CPAR Auditing Theory PDF

CPAR Reviewers Auditing Theory **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** - PREFACE TO PHILIPPINE STANDARDS ON QUALITY CONTROL, AUDITING, REVIEW, OTHER ASSURANCE AND RELATED SERVICES - PHILIPPINE FRAMEWORK FOR ASSURANCE ENGAGEMENTS - OBJECTIVE AND GENERAL PRINCIPLES GOVERNING AN AUDIT OF FINANCIAL STATEMENTS (PSA 200 \[Amended as a result of PSA 700 (Revised)\]) **The Authority Attaching to Philippine Standards Issued by the AASC** +-----------------------------------+-----------------------------------+ | **STANDARDS** | **APPLICATION** | +===================================+===================================+ | 1. Philippine Standards on | - Audit of historical financial | | Auditing (PSAs) | information | +-----------------------------------+-----------------------------------+ | 2. Philippine Standards on | - Review of historical | | Review Engagements (PSREs) | financial information | +-----------------------------------+-----------------------------------+ | 3. Philippine Standards on | - Assurance engagements dealing | | Assurance Engagements (PSAEs) | with subject matters other | | | than historical financial | | | information | +-----------------------------------+-----------------------------------+ | 4. Philippine Standards on | - Compilation engagements | | Related Services (PSRSs) | | | | - Engagements to apply | | | agreed-upon procedures to | | | information | | | | | | - Other related services | | | engagements as specified by | | | the AASC | +-----------------------------------+-----------------------------------+ 1. PSAs, PSREs, PSAEs and PSRSs are collectively referred to as the AASC's Engagement Standards. 2. Philippine standards on Quality Control (PSQC) are to be applied for all services falling under the AASC's engagement standards. 3. Philippine Standards are applicable to engagements in the Public sector. **The Authority Attaching to Practice Statements Issued by the AASC** 1. Philippine Practice Statements are issued to: - Provide interpretive guidance and practical assistance o professional accountants in implementing Philippine Standards; and - Promote good practice 2. Professional accountants should be aware of and consider Practice Statements applicable to the engagement. 3. A professional accountant who does not consider and apply the guidance included in a relevant Practice Statements should be prepared to explain how the basic principles and essential procedures in the AASC's Engagement Standard(s) addressed by the Practice Statement have been complied with. **PHILIPPINE FRAMEWORK FOR ASSURANCE ENGAGEMENTS** 1. The Framework does not itself establish standards or provide procedural requirements for the performance of assurance engagements. 2. In addition to the Framework and PSAs, PSREs and PSAEs, practitioners who perform assurance engagements are governed by: - The Philippine Code of Ethics for Professional Accountants; and - Philippine Standards on Quality Control (PSQCs) **ASSURANCE ENGAGEMENTS** 1. "Assurance engagement" means an agreement in which a particular expresses a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the outcome of the evaluation or measurement of a subject matter against criteria. 2. "Subject matter information" refers to the outcome of the evaluation or measurement of a subject matter. 3. In some assurance engagements, the evaluation or measurement of the subject I performed by the responsible party, and the subject matter information is in the form of an **assertion** by the responsible party that is made available to intended users (**assertion-based engagements).** 4. In other assurance engagements, the practitioner either directly performs the evaluation or measurement of the subject matter, or obtains a representation from the responsible party that has performed the evaluation or measurement that is not available to the intended users in the assurance report (**direct reporting engagements)** **TWO TYPES OF ASSURANCE ENGAGEMENT** 1. Reasonable assurance engagement -- the objective is a reduction in assurance engagement risk to an acceptably low level in the circumstances of the engagement as the basis for a **positive form of** expression of the practitioner's conclusion. 2. Limited assurance engagement -- the objective is a reduction in assurance engagement risk to a level that is acceptable in the circumstances of the engagement, but where the risk is greater than for a reasonable assurance engagement, as a basis for a **negative form** of expression of the practitioner's conclusion. **SCOPE OF THE FRAMEWORK** The following are non-assurance engagements and therefore are not covered by the Framework: 1. Engagements covered by the PSRSs such as agreed-upon procedures engagements and compilations of financial or other information. 2. The preparation of tax returns where no conclusion conveying assurance is expressed. 3. Consulting (or advisory) engagements, such as management and tax consulting. **ELEMENTS OF AN ASSUARANCE ENGAGEMENT** 1. A three-party relationship involving: - A practitioner; - A responsible party; and - Intended users. 2. An appropriate subject matter; 3. Suitable criteria; 4. Sufficient appropriate evidence; and 5. A written assurance report in the form appropriate to a reasonable assurance engagement or a limited assurance engagement. **OBJECTIVE AND GENERAL PRINCIPLES GOVERNING AN AUDIT OF FINANCIAL STATEMENTS** 1. The OBJECTIVE of an audit of financial statements is to enable the auditor to express an opinion whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework. 2. The auditor should comply with relevant ethical requirements relating to audit engagements. 3. The auditor should conduct the audit in accordance with PSAs. 4. "Scope of an audit" refers to the audit procedures that, in the auditor's judgment and based on PSAs, are deemed appropriate in the circumstances to achieve the objective of the audit. 5. The auditor should plan and perform an audit with an attitude of PROFESSIONAL SKEPTICISM recognizing that circumstances may exist that cause the financial statements to be materially misstated. 6. In forming the audit opinion, the auditor obtains sufficient appropriate evidence to be able to draw conclusions on which to base that opinion. 7. The auditor's opinion enhances the credibility of financial statements by providing a high, but not absolute, level of assurance. 8. Absolute assurance in auditing is not attainable as a result of such factors as: - The need for judgment; - The use of testing; - The inherent limitations of any accounting and internal control systems; and - The fact that most of the evidence available to the auditor is persuasive, rather than conclusive, in nature. 9. While the auditor is responsible for forming and expressing an opinion on the financial statements, the responsibility for the preparation and presentation of the financial statements in accordance with the applicable financial reporting framework is that of the entity's MANAGEMENT, with oversight from those charged with governance. **ENGAGEMENTS TO REVIEW FINANCIAL STATEMENTS** 1. The objective of a review of financial statements is to enable a practitioner to state whether, on the basis of procedures which do not provide all the evidence that would be require in an audit, anything has come to the practitioner's attention that causes the practitioner to believe that the financial statements are not prepared, in all material respects, in accordance with an identified financial reporting framework (**negative assurance)** 2. A review comprises INQUIRY and ANALYTICAL PROCEDURES which are designed to review the reliability of an assertion that is the responsibility of one party for use by another party. 3. A review does **not** ordinarily involve an assessment of accounting and internal control systems, tests of records and of responses to inquiries by obtaining corroborating evidence through inspection, observation, confirmation and computation, which are procedures ordinarily performed during an audit. 4. The level of assurance provided in a review report is less that that given in an audit report. **ENGAGEMENTS TO PERFORM AGREED-UPON PROCEDURES REGARDING FINANCIAL INFORMATION** 1. In an engagement to perform agreed-upon procedures, an auditor is engaged to carry out those procedures of an audit nature to which the auditor and the entity and any appropriate third parties have agreed and to report on FACTUAL FINDINGS. 2. The recipients of the report must form their own conclusion from the report of the auditor. 3. The report is restricted to those parties that have agreed to the procedures to be performed since others, unaware of the reasons for the procedures, may misinterpret the results. **ENGAGEMENTS TO COMPILE FINANCIAL INFORMATION** 1. In a compilation engagement, the accountant is engaged to use accounting expertise as opposed to auditing expertise to collect, classify, and summarized financial information. 2. It ordinarily entails reducing detailed data to manageable and understandable form without a requirement to test the assertions underlying that information. 3. The procedures performed are not designed and do not enable the accountant to express any assurance on the financial information. 4. Users of compiled financial information derived some benefit as a result of the accountant's involvement because the service has been performed with due professional skill and care. **SUMMARY** **Nature of service** **Audit** **Review** **Agreed-upon Procedures** **Compilation** ----------------------------- --------------------------------------------------- ---------------------------------------------------- -------------------------------- ------------------------------------------------------------- Level of Assurance Provided High, but not absolute assurance Moderate assurance No assurance No assurance Report provided Positive assurance on assertion(s) (Audit Report) Negative assurance on assertion(s) (Review Report) Factual findings of procedures Identification of information compiled (Compilation Report) **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** - - - PSA 210 \[AMENDED BY PSA 700(REVISED)\] **PSQC 1** 1. The firm should establish a **System of Quality Control** to provide it with reasonable assurance that: a. The firm and its personnel comply with professional standards and regulatory and legal requirements; and b. The reports issued by the firm or engagement partners are appropriate in the circumstances. 2. **Elements of a System of Quality Control** a. Leadership responsibility for quality within the firm b. Ethical requirements c. Acceptance and continuance of client relationships and specific engagements. d. Human resources e. Engagement performance f. Monitoring **PSA 220 (Revised)** 1. The **engagement team** should implement quality control procedures that are applicable to the individual audit engagement. 