Auditing and Assurance - Concepts and Applications - Lecture Aid
Auditing and Assurance - Concepts and Applications - Lecture Aid
1. *What is Auditing?
If you’re a business owner, you’re responsible for the information being audited, which you
present in your financial records.
If you’re the auditor, you investigate the assertions made on the financial statements to make
sure you agree with what the company is saying about itself.
i. To obtain reasonable assurance about whether the FS as a whole are free from
material misstatements, whether due to fraud or error, thereby enabling the auditor to
express an opinion on whether the financial statements are prepared, in all material
aspects, in accordance with an applicable financial reporting framework; and
ii. To report on the financial statements and communicate as required by the PSAs, in
accordance with auditor’s findings.
NOTE: Although the auditor’s opinion enhances the credibility of the financial
statements, the user cannot assume that the opinion is an assurance as to the future
viability of the entity nor the efficiency or effectiveness with which management has
conducted the affairs of the entity.
Reasonable assurance is a high but not absolute level of assurance. It is obtained when the
auditor has obtained sufficient appropriate audit evidence to reduce audit risk (i.e., the risk
that the auditor expresses an inappropriate opinion when the FS are materially misstated)
to an acceptably low level.
The auditor cannot provide absolute assurance due to the inherent limitations in the work
carried out. This results from the majority of audit evidence (on which the auditor draws
conclusions and bases the auditor’s opinion) being persuasive rather than conclusive.
4. What is the difference between persuasive evidence and conclusive evidence?
Persuasive evidence tips the scale one way or the other and provides you with a basis
beyond a reasonable doubt for forming an opinion.
EXAMPLE: Your job is to verify the current accounts receivable balance of P50,000. To
accomplish this, you send confirmation letters to the client’s 20 largest customers. The sum
of these customers’ accounts receivable balances is P37,500, which is 75 percent of the
total — the percentage your senior associate told you to check. If all the customers reply
with positive responses (meaning they confirm that they owe your client the amounts
shown in accounts receivable), you have enough persuasive evidence to issue an opinion
on the accuracy of the overall accounts receivable balance.
Convincing evidence is perfectly reliable. You’d have to look at all the client’s records to
achieve this level of assertion — something that’s never done during an audit. Reaching
this level of evidence isn’t feasible, because you have to complete an audit during a limited
amount of time and for a reasonable cost. Convincing evidence would be if you sent
confirmation letters to all customers and pursued all customers until they responded.
5. *Who has the primary responsibility for the preparation of the FS?
The management.
NOTE: Many people outside the accounting profession think that the auditor
prepares both the financial statements and the audit report as part of the whole
process. This is definitely not true. The financial statements are the responsibility
of management. Though an auditor may give the client journal entries to correct
errors, omissions, and misstatements shown on the financial statements and
discovered during the course of the audit, the auditor doesn’t prepare any client
financial statements.
NOTE: In risk-based audit, the audit team views all activities in the organization
first in terms of risks to strategies and objectives, and then in terms of
management’s plans and processes to mitigate the risk. The auditor obtain an
understanding of the client’s objectives. The risks are identified and the auditors
determine how management plans to mitigate the risk and whether those plans are
in place and operating effectively. (Cabrera, 2017)
Stages of Risk-Based Audit:
(See Figure 1.1 – Risk-Based Audit Process, Cabrera 2017, page 10.)
Audit risk is the risk that the auditor may give an unqualified opinion on materially
misstated financial statements.
(Comment: This definition of audit risk does not include the risk that the auditor might
erroneously express an opinion that the financial statements are materially misstated.)
NOTE: The auditor always wants to minimize this risk but should take into account
the costs associated with gathering the evidence to minimize it. Hence, it is
intertwined with materiality.
NOTE: The amount and persuasiveness of audit evidence gathered should vary
inversely with audit risk; i.e., lower audit risk requires gathering more persuasive
evidence.
a. Inherent Risk. This risk refers to the susceptibility of an account balance to material
errors assuming that the client does not have any related internal controls.
b. Control Risks. The risk that a material error in an account will not be prevented or
detected on a timely basis by the client’s system of internal control.
