ICAP CAF CAF-8: Audit and Assurance Essentials Flashcards

24 sample cards from the CAF-8: Audit and Assurance Essentials deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. Define audit risk and give its formula/components.

   Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. Audit Risk = Inherent Risk x Control Risk x Detection Risk.

2. Define inherent risk.

   The susceptibility of an assertion about a class of transactions, account balance or disclosure to a misstatement that could be material, before consideration of any related controls (e.g. complex estimates, susceptibility to fraud).

3. Define control risk.

   The risk that a material misstatement that could occur in an assertion will not be prevented, or detected and corrected, on a timely basis by the entity's internal control.

4. Define detection risk and state how the auditor controls it.

   The risk that the auditor's procedures will not detect a material misstatement that exists. The auditor controls it by adjusting the nature, timing and extent of audit procedures: higher assessed inherent/control risk requires lower detection risk and therefore more/better testing.

5. What is the inverse relationship between detection risk and the risk of material misstatement?

   For a given (acceptable) level of audit risk, detection risk is inversely related to the assessed risk of material misstatement (inherent x control). The higher the assessed RMM, the lower the detection risk the auditor must accept, requiring more extensive procedures.

6. Per ISA 315, what areas should the auditor understand about the entity and its environment?

   The relevant industry, regulatory and other external factors (including the applicable financial reporting framework); the nature of the entity (operations, ownership, financing); its accounting policies; its objectives, strategies and related business risks; measurement and review of financial performance; and the entity's internal control.

7. Name the five components of internal control (ISA 315).

   (1) The control environment, (2) the entity's risk assessment process, (3) the information system relevant to financial reporting, (4) control activities, and (5) monitoring of controls.

8. List risk assessment procedures used to understand the entity.

   Inquiries of management and others within the entity; analytical procedures; and observation and inspection. (Plus information from client acceptance, prior audits and the engagement partner.)

9. Define materiality.

   Information is material if its omission or misstatement could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements. It has both quantitative (size) and qualitative (nature) aspects.

10. What is performance materiality?

    An amount (or amounts) set by the auditor at less than materiality for the financial statements as a whole, to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds overall materiality.

11. Give common benchmarks used to calculate materiality.

    Typically: about 0.5%-1% of revenue, 1%-2% of total assets, or 5%-10% of profit before tax. The auditor selects an appropriate benchmark and percentage using professional judgement.

12. Distinguish between fraud and error.

    Both are misstatements; the distinction is intent. Error is unintentional (e.g. mistakes in gathering/processing data, incorrect estimates, misapplication of policies). Fraud is an intentional act involving deception to obtain an unjust or illegal advantage.

13. What are the two types of fraud relevant to the auditor (ISA 240)?

    (1) Fraudulent financial reporting (intentional misstatement/omission in the financial statements, often by management override), and (2) misappropriation of assets (theft of the entity's assets, often by employees).

14. What three conditions form the 'fraud triangle'?

    Incentive/pressure to commit fraud, opportunity (e.g. weak controls or ability to override them), and rationalisation/attitude that justifies the fraudulent act.

15. When is audit evidence 'sufficient and appropriate' (ISA 500)?

    Sufficiency is the measure of the quantity of evidence (affected by risk and quality). Appropriateness is the measure of quality — its relevance and reliability in supporting the conclusions. Both are needed for a reasonable basis for the opinion.

16. State the factors that affect the reliability of audit evidence.

    Evidence is more reliable when: obtained from independent external sources; generated internally under effective controls; obtained directly by the auditor (e.g. observation); in documentary form (paper/electronic) rather than oral; and provided by original documents rather than copies.

17. List the financial statement assertions about classes of transactions and events.

    Occurrence, Completeness, Accuracy, Cut-off, and Classification (and presentation).

18. List the financial statement assertions about account balances at period end.

    Existence, Rights and obligations, Completeness, and Accuracy, valuation and allocation (and presentation/classification).

19. Name the types of audit procedures used to obtain evidence.

    Inspection (of records/documents or assets), Observation, External confirmation, Recalculation, Reperformance, Analytical procedures, and Inquiry. (AEIOU + recalculation/reperformance.)

20. What is an external confirmation and which ISA governs it?

    Audit evidence obtained as a direct written response to the auditor from a third party (the confirming party), in paper or electronic form. It is governed by ISA 505, 'External Confirmations'.

21. Distinguish between positive and negative external confirmation requests.

    A positive confirmation asks the respondent to reply in all cases (agreeing or disagreeing), giving stronger evidence. A negative confirmation asks the respondent to reply only if they disagree, providing weaker, less persuasive evidence.

22. When is a negative confirmation appropriate as the sole substantive procedure?

    Only when the risk of material misstatement is low and controls are effective; a large number of small, homogeneous balances are involved; a very low exception rate is expected; and the auditor is not aware of circumstances that would cause recipients to disregard the request.

23. What assertion does a trade receivables external confirmation primarily test, and what does it not test well?

    It primarily provides evidence over existence and rights (and accuracy of the balance). It does not provide good evidence over completeness or the valuation/recoverability of the receivable (whether the customer will actually pay).

24. What should the auditor do if management refuses to allow an external confirmation to be sent?

    Inquire into management's reasons and evaluate their validity, evaluate the implications for assessed risk (including fraud) and the nature/timing/extent of other procedures, and perform alternative audit procedures. If the refusal is unreasonable or alternatives cannot give sufficient evidence, consider the implications for the audit opinion (e.g. scope limitation).

What this deck covers

CAF-8: Audit and Assurance Essentials flashcards FAQ