2. The **engagement partner should** a. Take responsibility for the overall quality on each audit engagement to which that partner is assigned. b. Consider whether members of the engagement team have complied with ethical requirements. c. Be satisfied that appropriate procedures regarding the acceptance and continuance of client relationships and specific audit engagements have been followed, and that conclusions reached in this regard are appropriate and have been documented. d. Be satisfied that the engagement team collectively has the appropriate capabilities, competence and time to perform the audit engagement in accordance with professional standards and regulatory and legal requirements, and to enable an auditor's report that is appropriate in the circumstances to be issued. e. Take responsibility for the direction, supervision and performance of the audit engagement in compliance with professional standards and regulatory and legal requirements, and for the auditor's report that is issued to be appropriate n he circumstances. f. Be satisfied that sufficient appropriate audit evidence has been obtained to support the conclusions reached and for the auditor's report to be issued. **PSA 210 \[AMENDED BY THE PSA 700 (REVISED)\]** 1. The purpose of this standard is to establish standards and provide guidelines on: a. Agreeing the terms of the engagement with the client; and b. The auditor's response to a request by a client to change the terms of an engagement to one that provides a lower level of assurance. 2. **Audit Engagement Letters** - It is in the interest of both client and auditor that the auditor sends an engagement letter, preferably before the commencement of the engagement, to help in avoiding misunderstandings with respect to the engagement. - **Principal Contents** - The objective of the audit of financial statements. - Management's responsibility for the financial statements. - The financial reporting framework adopted by management in preparing the financial statements. - The scope of the audit, including reference to applicable legislation, regulations or pronouncements of professional bodies to which the auditor adheres. - The form of any reports or other communication of results of the engagement. - The fact that because of the test nature and other inherent limitations of an audit, together with the inherent limitations of any accounting and internal controls system, there is an unavoidable risk that even some material misstatement may remain undiscovered. - Unrestricted access to whatever records, documentation and other information requested in connection with the audit. 3. **Acceptance of a Change in Engagement** 1. An auditor who, before the completion of the engagement, is requested to change the engagement tone which provides a lower level of assurance, should consider the appropriateness of doing so. 2. A request from the client for the auditor to change the engagement may result from: a. A change in circumstances affecting the need for the service; b. A misunderstanding as to the nature of an audit or related service originally requested; or c. A restriction on the scope of the engagement, whether imposed by management or caused by circumstances. 3. A change would **not** be considered reasonable if it appeared that the change relates to information that is incorrect, incomplete or otherwise unsatisfactory. 4. Before agreeing to change an audit engagement to a related service, an auditor would also consider any legal or contractual implications of the change. 5. If the auditor concludes that there is reasonable justification to change the engagement and if the audit work performed complies with the PSAs applicable to the change engagement, the report issued would be that appropriate for the revised terms of the engagement. 6. In order to avoid confusing the reader, the report would **not** include reference to: a. The original engagement; or b. Any procedures that may have been performed by the original engagement, except where the engagement is changed to undertake agreed-upon procedures. 7. Where the terms of the engagement are changed, the auditor and the client should agree in the new terms. 8. The auditor should not agree to a change of engagement where there is **no** reasonable justification for doing so. 9. If the auditor is unable to agree to a change of engagement and is **not** permitted to continue the original engagement, the auditor should withdraw and consider whether there is any obligation, contractual or otherwise, to report to other parties, such as the board of directors or shareholders, the circumstances necessitating the withdrawal. **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** - PSA 300 (Rev.) **PLANNING AN AUDIT OF FINANCIAL STATEMENTS** - PSA 300 (Rev.) **PLANNING AN AUDIT OF FINANCIAL STATEMENTS** 1. Planning an audit involves: - establishing the *overall audit strategy* for the engagement and - developing an *audit plan*, - in order to reduce audit risk to an acceptably low level. **Preliminary Engagement Activities** 2. The auditor should perform the following activities at the beginning of the current audit engagement: - Perform procedures regarding the continuance of the client relationship and the specific audit engagement. - Evaluate compliance with ethical requirements, including independence. - Establish an understanding of the terms of the engagement. **Planning Activities** 3. The auditor should establish the **overall audit strategy** for the audit. The overall audit strategy sets the scope, timing and direction of the audit, and guides the development of the more detailed audit plan 4. *The establishment of the overall audit strategy involves:* a. Determining the characteristics of the engagement that define its scope; b. Ascertaining the reporting objectives of the engagement to plan the timing of the audit and the nature of the communication required; and c. Considering the important factors that will determine the focus of the engagement team's efforts. 5. The auditor should develop an **audit plan** for the audit in order to reduce audit risk to an acceptably low level. 6. The audit plan is more detailed than the overall audit strategy and includes the nature, timing and extent of audit procedures to be performed by engagement team members in order to obtain sufficient appropriate audit evidence to reduce audit risk to an acceptably low level. 7. The audit plan includes: - - - **Changes to Planning Decisions during the Course of the Audit** The overall audit strategy and the audit plan should be updated and changed as necessary during the course of the audit. **Direction, Supervision and Review** 1. The auditor should plan the nature, timing and extent of direction and supervision of engagement team members and review their work. 2. The nature, timing and extent of the direction and supervision of engagement team members and review of their work vary depending on many factors, including: - The size and complexity of the entity; - The area of audit; - The risks of material misstatement; and - The capabilities and competence of personnel performing the audit work. 3. The auditor plans the nature, timing and extent of direction and supervision of engagement team members based on the assessed risk of material misstatement. **Documentation** The auditor should document the overall audit strategy and the audit plan, including any significant changes made during the audit engagement. **Communications with Those Charged with Governance and Management** 1. The auditor may discuss elements of planning with those charged with governance and the entity's management. 2. Discussions with those charged with governance ordinarily include the overall audit strategy and timing of the audit, including any limitations thereon, or any additional requirements. 3. When discussion of matters included in the overall audit strategy or audit plan occur, care is required in order not to compromise the effectiveness of the audit. **Additional Considerations in Initial Audit Engagements** *The auditor should perform the following activities prior to starting an initial audit:* 1. Perform procedures regarding the acceptance of the client relationship and the specific audit engagement. 2. Communicate with the previous auditor, where there has been a change of auditors, in compliance with relevant ethical requirements. PSA 315 **UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT AND ASSESSING THE RISKS OF MATERIAL MISSTATEMENT** 1. The auditor should obtain an understanding of the entity and its environment, including its internal control, sufficient to *identify and assess the risks of material misstatement* of the financial statements whether due to fraud or error, and sufficient *to design and perform further audit procedures*. 2. The auditor should perform the following risk assessment procedures to obtain an understanding of the entity and its environment, including its internal control: a. Industry, regulatory, and other external factors, including the applicable financial reporting framework. b. Nature of the entity, including the entity's selection and application of accounting policies. c. Objectives and strategies and the related business risks that may result in a material misstatement of the financial statements. d. Measurement and review of the entity's financial performance. e. Internal control. **INTERNAL CONTROL** 1. Internal control is the process designed and effected by those charged with governance, management, and other personnel to provide reasonable assurance about the achievement of the entity's objectives with regard to: - Reliability of financial reporting; - Effectiveness and efficiency of operations; and - Compliance with applicable laws and regulations. 2. The auditor uses the understanding of internal control to: - Identify types of potential misstatements; - Consider factors that affect the risks of material misstatement; and - Design the nature, timing and extent of further audit procedures. 3\. Internal control consists of the following **components**: 1.) The control environment. 4.) Control activities. a. Communication of enforcement of integrity and ethical values. b. Commitment to competence. c. Participation by those charged with governance. d. Management's philosophy and operating style. e. Organizational structure. f. Assignments of authority and responsibility. g. Human resource policies and practices. - The classes of transactions in the entity's operations that is significant to the financial statements. - The procedures, within both IT and manual systems, by which those transactions are initiated, recorded, processed and reported in the financial statements. - The related accounting records, whether electronic or manual, supporting information, and specific accounts in the financial statements, in respect of initiating, recording, processing and reporting transactions. - How the information system captures events and conditions, other than classes of transactions that are significant to the financial statements. - The financial reporting process used to prepare the entity's financial statements, including significant accounting estimates and disclosures. - Authorization - Performance reviews. - Information processing. - Physical controls. - Segregation of duties. 4\. Obtaining an understanding of internal control involves: a. Evaluating the design of a control; and b. Determining whether it has been implemented. **ASSESSING THE RISKS OF MAERIAL MISSTATEMENT** 1. The auditor should identify and assess the risks of material misstatement at the financial statements level, and at the assertion level for classes of transactions, account balances, and disclosures. 