ICAP CAF CAF-8: Audit and Assurance Essentials Syllabus

What rights does a removed or resigning auditor have?

The right to receive notice of and attend the meeting at which the matter is dealt with, to make written/oral representations to members, and (on resignation) to issue a statement of circumstances connected with the resignation.

Name the five fundamental principles of the IFAC/ICAP Code of Ethics.

Integrity, Objectivity, Professional competence and due care, Confidentiality, and Professional behaviour.

List the five categories of threats to compliance with the fundamental principles.

Self-interest, Self-review, Advocacy, Familiarity, and Intimidation threats.

Give the type of threat: an audit firm prepares the accounting records and then audits them.

A self-review threat — the auditor would be reviewing work performed by the firm itself.

Give the type of threat: total fees from one audit client represent a large proportion of the firm's total fees.

A self-interest threat (fee dependence), because the firm may be reluctant to act against the client for fear of losing the income.

What are 'safeguards' in the Code of Ethics?

Actions or other measures that may eliminate threats or reduce them to an acceptable level — created by the profession/legislation/regulation, or implemented within the firm or the client's systems (e.g. rotation, separate teams, independent review).

When may an auditor disclose confidential client information?

When disclosure is permitted by law and authorised by the client; required by law (e.g. evidence in legal proceedings, reporting to authorities); or there is a professional duty/right to disclose (e.g. to comply with quality review, to protect the member's interests, or to comply with technical/ethical requirements).

Define the overall audit strategy.

The strategy that sets the scope, timing and direction of the audit and guides the development of the more detailed audit plan — covering characteristics of the engagement, reporting objectives, significant factors/risks, and the nature, timing and extent of resources required.

Distinguish the audit strategy from the audit plan.

The audit strategy is the high-level approach (scope, timing, direction, resources). The audit plan is more detailed and describes the nature, timing and extent of planned risk assessment procedures and further audit procedures (tests of controls and substantive procedures) at the assertion level.

List the preliminary engagement activities the auditor performs at the start of an audit (ISA 300).

Performing client acceptance/continuance procedures, evaluating compliance with relevant ethical requirements (including independence), and establishing an understanding of the terms of the engagement (engagement letter).

Distinguish between the interim audit and the final audit.

The interim audit is carried out during the accounting period (before year-end), focusing on systems documentation and tests of controls and some transactions. The final audit takes place after the period end and focuses on substantive testing of year-end balances and the financial statements.

State two advantages of performing an interim audit.

It spreads the auditor's work more evenly, reducing year-end pressure and allowing earlier reporting; and it gives earlier identification of problems/risks, allowing more time for resolution before year-end.

Define audit documentation (working papers) and state its ISA.

The record of audit procedures performed, relevant audit evidence obtained, and conclusions reached. Governed by ISA 230. It includes audit programmes, analyses, memoranda, confirmations and schedules prepared by or for the auditor.

State three purposes/benefits of audit working papers.

They provide evidence of the basis for the auditor's conclusions and that the audit was planned and performed in accordance with ISAs; assist the team to plan, direct, supervise and review the work; and provide a record for future audits, quality reviews and inspections.

What is the standard for documentation under ISA 230 (the 'experienced auditor' test)?

Documentation must be sufficient to enable an experienced auditor, having no previous connection with the audit, to understand the nature, timing and extent of procedures performed, the results and evidence obtained, and significant matters and conclusions reached.

Distinguish the permanent audit file from the current audit file.

The permanent file holds information of continuing importance to successive audits (e.g. engagement letters, memorandum and articles, organisation structure, accounting systems notes). The current file holds information relevant to the current year's audit (e.g. financial statements, working papers, audit programmes, confirmations).

Define audit risk and give its formula/components.

Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. Audit Risk = Inherent Risk x Control Risk x Detection Risk.

Define inherent risk.

The susceptibility of an assertion about a class of transactions, account balance or disclosure to a misstatement that could be material, before consideration of any related controls (e.g. complex estimates, susceptibility to fraud).

Define control risk.

The risk that a material misstatement that could occur in an assertion will not be prevented, or detected and corrected, on a timely basis by the entity's internal control.

Define detection risk and state how the auditor controls it.

The risk that the auditor's procedures will not detect a material misstatement that exists. The auditor controls it by adjusting the nature, timing and extent of audit procedures: higher assessed inherent/control risk requires lower detection risk and therefore more/better testing.

