, in the auditor's professional judgement, were of most significance in the audit of the current period's financial statements. They are selected from matters communicated to those charged with governance and described in a separate KAM section of the auditor's report (required for listed/public interest entities).

How does the auditor report on 'going concern' under ISA (UK) 570?

The auditor evaluates management's use of the going concern basis. If a material uncertainty exists that is adequately disclosed, an unmodified opinion is given with a 'Material Uncertainty Related to Going Concern' section. If inadequately disclosed, the opinion is modified (qualified/adverse); if the basis is inappropriate, an adverse opinion is given.

Define 'Value for Money' (VFM) and its three components (the '3 Es').

VFM is achieving the optimal use of resources. The 3 Es: Economy (minimising the cost of resources — spending less), Efficiency (output per unit of input — spending well), and Effectiveness (extent to which objectives are achieved — spending wisely). Some add Equity (fair distribution).

What does a VFM/'use of resources' conclusion in public audit cover, and what form does it take?

It covers whether the body has proper arrangements for securing economy, efficiency and effectiveness in its use of resources — assessed against criteria such as financial sustainability, governance, and improving economy/efficiency/effectiveness. It is reported as a narrative commentary (and any significant weaknesses/recommendations), not a true-and-fair opinion.

Distinguish a financial statement audit from a VFM (performance) audit.

A financial statement audit gives an opinion on whether accounts are true and fair (regularity-based, ISA-driven). A VFM/performance audit examines the arrangements for economy, efficiency and effectiveness in using resources and reports conclusions and recommendations — it is forward-looking and improvement-focused, not an opinion on figures.

What is a 'public interest report' and what triggers one?

A report the external auditor of a local public body issues, in the public interest, on a matter coming to attention during the audit that should be brought to public/authority attention (e.g. significant financial mismanagement, unlawful expenditure, or governance failure). The body must consider and respond to it publicly.

Name the principal statutory powers of the external auditor of a local authority in England (Local Audit and Accountability Act 2014).

Power to issue a public interest report; to make written recommendations (statutory recommendations); to issue an advisory notice; to apply to the court for a declaration that an item of account is unlawful; and to give an Auditor's report on objections raised by local electors.

What rights do local electors have in relation to a local authority audit, and what must the auditor do?

Electors have the right to inspect the accounts and supporting documents, to question the auditor about them, and to make objections. The auditor must consider any objection and may respond by issuing a public interest report, making a recommendation, or applying to the court for a declaration that an item is unlawful.

What is the auditor's responsibility regarding laws and regulations (ISA (UK) 250) in a public body, including the duty to report?

The auditor obtains sufficient understanding of the legal/regulatory framework and how the entity complies, performs procedures to identify non-compliance affecting the accounts, and in the public sector has additional responsibilities — including reporting suspected unlawful expenditure, breaches of regularity, and reporting matters to the relevant regulator or the C&AG/NAO where required.