PIPFA Audit, Assurance and Ethics Syllabus

List areas of the entity an auditor must understand under ISA 315.

Industry, regulatory and external factors; the entity's nature (operations, ownership, structure); accounting policies; objectives, strategies and related business risks; measurement and review of financial performance; and the entity's internal control.

Define 'audit risk'.

The risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. It is a function of the risks of material misstatement and detection risk.

State the audit risk model (formula).

Audit Risk = Inherent Risk x Control Risk x Detection Risk (AR = IR x CR x DR).

Define inherent risk.

The susceptibility of an assertion about a class of transactions, account balance or disclosure to a misstatement that could be material, before consideration of any related internal controls.

Define control risk.

The risk that a material misstatement in an assertion will not be prevented, or detected and corrected, on a timely basis by the entity's internal control.

Define detection risk.

The risk that the auditor's procedures will not detect a material misstatement that exists in an assertion. It is the component the auditor controls by varying the nature, timing and extent of substantive procedures.

What is the relationship between detection risk and the risk of material misstatement?

They are inversely related: the higher the assessed risk of material misstatement, the lower the acceptable detection risk, so the auditor must perform more/more effective substantive procedures (and vice versa).

Define 'materiality'.

Information is material if its omission or misstatement could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. It has both quantitative (size) and qualitative (nature) aspects.

What is 'performance materiality'?

An amount set by the auditor at less than materiality for the financial statements as a whole, to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality.

Define 'internal control'.

The process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about the achievement of objectives relating to reliability of financial reporting, effectiveness/efficiency of operations, and compliance with laws and regulations.

List the five components of internal control under ISA 315 (COSO).

(1) The control environment; (2) the entity's risk assessment process; (3) the information system and communication; (4) control activities; (5) monitoring of controls.

Give five examples of control activities.

Authorisation, performance reviews, information processing controls, physical controls over assets and records, and segregation of duties.

What is 'segregation of duties'?

Dividing responsibilities so that no single person controls all stages of a transaction (e.g. authorisation, recording, and custody of assets are separated), reducing the risk of error and fraud.

What is a 'test of control'?

An audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level.

When does an auditor perform tests of control?

When the auditor intends to rely on the operating effectiveness of controls to reduce substantive testing, or when substantive procedures alone cannot provide sufficient appropriate evidence at the assertion level.

Give four examples of techniques used in tests of control.

Inspection of documents for evidence of authorisation, observation of a control being performed, reperformance of the control by the auditor, and inquiry of personnel (combined with other procedures).

What does 'sufficient appropriate audit evidence' mean?

Sufficiency is the measure of the quantity of evidence; appropriateness is the measure of its quality, i.e. its relevance and reliability in supporting the audit conclusions (ISA 500).

State factors affecting the reliability of audit evidence.

Evidence is more reliable when obtained from independent external sources, when internal controls are effective, when obtained directly by the auditor, when in documentary form, and when from original documents rather than copies.

List the procedures for obtaining audit evidence under ISA 500.

Inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, and inquiry.

What are 'substantive procedures'?

Audit procedures designed to detect material misstatements at the assertion level. They comprise (a) tests of details (of transactions, balances and disclosures) and (b) substantive analytical procedures.

What are 'analytical procedures'?

Evaluations of financial information through analysis of plausible relationships among financial and non-financial data, including investigation of identified fluctuations or relationships inconsistent with other information or expected values.

List the financial statement assertions about account balances.

Existence, rights and obligations, completeness, and valuation and allocation (for balances at period end).

List the assertions about classes of transactions and events.

Occurrence, completeness, accuracy, cut-off, and classification.

Define 'audit sampling'.

The application of audit procedures to less than 100% of items within a population of audit relevance such that all sampling units have a chance of selection, in order to draw a conclusion about the entire population (ISA 530).

Distinguish statistical from non-statistical sampling.

Statistical sampling uses random selection and probability theory to measure sampling risk; non-statistical sampling relies on the auditor's judgement to select the sample and evaluate results without quantifying sampling risk.

What is 'sampling risk'?

The risk that the auditor's conclusion based on a sample may differ from the conclusion if the entire population were subjected to the same procedure (e.g. wrongly concluding a control is effective or a balance is not materially misstated).

What is 'non-sampling risk'?

The risk that the auditor reaches an erroneous conclusion for any reason not related to sampling size, such as using inappropriate procedures or misinterpreting evidence.

What is the 'going concern' assumption?

The assumption that an entity will continue in operation for the foreseeable future and has neither the intention nor the need to liquidate or curtail materially the scale of its operations; under it, assets and liabilities are recorded on the basis the entity can realise/settle them in the normal course of business.

Give three indicators that may cast doubt on going concern.

Financial: net liabilities, recurring losses, inability to pay creditors, adverse key ratios, withdrawal of financial support. Operating: loss of key management/market/supplier, labour difficulties. Other: pending legal/regulatory action, uninsured catastrophes.

What are the auditor's responsibilities regarding going concern (ISA 570)?

