Summary - Chapter Notes Combined With Lecture Notes - Chapter 1,2,4,5,8-10 Summary - Chapter Notes Combined With Lecture Notes - Chapter 1,2,4,5,8-10
Summary - Chapter Notes Combined With Lecture Notes - Chapter 1,2,4,5,8-10 Summary - Chapter Notes Combined With Lecture Notes - Chapter 1,2,4,5,8-10
Summary - Chapter Notes Combined With Lecture Notes - Chapter 1,2,4,5,8-10 Summary - Chapter Notes Combined With Lecture Notes - Chapter 1,2,4,5,8-10
• ‘intended users’ - the people for whom the auditor prepares their report.
Example: shareholders, creditors, employees
• ‘responsible party’ - the person or organisation responsible for preparing the
financial statements. Example: company management
• ‘subject matter’ – that which the auditor is expressing a conclusion on. Example:
financial reports
• ‘criteria’ – the rules or principles by which the subject matter is being evaluated.
Example: Accounting standards and interpretations and Corporations laws
2. What are the different responsibilities of financial report preparers and auditors?
THE MOST COMMON ASSURANCE SERVICES ARE:
1. FINANCIAL REPORT AUDITS
An engagement designed to express an opinion about whether the report is
prepared in all material respects in accordance with a financial reporting framework
(ASA 200, para. 11; ISA 200, para 11).
Fnancial report audit provides reasonable assurance about whether the financial report is
prepared in all material respects in accordance with a financial reporting framework
Under sections 295(4)(c) and 295A of the Act, directors of the reporting entity must declare
whether the reporting entity will be able to pay its debts as and when they become due,
whether the financial records have been properly maintained, whether the financial report
and notes comply with Australian Accounting Standards including interpretations, and
whether the financial report and notes give a true and fair view - refers to the consistent
and faithful application of accounting standards in accordance with the financial reporting
framework when preparing the financial report (ASA 200, para. 13; ISA 200, para.13)
The auditor must be independent of the company they audit, exercise due professional
care, and comply with Auditing and Assurance.
2. COMPLIANCE AUDIT
Involves gathering evidence to ascertain whether rules, policies, procedures, laws
and regulations have been followed.
– A tax audit is an example of a compliance audit.
3. PERFORMANCE AUDIT
Refers to the economy, efficiency and effectiveness of an organisation’s activities.
– Usually done by internal auditors or can be outsourced to external auditors.
Economy refers to the cost of inputs, including wages and materials. Efficiency refers
to the relationship between inputs and outputs. Specifically, efficiency refers to the
use of the minimum amount of inputs to achieve a given output. Finally,
effectiveness refers to the achievement of certain goals or the production of a
certain level of outputs.
For example, if buying cheap inputs results in an inefficient production process,
efficiency may be seen to be sacrificed to achieve economic goals.
4. COMPREHENSIVE AUDIT
Combines elements of financial report audit, compliance audit and performance
audit. Eg an auditor may report on whether an entity has met its efficiency targets.
– Often occur in the public sector.
5. INTERNAL AUDIT
Provides assurance about various aspects of an organisation’s activities.
The internal audit function is typically conducted by employees of the organisation
being audited, but can be outsourced to an external audit firm. A semi-independent
service within an entity which generally evaluates and improves risk management,
internal control procedures and elements of the governance process
– Often contain elements of performance audits, compliance audits, internal
control assessments and reviews.
2. Why is there a demand for assurance services and what regulation exists to ensure it
meets the demand?
The users of the financial statements are not limited to the shareholders or owners
of the business.
Other users can include:
Investors: can include current or potential investors. Decisions include to buy,
hold or sell stake in the organisation.
Suppliers: may want to assess whether the entity can pay them back for
goods supplied.
Customers: may look into going concern if it is to rely on the entity for goods.
Lenders: to assess whether loan repayments can be made as and when they fall due.
Employees: to assess whether they can pay entitlements, and stability may be assessed
for job security.
Governments: whether the entity is complying with regulations and paying appropriate
taxes.
General public: whether they should associate with the entity (future employee,
customer or supplier,) what it does and plans to do in future.
THE DEMAND FOR AUDIT CAN BE EXPLAINED BY THE FOLLOWING THREE THEORIES:
1. AGENCY THEORY: Due to the remoteness of the owners from the entity, the owners
have an incentive to hire an auditor to assess information provided by management.
2. INFORMATION HYPOTHESIS: Due to the need for reliable information, users will
demand that information be audited to aid in decision making.
