ICMA Pakistan Audit & Assurance Syllabus

Define inherent risk.

The susceptibility of an assertion about a class of transactions, account balance or disclosure to a misstatement that could be material, before consideration of any related internal controls.

Define control risk.

The risk that a material misstatement that could occur in an assertion will not be prevented, or detected and corrected on a timely basis, by the entity's internal control.

Define detection risk and explain how the auditor controls it.

Detection risk is the risk that the auditor's procedures will not detect a material misstatement that exists. The auditor controls it by adjusting the nature, timing and extent of substantive procedures; higher assessed risk of material misstatement requires lower acceptable detection risk (more/better testing).

What is the relationship between detection risk and the risk of material misstatement (inherent x control)?

They are inversely related. To keep audit risk acceptably low, when the risk of material misstatement is assessed as high, the auditor must reduce detection risk (do more substantive work); when it is low, a higher detection risk is acceptable.

Define materiality and performance materiality.

Materiality: misstatements are material if they could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. Performance materiality: an amount set below overall materiality to reduce to an appropriately low level the probability that aggregated uncorrected and undetected misstatements exceed overall materiality.

Distinguish audit strategy from the audit plan (ISA 300).

The overall audit strategy sets the scope, timing and direction of the audit and guides development of the plan. The audit plan is more detailed, describing the nature, timing and extent of planned risk assessment procedures and further audit procedures at the assertion level.

What are the benefits of audit planning?

It helps devote appropriate attention to important areas, identify and resolve problems on a timely basis, properly organize and manage the engagement, assign work to team members appropriately, facilitate direction, supervision and review, and coordinate work of experts and component auditors.

What are the five components of internal control under COSO/ISA 315?

(1) The control environment; (2) the entity's risk assessment process; (3) the information system and communication; (4) control activities; (5) monitoring of controls.

List common types of control activities.

Authorisation; performance reviews; information processing controls (application and general IT controls); physical controls (over assets and records); and segregation of duties.

What are the main purposes served by segregation of duties?

To reduce the opportunity for any one person to both perpetrate and conceal errors or fraud by separating the functions of authorising transactions, recording transactions, and maintaining custody of assets.

What is a test of controls and when does the auditor perform them?

A test of controls is an audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements. The auditor performs them when intending to rely on controls (assessing control risk as less than high) or when substantive procedures alone cannot provide sufficient appropriate evidence.

Give examples of procedures used to test the operating effectiveness of controls.

Inquiry of relevant personnel; observation of the control being applied; inspection of documents/reports for evidence of control performance; and re-performance of the control by the auditor.

Distinguish a control deficiency from a significant deficiency in internal control (ISA 265).

A deficiency exists when a control is unable to prevent/detect misstatements, or a necessary control is missing. A significant deficiency is one (or a combination) that, in the auditor's professional judgment, is of sufficient importance to merit the attention of those charged with governance.

To whom and how does the auditor report internal control deficiencies?

Significant deficiencies must be communicated in writing on a timely basis to those charged with governance. Other (less significant) deficiencies are communicated to management at an appropriate level of responsibility (often via a management/letter of weaknesses).

What makes audit evidence 'sufficient' and 'appropriate'?

Sufficiency is the measure of the quantity of evidence (affected by assessed risk and quality). Appropriateness is the measure of its quality, comprising relevance (does it address the assertion) and reliability.

What factors generally make audit evidence more reliable?

Evidence is more reliable when obtained from independent external sources; when related internal controls are effective; when obtained directly by the auditor; when in documentary form (paper or electronic) rather than oral; and when provided by original documents rather than copies.

List the financial statement assertions about classes of transactions and events.

Occurrence, Completeness, Accuracy, Cut-off, Classification, and Presentation.

List the financial statement assertions about account balances at period end.

Existence, Rights and obligations, Completeness, Accuracy/valuation and allocation, Classification, and Presentation.

List the types of audit procedures used to obtain audit evidence.

Inspection, Observation, External confirmation, Recalculation, Re-performance, Analytical procedures, and Inquiry.