NOTE: The better the company’s internal controls, the lower the likelihood of
material misstatement.
c. Detection Risk. The risk that you won’t detect material errors, whether those errors are
intentional or unintentional. Detection risk occurs when you don’t use the right audit
procedures or you don’t use them correctly.
NOTE: Keep in mind that you can never completely eliminate detection risk
because you’ll most likely never look at each and every transaction. You’ll always
have some risk of a misstatement being missed, but your goal is to keep it to an
acceptable minimum.
NOTE: To reduce audit risk to an acceptable low level, the auditor is required to:
1. Assess the risks of material misstatement (Inherent Risk and Control Risk);
and
2. Limit detection risk.
NOTE: Many people outside the accounting profession think that the auditor
prepares both the financial statements and the audit report as part of the whole
process. This is definitely not true. The financial statements are the responsibility
of management. Though an auditor may give the client journal entries to correct
errors, omissions, and misstatements shown on the financial statements and
discovered during the course of the audit, the auditor doesn’t prepare any client
financial statements.
NOTE: Potential clients can also be rendered unauditable through no fault of their
own. Maybe their records were destroyed in a fire or flood. You must always query
the potential client as to the availability of records.
An engagement letter is one where the agreed terms of the audit engagement are recorded
or contained. It serves as the contract, detailing the duties and obligations of both the
auditor and the client. It includes:
the objective and scope of the audit;
the responsibilities of the auditor;
the responsibilities of the management (client);
identification of the applicable financial reporting framework for the preparation of
the financial statements; and
reference to the expected form and content of any reports to be issued by the auditor
and a statement that there may be circumstances in which a report may differ from
its expected form and content.
NOTE: What not to include in the engagement letter? Don’t use jargon that only
CPAs understand. Doing so will make your client uncomfortable and may cause
the client to refuse to sign the letter. Also, don’t overstate what you can do. And
certainly don’t include any promotional or marketing information.
Audit planning involves the establishment of the overall audit strategy for the engagement
and developing an audit plan, in order to reduce audit risk to an acceptably low level. It
generally involves the determination of the expected nature, timing and extent of the audit.
Nature refers to the type of procedures you use during the audit and the method
you use to gather sufficient, competent evidence to support the company’s
information. (e.g., vouching, physical examination, etc.)
Timing addresses when you do the audit procedures: before, on, or after the
balance sheet date.
NOTE: The higher the risk of error leading to material misstatements, the greater
the extent of your audit procedures.
13. What is materiality? When is it considered in planning an audit?
NOTE: When planning the audit, the auditor considers what would make the
financial statements materially misstated. The auditor’s assessment of materiality,
related to specific account balances and classes of transactions, helps the auditor
decide such questions as what items to examine and whether to use sampling and
analytical procedures. This enables the auditor to select audit procedures that, in
combination, can be expected to reduce risk to an acceptably low level.
There is an inverse relationship between materiality and the level of audit risk, that is, the
higher the materiality level, the lower the audit risk and vice versa.
EXAMPLE: If, after planning for specific audit procedures, the auditor determines that
the acceptable materiality level is lower, audit risk is increased. The auditor would
compensate for this by either:
• Reducing the assessed level of control risk, where this is possible, and supporting
the reduced level by carrying out extended or additional tests of control; or
• Reducing detection risk by modifying the nature, timing and extent of planned
substantive procedures.
This involves the identification and assessment of the risk of material misstatements
whether due to fraud or error at the financial statement and assertion levels, through
understanding the entity and its environment, including the entity’s internal control,
thereby providing a basis for designing and implementing the responses to the assessed
risks of material misstatement.
The following are the activities involved in the performance of risk assessment procedures:
a. Identification of Inherent Risks (Business and Fraud Risks) and Significant Risks
Step 1: Gather basic information about the entity.