3. INSURANCE HYPOTHESIS: Investors demand audited financial statements to insure
against potential losses.
• The culmination of the auditor’s work is a report. For financial report audits it
expresses their opinion of the financial statements (which is the type of audit we will
focus on in this unit)
• The audit report is based on the evidence gathered during the audit process
• The different types of reports that auditors can issue are summarised in section 1.4
of the text but these will be covered later in the semester in conjunction with
Chapter 12.
Integrity
Integrity (section 110 of APES 110) the obligation that all members of the professional
bodies be straightforward and honest.
Objectivity
(Section 120 of APES 110) refers to the obligation that all members of the professional
bodies not allow their personal feelings or prejudices to influence their professional
judgement. Members should be unbiased and not allow a conflict of interest or the
influence of others to impair their decision process. When faced with such a situation, a
member shall not perform a service if a circumstance or relationship biases or unduly
influences the member’s professional judgment with respect to that service.
Confidentiality
(Section 140 of APES 110). Confidentiality refers to the obligation that all members of the
professional bodies refrain from disclosing information to people outside of their workplace
that is learned as a result of their employment. Members must maintain confidentiality,
including in a social environment. Members are also not allowed to use information, that is
not publicly available, gained as a result of their employment to their advantage or to the
advantage of another person (for example, using information learned at a client to trade
shares).
Professional behaviour
(Section 150 of APES) Professional behaviour refers to the obligation that all members of
the professional bodies comply with rules and regulations and ensure that they do not harm
The reputation of the profession. Should be honest in their representations to current and
prospective clients.
Why is auditor independent critical to the audit function, and how is it achieved?
independence the ability to act and be seen to act with integrity, objectivity and
professional skepticism. Independence is essential when complying with the ethical
principles to act with integrity and objectivity. (APES 110, section 290) Independence —
assurance engagements’ deals with auditor independence. An external auditor is often
referred to as an independent auditor, which highlights the importance of independence in
every audit engagement. If an auditor is not independent of their client, it will affect the
credibility and reliability of the financial report. It is vital that financial report users believe
that the external auditor is independent of the company they audit.
According to APES 110, section 290 there are two forms of independence:
Independence of mind is the ability to act with integrity, objectivity and professional
scepticism. It is the ability to make a decision that is free from bias, personal beliefs and
client pressures.
Independence in appearance is the belief that independence of mind has been achieved. It
is not enough for an auditor to be independent of mind; they must also be seen to be
independent. Auditors must consider their actions carefully and ensure that nothing is done
to compromise their independence both of mind and in appearance.
It is the responsibility of every auditor to consider potential threats to their independence
and to seek out appropriate safeguards to reduce those threats to the extent possible. If a
threat to an auditor’s independence appears insurmountable for a particular client, an
auditor should consider discontinuing as the auditor of that client.
APES 110, section 290 sets out a conceptual framework to help members identify threats to
independence, evaluate the significance of those threats and apply safeguards to minimise
those threats.
(a) identify threats to independence
(b) evaluate the significance of the threats identified
(c) apply safeguards, when necessary, to eliminate the threats or reduce them to an
acceptable level.
Threats to independence
The Code of Ethics for Professional Accountants identifies five key threats to auditor
independence (APES 110, s. 290). They are the self-interest, self-review, advocacy,
familiarity and intimidation threats.
Self-interest threat (APES 100, section 290) Self-interest threat refers to the threat that can
occur when an accounting firm or its staff has a financial interest in an audit client. For
example; a member of the assurance team having a significant close business relationship
with an assurance client or a member of the audit team entering into employment
negotiations with the audit client.
Self-review threat (Section 200.5 of APES 110) Self-review threat refers to the threat that
can occur when the assurance team need to form an opinion on their own work or work
performed by others in their firm. For example: a firm issuing an assurance report on the
effectiveness of the operation of financial systems after designing or implementing the
systems or a member of the assurance team being, or having recently been, a director or
officer of the client
Advocacy threat
(200.6 of APES 110) Advocacy threat refers to the threat that can occur when an accounting
firm or its assurance staff acts, or is believed to act, on behalf of its assurance client. The
objectivity of the assurance provider may come under question. For example the firm
promoting shares in an audit client or a member acting as an advocate on behalf of an audit
client in litigation or disputes with third parties.
Familiarity threat (Section 200.7 of APES 110) Familiarity threat refers to the threat that can
occur when a close relationship exists or develops between the assurance firm and the
client or between members of the assurance team and directors or employees of the client.