2. **The auditor:** - Identifies risks throughout the process of obtaining an understanding of the entity and its environment, including relevant controls that relate to the risks, and by considering the classes of transactions, account balances, and disclosures in the financial statements; - Relates the identified risks to what can go wrong at the assertion level; - Considers whether the risks are of a magnitude that could result in a material misstatement of the financial statements; and - Considers the likelihood that the risks could result in a material misstatement of the financial statements. **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** PSA 330 **THE AUDITOR'S PROCEDURES IN REPONSE TO ASSESSED RISKS** **Overall responses** 1. The auditor should determine overall responses to address the risks of material misstatement at the financial statement level. Such responses may include: - Emphasizing to the audit team the need to maintain professional skepticism n gathering and evaluating audit evidence - Assigning more experienced staff or those with special skills or using experts - Providing more supervision - Incorporating additional elements of unpredictability in the selection of further audit procedures to be performed - Making general changes to the nature, timing or extent of audit procedures **Audit Procedures Responsive to Risks of Material Misstatement at the Assertion Level** 1. In designing further audit procedures, the auditor considers the following: - The significance of the risk - The likelihood that the material misstatement will occur - The characteristics of the class transactions, account balance, or disclosure involved. - The nature of the specific controls used by the entity and in particular whether they are manual or automated - Whether the auditor expects to obtain audit evidence to determine if the entity's controls are effective n preventing, or detecting and correcting, material misstatements 2. **Considering the nature, timing and extent of further audit procedures** a. Purpose- tests of controls or substantive procedures b. Type - inspection, observation, inquiry, confirmation, recalculation, reperformance, or analytical procedures. 1. The auditor is required to perform tests of controls when: a. The auditor's risk assessment includes an expectation of the operating effectiveness of controls; or b. When the substantive procedures alone do not provide sufficient appropriate audit evidence at the assertion level 2. Tests of the operating effectiveness of controls are performed only on those controls that the auditor has determined are suitably designed to prevent, or detect and correct, a material misstatement in an assertion 3. Testing the operating effectiveness of controls includes obtaining evidence about: a. How controls were applied at relevant times during the period under audit; b. The consistency with which they were applied; and c. By whom or by what means they were applied. **SUBSTANTIVE PROCEDURES** 1. Substantive test procedures are performed in order to detect material misstatements at the assertion level, and include: - Tests of details of classes of transactions, account balances, and disclosures; and - Substantive analytical procedures 2. The auditor's substantive procedures should include the following audit procedures related to the financial statement closing process: - Agreeing or reconciling the financial statements with accounting records; and - Examining material journal entries and other adjustments made during the course of preparing the financial statements 3. The auditor should perform audit procedures to evaluate whether the overall presentation of the financial statements, including the related disclosures, are in accordance with the applicable financial reporting framework. **Evaluating the sufficiency and appropriateness of audit evidence obtained** 1. Based on the audit procedures performed and the audit evidence obtained, the auditor should evaluate whether the assessments of the risks of material misstatement at the assertion level remain appropriate. 2. The auditor should conclude whether the assessments of the risks of material misstatement in the financial statements. 3. If the auditor has not obtained sufficient appropriate audit evidence as to a material financial statement assertion, the auditor should attempt to obtain further audit evidence. If the auditor is unable to obtain further audit evidence, the auditor should express a qualified opinion or a disclaimer of opinion. **Documentation** 1. The auditor should document: - The overall responses to address the assessed risks of material misstatement at the financial statement level and the nature, timing, and extent of the further audit procedures; - The linkage of those procedures with the assessed risks at the assertion level; and - The results of the audit procedures 2. If the auditor plans to use audit evidence about the operating effectiveness of controls obtained in prior audits, the auditor should document the conclusions reached with regard to relying on vcfsuch controls that were tested in a prior audit. 3. The auditor's documentation should demonstrate that the financial statements agree or reconcile with the underlying accounting records. **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** PSA 320 **AUDIT MATERIALITY (amended by PSA 240 \[Revised 2005\])** PSA 520 **ANALYTICAL PROCEDURES** PSA 550 **RELATED PARTIES** PSA 610 **CONSIDERING THE WORK OF INTERNAL AUDIT** PSA 620 **USING THE WORK OF AN EXPERT** **PSA 320** **AUDIT MATERIALITY** 1. Materiality should be considered by the auditor when: - Determining the nature, timing and extent of audit procedures; and - Evaluating the effect of misstatements 2. There is an inverse relationship between materiality and the level of audit risk 3. In evaluating whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework, the auditor should assess whether the aggregate of uncorrected misstatements that have been identified during the audit is material. 4. If the auditor concludes that the aggregate of uncorrected misstatements may be material, the auditor needs to consider: - Reducing audit risk by extending audit procedures; or - requesting management to adjust the financial statements for the misstatements identified 5. If management refuses to adjust the financial statements and the results of extended audit procedures do not enable the auditor to conclude that the aggregate of uncorrected misstatements is not material, the auditor should consider the appropriate modification to the auditor's report. 6. If the auditor has identified a material misstatement resulting from error, the auditor should communicate the misstatements to the appropriate level of management on a timely basis, and consider the need to report it to those charged with governance. PSA 520 **ANALYTICAL PROCEDURES** 1. "Analytical procedures" means the analysis of significant ratios and trends including the resulting investigation of fluctuations and relationships that are inconsistent with other relevant information or which deviate from predicted amounts. 2. Analytical procedures also include consideration of comparisons of the entity's financial statements: a. Comparable information for prior periods b. Anticipated results of the entity, such as budgets or forecasts, or expectations of the auditor, such as an estimation of depreciation c. Similar industry information 3. Analytical procedures also include consideration of relationships: a. Among elements of financial information that would be expected to conform to a predictable patter based on the entity's experience, such as gross margin percentages. b. Between financial information and relevant no-financial information, such as payroll costs to numbers and employees 4. The auditor should apply analytical procedures at the planning stage to assist in understanding the business and in identifying areas of potential risk. Analytical procedures in planning the use both financial and non-financial information. 5. The auditor should apply analytical procedures at or near the end of the audit when performing an overall conclusion as to whether the financial statements as a whole are consistent with the auditor's knowledge of the business. 6. The application of analytical procedures is based on the expectation that relationships among data exist and continue in the absence of known conditions to the contrary. The presence of these relationships provides audit evidence as to the completeness, accuracy and validity of the data produced by the accounting system 7. The extent of reliance that the auditor places on the results of analytical procedures depends on the following factors: a. Materiality of the items involved b. Other audit procedures directed toward the same audit objectives c. Accuracy with which the expected results of analytical procedures can be predicted. 8. When analytical procedures identify significant fluctuations or relationships that are inconsistent with other relevant information or that deviate from predicted amounts, the auditor should investigate and obtain adequate explanations and appropriate corroborative evidence. 9. The investigation of unusual fluctuations and relationships ordinarily begins with inquiries of management, followed by: a. Corroboration of management responses; and b. Consideration of the need to apply other audit procedures based on the results of such inquiries, if management is unable to provide an explanation or if the explanation is not considered adequate. PSA 550 **RELATED PARTIES** 1. Management is responsible for the identification and disclosure of related parties and transactions with such parties. 2. The auditor should perform audit procedures designed to obtain sufficient appropriate audit evidence regarding the identification and disclosure by management of related parties and the effect of related party transactions that are material to the financial statements. However, an audit cannot be expected to detect all related party transactions. 3. The auditor needs to have a sufficient understanding of the entity and its environment to enable identification of the events, transactions and practices that may result in a risk of material misstatement regarding related parties and transactions with such parties. 4. When obtaining an understanding of the entity's internal control, the auditor should consider the adequacy of control activities over the authorization and recording of related party transactions. 5. In examining the identified related party transactions, the auditor should obtain sufficient appropriate audit evidence as to whether these transactions have been properly recorded and disclosed. 6. The auditor should obtain a written representation from management concerning: a. The completeness of information provided regarding the identification of related parties; and b. The adequacy of related party disclosures in the financial statements 7. The auditor is unable to obtain sufficient appropriate audit evidence concerning related parties and transactions with such parties or concludes that their disclosure in the financial statements is not adequate; the auditor should modify the audit report appropriately. PSA 610 **CONSIDERING THE WORK OF INTERNAL AUDIT** 1. The external auditor should obtain a sufficient understanding of internal audit activities to identify and assess the risks of material misstatement of the financial statements and to design and perform further audit procedures. 2. The external auditor should perform an assessment of the internal audit function when internal auditing is relevant to the external auditor's risk assessment. 3. When obtaining an understanding and performing a preliminary assessment of the internal audit function, the important criteria are: a. Organizational status b. Scope of the function c. Technical competence d. Due professional care 4. When planning to use the work of internal auditing, the external auditor will need to consider internal auditing's tentative plan for the period and discuss it as early a stage as possible. 