ICAP CFAP CFAP-6: Audit, Assurance and Data Syllabus

CFAP-6: Audit, Assurance and Data syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for CFAP-6: Audit, Assurance and Data in ICAP CFAP, not a summary of it.

1. 1

   Audit Planning, Risk and Evidence

   5 topics

   • General Principles and Responsibilities in an Audit
   • Assessing Risks of Material Misstatement
   • ICT and Data Analytics in Auditing
   • Internal Controls and Cyber Security
   • Sufficient and Appropriate Audit Evidence
2. 2

   Specific Audit Considerations

   6 topics

   • Group Audits, Using Internal Audit and Auditor's Expert
   • Consideration of Laws and Regulations
   • Going Concern
   • Related Parties and Written Representations
   • Subsequent Events
   • Entities Using a Service Organization
3. 3

   Audit Conclusions and Reporting

   3 topics

   • Forming and Reporting the Audit Opinion
   • Independent Auditor's Report Content
   • Comparative Information and Other Information
4. 4

   Other Assurance and Related Services

   7 topics

   • Special Purpose Frameworks and Single Financial Statements
   • Review Engagements of Historical Financial Statements
   • Assurance Engagements Other than Audits or Reviews
   • Prospective and Pro Forma Financial Information
   • Reporting on Controls at a Service Organization
   • Greenhouse Gas Statement Assurance
   • Agreed-upon Procedures and Compilation Engagements
5. 5

   Ethics, Quality Control and Professional Requirements

   3 topics

   • Applying the Code of Ethics to Complex Scenarios
   • Quality Management for Audits, Reviews and Assurance Engagements
   • Laws Relating to Professional Misconduct

CFAP-6: Audit, Assurance and Data flashcards for ICAP CFAP

19 of 61 cards from the CFAP-6: Audit, Assurance and Data deck — real questions with worked answers.

1. What is the overall objective of the auditor under ISA 200?

   To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement (whether due to fraud or error), enabling the auditor to express an opinion on whether they are prepared, in all material respects, in accordance with the applicable financial reporting framework; and to report and communicate as required by the ISAs.

2. Define 'reasonable assurance' in the context of an audit.

   A high, but not absolute, level of assurance. It is obtained when the auditor has gathered sufficient appropriate audit evidence to reduce audit risk to an acceptably low level. It is not absolute because of inherent limitations of an audit.

3. What is 'professional skepticism' under ISA 200?

   An attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to fraud or error, and a critical assessment of audit evidence.

4. State the audit risk model formula.

   Audit Risk = Inherent Risk x Control Risk x Detection Risk. (Risk of Material Misstatement = Inherent Risk x Control Risk.)

5. What is the relationship between detection risk and the risk of material misstatement?

   They are inversely related. The higher the assessed risk of material misstatement, the lower the detection risk the auditor must accept, requiring more/more persuasive audit evidence (more substantive work).

6. Under ISA 315 (Revised), what are the two components into which risk of material misstatement is assessed?

   Inherent risk and control risk, assessed separately at both the financial statement level and the assertion level for classes of transactions, account balances and disclosures.

7. What are the five components of internal control under ISA 315?

   (1) Control environment, (2) Entity's risk assessment process, (3) Information system and communication, (4) Control activities, (5) Monitoring of controls.

8. Define a 'significant risk' under ISA 315 (Revised).

   An identified risk of material misstatement for which the assessment of inherent risk is close to the upper end of the spectrum of inherent risk (high likelihood and high magnitude), or that is to be treated as a significant risk in accordance with the requirements of other ISAs.

9. What are the inherent risk factors the auditor considers under ISA 315 (Revised)?

   Complexity, subjectivity, change, uncertainty, and susceptibility to misstatement due to management bias or fraud (and other factors affecting susceptibility to misstatement).

10. What is materiality, and how does performance materiality differ from it (ISA 320)?

    Materiality: the magnitude of misstatements that could reasonably influence the economic decisions of users. Performance materiality: an amount(s) set lower than overall materiality to reduce to an appropriately low level the probability that uncorrected and undetected misstatements exceed materiality.

11. In ICT/data analytics auditing, what is an Audit Data Analytics (ADA)?

    The science and art of discovering and analysing patterns, deviations and inconsistencies, and extracting other useful information in data underlying or related to the subject matter of an audit, through analysis, modelling and visualisation, for planning or performing the audit.

12. Give two examples of how data analytics can be used in an audit.

    Examples: testing 100% of a population (full-population testing) rather than sampling; journal entry testing for unusual entries; three-way matching of orders/receipts/invoices; recalculation of large datasets; identifying duplicate payments; trend and ratio analysis across the whole ledger.

13. What is a CAAT (Computer-Assisted Audit Technique)? Name the two main types.

    A CAAT uses the computer as an audit tool. Two main types: (1) Audit software (e.g. data extraction/interrogation tools used to test data files), and (2) Test data (data with known results processed through the client's system to test controls).

14. Distinguish general IT controls (GITCs) from application controls.

    GITCs are policies/procedures relating to many applications, supporting the effective functioning of application controls (e.g. access security, change management, IT operations, program development). Application controls are manual or automated controls operating at the business process level applied to individual applications (e.g. input, processing, output controls).

15. What are the three categories of application controls?

    Input controls (ensure data entered is complete, accurate and authorised), Processing controls (ensure data is processed correctly), and Output controls (ensure output is complete, accurate and distributed appropriately).

16. Name three common cyber security threats relevant to an audit client.

    Examples: malware/ransomware, phishing and social engineering, denial-of-service (DoS/DDoS) attacks, unauthorised access/hacking, data breaches, and insider threats.

17. What is the auditor's responsibility regarding a client's cyber security incident?

    To consider whether the incident could result in material misstatement (e.g. impaired assets, contingent liabilities, going concern issues, disclosure deficiencies) and whether it indicates a control deficiency to be communicated to those charged with governance; it is management's responsibility to prevent and detect breaches.

18. Define 'sufficient appropriate audit evidence' (ISA 500).

    Sufficiency is the measure of the quantity of audit evidence; appropriateness is the measure of the quality (relevance and reliability). The auditor must obtain enough good-quality evidence to reduce audit risk to an acceptably low level and support the opinion.

19. List the factors that affect the reliability of audit evidence (ISA 500).

    Reliability is greater when: obtained from independent external sources; internally generated under effective controls; obtained directly by the auditor; in documentary form (rather than oral); and original documents (rather than copies/scans).

See more CFAP-6: Audit, Assurance and Data flashcards →

Planning CFAP-6: Audit, Assurance and Data for ICAP CFAP

CFAP-6: Audit, Assurance and Data (ICAP CFAP) FAQ