The assurance team become too sensitive to the needs of the client and lose their
objectivity. For example; a member of the engagement team having a close or immediate
family member who is a director or officer of the client or senior personnel having a long
association with the assurance client.
Intimidation threat (Section 200.8 of APES 110) Intimidation threat refers to the threat that
can occur when a member of the assurance team feels threatened by the client’s staff or
directors. The assurance team member is unable to act objectively, believing that if they do
so there may be some negative. For example, a firm being threatened with dismissal from a
client engagement or an audit client indicating that it will not award a planned non-
assurance contract to the firm if the firm continues to disagree with the client’s accounting
treatment for a particular transaction.
Safeguards to independence
Safeguards are mechanisms that have been developed by the accounting profession,
legislators, regulators, clients and accounting firms (APES 110, s. 290). They are used to
minimize the risk that a threat will surface (for example, through education) and to deal
with a threat when one becomes apparent (for example, through reporting processes within
the assurance firm).
SAFEGUARDS TO INDEPENDENCE
1. Created by profession, legislation or regulation
• Quality control standards
• Code of ethics
• Legislative requirement to be independent
2. Created by clients
• Corporate governance
• Policies and procedures
3. Created by accounting firms
• Quality control procedures
• Client acceptance and continuance
What is the auditor’s legal liability to parties that use audit reports?
The auditor must be diligent in applying technical and professional standards, and
document each stage in the audit process. If the auditor is found to be negligent (to have
not exercised due care) they may be sued for damages by their client or a third party.
Under tort law, to prove that an auditor has been negligent it must be established that:
Key Cases
London and General Bank Ltd - account receivable was over stated, didn’t put it in the
reports, but said it was going to be in the general meeting, you have to provide it to the
share holders, but to the chief of the company, the auditor was announced guilty in this
case, reasonable care and skill
Kingston Cotton Mill - managers of the company overvalued it inventory, auditor didn't’t
check the value of inventory at the time 1896 that how it was operated, manager gave
certificate of value these days it is not good auditing, the judge said it wasn’t looking for
fraud by the managers, if it comes across its wrong they should investigate ate not look for
wrong doing.
Pacific Acceptance - finance company that gave loans based on doge information that didn’t
have enough security, auditor used no efficient staff, and didn’t supervise them, company
lost business and the auditor was responsibility. (replace London and kington case)
HIH - auditor did a bad job, he got soft, lost independence, he didn’t stand up didn’t want to
lose the client.
Centro – settle out before court, two aspect to it, joint responsibility between manager and
auditor, the auditor duties making sure advise shareholder of problems - in class exercise
2. How are materiality levels established and incorporated into the audit process?
Materiality guides audit planning, testing, and assessment of information in financial
report
Information is material if it impacts on the decision-making process of users of the
financial report (AASB 1031)
Information could be considered material because of its qualitative or quantitative
characteristics
Materiality is a key auditing concept and is assessed during the risk assessment
phase of every audit. This preliminary assessment of materiality guides audit
planning and testing. Before explaining how an auditor arrives at their preliminary
materiality assessment, it is important to differentiate between the qualitative and
quantitative considerations of materiality.
qualitative materiality information that impacts a user’s decision-making process for
a reason other than its magnitude
quantitative materiality information that exceeds an auditor’s preliminary
materiality assessment, which is between 5 and 10 per cent of an appropriate base
SETTING MATERIALITY
Auditor uses professional judgement. They are mindful of the primary users of the
financial report. For listed companies, the primary users are the shareholders. For
unlisted companies, the primary users are generally the owners and/or major
lenders of funds.
Audit firms vary in methods to set materiality percentages in the risk assessment
phase to derive at an appropriate base percentage
o Balance sheet bases include total assets or equity
o Income statement bases include profit before tax, revenue or gross profit
Setting lower materiality level during planning increases quality and quantity of
evidence required to be gathered
AASB 1031 provides guidelines on the percentages to use when calculating
materiality. Any item that is 10 per cent or greater of profit before tax is considered
to be material. Any item less than 5 per cent of profit before tax is considered to be
immaterial. The materiality of any item between 5 and 10 per cent of the profit
before tax is a matter for professional judgement. When using total assets or
revenue as a base, the percentages fall to 0.5–1 per cent and when equity is the
base, the percentages are 1–2 per cent.
When setting a lower planning materiality level, an auditor increases the quality and
quantity of evidence that needs to be gathered. When gathering evidence, one of
the criteria may be to test material items.
