Tag: Tests of Control

  • When doing a Risk Assessment on a client, what does an auditor look at?

    When doing a Risk Assessment on a client, what does an auditor look at?

    Because risk is such a significant component of an audit, it is of the utmost significance that auditors approach risk evaluation with the utmost caution.

    The auditor is tasked with several overall objectives, one of which is to identify the risks that a company faces (both business risk and the risk of material misstatement) and then minimise these risks to an acceptable level.

    In light of this difficulty, the objective of ISA 330, entitled The Auditor’s Responses to Assessed Risks, is to address the responsibilities that an auditor must face when developing and putting into practice audit procedures tailored to respond specifically to the risk of material misstatement.

    ISA 330 and ISA 315, “Identifying and Assessing the Risks of Material Misstatement Through Understanding the Entity and its Environment,” have a substantial amount of interaction.

    The auditor’s methodology/approach in planning and carrying out further audit procedures is referred to as being “responsive to the assessed risk of material misstatement.”

    There are generally two fundamental methods of obtaining audit evidence to help reduce audit risk:

    1. Substantive Testing (or Tests of Detail); and
    2. Tests of Control (or Compliance Testing).

    ISA 330 defines substantive testing and tests of control as follows:

    ‘Substantive procedures: an audit procedure designed to detect material misstatements at the assertion level. Substantive procedures comprise:

    1. Tests of details (of classes of transactions, account balances, and disclosures); and
    2. Substantive Analytical Procedures.

    Tests of controls: an audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level.’

    The auditor could think that doing tests of control is not an effective way [especially for SME clients] to acquire sufficient and appropriate audit evidence to address the levels of risk. As a result, they would think that a more substantive approach would be needed. These concepts illustrate that audit procedures must be responsive to the assessed levels of risk.

    Risk at the Assertion Level

    When referring to what management has asserted [stated] to be true, the term “assertion” should be used.

    As an instance, management will declare (at the assertion level of the financial statement) that all transactions that should have been documented have been recorded.

    As a result, management will make an assertion, and it will be the auditor’s responsibility to provide audit evidence that substantiates this assertion.

    As part of their risk assessment, the auditor will identify important areas (transactions, balances, and disclosures) that are prone to the risk of material misstatement.

    Hence, the auditor will look at both the “inherent” and the “control” risks.

    Inherent Risk

    The possibility that the account or section being audited has been materially misstated due to fraud or error without considering the related internal controls is known as the “inherent risk.”

    In assessing inherent risk, these are some of the factors that the auditor needs to consider:

    • The complexity of determining the account amount (especially if the amount is estimated);
    • History (have there been past errors discovered);
    • The circumstances of the entity’s business and the environment in which it operates; and
    • Management’s overall risk awareness.

    Control Risk

    The control risk is the risk that the internal control environment in a particular part of the accounting system will not prevent, detect and correct a material misstatement.

    As a result, the auditor shall consider the inherent risk and control risk at the financial statement assertions level and then evaluates the probability that the financial statements include a material misstatement.

    In some cases, the assessed levels of risk might be such that the auditor decides it is appropriate to obtain more persuasive audit evidence in areas where the assessed levels of risk are so high (for example, cash in a cash-based business such as a restaurant).

    Significant risks are those that need extra attention from the auditor.

    The following are signs that risk could be considered significant:

    1. Risk of fraud.
    2. A significant degree of subjectivity in the financial information.
    3. Unusual transactions.
    4. Significant transactions are undertaken with a related party.
    5. The transactions undertaken are complex.

    Responses to the Assessed Risks

    The objective of ISA 330 is:

    ‘to obtain sufficient, appropriate audit evidence regarding the assessed risks of material misstatement, through designing and implementing appropriate responses to these risks.’

    Responses can include exercising professional scepticism, using auditor’s experts, deploying extra or alternative employees with suitable levels of experience and competence to meet the assessed levels of risk, and using more unexpected audit processes by the auditor.

    Tests of Control

    Tests of control are what the auditor does to determine how well the entity’s control environment works.