5. Where the work of internal auditing is to be a factor in determining the nature, timing and extent of the external auditor's procedures, it is desirable to agree in advance the timing of such work, the extent of audit coverage, materiality levels and proposed methods of sample selection, documentation of the work performed and review and reporting procedures. 6. A liaison with internal auditing is more effective when meetings are held at appropriate intervals during the period. 7. When the external auditor intends to use specific work of internal auditing, the external auditor should evaluate and perform audit procedures on that work to confirm its adequacy for the external auditor's purposes. 8. The evaluation of specific work of internal auditing involves consideration of the adequacy of the scope of the work and related programs and whether the preliminary assessment of the internal auditing remains appropriate. 9. The nature, timing and extent of audit procedures performed on the specific work of internal auditing will depend on: - The external auditor's judgment as to the risk of material misstatement of the area concerned; - The assessment of internal auditing; and - The evaluation of the specific work by internal auditing. 10. The external auditor would record conclusions regarding the specific internal auditing work that has been evaluated and the audit procedures performed on the internal auditor's work. PSA 620 **USING THE WORK OF AN EXPERT** 1. "Expert' means a person or firm possessing special skill, knowledge and experience in a particular filed other than accounting and auditing. 2. An expert may be: a. Contracted by the entity; b. Contracted by the auditor; c. Employed by the entity; or d. Employed by the auditor. 3. When determining the need to use the work of an expert, the auditor would consider: a. The materiality of the financial statement item being considered; b. The risk of misstatement based on the nature and complexity of the matter being considered; and c. The quantity and quality of other audit evidence available 4. When planning t use the work of an expert, the auditor should evaluate the professional competence and objectivity of the expert. 5. The risk that an expert's objectivity will be impaired increases when the expert is: a. Employed by the entity; or b. Related in some other manner to the entity. 6. The auditor should obtain sufficient appropriate audit evidence that the scope of the expert's work is adequate for the purposes of the audit. Audit evidence may be obtained through a review of the terms of reference which are often set out in written instructions from the entity to the expert. a. The objectives and scope of the expert's work b. A general outline as to the specific matters the auditor expects the expert's report to cover c. The intended use by the auditor of the expert's work, including the possible communication to third parties of the expert's identity and extent f involvement d. The extent of the expert's access to appropriate records and files e. Clarification of the expert's relationship with the entity, if any. f. Confidentiality of the entity's information g. Information regarding the assumptions and methods intended to be used by the expert and their consistency with those used in prior periods. 7. The auditor should evaluate the appropriateness of the expert's work as audit evidence regarding the financial statement assertion being considered. This will involve assessment of whether the substance of the expert's findings is properly reflected in the financial statements or supports the financial statement assertions, and consideration of: a. Source data used. b. Assumptions and methods used and their consistency with prior periods c. Results of the expert's work in the light of the auditor's overall knowledge of the business and of the results of other audit procedures. 8. When considering whether the expert has used source data which is appropriate in the circumstances, the auditor would consider the following procedures: a. Making inquiries regarding any procedures undertaken by the expert to establish whether the source data is sufficient, relevant and reliable. b. Reviewing or testing the data used by the expert 9. If the results of the expert's work do not provide sufficient audit evidence or if the results are not consistent with other audit evidence, the auditor should resolve the matter. This may involve: a. Discussions with the entity and the expert b. Applying additional audit procedures c. Including possibly engaging another expert; or d. Modifying the auditor's report 10. When issuing an unmodified auditor's report, the auditor should not refer to the work of an expert. Such a reference might be misunderstood to be a qualification of the auditor's opinion or a division of responsibility, neither of which is intended. 11. If as a result of the work of an expert, the auditor decides to issue a modified auditor's report, in some circumstances it may be appropriate, in explaining the nature of the modification, to refer to or describe the work o the expert (including the identity of the expert and the extent of the expert's involvement). In these circumstances, the auditor would obtain the permission of the expert before making such a reference. If permission is refused and the auditor believes a reference is necessary, the auditor may need to seek legal advice. **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** PSA 500(REVISED) **AUDIT EVIDENCE** PSA 501 **AUDIT EVIDENCE -- ADDITIONAL CONSIDERATIONS ON SPECIFIC ITEMS** PSA 505 **EXTERNAL CONFIRMATIONS** PSA 230 **AUDIT DOCUMENTATION** PSA 500(REVISED) **AUDIT EVIDENCE** 1. The auditor should obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on which to base the audit opinion 2. "**Audit Evidence"** is all the information used by the auditor in arriving at the conclusions on which the opinion is based, and includes the information contained in the accounting records underlying the financial statements and other information 3. **Accounting records** generally include: - The records of initial entries and supporting records, such as checks and records of electronic fund transfers; - Invoices - Contracts - The general and subsidiary ledgers, journal entries and other adjustments to the financial statements that are not reflected in formal journal entries; and - Records such as work sheets and spreadsheets supporting cost allocations, computations, reconciliations and disclosures 4. Other information that the auditor may use as audit evidence includes: - Minutes of the meetings - Confirmations from third parties - Analysts' reports - Comparable data about competitors (benchmarking) - Control manuals - Information obtained by auditors from such audit procedures as inquiry, observation, and inspection; and - Other information developed by, or available to, the auditor that permits the auditor to reach conclusions through valid reasoning **Sufficient appropriate evidence** 1. Sufficiency is the measure of the quantity of audit evidence 2. Appropriateness is the measure of the quality of audit evidence; that is, its relevance and its reliability in providing support for, or detecting material misstatements in, the classes of transactions, account balances, and disclosures and related assertions. 3. The following generalizations can be made about the reliability of audit evidence: a. Audit evidence I more reliable when it is obtained from independent sources outside the entity b. Audit evidence that is generated internally is more reliable when the related controls imposed by the entity are effective c. Audit evidence obtained directly by the auditor (for example, observation of the application of a control) is more reliable than audit evidence obtained indirectly or by inference (for example, the inquiry about the application of control) d. Audit evidence is more reliable when it exists in a documentary form, whether paper, electronic, or other medium (for example, contemporaneously written record of a meeting is more reliable than a subsequent oral representation of the matters discussed) e. Audit evidence provided by original documents is more reliable than audit evidence provided by photocopies or facsimiles 4. An audit rarely involves the authentication of documentation, nor is the auditor trained as or expected to be an expert in such authentication 5. When information produced by the entity is used by the auditor to perform audit procedures, the auditor should obtain audit evidence about the accuracy and completeness of the information 6. In forming an audit opinion, the auditor does not examine all the information available because conclusions ordinarily can be reached by using sampling approaches and other means of selecting items for testing. **The use of assertions in obtaining audit evidence** 1. Management is responsible for the fair presentation of financial statements that reflect the nature and operations of the entity. 2. In representing that the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework, management implicitly or explicitly makes assertions regarding the recognition, measurement, presentation, and disclosure of the various elements of financial statements and related disclosures 3. The auditor should use assertions for classes of transactions, account balances, and presentation and disclosures in sufficient detail to form a basis for the assessment of risks of material misstatement and the design and performance of further audit procedures **CATEGORIES OF ASSERTIONS** a. Assertions about classes of transactions and events for the period under audit: 1. OCCURRENCE - transactions and events that have been recorded have occurred and pertain to the entity 2. COMPLETENESS - all transactions and events that should have been recorded have been recorded. 3. ACCURACY - amounts and other data relating to recorded transactions and events have been recorded appropriately 4. CUTOFF - transactions and events have been recorded in the correct accounting period 5. CLASSIFICATION - transactions and events have been recorded in the proper accounts b. Assertions about account balances at the period end: 1. EXISTENCE -assets, liabilities, and equity interests exist 2. RIGHTS AND OBLIGATIONS - the entity holds or controls the right to assets, and liabilities are obligations of the entity 3. COMPLETENESS - all assets, liabilities, and equity interests that should have been recorded have been recorded 4. VALUATION AND ALLOCATION - assets, liabilities and equity interests are included in the financial statements at appropriate amounts and any resulting valuation or allocation adjustments are appropriately recorded c. Assertions about presentation and disclosure: 1. OCCURRENCE AND RIGHTS AND OBLIGATIONS - Disclosed events, transactions, and other matters have occurred and pertain to the entity 2. COMPLETENESS - All disclosures that should have been included in the financial statements have been included 3. CLASSIFICATION AND UNDERSTANDABILITY - Financial information is appropriately presented and described and disclosures are clearly expressed 4. ACCURACY AND VALUATION - Financial and other information are disclosed fairly and at appropriate amounts **Audit procedures for obtaining audit evidence** 1. RISK ASSESSMENT PROCEDURES 2. TESTS OF CONTROLS 3. SUBSTANTIVE PROCEDURES **Examples of audit procedures** 1. INSPECTION 2. OBSERVATION 3. INQUIRY 4. CONFIRMATION 5. RECALCULATION 6. REPERFORMANCE 7. ANALYTICAL PROCEDURES PSA 501 **AUDIT EVIDENCE -- ADDITIONAL CONSIDERATIONS ON SPECIFIC ITEMS** **Attendance at Physical Inventory Counting** 1. 2. 3. 4. - - - - - - 5. - - - 6. 7. 8. 9. - - - - **Procedures regarding litigation and claims** 1. - - - - 2. 