ACCA F8 (INT) Audit & Assurance - 2010 - Study text - Emile Woolf Publishing
Подождите немного. Документ загружается.
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 105
Paper F8 (INT)
Audit and assurance
CHAPTER
6
Planning and
risk assessment
Contents
1 Planning an audit: ISA 300
2 Understanding the business and materiality: ISAs
250, 315 and 320
3 Audit risk: ISA 330
4 Fraud: ISA 240
5 Internal audit and review planning
Paper F8: Audit and assurance (International)
106 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Planning an audit: ISA 300
The purpose of an audit plan
Professional scepticism
Introduction to ISA 300
Contents of the overall audit strategy and the audit plan
1 Planning an audit: ISA 300
1.1 The purpose of an audit plan
A plan sets out what needs to be done to achieve an objective. In the case of an
external or internal audit, the objective is the production of an audit report
containing an opinion on the information subject to audit. An audit plan should be
prepared as a means of achieving this objective efficiently and effectively.
Content of an audit plan
Preparing an audit plan is the first stage in the conduct of an audit engagement. The
plan sets out answers to three main questions (the ‘3Ws’):
Who will perform the audit work? (Staffing)
When will the work be done? (Timing)
What work is to be done? (The scope of the audit)
Risk assessment and the audit plan
To prepare a suitable audit plan, the auditor needs to have an in-depth knowledge
and understanding of:
the entity to be audited, and
the environment in which the entity operates.
The auditor needs this knowledge and understanding in order to assess the risk
attached to the audit. Risk assessment is a key feature of the audit planning process
and the assessment of risk in the audit will affect:
the amount of audit work performed in general, and
the areas on which the auditor will focus his attention.
The planning process is essential to all audits, both internal and external. It is
equally important to other assurance engagements such as a ‘review’ assignment.
Chapter 6: Audit planning and risk assessment
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 107
1.2 Professional scepticism
As set out in a previous chapter, it is a requirement of ISA 200 that, when planning
and performing an audit, the auditor should adopt an attitude of professional
scepticism. Professional scepticism is defined by ISA 200 as:
“An attitude that includes a questioning mind, being alert to conditions which may
indicate possible misstatement due to error or fraud, and a critical assessment of
audit evidence”.
This does not mean that the auditors should disbelieve everything they are told, but
they should view what they are told with a sceptical attitude, and consider whether
it appears reasonable and whether it conflicts with any other evidence. In other
words, they must not simply believe everything management tells them.
1.3 Introduction to ISA 300
The objective of the auditor, per ISA 300 Planning an audit of financial statements is to
plan the audit work so that the audit will be performed in an effective manner.
Adequate planning benefits the audit by:
helping the auditor to devote appropriate attention to important areas of the
audit
helping the auditor to identify and resolve potential problems
helping the auditor organise and manage the audit engagement so that it is
performed in an effective and efficient manner
assisting in the selection of staff with appropriate experience and the proper
assignment of work to them
allowing for the direction and supervision of staff and review of their work.
ISA 300 requires the auditor to:
involve the whole engagement team in planning the audit
establish an understanding of the terms of the engagement as required by ISA
210
establish an overall strategy for the audit that sets the scope, timing and
direction of the audit and that guides the development of the audit plan
develop an audit plan which includes a description of the nature, timing and
extent of planned risk assessment procedures and planned further audit
procedures
document the overall audit strategy and the audit plan, including any significant
changes made during the audit.
Paper F8: Audit and assurance (International)
108 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
1.4 Contents of the overall audit strategy and the audit plan
The overall audit strategy
As set out above, the overall audit strategy sets the scope, timing and direction of
the audit and guides the development of the more detailed audit plan. The
establishment of the overall audit strategy involves the following:
Determining the characteristics of the engagement that define its scope such as:
− the financial reporting framework used (for example, international
financial reporting standards)
− any industry specific reporting requirements
− the location of the components of the entity (for example, there might be
overseas branches).