What are substantive procedures and their two categories?

Substantive procedures are audit procedures designed to detect material misstatements at the assertion level. The two categories are: (1) tests of details (of transactions and balances) and (2) substantive analytical procedures.

What are analytical procedures and where in the audit are they required?

Analytical procedures are evaluations of financial information through analysis of plausible relationships among financial and non-financial data. They are required at the risk assessment (planning) stage and at the overall review (final/completion) stage, and may also be used as substantive procedures.

Define audit sampling.

The application of audit procedures to less than 100% of the items within a population of audit relevance such that all sampling units have a chance of selection, in order to provide a reasonable basis for the auditor to draw conclusions about the entire population.

Distinguish sampling risk from non-sampling risk.

Sampling risk is the risk that the auditor's conclusion based on a sample differs from the conclusion if the whole population were tested. Non-sampling risk is the risk of an erroneous conclusion for any reason unrelated to sampling, e.g. using inappropriate procedures or misinterpreting evidence.

Distinguish statistical from non-statistical sampling.

Statistical sampling uses random selection and probability theory to measure and evaluate sampling risk quantitatively. Non-statistical (judgmental) sampling relies on the auditor's judgment to select the sample and evaluate results, without a quantified measure of sampling risk.

Which assertion is primarily tested by directional testing from the source documents to the records (vouching the other way), and what is the key risk for receivables versus payables?

For trade receivables the key risk is overstatement (test existence by tracing recorded balances to external confirmations/evidence). For trade payables the key risk is understatement/completeness (search for unrecorded liabilities).

What is the primary audit procedure to verify the existence of trade receivables, and what are positive and negative confirmations?

External (direct) confirmation of balances with customers. A positive confirmation asks the customer to reply confirming agreement or disagreement; a negative confirmation asks for a reply only if the customer disagrees, providing weaker evidence.

What is the principal audit procedure for verifying the existence and condition of inventory?

Attendance at the physical inventory count, observing the count, performing test counts (from records to floor for existence and floor to records for completeness), and assessing the condition of items for valuation.

How is inventory valued for audit purposes and what is tested?

Inventory is measured at the lower of cost and net realisable value (IAS 2). The auditor tests cost (e.g. FIFO/weighted average) by reference to invoices and NRV by reference to post-year-end selling prices, checking for slow-moving or obsolete items.

What are subsequent events and the two types under ISA 560?

Subsequent events are events occurring between the date of the financial statements and the date of the auditor's report (and facts discovered after). Adjusting events provide evidence of conditions existing at the reporting date (adjust the figures); non-adjusting events are indicative of conditions arising after the reporting date (disclose if material).

What is the going concern basis, and what is the auditor's responsibility regarding it (ISA 570)?

The going concern basis assumes the entity will continue in operation for the foreseeable future. The auditor must obtain sufficient appropriate evidence about, and conclude on, the appropriateness of management's use of the going concern basis, and whether a material uncertainty exists. If a material uncertainty is adequately disclosed, the opinion is unmodified with a 'Material Uncertainty Related to Going Concern' section; if inadequately disclosed, the opinion is modified.

What are written representations and why are they obtained (ISA 580)?

Written representations are written statements by management to the auditor confirming certain matters or supporting other evidence (e.g. that management has fulfilled its responsibilities and disclosed all relevant information). They are necessary audit evidence but are not sufficient on their own and do not relieve the auditor of other procedures. They are required at or near the date of the auditor's report.

What is the purpose of the overall review of financial statements at the completion stage?

To assess, using analytical procedures and overall evaluation, whether the financial statements are consistent with the auditor's knowledge of the business, whether accounting policies are appropriate and adequately disclosed, and whether the financial statements as a whole give a true and fair view and comply with the applicable framework.

What is the difference between fraud and error in an audit context?

Both result in misstatements. Error is an unintentional misstatement (e.g. a mistake in processing data). Fraud is an intentional act by one or more individuals involving deception to obtain an unjust or illegal advantage; for the auditor it is distinguished by intent and includes fraudulent financial reporting and misappropriation of assets.