3. - A list of litigation and claims. - Management's assessment of the outcome of the litigation or claim and its estimate of the financial implications, including costs involved. - A request that the lawyer confirms the reasonableness of management's assessments and provides the auditor with further information if the list is considered by the lawyer to be incomplete or incorrect. 4. The auditor considers the status of legal matters up to date of the audit report. 5. If management refuses to give the auditor permission to communicate with the entity's lawyers, this would be a scope limitation and should ordinarily lead to a qualified opinion or a disclaimer of opinion. **Valuation and disclosure of long-term investments** 1. 2. 3. **Segment information** 1. 2. 3. 4. PSA 505 **EXTERNAL CONFIRMATIONS** 1. 2. 3. 4. - - - - 5. 6. 7. 8. PSA 230 (Revised) **AUDIT DOCUMENTATION** 1. The auditor should prepare, on a timely basis, audit documentation that provides: - a sufficient and appropriate record of the basis for the auditor's report; and - evidence that the audit was performed in accordance with PSAs and applicable legal and regulatory requirements 2. "Audit documentation" means the record of audit procedures performed, relevant audit evidence obtained, and conclusions the auditor reached (terms such as "working papers" or "work papers" are also sometimes used). 3. "experience auditor" means an individual (whether internal or external to the firm) who has reasonable understanding of - Audit processes; - PSAs and applicable legal and regulatory requirements - The business environment in which the entity operates; and - Auditing and financial reporting issues relevant to the entity's industry 4. Audit documentation may be recorded on paper or on electronic or other media 5. The auditor should prepare the audit documentation so as to enable an experiences auditor, having no precious connection with the audit, to understand: - the nature, timing , and extent of the audit procedures performed to comply with PSAs and applicable legal and regulatory requirements - the results of the audit procedures and the audit evidence obtained; and - significant matters arising during the audit and the conclusions reached thereon 6. in documenting the nature, timing and extent of audit procedures performed, the auditor should record the identifying characteristics of the specific items or matters beig tested 7. the auditor should document discussions of significant matters with management and others on a timely basis 8. where, in exceptional circumstances, the auditor judges it necessary to depart from a basic principle or an essential procedure that is relevant in the circumstances of the audit, the auditor should document how the alternative audit procedures performed achieved the objective of the audit, and, unless otherwise clear, the reasons for the departure 9. the auditor should record: - who performed the audit work and the date such work was completed - who reviewed the audit work performed and the date and extent of such review 10. The auditor should complete the assembly of the final audit file on a timely basis after the date of the auditor's report. As PSQC 1 indicates, 60 days after the date of the auditor's report is ordinarily an appropriate time limit within which to complete the assembly of the final audit file **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** PSA 240 (REVISED 2006) **THE AUDITOR'S RESPONSIBILITY TO CONSIDER FRAUD IN AN AUDIT OF FINANCIAL STATEMENTS** PSA 250 **CONSIDERATIONS OF LAWS AND REGULATIONS IN AN AUDIT OF FINANCIAL STATEMENTS** PSA 260 **COMMUNICATIONS OF AUDIT MATTERS WITH THOSE CHARGED WITH GOVERNANCE** PSA 240 (REVISED 2006) **THE AUDITOR'S RESPONSIBILITY TO CONSIDER FRAUD IN AN AUDIT OF FINANCIALSTATEMENTS** **FRAUD** refers to an intentional act by one party or more individuals among management, those charged with governance, employees or third parties, involving the use of deception to obtain an unjust or illegal advantage Fraud involves: - Incentive or pressure to commit fraud - A perceived opportunity to act or to do so - Some rationalization of the act Management fraud - fraud involving one or more members of management or those charged with governance Employee fraud - fraud involving only employees of the entity (*In either case, there may be collusion within the entity or with third parties outside of the entity)* **TWO TYPES OF FRAUD** 1. **FRAUDULENT FINANCIAL REPORTING** - Involves intentional misstatements including omissions of amounts or disclosures in financial statements to deceive financial statement users - often involves management override of controls that otherwise may appear to be operating effectively - can be caused by the efforts of management to manage earnings in order to deceive financial statements users by influencing their perceptions as to the entity's performance and profitability - may be accomplished by the following - manipulation, falsification (including forgery), or alteration of accounting records or supporting documentation from which the financial statements are prepared - misrepresentation in, or intentional omission from, the financial statements of events, transactions or other significant information - intentional misapplication of accounting principles relating to amounts, classifications, manner of presentation, or disclosure 2. **MISAPPROPRIATION OF ASSETS** - Involves the theft of an entity's assets and is often perpetrated by employees in relatively small and immaterial amounts - Can also involve management who are usually more able to disguise or conceal misappropriations in ways that are difficult to detect - Often accompanied by false or misleading records or documents in order to conceal the fact that the aspects are missing or have been pledged without proper authorization - Can be accompanied in a variety of ways including: - Embezzling receipts - Stealing physical assets or intellectual property - Causing an entity to pay for the goods and services not received - Using an entity's assets for personal use **Responsibilities of Those charged with Governance and of Management** 1. The primary responsibility for the prevention and detection of fraud rests with both those charged with governance of the entity and with management 2. It is important management, with the oversight of those charged with governance, place a strong emphasis on fraud prevention, which may reduce opportunities for fraud to take place, and fraud deterrence, which could persuade in individuals not to commit fraud because of the likelihood detection and punishment 3. It is the responsibility of those charged with governance of the entity to ensure , through oversight of management, that the entity establishes and maintains internal control to provide reasonable assurance with regard to reliability of financial reporting, effectiveness and efficiency of operations and compliance with applicable law and regulations 4. It is the responsibility of management, with oversight from those charged with governance, to establish a control environment and maintain policies and procedures to assist in achieving the objective ensuring, as far as possible, the orderly and efficient conduct of the entity's business **Inherent limitations of an Audit in the context of Fraud** 1. Owing to inherent limitations of an audit, there is an unavoidable risk that some material misstatements of the financial statements will not be detected, even though the audit is properly planned and performed in accordance with PSAs 2. The risk of not detecting a material misstatement resulting from fraud is higher than the risk of not detecting a material misstatement resulting from error because fraud may involve sophisticated and carefully organized schemes designed to conceal it, such as: - Forgery - Deliberate failure to record transactions - Intentional misrepresentation being made to the auditor 3. The risk of the auditor not detecting a material misstatement resulting from management fraud is greater than for employee fraud, because management is frequently in a position to directly or indirectly manipulate accounting records and present fraudulent financial information 4. The subsequent discovery of a material misstatement of the financial statements resulting from fraud does not, in and of itself, indicate a failure to comply with PSAs **Responsibilities of the auditor for detecting material misstatements due to fraud** 1. An auditor conducting an audit in accordance with PSAs obtains reasonable assurance that the financial statements taken as a whole are free from material misstatement, whether caused by fraud or error 2. An auditor cannot obtain absolute assurance that material misstatements in the financial statement will be detected because of such factors as of the following: - use of judgment - use of testing - inherent limitations of internal control - the fact that much of the audit evidence available to the auditor is persuasive rather than conclusive in nature 3. The auditor should maintain an attitude of professional skepticism throughput the audit, recognizing the possibility that a material misstatement due to fraud could exist, notwithstanding the auditor's past experience with the entity about the honesty and integrity of management and those charged with governance 4. Members of the engagement team should discuss the susceptibility of the entity's financial statements to material misstatement due to fraud 5. **Risk assessment procedures** 1. Makes inquiries of management, of those charged with governance, and of others within the entity as appropriate and obtains an understanding of how those charged with governance exercise oversight of management's processes for identifying and responding to the risks of fraud and he internal control that management has established to mitigate these risks 2. Considers whether one or more fraud risk factors are present 3. Considers any unusual or unexpected relationships that have been identified in performing analytical procedures 4. Considers other information that may be helpful in identifying the risks of material misstatement due to fraud**.