When inherent and control risk are assessed as high he risk of material misstatement
is assessed as high and an auditor will set detection risk as low, to reduce audit risk
to an acceptably low level. There is an inverse relation between the risk of material
misstatement (a client’s inherent and control risk combined) and detection risk, as
set by the auditor. By assessing control risk as high, an auditor has determined that
their client’s system of internal controls is non-existent, very poor or unlikely to be
effective in mitigating the inherent risks identified. When the risk of material
misstatement is high, the audit strategy set by the auditor is to do no (or very
limited) tests of control and place increased reliance on substantive tests of
transactions and account balances. For example, a client sells expensive medical
testing equipment and has limited security. If even a few pieces of equipment go
missing or are stolen it will have a material impact on the value of inventory. No
regular stocktakes are held either. Inherent risk is high for the existence of inventory;
stock may be recorded that does not exist. In this case control risk is high as there
are no controls in place to mitigate (reduce) the identified risk.
An exception is where an auditor has identified a significant risk. In this case, an
auditor will gain an understanding of their client’s controls relevant to that risk (ASA
315,para. 29; ISA 315, para. 29). For example, if a client has significant transactions
that involve estimation, an auditor will review the processes used by management to
make those estimations. If a client does not have adequate controls to address
significant risks, this is considered a noteworthy deficiency in a client’s system of
internal controls (ASA 315, para. A126; ISA 315, para. A126).
When assessing control risk as low an auditor will generally obtain a detailed
understanding of their client’s system of internal controls as they plan to rely on that
system to identify, prevent and detect material misstatements.
For low-risk clients, if tests of controls are conducted and found to be effective, the
audit strategy will be to reduce reliance on detailed substantive testing of
transactions and account balances. An auditor can never completely rely on a client’s
system of internal controls and will always conduct some substantive procedures to
gather independent evidence regarding the numbers that appear in their client’s
financial report.
For example, a client sells nuts and bolts and conducts regular stock counts. Inherent
risk is low as a significant number of nuts and bolts would need to be stolen before
having a material impact on the amount recorded for inventory. The auditor will plan
on testing that the stock counts are effective and that records are updated on a
timely basis for any stock losses.
4. How can measures of performance and analytical procedures assist in assessing risk
in an audit?
As part of gaining understanding of client, auditor should learn how client
measures its own performance
– The key performance indicators (KPIs) used by a client to monitor and assess its
own performance and the performance of its senior staff provide an auditor with
insights into the accounts that their client focuses on when compiling its financial
report and which accounts are potentially at risk of material misstatement.
– Auditor needs to understand what client focuses on, and what is potentially
at risk of misstatement
PROFITABILITY
– Profit by division, branch, manager etc
– Price earnings ratio (P/E) market price per share divided by earnings per
share, shows how much a shareholder is willing to pay per dollar of earnings.
– Earnings per share (EPS) profit divided by weighted average ordinary shares
issued, reflects the earnings return on each issued share
• Decline could signal pressure on management
– Cash Earning per share (CEPS) operating cash flow divided by outstanding
shares, shows the cash flow capacity of a company for each issued share
– Inventory turnover
For both techniques, auditor should factor in client and economic changes and form
expectations of reasonable changes in balances over time
3. COMMON-SIZE ANALYSIS (VERTICAL ANALYSIS)
• Comparison of account balances to single line item
• Balance sheet – express each item as % of total assets
• Income statement – express each item as % of sales
•
Using analysis over several years, auditor can see how each
account contributes to totals, and how this changes over time
4. RATIO ANALYSIS
Assess relationship between various financial report balances, and
between them and non-financial items
— Profitability ratios
— Liquidity ratios
— Solvency ratios
o The gross profit margin indicates whether a seller of goods has a sufficient mark-up
on goods sold to pay for other expenses.
o The profit margin indicates the profitability of a company after taking into account
all operating expenses.
o The return on assets (ROA) indicates the ability of a company to generate income
from its average investment in total assets.
o The return on shareholders’ equity (ROE) indicates the ability of a company to
generate income from the funds invested by its common (ordinary) shareholders.
o The current ratio indicates how well current assets cover current liabilities. A ratio
that is greater than one indicates that a company should be able to meet its short-
term commitments when they fall due.
o The acid-test (quick) ratio indicates how well liquid (cash or near cash) assets cover
current liabilities. Liquid assets include cash, short-term investments and receivables
o Inventory turnover measures how many times a company sells its inventory in a
year. An auditor will look at the trend in this ratio to determine whether inventory is
being turned over more or less frequently from year to year.
