Institute of Financial Accountants (IFA) Qualifications Audit, Assurance and Professional Ethics Syllabus

What is the purpose of an overall audit strategy?

It sets the scope, timing and direction of the audit and guides development of the detailed audit plan, addressing resources, key dates, materiality and reporting objectives.

How does the audit strategy differ from the audit plan?

The strategy is the high-level overall approach (scope, timing, direction, resources); the audit plan is the more detailed description of the nature, timing and extent of specific risk assessment and further audit procedures to be performed.

What are analytical procedures?

Evaluations of financial information through analysis of plausible relationships among both financial and non-financial data, including investigation of identified fluctuations or relationships that are inconsistent with other information or differ from expected values.

At which stages of the audit are analytical procedures used, and is each stage mandatory?

Planning (risk assessment – mandatory), substantive testing (optional, as substantive analytical procedures), and at the overall review/completion stage (mandatory, to form an overall conclusion).

Name four common ratios used in analytical procedures.

Gross profit margin ($\frac{\text{Gross profit}}{\text{Revenue}}$), current ratio ($\frac{\text{Current assets}}{\text{Current liabilities}}$), receivables collection period ($\frac{\text{Receivables}}{\text{Credit sales}} \times 365$), and gearing ($\frac{\text{Debt}}{\text{Equity}}$).

What are the five components of internal control under the COSO/ISA 315 framework?

(1) The control environment; (2) the entity's risk assessment process; (3) the information system and communication; (4) control activities; (5) monitoring of controls.

What is the difference between a test of control and a substantive procedure?

A test of control evaluates the operating effectiveness of a control in preventing/detecting material misstatements. A substantive procedure detects material misstatements at the assertion level directly (tests of detail and substantive analytical procedures).

List five common types of control activity.

Authorisation, performance reviews, information processing controls (including general IT and application controls), physical controls over assets, and segregation of duties.

What does the mnemonic 'walkthrough test' achieve in evaluating internal control?

Tracing one or a few transactions through the entire accounting/control system to confirm the auditor's understanding of how the system operates and that controls are implemented as described.

Why does a deficiency in internal control increase control risk?

Because the control fails to prevent, or detect and correct, misstatements on a timely basis, so the auditor cannot rely on it and must increase substantive testing to keep detection risk low.

What are the qualities of audit evidence the auditor must obtain (ISA 500)?

Sufficient (a measure of quantity) and appropriate (a measure of quality – relevance and reliability) audit evidence to support the audit opinion.

List factors that increase the reliability of audit evidence.

Evidence from independent external sources, evidence obtained directly by the auditor, evidence in documentary/written form rather than oral, original documents rather than copies, and evidence generated under effective internal control.

What are financial statement assertions for classes of transactions and events?

Occurrence, completeness, accuracy, cut-off, classification, and presentation.

What are the assertions for account balances at period end?

Existence, rights and obligations, completeness, accuracy/valuation and allocation, classification, and presentation.

Match the assertion to the risk: which assertion addresses the risk that recorded sales did not actually occur?

The occurrence assertion (the sales transactions recorded actually took place and pertain to the entity).

List the main procedures for obtaining audit evidence (the 'AEIOU + RR' methods).

Analytical procedures, Enquiry, Inspection, Observation, recalculation/reperformance, and external confirmation (recalculation and reperformance often grouped together).

What substantive procedures provide evidence over the existence of inventory?

Attendance at the inventory count, observation of count procedures, performing test counts (floor-to-sheet and sheet-to-floor), and reviewing cut-off around the count date.

What is the primary procedure to test the existence and rights of trade receivables?

External (direct) confirmation of balances with customers (positive or negative confirmation), supplemented by after-date cash receipts review for non-responses.

How does an auditor test the valuation assertion for trade receivables?

Review the aged receivables listing, assess the adequacy of the allowance for doubtful debts, examine after-date cash receipts, and consider disputed/old balances and credit notes issued after year end.

What are the two broad approaches to audit sampling?

Statistical sampling (uses random selection and probability theory to measure sampling risk) and non-statistical (judgemental) sampling (selection and evaluation based on auditor judgement).

What is sampling risk?