What is the inverse relationship between detection risk and the risk of material misstatement?

For a given (acceptable) level of audit risk, detection risk is inversely related to the assessed risk of material misstatement (inherent x control). The higher the assessed RMM, the lower the detection risk the auditor must accept, requiring more extensive procedures.

Per ISA 315, what areas should the auditor understand about the entity and its environment?

The relevant industry, regulatory and other external factors (including the applicable financial reporting framework); the nature of the entity (operations, ownership, financing); its accounting policies; its objectives, strategies and related business risks; measurement and review of financial performance; and the entity's internal control.

Name the five components of internal control (ISA 315).

(1) The control environment, (2) the entity's risk assessment process, (3) the information system relevant to financial reporting, (4) control activities, and (5) monitoring of controls.

List risk assessment procedures used to understand the entity.

Inquiries of management and others within the entity; analytical procedures; and observation and inspection. (Plus information from client acceptance, prior audits and the engagement partner.)

Define materiality.

Information is material if its omission or misstatement could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. It has both quantitative (size) and qualitative (nature) aspects.

What is performance materiality?

An amount (or amounts) set by the auditor at less than materiality for the financial statements as a whole, to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality.

Give common benchmarks used to calculate materiality.

Typically: about 0.5%-1% of revenue, 1%-2% of total assets, or 5%-10% of profit before tax. The auditor selects an appropriate benchmark and percentage using professional judgement.

Distinguish between fraud and error.

Both are misstatements; the distinction is intent. Error is unintentional (e.g. mistakes in gathering/processing data, incorrect estimates, misapplication of policies). Fraud is an intentional act involving deception to obtain an unjust or illegal advantage.

What are the two types of fraud relevant to the auditor (ISA 240)?

(1) Fraudulent financial reporting (intentional misstatement/omission in the financial statements, often by management override), and (2) misappropriation of assets (theft of the entity's assets, often by employees).

What three conditions form the 'fraud triangle'?

Incentive/pressure to commit fraud, opportunity (e.g. weak controls or ability to override them), and rationalisation/attitude that justifies the fraudulent act.

When is audit evidence 'sufficient and appropriate' (ISA 500)?

Sufficiency is the measure of the quantity of evidence (affected by risk and quality). Appropriateness is the measure of quality — its relevance and reliability in supporting the conclusions. Both are needed for a reasonable basis for the opinion.

State the factors that affect the reliability of audit evidence.

Evidence is more reliable when: obtained from independent external sources; generated internally under effective controls; obtained directly by the auditor (e.g. observation); in documentary form (paper/electronic) rather than oral; and provided by original documents rather than copies.

List the financial statement assertions about classes of transactions and events.

Occurrence, Completeness, Accuracy, Cut-off, and Classification (and presentation).

List the financial statement assertions about account balances at period end.

Existence, Rights and obligations, Completeness, and Accuracy, valuation and allocation (and presentation/classification).

Name the types of audit procedures used to obtain evidence.

Inspection (of records/documents or assets), Observation, External confirmation, Recalculation, Reperformance, Analytical procedures, and Inquiry. (AEIOU + recalculation/reperformance.)

What is an external confirmation and which ISA governs it?

Audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper or electronic form. It is governed by ISA 505, 'External Confirmations'.

Distinguish between positive and negative external confirmation requests.

A positive confirmation asks the respondent to reply in all cases (agreeing or disagreeing), giving stronger evidence. A negative confirmation asks the respondent to reply only if they disagree, providing weaker, less persuasive evidence.

When is a negative confirmation appropriate as the sole substantive procedure?

Only when the risk of material misstatement is low and controls are effective; a large number of small, homogeneous balances are involved; a very low exception rate is expected; and the auditor is not aware of circumstances that would cause recipients to disregard the request.

What assertion does a trade receivables external confirmation primarily test, and what does it not test well?

It primarily provides evidence over existence and rights (and accuracy of the balance). It does not provide good evidence over completeness or the valuation/recoverability of the receivable (whether the customer will actually pay).

What should the auditor do if management refuses to allow an external confirmation to be sent?

Inquire into management's reasons and evaluate their validity, evaluate the implications for assessed risk (including fraud) and the nature/timing/extent of other procedures, and perform alternative audit procedures. If the refusal is unreasonable or alternatives cannot give sufficient evidence, consider the implications for the audit opinion (e.g. scope limitation).