** **Responses to the risks of material misstatement due to fraud** 1. The auditor should determine overall responses to address he assessed risks of material misstatement due to fraud at the financial statement level and should design and perform further audit procedures whose nature, timing and extent are responsive to the assessed risks at the assertion level 2. In determining overall responses to address the risks of material misstatement due to fraud at the financial statement level the auditor should: - Consider the assignment and supervision of personnel - Consider the accounting policies used by the entity; and - Incorporate an element of unpredictability in the selection of the nature, timing and extent of audit procedures 3. **Audit procedures responsive to risks of material misstatement due to fraud at the assertion level** a. The nature of audit procedures to be performed may need to be changed to obtain audit evidence that is more reliable and relevant to obtain additional corroborative information b. The timing of substantive procedures may need to be modified. The auditor may conclude that performing substantive testing at or near the period end better addresses an assessed risk of material misstatement due to fraud c. The extent of the procedures applied reflects the assessment of the risks of material misstatement due to fraud. For example, increasing sample sizes or performing analytical procedures at a more detailed level may be appropriate 4. To respond to the risk of management override of controls, the auditor should design and perform audit procedures to: d. Test the appropriateness of journal entries recorded in the general ledger and other adjustments made in the preparation of the financial statements e. Review accounting estimates for biases that could result to material misstatement due to fraud f. Obtain an understanding of the business rationale of significant transactions that the auditor become aware of that are outside the normal course of the business for the entity, or that otherwise appear to be unusual given the auditor's understanding of the entity and its environment **Evaluation of audit evidences** 1. The auditor should consider whether analytical procedures that are performed at or near the end of audit when forming an overall conclusion as to whether the financial statements as a whole are consistent with auditor's knowledge of the business indicate a previously unrecognized risk of material misstatement due to fraud 2. When the auditor identifies the misstatement, the auditor should consider whether such a misstatement may be indicative of fraud and if there is such an indication the auditor should consider the implications of the misstatement in relation to other aspects of the audit, particularly the reliability of management representations 3. When the auditor confirms that, or is unable to conclude whether, the financial statements are materially misstated as a result of fraud, the auditor should consider the implications for the audit **Management representations** The auditor should obtain written representations from management that: a. It acknowledges its responsibility for the design and implementation of internal control to prevent and detect fraud b. It has disclosed to the auditor the results of its assessment of the risk that the financial statements may be materially misstated as a result of fraud c. It has disclosed to the auditor its knowledge of fraud or suspected fraud affecting the entity involving: i. Management ii. Employees who have significant roles in internal control iii. Others where the fraud could have a material effect on the financial statements and g. It has disclosed to the auditor its knowledge of any allegations of fraud, or suspected fraud, affecting the entity's financial statements communicated by the employees, former employees, analysts, regulators or others **Communication with management and those charged with governance** 1. If the auditor has identified a fraud or has obtained information that indicates that a fraud may exist, the auditor should communicate these matters as soon as practicable to the appropriate level of management 2. If the auditor has identified fraud involving management, employers who have significant roles in internal control, or others where the fraud results in a material misstatement in the financial statements, the auditor considers seeking legal advice to assist in the determination of the appropriate course of action 3. If the integrity or honesty of management or those charged with governance is doubted, the auditor considers seeking legal advice to assist in the determination of the appropriate course of action 4. The auditor should make those charged with governance and management aware, as soon as practicable, and at the appropriate level of responsibility, of material weaknesses in the design or implementation of internal control to prevent and detect fraud which may have come to the auditor's attention 5. The auditor's professional duty to maintain the confidentiality of client information may preclude reporting fraud to a party outside the client the entity. However, the duty of confidentiality may be overridden by regulatory requirements **Auditor unable to continue the engagement** 1. If , as a result of a misstatement resulting from fraud or suspected fraud, the auditor encounters exceptional circumstances that bring into question the auditor's ability to continue performing audit, the auditor should: a. Consider the professional and legal responsibilities applicable in the circumstances, including whether there is a requirement for the auditor to report to the person or persons who made the audit appointment or, I some cases, to regulatory authorities b. Consider the possibility of withdrawing from the engagement; and c. If the auditor withdraws: iv. Discuss the appropriate level of management and those charged with governance the auditor's withdrawal from the engagement and the reasons for the withdrawal; and v. Consider whether there is a professional or legal requirement to report to the person or persons who made the audit appointment or, in some cases, to regulatory authorities, the auditor's withdrawal from the engagement and the reasons for the withdrawal **Documentation** 1. The documentation of the auditor's understanding of the entity and its environment and the auditor's assessment of the risks of material misstatement should include: a. The significant decisions reached during the discussion among the engagement team regarding the susceptibility of the entity's financial statements to material misstatement due to fraud b. The identified and assessed risks of material misstatement due to fraud at the financial statement level and at the assertion level 2. The documentation of the auditor's responses to the assessed risks of material misstatement should include: a. The overall responses to the assessed risks of material misstatement due to fraud at the financial statement level and the nature, timing and extent of audit procedure, and the linkage of those procedures with the assessed risks of material misstatement due to fraud at the assertion level b. The results of the audit procedures, including those designed to address the risk of management override of controls 3. The auditor should document the communications about fraud made to management, those charged with governance, regulators and others 4. When the auditor has concluded that the presumption that there is a risk of material misstatement due to fraud related to revenue recognition is not applicable in the circumstances of the engagement, the auditor should document the reasons for that conclusion PSA 250 **CONSIDERATION OF LAWS AND REGULATIONS IN AN AUDIT OF FINANCIAL STATEMENTS** 1. "Noncompliance" as used in PSA 250 refers to acts of omission or commission by he entity being audited, either intentional and unintentional, which are contrary to the prevailing laws and regulations 2. Noncompliance does not include personal misconduct (unrelated to the business activities of the entity) by the entity's management or employees 3. When planning and performing audit procedures and in evaluating and reporting the results thereof, the auditor should recognize that noncompliance by the entity with laws and regulation may materially affect the financial statements **Responsibility of management for the compliance with laws and regulations** 1. It is management's responsibility to ensure that the entity's operations conducted in accordance with laws and regulations 2. The responsibility for the prevention and detection of noncompliance rests with management 3. The following policies and procedures, among others, may assist management in discharging its responsibilities for the prevention and detection of noncompliance: - Monitoring legal requirements and ensuring that operating procedures are designed to meet these requirements - Instituting and operating appropriate systems of internal control - Developing, publicizing and following a Code of Conduct - Ensuring employees are properly trained and understand the Code of Conduct - Monitoring compliance with the Code of Conduct and acting appropriately to discipline employees who fail to comply with it - Engaging legal advisors to assist in monitoring legal requirements - Maintaining a register of significant laws with which the entity has to comply within its particular industry and a record of complaints **The auditor's consideration of compliance with laws and regulations** 1. The auditor is not, and cannot be held responsible for preventing noncompliance 2. The auditor should plan and perform the audit with an attitude of professional skepticism recognizing that the audit may reveal conditions or events that would lead to questioning whether an entity is complying with laws and regulations 3. In order t plan the audit, the auditor should a general understanding of the legal and regulatory framework applicable to the entity and the industry and how the entity is complying wih that framework 4. After obtaining the general understanding, the auditor should perform procedures to help identify instances of noncompliance with those laws and regulations where non compliance should be considered when preparing financial statements specifically: a. Inquiring of management as to whether the entity is in compliance with such laws and regulations b. On receipt of an inquiry from the proposed auditor, the existing auditor should advise whether there are any professional reasons why the proposed auditor should not accept the appointment. If permission from the client to discuss its affairs with the proposed auditor of denied by the client, the fact should be disclosed to the propose auditor **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** **AUDIT SAMPLING** **(**BASED ON PSA 530: AUDIT SAMPLING AND OTHER SELECTIVE TESTING PROCEDURES) **Selecting items of testing to gather audit evidence** When designing audit procedures, the auditor should determine appropriate means of selecting items for testing. The means available to the auditor are: a. Selecting all items (100% examination) b. Selecting specific items c. Audit sampling **Selecting all items (100% examination)** - Unlikely in the case of tests of control but more common for substantive procedures - May be appropriate when: a. The population constitutes a small number of large value items b. When both inherent risk and control risk are high and other means do not provide sufficient appropriate audit evidence c. When the repetitive nature of a calculation or other process performed by a computer information system makes a 100% examination cost effective **Selecting specific items** - The auditor may decide to select specific items from a population based on such factors as knowledge of the client's business, preliminary assessments of inherent and control risks, and the characteristics of the population being tested - The judgmental selection of specific items is subject to nonsampling risk - Specific selected items may include: - High value or key items - All items over a certain amount - Items to obtain information - Items to test procedures - While an efficient means of gathering audit evidence, it does not constitute audit sampling. The results of audit procedures applied to specific items selected cannot be projected to the entire population **AUDIT SAMPLING** 1. "Audit Sampling" involves the application of audit procedures to less than 100% of items with an account balance or class of transactions 2. Sampling may be statistical or nonstatistical. I. Statistical sampling means any approach t sampling that has the following characteristics: a. Random selection of a sample b. Use of probability theory to evaluate sample results II. Nonstatistical sampling is a sampling approach that does not have characteristics (a) and (b). **Audit sampling plan** refers to the procedures an auditor applies t accomplish a sampling application. In aids an auditor I forming conclusions