The risk that the auditor's conclusion based on a sample may differ from the conclusion if the entire population were tested. It includes the risk of incorrect acceptance and incorrect rejection.

Why must audit work be documented (ISA 230)?

To provide a sufficient and appropriate record of the basis for the auditor's report and evidence that the audit was planned and performed in accordance with ISAs and legal/regulatory requirements, enabling quality review and accountability.

What is the 'experienced auditor' test for audit documentation?

Documentation should be sufficient to enable an experienced auditor, with no previous connection to the audit, to understand the nature, timing and extent of procedures performed, the results, evidence obtained, and significant matters and conclusions reached.

What are subsequent events in auditing (ISA 560)?

Events occurring between the date of the financial statements and the date of the auditor's report, and facts that become known to the auditor after the date of the report. They are classified as adjusting or non-adjusting events.

Distinguish adjusting from non-adjusting subsequent events.

Adjusting events provide evidence of conditions that existed at the reporting date (financial statements are adjusted). Non-adjusting events arose after the reporting date (disclose only if material; do not adjust).

What is the going concern basis of accounting and the auditor's responsibility regarding it?

The assumption that the entity will continue in operation for the foreseeable future (at least 12 months). The auditor evaluates management's assessment, considers whether a material uncertainty exists, and assesses the appropriateness of the basis used.

How should the auditor's report respond when a material uncertainty related to going concern is adequately disclosed?

Issue an unmodified opinion but include a separate 'Material Uncertainty Related to Going Concern' section drawing attention to the disclosure note.

What are written representations and why are they obtained (ISA 580)?

Written statements by management provided to the auditor to confirm certain matters or support other evidence (e.g. that management has fulfilled its responsibilities and disclosed all relevant information). They are necessary but are not sufficient appropriate evidence on their own.

What is the purpose of the audit (engagement) file review at completion?

To ensure sufficient appropriate evidence has been obtained, work has been adequately performed and documented, and conclusions support the opinion; for listed/PIE audits an engagement quality review (EQR) by an independent reviewer may be required before the report is signed.

What are the elements of an unmodified auditor's report?

Title; addressee; opinion section; basis for opinion; (KAM for listed); going concern; other information; respective responsibilities of management/those charged with governance and the auditor; auditor's signature, name, location and date.

What are the three types of modified audit opinion and when is each used?

Qualified ('except for' – material but not pervasive misstatement or inability to obtain evidence); Adverse (material and pervasive misstatement – financial statements do not give a true and fair view); Disclaimer (material and pervasive inability to obtain sufficient appropriate evidence).

Complete the matrix: misstatement that is material but NOT pervasive leads to which opinion? Material AND pervasive?

Material but not pervasive misstatement: qualified ('except for') opinion. Material and pervasive misstatement: adverse opinion.

Complete the matrix: inability to obtain sufficient appropriate evidence that is material but not pervasive vs material and pervasive.

Material but not pervasive: qualified ('except for') opinion. Material and pervasive: disclaimer of opinion.

What are Key Audit Matters (KAM) and which engagements require them?

Those matters that, in the auditor's professional judgement, were of most significance in the audit of the current period's financial statements. Required for audits of listed entities and where otherwise agreed/required.

What is the difference between an 'Emphasis of Matter' and an 'Other Matter' paragraph?

Emphasis of Matter draws attention to a matter appropriately presented/disclosed in the financial statements that is fundamental to users' understanding (opinion unmodified). Other Matter refers to a matter not presented/disclosed in the financial statements but relevant to users' understanding of the audit or auditor's responsibilities.

What must the auditor communicate to those charged with governance (ISA 260)?

The auditor's responsibilities, the planned scope and timing of the audit, significant findings (including significant difficulties, deficiencies in internal control, qualitative aspects of accounting practices), and auditor independence (for listed entities).

What is the difference between communicating with those charged with governance and reporting deficiencies to management (ISA 265)?

Significant deficiencies in internal control must be communicated in writing to those charged with governance on a timely basis; other (lesser) deficiencies of sufficient importance may be communicated to management, often via a management letter.

List the five fundamental principles of professional ethics (IESBA/ICAEW/IFA Code).

Integrity, Objectivity, Professional competence and due care, Confidentiality, and Professional behaviour.

Define the fundamental principle of integrity.