o Receivables turnover measures how many times a year a company collects cash from
its debtors. A slowdown in this ratio may indicate that the client is making sales to
customers who are unable to pay for their goods on a timely basis or the client is not
following up on customers who are late in paying in an efficient manner. If receivables
turnover falls, an auditor will spend more time considering the adequacy of the
allowance for doubtful debts.
o Solvency ratios are used to assess the long-term viability of a company. Liquidity
ratios tend to take a short-term view of a company; solvency ratios have a long-term
perspective.
o The debt to equity ratio indicates the relative proportion of total assets being
funded by debt relative to equity. A high debt to equity ratio increases the risk that a
client will not be able to meet interest payments to borrowers when they fall due.
o Times interest earned measures the ability of earnings to cover interest payments. A
low ratio indicates that a client may have difficulty meeting its interest payments to
lenders if there is a lack of evidence that the client has the capacity to service its
debt.
2. What is sufficient appropriate audit evidence and what types of audit evidence are
available?
Evidence is the information that an auditor uses when arriving at their opinion on the truth
and fairness of the client’s financial report (ASA 500; ISA 500). It is the responsibility of those
charged with governance at a client to ensure that the financial report is prepared in
accordance with Australian Accounting Standards and the Corporations Act 2001. They are
also responsible for ensuring that accurate accounting records are maintained and any
potential misstatements are prevented, or detected and corrected. It is the responsibility of
the auditor to gather sufficient appropriate evidence to arrive at their opinion.
Auditor must gather sufficient appropriate evidence
Sufficiency relates to quantity of evidence
Appropriateness relates to quality of evidence
Audit risk determines what evidence is required
High Risk accounts; (refer to previous chapter for the table) When there is a significant risk
that an account will be misstated and the client’s system of internal controls is not
considered to be effective at reducing that risk, detection risk is set as low and more high-
quality evidence is gathered when conducting substantive tests of that account.
Low Risk accounts; (refer to previous chapter for the table) When there is a low risk that an
account will be misstated and the client’s system of internal controls is considered to be
adequate for that account, detection risk is set as high and less high-quality evidence is
gathered when conducting substantive tests of that account.
3. What issues must an auditor consider when using the work of an expert or another
auditor?
Auditor may engage expert to help in the audit when auditor does not possess
required skills and knowledge to assess item
– Expert could be member of audit team, audit firm, client, or independent
– ASA 620; ISA 620 provides guidance
1. Is expert required?
2. Determining scope of work for expert
3. Selecting expert – assessing objectivity, capability of expert
4. Assessing work of expert
5. Auditor is responsible for drawing conclusions
GROUP ENGAGEMENT PARTNER responsible for signing audit report, but may use
other auditors, especially for remote locations
– Consider capacity of component auditors to undertake the work (ASA 600;
ISA 600)
– Component auditor’s work must be to same standard as group engagement
partner
• Objectivity
• Gathering sufficient, appropriate evidence
ENTITY-LEVEL CONTROLS:
the collective assessment of the client’s control environment, risk assessment process,
information system, control activities and monitoring of controls.
T here are two types of internal controls: entity-level controls and transaction-level
controls. This chapter will focus on transaction-level controls. Transaction-level controls
relate to one of the five components of entity-level internal control
Control Environment ; the terms internal control, control(s), system of internal controls and
components of internal control may be used to refer to the same process
Entity’s risk assessment process; the collective assessment of the client’s control
environment, risk assessment process, information system, control activities and monitoring
of controls
It and communication systems
Control Activities ; policies and procedures that help ensure that management directives are
carried out. Control activities are a component of internal control.
Monitoring of Controls
TRANSACTION-LEVEL CONTROLS
TRANSACTION-LEVEL CONTROLS are designed to reduce the risk of misstatement due to
error or fraud and to ensure that processes are operating effectively.
• Controls can include any procedure used and relied upon by client to prevent errors
occurring, or to detect and correct errors that occur
TYPES OF CONTROLS
CONTROLS HAVE TWO MAIN OBJECTIVES:
1. To prevent or detect misstatements in the financial report, or
2. To support the automated parts of the business in the functioning of the
controls in place
PREVENTATIVE CONTROLS
TESTS OF CONTROLS
• are the audit procedures performed to test the operating effectiveness of controls in
preventing or detecting and correcting material misstatements at the assertion
level.