• client-prepared information
• external data
• relevant correspondence
• client’s key business procedures
Information system
o The classes of transactions in the entity’s operations that are
significant to the financial statements
o The procedures, within both IT and manual systems, by which those
transactions are initiated, recorded, processed, corrected as
necessary, transferred to the general ledger and reported in the
financial statements
o The related accounting records, supporting information and specific
accounts in the financial statements that are used to initiate, record,
process and report transactions; this includes the correction of
incorrect information and how information is transferred to the
general ledger.
o How the information system captures events and conditions, other
than transactions, that are significant to the financial statements
o The financial reporting process used to prepare the entity’s financial
statement, including significant accounting estimates and
disclosures
o Controls surrounding journal entries, including non-standard
journal entries used to record non-recurring, unusual transactions or
adjustments.
Control activities
NOTE: An audit does not require an understanding of all the control activities
related to each significant class of transactions, account balance, and disclosure
in the financial statements or to every assertion relevant to them.
NOTE: In understanding the entity’s control activities, the auditor shall obtain an
understanding of how the entity has responded to risks arising from IT.
Monitoring
c. Concluding the Risk Assessment Phase. (Refer to page 84 for the fundamental
questions that you, as auditor, must address to determine the optimal amount of
audit work)
16. What are the steps in the Risk Response Phase? (See Figure 4.1, page 101)
The Risk Response Phase in the Risk-Based Audit Approach includes the following steps:
a. Designing the overall audit responses and further audit procedures. This will
require:
i. Updating overall audit strategy
ii. Developing response to assessed risks
iii. Briefing team on audit plans as required
NOTE: The starting point for designing an effective audit response is the listing of
assessed risks that we developed at the conclusion of the risk assessment phase of
the audit.
NOTE: The auditor shall design and implement overall responses to address the
risks identified and assessed at the financial statement level and assertion level for
financial statement areas and disclosures.
Many audit firms assign less experienced auditors to work low-risk engagements and save
the big guns for the tough cases. That means that as a staff associate, you’ll more than
likely have the pleasure of working these easier engagements early in your career.
Also, in low-risk situations, sample sizes (the number of records you look at) will be set at
normal levels. Normal levels of any audit criteria are usually set as firm policy, meaning
that your senior associate will tell you what size samples to use.
Professional skepticism is also set at normal levels, which simply means you’ll be more
apt to take transactions at face value. In other words, you assume the transactions are
correct unless you discover otherwise.
If an audit engagement is high-risk, you have to sit back, evaluate how the company does
business, and think about how material misstatements may slip through the cracks. You
then design an extended audit to provide as much assurance as possible that you’ll detect
those misstatements.
Actions you take during a low-risk engagement are flip-flopped for a high-risk one. More
experienced staff associates work on the engagement. The senior associates become more
hands-on. Your firm may hire outside specialists who have knowledge and skills relating
to the business’s specific needs that are lacking in the CPA firm.
Professional skepticism increases, as does the number of items selected for sampling. You
may use more extensive analytical procedures, which compare the business’s financial data
with your expectations of how the data should look.
NOTE: As you do your investigative work getting to know your client, following
your risk assessment procedures, and assessing the risk of material misstatement,
you must extensively document everything you do. You use this documentation to
provide a clear audit trail of what steps you took so you have written substantiation
for the various levels of risk you’ve assessed for the financial statement accounts
and transactions.
19. What is meant by Audit Procedures? What are the types of audit procedures?
Audit procedures are the methods or acts that auditors use to gather evidence to determine
the validity of financial statement assertions.
The various types of an audit procedures available to the auditor are categorized as follows:
1. Test of Controls or Compliance Tests – designed to evaluate the operating effectiveness of
controls in preventing, or detecting and correcting, material misstatements at the assertion
level.
Types:
a. No Trail – this does not leave a visible trail in the supporting documents of
the performance of control procedure by the client’s employee. The auditor
makes inquiries and observation of office personnel and routines to
determine how control procedures are performed and who perform them.
b. Documentary Trail – this leaves a visible trail in the supporting documents.
Hence the auditor inspects the documents supporting a particular type of
transaction to see whether a control procedure, such as approval or other
checking, was performed and who performed it as indicated by signatures
or initials.