about one r more characteristics or either a particular class of transactions or a particular account balances 1. ATTRIBUTE SAMPLING - Applicable to tests of control - Used to test an entity's rate of deviation (also called rate of occurrence) from a prescribed control procedure 2. VARIABLES SAMPLING - Applicable to substantive test - Most commonly used to test whether recorded account balances are fairly stated **SAMPLING RISK** 1. It arises from the possibility that the auditor's conclusion, based on a sample may be different from the conclusion reached if the entire population were subjected to the same audit procedures 2. The confidence level (also called reliability level) is the mathematical complement of the applicable sampling risk factor 3. It is to be measured and controlled. The auditor controls it by specifying the acceptable level when developing the sampling design 4. For tests of control, it has the following aspects: a. Risk of assessing control risk too low (Risk of Overreliance) - The risk that the auditor would conclude that the control risk is lower than it actually is - It affects audit effectiveness and is more likely to lead to an inappropriate audit opinion b. Risk of assessing control risk too high (Risk of under reliance) - The risk that the auditor would conclude that control risk is higher than actually is - It affects audit efficiency as it would lead to additional work to establish that initial conclusions were incorrect 5. For substantive tests, it has the following aspects: a. Risk of incorrect acceptance - The risk that the auditor would conclude that a material error exists when in fact it does - It affects audit effectiveness and is more likely to lead to an inappropriate audit opinion b. Risk of incorrect rejection - - It affects audit effectiveness as it would lead to additional work to establish that initial conclusions were incorrect **NONSAMPLING RISK** It arises from factors that cause the auditor to reach an erroneous conclusion for any reason not related to the size of the sample. For example, most audit evidence is persuasive rather than conclusive, the auditor might use inappropriate procedures, or the auditor might misinterpret evidence and fail to recognize an error. **5 STEPS IN ATTRIBUTE SAMPLING PLAN** 1. 2. - 3. - An attribute s a characteristic of control. For example, the supervisor's signature of approval on a document. A deviation is the absence of an attribute The sample size is determined by considering the following factors: a. Risk of assessing control risk too low b. Tolerable deviation rate c. Expected population deviation rate Risk of assessing control risk too low - There is an inverse relationship between the risk and the sample size. The higher the acceptable risk, the smaller the sample size - Because the risk of assessing control risk too low relates to the effectiveness of the audit, it is kept at a relatively low level by the auditor Tolerable deviation rate - This the maximum deviation rate that the auditor is willing to accept - The lower the rate of deviation that the auditor is willing to accept, the larger the sample size needs to be Expected population deviation rate (expected error) - The rate of deviation from the prescribed control procedure the auditor expects to find in the population - The higher the rate of deviation the auditor expects, the larger the sample size needs to e so as to be in a position o make a reasonable estimate of the actual rate of deviation - Factors relevant to the auditor's consideration of the expected error rate include: - The auditor's understanding of the business (in particular, procedures undertaken to obtain an understanding of the accounting and internal control systems) - Charges in the personnel or in the accounting and internal control systems - The results of audit procedures applied in prior periods - The results of other audit procedures a. Random number sampling - Each item in the population has an equal chance and nonzero probability of selection - It is usually accomplished by generating random numbers from a random number table or computer program and tracing them to associated documents or items in th population - It is appropriate for both statistical and nonstatistical sampling b. Systematic selection - The number of sampling units in the population is divided by the sample size to give a sample interval, for example 50, and having determined the starting point within the first 50, each 50^th^ sampling unit is hereafter selected - Although the starting point may be determined haphazardly, the sample is more likely to be truly random if it is determined by use of a computerized random number generator or random number tables - When using systematic selection, the auditor would need to determine that sampling interval corresponds with a particular pattern in the population c. Block selection or cluster sampling - It involves selecting a block(s) of contiguous items from within the population - It cannot be ordinarily used in audit sampling because most populations are structured such that items in sequence can be expected to have similar characteristics to each other, but different characteristics from items elsewhere in the population - Although in some circumstances it may be an appropriate audit procedure to examine a block of items, it would rarely be an appropriate sample selection technique when the auditor intends to draw valid inferences about the entire population based on sample d. Haphazard selection - The auditor selects a sample without following a structured technique - It is not appropriate when using statistical sampling e. Stratification - This involves subdividing the population into subpopulations or strata, i.e., a group of sampling units which have similar characteristics (often monetary value) - The strata must be explicitly defined so that each sampling unit can belong to only one stratum - This method enables the auditor to direct his efforts towards the items he considers would potentially contain the greater monetary error 6. Perform sampling plan 7. Evaluate and document results a. Determining the sample deviation rate Sample deviation rate = [number of deviations observed] Sample size b. Determining the maximum population deviation rate (achieved upper deviation limit) and the allowance for sampling risk (achieved precision) - The maximum deviation rate is based on the sample size and the number of deviations discovered. There are standard tables that yield maximum population deviation rates at specified risks of assessing control risk too low - Allowance for sampling risk = Maximum Deviation Rate -- Sample Deviation Rate c. Considering qualitative information d. Reaching an overall conclusion **COMMONLY USED ATTRIBUTES SAMPLING TECHNIQUES** 1. ATTRIBUTE ESTIMATION SAMPLING - A statistical sampling plan for tests of controls - Appropriate when an auditor wishes to estimate a true but unknown population deviation rate - Uses a fixed sampling plan, i.e., the auditor tests a single sample 2. SEQUENTIAL SAMPLING (ALSO CALLED STOP-OR-GO SAMPLING) - The sampling plan is performed in several steps - Following each step, the auditor decides whether to stop or to go on to the next step - Appropriate when the auditor expects zero or very few deviations 3. DISCOVERY SAMPLING - Appropriate when the expected deviation rate is near zero and when the auditor's objective is to find at least one deviation in a sample if the actual population deviation rate exceeds or equals a predetermined critical rate (tolerable deviation rate) **STEPS IN A VARIABLE SAMPLING PLAN** 1. Determine the objectives of the test The auditor's objective is to test the reasonableness of a record account balance, called hypothesis testing. 2. Define the population and sampling unit 3. Choose an audit sampling technique a. Statistical vs. Nonstatistical b. Classical variables sampling vs. Probability-proportional-to-size sampling 4. Determine the sample size The auditor considers the following: a. Variation within the population - Sample size varies in the same direction as the variation in population amounts. As population variation increases, so does the sample size - An estimate of population variation is made by determining a population standard deviation b. Acceptable risk of incorrect rejection c. Acceptable risk of incorrect acceptance d. Tolerable error -- the maximum monetary error that may exist in an account balance without causing the financial statements to be materially misstated 5. Determine the method of sample selection 6. Perform the sampling plan 7. Evaluate the sample results a. Projecting the same error to the population b. Considering sampling risk c. Considering qualitative information d. Reaching an overall conclusion **CLASSICAL VARIABLES SAMPLING TECHNIQUES** A. Mean-per-unit estimation A classical variables sampling technique that projects the sample average to the population by multiplying the sample average by the number of items in the population B. Difference estimation It is a classical variables sampling technique that uses the average difference between audited amounts and individual recorded amounts to estimate the total audited amount of a population and an allowance for sampling risk. C. Ratio estimation 1. Each population item must have a recorded book value 2. Total population book value must be known 3. Expected differences between audited and recorded book values must not be too rare Choosing between difference and ratio estimation Ratio estimation is more appropriate when he differences are nearly proportional to book values. Difference estimation is more appropriate when there is little or n relationship between the absolute amounts of the differences and the book values. PROBABILITY-PROPROTIONAL-TO-SIZE SAMPLING (PPS) - PPS uses a peso as the sampling unit - PPS sampling gives each individual peso in the population an equal chance of selection - PPS is only useful for TESTS OF OVERSTATEMENTS (e.g., assets) since the sample selection method dictates that the larger the transaction or amount, the more likely that it will be selected. - PPS is inappropriate for testing liabilities because understatement is the primary audit consideration **EXAMPLES OF FACTORS INFLUENCING SAMPLE SIZE FOR TESTS OF CONTROL** **(PSA 530, APPENDIX I)** **[Factor] [Effect on Sample size]** An increase in the auditor's intended reliance on accounting and Internal control systems increase An increase in the rate of deviation from the prescribed control Procedure that the auditor is willing to accept (Tolerable error) decrease An increase in the rate of deviation from the prescribes control Procedure that the auditor expects to find in the population (Expected error) increase An increase in the auditor's required confidence level (or conversely A decrease in the risk that the auditor will conclude that the auditor will Conclude that the control risk is lower than the actual control risk in the Population) increase An increase in number of sampling units in the population negligible effect **EXAMPLES OF FACTORS INFLUENCING SAMPLE SIZE FOR SUBSTANTIVE PROCEDURES** **(PSA 530, APPENDIX II)** **[Factor] [Effect on Sample size]** An increase in the auditor's assessment of inherent risk increase An increase in the auditor's assessment of control risk increase An increase in the use of other substantive procedures Directed at the same financial statement assertion decrease An increase in the auditor's required confidence level (or Conversely, a decrease in the risk that the auditors will conclude that A material error does not