1) PREVENT CONTROLS can be applied to each transaction during normal
processing to avoid errors occurring
2) Commonly automated, e.g. reject duplicate transaction
An absence of effective prevent controls increases the risk that errors will occur or fraud
may occur and therefore increases the need for controls that are sensitive enough to detect
these errors should they occur.
For example, the signature of the goods inwards staff member on a delivery docket or a bill
of lading indicates that the signer agreed that stock was physically received into the
warehouse but it does not guarantee that the person carefully reviewed it or that they
agreed the quantities of each item on the delivery docket. The documentation
may have been signed based on only a quick glance or without any review at all. Thus, goods
may be recorded that do not exist, excess goods may have been received but not be
recorded, or the goods received may not match the goods ordered and recorded. The
quality of the evidence that the control will prevent one of these errors from occurring does
not provide persuasive enough evidence for the auditor to conclude that the control
operated effectively throughout the reporting period.
DETECTING CONTROLS
2) DETECT CONTROLS are necessary to identify and correct errors that do enter the
records
– Usually not applied to transaction during normal flow of processing, but
applied outside normal flow to partially or fully processed transactions
• E.g. payments are prepared and held by system until approved, then
processed
– Wide variation in detect controls from client to client, depending on
complexity, preferences
• Can be informal and formal
Detect controls can depend on the nature of the client’s business and on the competence,
preferences and imagination of the people who perform the controls. Detect controls may
be formally established procedures, such as the preparation of a monthly reconciliation and
the subsequent follow-up of reconciling or unusual items.
DETECT CONTROLS
It is important that detect controls:
• Completely and accurately capture all relevant data
• Identify all potentially significant errors
• Are performed on a consistent and regular basis
• Include follow-up and correction on timely basis of any misstatements or issues
detected
MANUAL CONTROLS
MANUAL AND AUTOMATED CONTROLS
• Purely manual controls do not rely on IT for operation
• e.g. locked cage for inventory
• Could rely on IT information from others
• e.g. reconcile stock count to computer generated consignment stock
statements
AUTOMATED CONTROLS
AUTOMATED CONTROLS generally rely on client’s IT
It is important to identify the extent of reliance a control places on IT to determine the
effect of IT on the evaluation of controls. The key consideration for relying on automated
aspects of controls is to determine whether or not the client has effective ITGCs.
– IT general controls (ITGCs)
• Support functioning of automated controls
• Provide basis for relying on electronic evidence in audit
– Types of ITGCS:
• Program change controls; only appropriately authorised, tested and approved
changes are made to applications, interfaces, databases and operating systems
• Logical access controls; only authorised personnel have access to data and
applications and can perform only authorised tasks and functions. For example,
the accounts receivable clerk does not have access or authorisation to the cash
payments application; the payroll manager may have access to the electronic
funds transfer application, but is unable to process any pay runs without the
additional approval (and use of passwords) of the financial controller.
• Other ITGCs, e.g. data back-up
• Application controls apply to processing of individual transactions, support
segregation of duties e.g. edit checks, validations, calculations, interfaces,
authorisations
ITGCs are important because they impact the effectiveness both of application controls and
IT-dependent manual controls, as well as potentially affecting the reliability of electronic
audit evidence the auditor may wish to rely upon during the audit.
the period of reliance. For some controls they may need evidence only as at
year-end, whereas for most controls they need evidence that the control
operated throughout the year.
– the existence of a combination of controls that may reduce the level of
assurance that might be needed from any one of the controls
– the relative importance of the ‘what could go wrong’ questions or statement
being considered
– other factors that relate to the likelihood that a control operated as
intended. In determining the extent of tests of a control, the auditor
considers several other factors that affect the perception of the likelihood
that a control operated as intended throughout the period of reliance,
including:
o the competence (and integrity) of the person who performs the control
o the quality of the control environment such as the potential for
management to override the control or for the control to be bypassed
o changes in the accounting system that may have occurred
o unexplained changes in related account balances
• Testing must provide enough evidence to be able to reasonably conclude that
control is effective
• Attribute sampling allows conclusion about population in terms of frequency of
control being performed
– E.g. attribute being tested could be presence/absence of authorising
signature on document
– Evidence of one exception (or deviation) in sample
• Investigate cause of exception,
• Increase sample and extend testing, or
• Amend decision to rely on control – test other controls and/or
increase substantive testing
How many tests of each control might be performed depending on the frequency of the
control in question. The selection of how many instances of a control to test is an area of
significant judgment. The example only and two different auditors are likely to design two
different extents of testing. For example, if it is a monthly control and the auditor wants to
obtain a more than limited level of assurance from the controls testing, two controls (for
example, a monthly bank reconciliation) would be tested from throughout the year. If,
however, only a limited level of assurance from the controls testing is required, only one
control would be tested from throughout the year. ‘More than limited’ in this example is
not the same as reasonable assurance (which is 95 per cent confidence).