    For example, the auditor might watch the sales invoice processing cycle to see if the controls over the entity’s sales processing can find and fix [identifying and correcting] mistakes quickly.

    The auditor can also do tests of control if they think that just doing tests of substantive won’t be enough to provide enough audit evidence at the assertion level.

    Financial statement risk, which is the risk that the financial statements contain a material misstatement, and detection risk, which is the risk that the auditor’s procedures won’t catch [fail to detect] a material misstatement, are opposites (the lower the financial statement risk, the higher the detection risk becomes and vice versa).

    For recurring audits, tests of controls will have been done in previous audits, and there will be evidence in the audit files from previous years about how well those controls work.

    In some jurisdictions, rules say that detailed tests of control can only be done every third audit. But the auditor’s risk assessment should decide how often control tests should be done. Usually, these are the things to think about:

    • The risk of material misstatement;
    • The general operating effectiveness of the internal controls;
    • The extent of reliance on internal control;
    • The effectiveness of general IT-related internal controls; and
    • The application of internal control by the entity.

    The above list is not exhaustive, and the auditor may think other factors should also be considered when deciding how long it should pass before detailed control tests are performed.

    No matter what procedures are performed, ISA 330 says that the auditor must do substantive procedures on important areas, such as:

    • Agreeing on the financial statements to the underlying accounting records.
    • Examining material journal entries.
    • Examine other adjustments that have been made in preparing the financial statements.

    Documentation

    The auditor should make sure that proper records have been kept for the following things:

    • The discussion among the audit engagement team relating to the susceptibility of the financial statements to material misstatement (including any significant decisions reached).
    • Key elements of understanding the entity and the environment in which it works. Also, the sources of the information gathered and the methods used to assess the risks [risk assessment procedures].
    • The identified and assessed risks of material misstatement.
    • Significant risks that have been identified together with an evaluation of the related controls.
    • Overall responses to address the risks of material misstatement.
    • The nature, timing and extent of further audit procedures linked to the assessed risks at the assertion level.
    • Documented conclusions where the auditor has relied on the evidence concerning the effectiveness of controls from previous audits and how these conclusions are appropriate.
    Our website's articles, templates, and material are solely for you to look over. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.

    Keep in touch with us so that you can receive timely updates |

    要获得即时更新，请与我们保持联系

    1. Website ✍️ https://www.ccs-co.com/ 2. Telegram ✍️ http://bit.ly/YourAuditor 3. Facebook ✍

    4. Blog ✍ https://lnkd.in/e-Pu8_G 5. Google ✍ https://lnkd.in/ehZE6mxy

    6. LinkedIn ✍ https://www.linkedin.com/company/74734209/admin/

    14
  • What are the Overall Purpose and Main Features of an Audit?

    What are the Overall Purpose and Main Features of an Audit?

    The general objective of an audit is discussed in ISA 200 Overall Objective of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing.

    According to ISA 200, the following objectives must be met for an audit of financial statements to be considered successful:

    “To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and to report on the financial statements, and communicate as required by the ISAs, in accordance with the auditor’s findings.”

    Every single ISA has what is known as an “objective,” which can also be translated as “what the ISA aims to accomplish.”

    When the auditor carries out the audit following the ISAs and succeeds in achieving the objectives outlined in each ISA, the overall objective of the audit (which was outlined earlier) is considered to have been accomplished.

    However, for the auditor to accomplish the objectives outlined in ISA 200, they need to comprehensively understand the requirements outlined in each ISA and ensure they comply with those requirements.

    Since each audit is unique in various ways, it is important to note that the ISAs may sometimes suggest different procedures to achieve their objectives.

    As a consequence, the auditor is required to go beyond the requirements of the ISA if they consider it necessary to achieve the objective of the ISA.

    Achieving the overall objectives of the ISAs

    To ensure that the general objectives of the ISAs are met, the auditors are required to design and carry out the audit using some level of professional scepticism and to use professional judgement in all aspects of the process.

    According to ISA 200.13(l), the following is an acceptable definition of the phrase “Professional Scepticism”:

    Professional scepticism is an attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement due to error or fraud, and a critical assessment of audit evidence.