Types:
a. Tests of Details – involves obtaining evidential matter on the items (or
details) involved in an account balance or class of transactions.
i. Tests of Transactions – tests of the processing of individual
transactions by inspection of the documents and accounting records
involved in processing.
ii. Tests of Balances – applied directly to the details of balances in
general ledger accounts. Their objective is to establish the monetary
correctness of the accounts they relate to.
b. Analytical Review Procedures – involve study and comparison of
relationships among accounting data and related information. They identify
unusual fluctuations for investigation and focus on the rationale of
relationship.
NOTE: The auditor applies compliance tests when the purpose is to see whether
prescribed accounting control procedures are being followed. This evaluation
identifies the control procedures that can be relied on in performing restricted
substantive tests. Substantive tests are applied when the auditor’s purpose is to see
whether the peso amount of an account is properly stated.
NOTE: Audit procedures vary according to the risks associated with the client and
the methods used to record transactions. (See page 105, Selecting the Audit
Procedures that Will Be Applied)
20. Guidelines – Summary of Relevant PSAs [PSA 300 and 330] (See page 108)
design and implement overall responses to address the assessed risks of material
misstatements at the FS level
design and perform further audit procedures (FAP) whose nature, timing and extent
are based on and are responsive to the assessed risks at the assertion level
o consider the reasons for the assessment, including:
likelihood of material misstatement due to the particular
characteristics of the relevant class of transactions, account
balances, or disclosure (i.e., inherent risk); and
whether the assessment takes account of relevant controls (i.e.,
control risk), thereby requiring the auditor to obtain audit evidence
to determine whether such controls are operating effectively
o obtain more persuasive audit evidence the higher the assessment of risk
develop an audit plan which include a description of
o the nature, timing, and extent of planned risk assessment procedures;
o the nature, timing and extent of planned FAP
o other planned audit procedures so that the engagement complies with PSAs.
when designing and performing audit procedures, consider the relevance and
reliability of the information to be used as audit evidence
when designing tests of controls and tests of details, determine means of selecting
items for testing that are effective in meeting the purpose of the audit procedure
Test of Controls
design and perform test of controls to obtain sufficient appropriate audit evidence
as to the operating effectiveness of relevant controls if:
o assessment of risks of material misstatement at the assertion level includes
an expectation that the controls are operating effectively; or
o substantive procedures alone cannot provide sufficient appropriate audit
evidence at the assertion
In designing and performing test of controls,
o obtain more persuasive audit evidence the greater the reliance the auditor
places on the effectiveness of a control
o perform other audit procedures in combination with inquiry to obtain audit
evidence about the operating effectiveness of the controls
o determine whether the control to be tested depend upon other controls and,
if so, whether it is necessary to obtain audit evidence supporting the
effective operation of those indirect controls.
If the auditor plans to relay on controls over a risk the auditor has determined to be
a significant risk, the auditor shall test those controls in the current period.
Substantive Tests
Irrespective of the assessed risks of material misstatements, auditor shall design
and perform substantive procedures for each material class of transactions, account
balances and disclosure
Consider whether external confirmation procedures are to be performed as
substantive audit procedures
The auditor’s substantive procedures shall include the following audit procedures
related to the financial statement closing process:
o Reconciling the financial statements with the underlying accounting
records;
o Examining material journal entries and other adjustments made during the
course of preparing the financial statements
If the auditor has determined that an assessed risk of material misstatement at the
assertion level is a significant risk, the auditor shall perform substantive procedures
that are specifically responsive to that risk. When the approach to a significant risk
consists only of substantive procedures, those procedures shall include tests of
details
If substantive procedures are performed at an interim date, the auditor shall cover
the remaining period by performing:
o Substantive procedures, with test of controls for the intervening period;
o If the auditor determines that it is sufficient, further substantive procedures
only,
that provide a reasonable basis for extending the audit conclusions from the interim
date to the period end
Perform audit procedures to evaluate whether the overall presentation of the
financial statements, including the related disclosures, is in accordance with the
applicable financial reporting framework.