To obtain sufficient appropriate evidence on the appropriateness of management's use of the going concern basis, conclude on whether a material uncertainty exists, and report implications in the auditor's report (including a 'Material Uncertainty Related to Going Concern' section where applicable).

Name the four types of audit opinion.

Unmodified (unqualified) opinion, qualified opinion, adverse opinion, and disclaimer of opinion.

When is an 'unmodified opinion' given?

When the auditor concludes that the financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework (i.e. they give a true and fair view).

What two circumstances lead to a modified opinion?

(1) The financial statements are materially misstated; or (2) the auditor is unable to obtain sufficient appropriate audit evidence (a limitation of scope).

Distinguish a qualified opinion from an adverse opinion / disclaimer (based on pervasiveness).

Qualified ('except for') = misstatement or inability to obtain evidence is material but NOT pervasive. Adverse = misstatements are material AND pervasive. Disclaimer = inability to obtain evidence is material AND pervasive (no opinion expressed).

What does 'pervasive' mean in the context of audit opinions?

Effects that are not confined to specific elements of the FS; or if confined, represent a substantial proportion of the FS; or, for disclosures, are fundamental to users' understanding of the FS.

What is an 'Emphasis of Matter' paragraph?

A paragraph in the auditor's report referring to a matter appropriately presented or disclosed in the FS that, in the auditor's judgement, is of such importance that it is fundamental to users' understanding. It does NOT modify the opinion.

List the principal elements of an unmodified auditor's report under ISA 700.

Title; addressee; Opinion section; Basis for Opinion; (Going Concern if relevant); Key Audit Matters (listed entities); responsibilities of management/TCWG; auditor's responsibilities; other reporting responsibilities; auditor's signature; engagement partner name; auditor's address; and date.

What are 'Key Audit Matters' (KAM)?

Those matters that, in the auditor's professional judgement, were of most significance in the audit of the current period's financial statements. They are selected from matters communicated to those charged with governance and reported in the auditor's report of listed entities (ISA 701).

List the five fundamental principles of professional ethics for accountants (IESBA Code).

Integrity, Objectivity, Professional competence and due care, Confidentiality, and Professional behaviour.

What does the fundamental principle of 'integrity' require?

To be straightforward and honest in all professional and business relationships.

What does 'objectivity' require?

Not to compromise professional or business judgements because of bias, conflict of interest, or undue influence of others.

What does 'professional competence and due care' require?

To attain and maintain professional knowledge and skill at the level required to provide competent professional service based on current developments, and to act diligently in accordance with applicable technical and professional standards.

What does the principle of 'confidentiality' require, and when may information be disclosed?

To respect the confidentiality of information acquired through professional/business relationships and not disclose or use it for personal advantage. Disclosure is permitted when there is legal/professional right or duty to disclose, or with proper authority.

What does 'professional behaviour' require?

To comply with relevant laws and regulations and avoid any conduct that the professional accountant knows or should know might discredit the profession.

Name the five categories of threats to compliance with the fundamental principles.

Self-interest, self-review, advocacy, familiarity, and intimidation threats.

Define the 'self-interest' threat with an example.

The threat that a financial or other interest will inappropriately influence judgement or behaviour. Example: holding shares in the audit client, or a contingent fee arrangement, or fee dependence on one client.

Define the 'self-review' threat with an example.

The threat that the firm will not appropriately evaluate the results of a previous judgement or service performed by the firm/individual on which it now relies. Example: auditing financial statements the firm itself prepared, or valuing assets it now audits.

Define the 'advocacy' threat with an example.

The threat that a professional accountant will promote a client's or employer's position to the point that objectivity is compromised. Example: acting as the client's advocate in litigation or promoting its shares.

Define the 'familiarity' threat with an example.

The threat that, due to a long or close relationship, an accountant will be too sympathetic to a client's interests or too accepting of its work. Example: a long-serving engagement partner, or a close family member in a key client role.

Define the 'intimidation' threat with an example.

The threat that an accountant will be deterred from acting objectively because of actual or perceived pressures, including undue influence. Example: threat of dismissal/replacement over a disagreement, or threat of litigation.

What are 'safeguards' against threats to ethical principles?

Actions, individually or in combination, that the accountant takes to effectively reduce identified threats to compliance with the fundamental principles to an acceptable level.

Give examples of safeguards created by the profession, legislation or regulation.

Educational/training and experience requirements for entry; continuing professional development; corporate governance regulations; professional standards; and professional/regulatory monitoring and disciplinary procedures.

How should fee dependence on a single audit client be safeguarded?

Where total fees from a client (or its group) represent a large proportion of total firm fees, safeguards include reducing dependency, engaging an external quality (pre- or post-issuance) review, and consulting a professional/regulatory body; required disclosure to those charged with governance.

Why does providing certain non-assurance services to an audit client create a threat?

It can create self-review and self-interest threats (and sometimes advocacy/management threats), because the firm may end up auditing its own work or becoming too aligned with management; for listed/public interest entities such services are often prohibited.