    The term ‘Professional Judgement’ is defined in ISA 200.13(k) as:

    ‘…the application of relevant training, knowledge and experience in making informed decisions about the appropriate courses of action in the circumstances of the audit engagement.’

    The purpose of the audit is to improve the credibility of the financial statements, which in turn ensures that the user of those financial statements can make decisions that are reasonable and based on accurate information regarding a specific entity.

    The conclusion that the auditor draws is whether or not the information included in the financial statements is presented as a truthful and fair picture fairly (or gives a true and fair view).

    In addition, the auditor will also form an opinion about whether or not the financial statements have been correctly produced in compliance with the applicable financial reporting framework (for example, IFRS, MFRS. MPERS).

    For the auditor to be able to provide reasonable assurance that the financial statements are free from material misstatement, they have to have a solid understanding of where and how such misstatements are likely to arise.

    During the audit, the auditor will conduct a risk assessment under the ISAs, and as part of that assessment, they will take into account how likely these misstatements will occur.

    This is being done to ensure that the areas where the auditor has found the risks of material misstatements will likely receive the appropriate attention.

    These risk assessments do not necessarily only focus on the parts of the financial statements that are likely to contain material misstatements.

    Instead, the risk assessment is also intended to identify the parts of the financial statements in which the risk of material misstatement is low.

    This will enable the auditor to reduce the amount of testing performed in those parts of the financial statements, preventing resources and time from being wasted on parts of the financial statements that pose a low risk.

    Inherent limitations

    It is common knowledge that an external audit has inherent restrictions, which causes the opinion expressed by the auditor to be persuasive as opposed to conclusive.

    The auditor is required under the ISAs to gain reasonable certainty (note that this is not the same thing as “absolute assurance”) that the financial statements are free from material misstatement, regardless of whether the misstatement was the result of fraud or an error.

    The auditor can attain this degree of reasonable certainty when they have gathered sufficient and appropriate audit evidence to bring the audit risk down to a level that is considered to be acceptable (audit risk is the risk that the auditor will express an inappropriate audit opinion when the financial statements are materially misstated).

    Some of the inherent limitations of an audit are as follows:

    1. Audits require a significant amount of judgement on the auditor’s part (for example, what items to test).
    2. Only some items within the financial statements are tested (this is because it would be impractical for the auditor to test 100% of every transaction throughout the year).
    3. Audit reports are generally issued long after detailed audit work has been carried out.
    4. Audit evidence is persuasive, not conclusive (for example, accounting estimates and use of judgements).
    5. There are limitations in accounting and control systems (for example, the possibility of fraud, human error and the potential for management override of internal controls).

    Although inherent limitations exist (and as a result, a material misstatement may go unnoticed), auditors will typically plan their work in such a way that they have a reasonable chance of detecting a material misstatement within the financial statements.

    This is because inherent limitations prevent auditors from obtaining all relevant information.

    If the objectives of each ISA are achieved, then the risk of an audit should be lowered to a level that is acceptable to a reasonable person.

    Main features

    An audit will, in basic terms, comprise the inspection of a company’s financial statements and the disclosures contained within those statements.

    As a rule, the auditor is not responsible for preparing the financial statements (although, in some SME cases, the auditors may be involved, provided adequate safeguards have been implemented to maintain independence).

    The final product of the audit is the auditor’s conclusion about whether or not the financial statements provide a true and fair view of the company’s financial situation.

    A risk-based audit consists of the following:

    To conclude ( to arrive at their opinion), the auditor must be perceived as independent of the entity being audited.

    A person is considered “independent” for auditing purposes if they do not have significant personal interests in the entity being audited.

    To accomplish the objective of the audit in the most efficient manner, ensuring that the auditor in question is independent of the entity being audited is essential.

    This allows the auditor to provide an opinion that is both professional and unbiased.

    Audit assignments must be carried out logically and structured since it is highly improbable that any two audit tasks will be the same.

    The objective of the audit is to ensure that the financial statements of an entity present a true and fair view of the state of the company’s affairs as of its reporting date.