Identify the activities and types of transactions that occur in a company’s revenue
cycle;
Relate the effect of controls on the assertions embodied in the FS, sales adjustments,
and cash receipts transactions;
Determine the essential features of internal control over the transactions in the
revenue and collection cycle;
Prepare and perform the audit procedures for compliance test of controls over these
transactions;
After evaluating the effectiveness of internal control, perform substantive tests of
transactions to meet transaction-related audit objectives for revenue and collection
cycle; and
Design tests of details of accounts affected by the revenue and collection cycle and
analytical procedures to satisfy balance-related audit objectives.
22. What is the nature of the Revenue and Collection Cycle?
The revenue and collection cycle of an entity consists of the activities relating to the
exchange of goods and services with customers and the collection of the revenue in cash.
For a trading concern, the classes of transactions in the revenue and collection cycle
involve:
a. Sales (cash and credit);
b. Sales adjustments (discounts, returns and allowances and uncollectible accounts
provisions and write-offs); and
c. Cash receipts (collections on accounts and cash sales).
23. What are the documents used in the Revenue and Collection Cycle and their Audit
Significance?
24. What are the Accounting Records in the Revenue and Collection Cycle?
Sales journal
Sales returns and allowances journal
Cash receipts journal
General journal
Accounts receivable master file/subsidiary ledger
Accounts receivable trial balance
28. What are the activities that should be undertaken by the auditor in relation to audit
of the expenditure cycle?
Diagram the flow of transaction in a typical expenditure cycle, the specific accounts
affected and the elements of control within the cycle
Relate the effects of controls on the assertions embodied in the FS
Determine the essential feature of internal control over the transactions in the
expenditure cycle
Prepare an audit program to gather evidence regarding compliance with control
procedures that reduce control risk
Evaluate effectiveness of controls and perform the substantive tests of transactions
to gather evidence to determine whether financial statement assertions are
materially correct on accounts affected by the expenditure cycle
Design test of details of account balances and analytical procedures to satisfy
balance-related audit objectives
The expenditure cycle involves the activities associated with the acquisition and payment
of goods and services, plant assets and labor.
For a trading concern, the major classes of transactions in this cycle are:
a. Acquisitions
b. Cash disbursements
c. Payroll
30. What are the Documents used in the Expenditure Cycle and their Audit Significance?
31. What are the Accounting Records involved in the Expenditure Cycle?
Purchase Journal
Cash Disbursement Transaction File/Journal
Accounts Payable Master File/Subsidiary Ledger
Payroll transactions involve the events and activities relative to executive and employee
compensation. This class of transactions includes salaries of personnel, wage earner
(factory workers); sales persons’ commissions, bonuses to executives, payroll taxes,
pensions and profit-sharing plans and other employees’ fringe benefits.
35. What are the Documents used in the Payroll and Personnel Cycle and their Audit
Significance?
The production cycle involves the conversion of raw materials into finished goods. It
includes the production planning and control of the types and quantities of products to be
manufactured, the inventory levels (raw materials, finished goods) to be maintained, and
the activities pertaining to the manufacturing process. This cycle interfaces with both the
revenue and expenditure cycles.
40. In conducting an audit of the financing and investing cycles, what are the activities
that the auditor should undertake?
i. Identify the activities and types of transactions that occur in a company’s financing
and investing cycles;
ii. Relate the internal accounting control objectives to financing and investing
activities;
iii. Determine the essential features of internal control over the above-mentioned
transactions;
iv. Perform compliance tests of controls over these transactions;
v. Perform substantive audit procedures to determine whether financial statement
assertions are materially correct on accounts affected by the financing and investing
cycles; and
vi. Design tests of details of account balances and analytical procedures to satisfy
balance-related audit objectives
Such cycles include the responsibilities of planning the cash needs, raising capital, and
investing funds. These cycles embrace the major non-operating activities of many
companies.
43. What are the possible errors that may occur in relation to the financing cycle?