To be straightforward and honest in all professional and business relationships; it implies fair dealing and truthfulness.

Define the fundamental principle of objectivity.

Not to compromise professional or business judgements because of bias, conflict of interest or undue influence of others.

What does professional competence and due care require?

Attaining and maintaining professional knowledge and skill at the level required to ensure competent professional service based on current developments, and acting diligently and in accordance with applicable technical and professional standards.

When may a professional accountant disclose confidential client information?

When disclosure is permitted by law and authorised by the client, required by law (e.g. evidence in legal proceedings, money laundering reports), or there is a professional duty/right to disclose where not prohibited by law (e.g. to comply with quality reviews or defend in litigation).

Name the five categories of threat to compliance with the fundamental principles.

Self-interest threat, self-review threat, advocacy threat, familiarity threat, and intimidation threat.

Define a self-review threat and give an example.

The threat that an accountant will not appropriately evaluate the results of a previous judgement or service they (or their firm) performed. Example: auditing financial statements that include figures the firm prepared (e.g. providing accounting/bookkeeping services then auditing them).

Define an advocacy threat and give an example.

The threat that an accountant will promote a client's position to the point that objectivity is compromised. Example: acting as an advocate for an audit client in litigation or promoting its shares in a securities offering.

Define a familiarity threat and give an example.

The threat that, due to a long or close relationship, an accountant will be too sympathetic to a client's interests or too accepting of their work. Example: a long association of senior personnel with the audit client, or a close family member in a key role at the client.

Define an intimidation threat and give an example.

The threat that an accountant will be deterred from acting objectively because of actual or perceived pressures, including attempts to exercise undue influence. Example: threat of dismissal or litigation, or pressure to reduce fees inappropriately.

What are the two broad categories of safeguard against ethical threats?

Safeguards created by the profession, legislation or regulation (e.g. CPD requirements, professional standards, external monitoring), and safeguards within the firm and engagement (e.g. policies, second partner review, rotation, independent EQR).

What is independence in the context of assurance engagements, and its two aspects?

Independence is freedom from conditions that threaten objectivity. Independence of mind (the state allowing an opinion without compromise) and independence in appearance (avoidance of facts/circumstances so significant a reasonable third party would conclude integrity/objectivity is compromised).

How long can a key audit partner act for a listed/PIE audit client before rotation, and why?

Generally a maximum of 7 years, after which a 'cooling-off' period applies (e.g. 5 years for the engagement partner under the FRC/IESBA rules), to mitigate the familiarity and self-interest threats.

Why are contingent fees prohibited for audit and assurance engagements?

A contingent fee (where the fee depends on the outcome) creates a significant self-interest threat to objectivity and independence that no safeguard could reduce to an acceptable level.

What is the risk when fees from one audit client are a large proportion of a firm's total fees?

A self-interest and intimidation threat from fee dependency. For listed/PIE clients, where total fees exceed certain thresholds (e.g. 15% of the firm's total fees for two consecutive years), disclosure to those charged with governance and an independent (pre- or post-issuance) review are required.

Why must an auditor not own shares in an audit client?

A direct financial interest creates a self-interest threat to independence so significant that no safeguard can reduce it to an acceptable level; the interest must be disposed of or the engagement declined.

What is the conceptual framework approach to resolving ethical issues?

Identify threats to compliance with the fundamental principles, evaluate their significance, and apply safeguards to eliminate them or reduce them to an acceptable level; if this is not possible, decline or discontinue the engagement/service.

What steps should an accountant take to resolve an ethical conflict?

Consider the relevant facts, ethical issues, fundamental principles and established internal procedures; consult on a confidential basis with those charged with governance or the professional body; and if unresolved, consider obtaining legal advice and, where appropriate, withdrawing from the engagement or employment.

What is the auditor's obligation under money laundering regulations regarding suspicious activity?

To report knowledge or suspicion of money laundering to the firm's Money Laundering Reporting Officer (MLRO) or relevant authority, and to avoid 'tipping off' the client. This overrides the duty of confidentiality.

What is professional scepticism and why is it required throughout the audit?

An attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement due to error or fraud, and a critical assessment of audit evidence; it counters bias and the risk of management override and over-reliance on representations.