.
RESULTS OF AUDITOR’S TESTING
Do results of control testing confirm preliminary evaluation of controls and control
risk based on internal control documentation?
• If so, do not modify planned substantive procedures
• If not,
• Are compensating controls available? If so, then test them.
• Revise audit risk assessment for related account and the planned audit
strategy
DOCUMENTING CONCLUSIONS
Results of control testing documented in working papers
• Test performed
• Purpose of test of controls
• Actual controls selected for testing
• Results of testing- exceptions found
Document in sufficient detail to allow another auditor to perform same test
• Extent of documentation depends on complexity of client’s operations,
systems and controls
• Review impact of testing controls on rest of audit
In-class Exercise 1
Test of control linked to transaction assertion:
For each Test of Control below identify the assertion being tested.
a. Review evidence of the accounting for the numerical sequence of invoices.
b. Review a sample of cash payment transactions for evidence of authorisation of the
account to be charged.
c. Use test data on a back-up copy of the Sales File to confirm that IT edit checks operate as
prescribed.
Solution to in-class Ex 2
a. Yes, with qualification. But must test at least some of the controls every year so
that all controls are tested over a 3 year period. ASA330.14B
b. If greater reliance is placed on the control then more frequent test is needed. this
control is really important, test it more often, if its not important don’t test it every
year (if that’s required)
For example, the auditor needs to verify that sales transactions recorded in the income
statement occurred and relate to the entity (the occurrence assertion). Those same sales
transactions flow through to the trade receivables balance in the balance sheet, and the
auditor needs to verify that the balance of trade receivables as at
year-end exists and that the client holds the rights to those receivables (the existence, and
rights and obligations assertions). The auditor then needs to verify that the balances then
disclosed in the financial report as sales revenue and trade receivables occurred and relate
to the entity (the occurrence, and rights and obligations assertions).
RISK ASSESSMENTS ARE REQUIRED TO BE PERFORMED AT ASSERTION LEVEL (ASA 315; ISA
315)
• Assertions can be stated as audit objectives
– Management assert that sales transactions recorded in income
statement occurred and relate to the entity
– Auditor’s objective is to verify that recorded sales transactions exist
• Transaction assertions are related to account balance and disclosure
assertions
– Work done to verify sales occurrence provides some evidence about
accounts receivable existence
• Audit procedures that are designed to detect material misstatements at the assertion
level
• They are used to obtain direct evidence as to the completeness, accuracy, and validity of
data, and the reasonableness of the estimates and other information contained in the
financial report
• Audit program documents substantive procedures the auditor plans to use to identify
and rectify material errors before giving the audit opinion
RELATIONSHIP BETWEEN RISK ASSESSMENT AND THE NATURE, TIMING AND EXTENT OF
SUBSTANTIVE PROCEDURES
THE NATURE OF SUBSTANTIVE TESTING VARIES FROM ACCOUNT TO ACCOUNT AND
CONSISTS OF ONE OR A COMBINATION OF TECHNIQUES, INCLUDING:
o Key items testing
o Representative testing
o Other test of transactions/underlying data
o Analytical procedures
The appropriate mix of substantive procedures depends on:
• The nature of the account balance
• The risk assessment for the specific account and the client overall
Risk assessments not only affect the extent of the tests, but can also affect the nature and
timing. For example, in the situation described above, it is likely that the auditor would test
the completeness of claims at or near year-end; however, the tests of the valuation for
individual claims by product type could be carried out prior to year-end.
Similarly, the auditor may have agreed with the client that based on the risk assessment it is
appropriate for the client to carry out a physical stocktake prior to year-end (existence
assertion). However, it is not appropriate for the auditor to test the client’s valuation
(pricing) of its stock at that date. Rather, they would perform tests of stock pricing as at a
date nearer to or at the year-end.
Significant professional judgement is therefore required in relating the risk assessment to
the nature, timing and extent of the tests in order to hold overall audit risk to an acceptable
level.
The auditor might also perform substantive procedures prior to year-end because of a client
reporting requirement.