    In light of this, it would be irresponsible for the auditor to carry out the audit in a haphazard manner and not pre-planned.

    Before beginning any detailed audit work, the auditor must carry out a comprehensive planning procedure.

    The procedure of the Clarity Project will have a substantial influence on several areas, including planning. The auditor can only show that they have developed a sufficient understanding of the entity to enable an efficient audit if adequate planning exists.

    This prevents an efficient audit from taking place. The planning will take many different forms and will contain the following documentation schedule:

    • The entity’s background and history;
    • The entity’s policies and procedures;
    • Key management and staff;
    • Significant accounting policies;
    • The environment in which the entity operates;
    • Accounting systems;
    • Any problems encountered in previous audits;
    • A timetable for key events;
    • The audit budget;
    • The audit strategy;
    • The audit plan;
    • Meetings held with the client before the audit; and
    • Meetings of the audit team before the detailed audit work.

    A full risk assessment is also required at the planning stage and the audit strategy is then developed as a result of this risk assessment to ensure that the audit procedures adopted during the course of the audit are responsive to the risks identified at the planning stage.

    The following table provides a concise analysis of the complete auditing process for your perusal.

    As can be seen in the chart below, the first phase in the auditing process is audit planning.

    In this regard, compliance with the following two fundamental standards is required:

    • ISA 300, “Planning an Audit of Financial Statements,”; and
    • ISA 315, “Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and its Environment,”
    ​New AuditRecurring Audit
    Legal and ethical mattersConsiderReview
    Acceptance and letter of engagementPrepare and issueReview and update where necessary
    Obtain an understanding of the entity and its environmentObtain and prepareReview and update where necessary

    The auditor is responsible for documenting their degree of knowledge of the accounting and internal control procedures utilised by the audit client.

    To do this, the auditor will have to conduct a risk assessment. This is done so that the auditor can ensure that the procedures they use when performing the detailed audit work are appropriate for the risks they identify.

    The next thing for the auditor to do is to think about how they might develop enough audit evidence that is both suitable and adequate.

    Evidence for audits can be gathered through various methods, but in most cases, it comes from either test of control or Substantive Procedures, or often a combination of the two.

    Tests of Control are often referred to as ‘Compliance Tests’.

    To determine whether the evidence can be gathered from tests of controls (and, as a result, reduce detailed substantive procedures), the auditor is required to evaluate the effectiveness of the internal controls; in other words, the auditor must ensure that the controls will prevent, detect, and correct a material misstatement within the accounting system promptly.

    This is necessary to determine whether the evidence can be gathered from tests of controls.

    In compliance with the provisions included in ISA 265 Communicating Deficiencies to those Charged with Governance and Management, any significant deficiencies in internal controls will be reported to those charged with governance.

    The key purpose of the external audit is highlighted above.

    The objective of the audit looks at the primary needs of external stakeholders of an entity, as opposed to the requirements of the entity’s management.

    Typically, an entity’s bankers, trade payables and receivables, workers, possible investors, and tax authorities are considered to be external stakeholders.

    As a result, the objective of the audit is to verify that the general-purpose financial statements are objective, free from bias and manipulation, and pertinent to the requirements of the individuals who will be using those financial statements.

    The following graphic illustrates how key stakeholders may be identified:

    Our website's articles, templates, and material are solely for reference. Although we make every effort to keep the information up to date and accurate, we make no representations or warranties of any kind, either express or implied, regarding the website or the information, articles, templates, or related graphics that are contained on the website in terms of its completeness, accuracy, reliability, suitability, or availability. Therefore, any reliance on such information is strictly at your own risk.

    Keep in touch with us so that you can receive timely updates |

    要获得即时更新，请与我们保持联系

    1. Website ✍️ https://www.ccs-co.com/ 2. Telegram ✍️ http://bit.ly/YourAuditor 3. Facebook ✍

    4. Blog ✍ https://lnkd.in/e-Pu8_G 5. Google ✍ https://lnkd.in/ehZE6mxy

    6. LinkedIn ✍ https://www.linkedin.com/company/74734209/admin/

    14