exist, when in fact it does exist) increase An increase in the amount of error the auditor expects to find in The population (tolerable error) decrease An increase in the amount of error the auditor expects to find in the Population (expected error) increase Stratification of the population when appropriate decrease The number of sampling units in the population negligible effect **CPA REVIEW SCHOOL OF THE PHILIPPINES** **Manila** **AUDITING THEORY CPA REVIEW** **AUDITING IN A CIS (IT) ENVIRONMENT** 1. A CIS environment exists when a computer of any type or size is involved in the processing by the entity of financial information of significance to the audit, whether the computer is operated by the entity or by a third party 2. The overall objective and scope of an audit does not change in a CIS environment 3. A CIS environment may affect: a. The procedures followed in obtaining a sufficient understanding of the accounting and internal control systems b. The consideration of the inherent and control risk c. The design and performance of tests of controls and substantive procedures 4. The auditor should have sufficient knowledge of the CIS to plan, direct, and review the work performed 5. If specialized skills are needed, the auditor would seek the assistance of a professional possessing such skills, who may be either on the auditor's staff or an outside professionals 6. In planning the portions of the audit which may be affected by the client's CIS environment, the auditor should obtain an understanding of the significance and complexity of the CIS activities and the availability of data for use in the audit 7. When the CIS are significant, the auditor should also obtain an understanding of the CIS environment and whether it may influence the assessment of inherent and control risks 8. The auditor should consider the CIS environment in designing audit procedures to reduce audit risk to an acceptably low level. The auditor can use either manual audit procedures, computer-assisted audit techniques, or a combination of both to obtain sufficient evidential matter **RISK ASSESSMENTS AND INTERNAL CONTROL:** **CIS CHARACTERISTICS AND CONSIDERATION** **Organizational Structure** *Characteristics of a CIS organizational structure includes:* a. Concentration of functions and knowledge Although most systems employing CIS methods will include certain manual operations, generally the number of persons involved in the processing of financial information is significantly reduced. b. Concentration of programs and data Transaction and master file data are often concentrated, usually in machine-readable form, either in one computer installation located centrally or in a number of installations distributed throughout the entity. **Nature of Processing** The use of computers may result in the design of systems that provide less visible evidence than those using manual procedures. In addition, these systems may be accessible by a larger number of persons. *System characteristics that may result from the nature of CIS processing include:* a. Absence of input documents - Data may be entered directly into the computer system without supporting document - In some on-line transaction systems, written evidence of individual data entry authorization (e.g., approval for order entry) may be replaced by other procedures, such as authorization controls contained in computer programs (e.g., credit limit approval) b. Lack of visible audit trail The transaction trail may be partly in machine-readable form and may exist only for a limited period of time (e.g., audit logs may be set to overwrite themselves after a period of time or when the allocated disk space is consumed) c. Lack of visible output Certain transactions or results of processing may not be printed or only summary data may be printed d. Ease of access to data and computer programs Data and computer programs may be assessed and altered at the computer or through the use of computer equipment at remote locations. Therefore, in the absence of appropriate controls, there is an increased potential for unauthorized access to, and alteration of, data and programs by persons inside or outside the entity **Design and procedural aspects** The development of CIS will generally result n design and procedural characteristics that are different from those found in manual systems. These different design and procedural aspects of CIS include: a. Consistency of performance CIS perform functions exactly as programmed and are potentially more reliable than annual systems, provided that all transactions types and conditions that could occur are anticipated and incorporated into the system. On the other hand, a computer program that is not correctly programmed and tested may consistently process transactions or other data erroneously b. Programmed control procedures The nature of computer processing allows the design of internal control procedures in computer programs c. Single transaction update of multiple or data base computer files A single input t the accounting system may automatically update all records associated with the transaction d. Systems generated transactions Certain transactions may be initiated by the CIS itself without the need for an input document e. Vulnerability of data and program storage media Large volumes of data and the computer programs used to process such data may be stored on portable or fixed storage media, such as magnetic disks and tapes. These media are vulnerable to theft, loss, or intentional or accidental destruction. **INTERNAL CONTROLS IN A CIS ENVIRONMENT** **GENERAL CIS CONTROLS --** to establish a framework of overall control over the CIS activities and to provide a reasonable level of assurance that the overall objectives of internal control are achieved *General CIS controls may include:* a. Organization and management controls -- designed to define the strategic direction and establish an organizational framework over CIS activities, including: - Strategic information technology plan - CIS policies and procedures - Segregation of incompatible functions - Monitoring of CIS activities performed by third party consultants b. Development and maintenance controls -- designed to provide reasonable assurance that systems are developed or acquired, implemented and maintained in an authorized and efficient manner. They also typically are designed to establish control over: - Project initiation, requirements definition, systems design, testing, data conversion, go-live decision, migration to production environment, documentation of new or revised systems, and user training - Acquisition and implementation of off-the-shelf packages - Request for changes to the existing systems - Acquisition, implementation, and maintenance of system software c. Delivery and support controls -- designed to control the delivery of CIS services and include: - Establishment of service level agreements against which CIS services are measured - Performance and capacity management controls - Disaster recovery/contingency planning, training, and file backup - Computer operations controls - Systems security - Physical and environment controls d. Monitoring controls -- designed to ensure that CIS controls are working effectively as planned. These include: - Monitoring of key CIS performance indicators - Internal external CIS audits **CIS APPLICATION CONTROLS --** to establish specific control procedures over the application systems in order to provide reasonable assurance that all transactions are authorized, recorded and are processed completely, accurately and on a timely basis. CIS application controls include: a. Controls over Input -- designed to provide reasonable assurance that: - Transactions are properly authorized before being processed by the computer - Transactions are accurately converted into machine readable form and recorded in the computer data files - Transactions are not lost, added, duplicated or improperly changed - Incorrect transactions are rejected, corrected and, if necessary, resubmitted on a timely basis. b. Controls over processing and computer data files -- designed to provide reasonable assurance that: - Transactions, including system generated transactions, re properly processed by the computer - Transactions are not lost, added, duplicated or improperly changed - Processing errors (i.e., rejected data and incorrect transactions) are identified and corrected on a timely basis c. Controls over output -- designed to provide reasonable assurance that: - Results of processing are accurate - Access to output is restricted to authorized personnel on a timely basis - Output is provided to appropriate authorized personnel on a timely basis **Review of general CIS controls** General CIS controls that relate to some or all applications are typically interdependent controls in that their operation is often essential to the effectiveness of CIS application controls. Accordingly, it may be more efficient to review the design of the general controls before reviewing the application controls. **Review of CIS application controls** *CIS application controls which the auditor may wish to test include:* a. Manual controls exercised by the user b. Controls over system output c. Programmed control procedures **CIS ENVIRONMENTS -- STAND-ALONE PERSONAL COMPUTERS** 1. A personal computer (PC) can be used in various configurations. These include: a. A stand-alone workstation operated by a single user or a number of users at different times; b. A workstation which part of a Local Area Network (LAN) of PCs; and c. A workstation connected to a server 2. In a stand-alone PC environment, it may not be practicable or cost-effective for management to implement sufficient controls to reduce the risks of undetected error to a minimum level 3. After obtaining the understanding of the accounting system and control environment, the auditor may find it more cost-effective not to make a further review of general controls or application controls, but concentrate audit efforts on substantive procedures. **CIS ENVIRONMENTS -- ON-LINE COMPUTER SYSTEMS** 1. On-line computer systems are computer systems that enable users to access data and programs directly through terminal devices 2. On-line systems allow users to directly initiate various functions such as: a. Entering transactions b. Making inquiries c. Requesting reports d. Updating master files e. Electronic commerce activities 3. Types of terminals used in on-line systems: A. 1. Basic keyboard and screen 2. Intelligent terminal 3. PCs B. 1. Point-of-sale devices 2. Automated teller machines (ATM) 5. Types of on-line computer systems: h. On-line/ real time processing Individual transactions are entered at terminal devices, validated, and used to update related computer files immediately. i. On-line/batch processing Individual transactions are entered at a terminal device, subjected to certain validation checks, and added to a transaction file that contains other transactions entered during the period. Later, during a subsequent processing cycle, the transaction file may be validated further and then used to update relevant master file. j. On-line/Memo update (and subsequent Processing) - Combines in-line/ real time and on-line/ batch processing - Individual transactions immediately update a memo file containing information that has been extracted from the most recent version of the master file. Inquiries are made from this memo file - These same transactions are added to a transaction file for

CPAR Auditing Theory PDF

Document Details

Tags

Related

Summary

Full Transcript

Upgrade to continue