Test Of Detail
• Are substantive tests other than analytical procedures
• Designed to verify a balance or transaction with supporting documentation
• Often referred to as either vouching or tracing
– Vouching: taking a balance or transaction from the underlying accounting
records and verifying it by agreeing the details to supporting evidence
outside of the accounting records of the company. Evidence if it’s a valid valid
of the transaction that has occurred or the existence of the balance.
• Primarily tests existence/occurrence assertion
– Tracing: tracking a source document to the accounting records, record in the
general journal to the statements, the completeness. If you starting from the
financial statements you are not testing for completeness.
• Primarily tests completeness assertion
The auditor considers the relevance of the information used in the analytical procedure; for
example:
• Analytical procedures may not be useful when they are used on a company with
significantly diverse operations and geographical segments. Analytical procedures
are ordinarily more useful on an individual subsidiary, business segment or location
basis than on a consolidated basis.
• The analytical procedure is adversely affected if the industry data is unreliable or is
not comparable to the client’s data. Industry ratios that are no longer meaningful
because of rapidly changing economic conditions may be misleading.
• For entities with operations in inflationary economies, the extent to which increases
in, say, costs or prices have been affected by inflation should be considered before
performing analytical procedures and relying on the results.
• The comparison of budget to actual results is meaningful only if the client’s budget
process is well controlled. In some cases it may be necessary to expand the
understanding of the process beyond that obtained during the planning phase of the
audit
The auditor tests the reliability of underlying data when the analytical procedure is to
provide persuasive assurance; they use judgement to determine the need for, and extent of,
tests of underlying data when the analytical procedure provides corroborative assurance;
and they need not test underlying data when the analytical procedure provides minimal
assurance
CORROBORATIVE
An analytical procedure provides corroborative evidence if
1. Confirms audit findings from other procedures
2. Supports management representations or otherwise decreases the level of
audit skepticism
Allows auditor to limit extent of other procedures in the area
Unexpected results would require auditor to expand other substantive audit
procedures to provide explanation of result
3. MINIMAL
– Not persuasive or corroborative
– E.g. simple comparison with previous year to help identify problems, not to
reduce other testing
– In deciding whether a particular analytical procedure or combination of
procedures provides corroborative evidence or only minimal support for the
conclusion, the auditor evaluates both the extent of their analytical procedures
and the quality of the evidence they expect to obtain.
the timing of substantive testing is dependent on the risk assessment of the significant
account or disclosure in question.
Also determined by risk assessment
o Lower DR, more work done at year-end
Audit firm must also consider availability of resources to conduct procedures around
year-end
o Use techniques to influence schedule:
Review events prior to year-end, e.g. acquisitions
Review activity in period to date, e.g. review interim ageing of debtors
then update at year-end
Perform general audit procedures prior to year-end, e.g. read board
minutes
Review provisions prior to year-end, e.g. understand estimation
processes used by management
Leverage off internal audit (ASA 610; ISA 610)
3. OTHER MATTERS TO CONSIDER IN DESIGNING SUBSTANTIVE PROCEDURES
Ensure procedures respond to specific risk faced by client from both IR and CR factors
o Different clients may have same overall level of risk but risk caused by different
factors – procedures would be also different
Take credit for work already done – early work in audit to assess risk also provides
evidence.
Set appropriate testing thresholds – what the auditor considers important for an audit
will vary depending on the overall risk assessment.
4. RIGHTS AND OBLIGATIONS assertion also significant where clients may pledge
assets
Pledging restricts client’s rights over cash
5. VALUATION AND ALLOCATION usually only an issue when client has significant
foreign currency bank accounts
In-class Exercise 1
Substantive procedures:
When would it be more appropriate to use analytical procedures as a substantive test?
For account balance:
– That are immaterial; or
– That are low risk; or
– Where only corroborating evidence is required; or
– Which can be easily tested for overall reasonableness via calculations ( e.g. sales
commission expensive as a % of sales)
In-class Exercise 2
Testing Cash and Accounts Rec. balances:
Identify a substantive procedure that an auditor could undertake to gain evidence about the
following:
a. Existence of Cash at Bank
b. Cut-off of Accounts Receivable sales transaction
c. Valuation/Allocation of Accounts Receivable.
a. bank confirmation – external confirmation
b. cut off issues relates to dates, around year end. Traced customer orders and credit notes
around year end to related delivery records and sales invoices to ensure they recorded in
the correct period.
c. examine aged debtors listening for adequacy of allowance for doubtful debts. There is a
doubt of collection. Test subsequent repceipts.