Ascertaining the reporting objectives of the engagement, such as reporting
deadlines and the nature of communications required.
Considering important factors which will determine the focus of the audit
team’s efforts, such as:
− materiality thresholds
− high risk areas of the audit
− the audit approach (for example, whether the auditor is planning to rely
on the entity’s internal controls)
− any recent developments in relation to the entity, the industry or financial
reporting requirements.
The above will then allow the auditor to decide on the nature, extent and timing of
resources needed to perform the engagement. In particular the auditor should
consider:
where experienced members of staff may be needed (for example, on high risk
areas)
the number of staff to be allocated to specific areas (for example, extra staff may
be needed for attendance at the year-end inventory count)
when the resources are needed (for example, are more staff needed at the final
audit than at the interim audit)
how such resources are to be managed, directed and supervised (for example,
the timing of team briefing meetings and manager and partner reviews of work
performed by other members of the audit team).
*Most large audits will be split into two phases. Much of the systems assessment
work and transaction testing will be carried out on the interim audit (taking place
perhaps two-thirds of the way through the year) with the balance of the work and
testing of statement of financial position items taking place at the final audit shortly
after the year end.
Chapter 6: Audit planning and risk assessment
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 109
The audit plan
Once the overall audit strategy has been established the auditor can develop the
more detailed audit plan.
The audit plan will set out:
the procedures to be used in order to assess the risk of misstatement in the
entity’s accounting records/financial statements, and
planned further audit procedures for each material audit area. These audit
procedures might be in response to the risks assessed, or specific procedures to
be carried out to ensure that the engagement complies with ISAs.
The audit procedures to be performed by audit team members will be those needed
in order to:
obtain sufficient appropriate audit evidence, and
reduce audit risk to an acceptably low level.
Audit risk is considered in detail in the next section. What constitutes “sufficient
appropriate audit evidence” is considered in a later chapter.
These procedures will be set out in a series of audit programmes. Audit
programmes are sets of instructions to the audit team, specifying the audit
procedures that should be performed in each area of the audit.
Paper F8: Audit and assurance (International)
110 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Understanding the business and materiality: ISAs 250, 315 and 320
Understanding the entity and its environment
Understanding the accounting and internal control systems
Risk and materiality
Materiality: ISA 320
Compliance with laws and regulations: ISA 250
2 Understanding the business and materiality: ISAs
250, 315 and 320
2.1 Understanding the entity and its environment
In order to prepare the overall audit strategy and audit plan, the auditor will need
to form an understanding of the entity and its environment. This will involve
considering such factors as:
the industry in which the entity operates
the nature and competence of its management
the entity’s internal control system
its current financial performance
reporting requirements and deadlines
any recent developments.
This is a requirement of ISA 315 Identifying and assessing the risks of material
misstatement through understanding the entity and its environment.
The objective of the auditor under ISA 315 is to identify and assess the risks of
misstatement, whether due to fraud or error, through understanding the entity and
its environment, including its internal controls.
This risk assessment process will then provide a basis for designing and
implementing responses to those assessed risks. The responses to the assessed risks
will take the form of audit procedures (covered in later chapters).
The auditor should look for factors that could be significant and to which particular
attention should be given by the audit team. For example, the auditor may be aware
that there is a recession in the industry in which the client company operates, but
that rising commodity prices have forced companies to raise the prices of their
products and so pass on the higher costs to customers. In addition, the auditor may
also be aware that the client company has a poor track record in collecting trade
receivables. This knowledge of the business might make the auditor reach the
conclusion that the audit should give particular attention to the measurement of
trade receivables, and the estimates for bad and doubtful debts.
Chapter 6: Audit planning and risk assessment
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 111
ISA 315 requires the auditor’s risk assessment procedures to include the following:
Inquiries of management and others (ie asking questions and getting answers).
Analytical procedures, which involves the study of ratios and trends to identify
the existence of unusual transactions or events or amounts, ratios or trends that
might have implications for the audit. For example, an analysis of payables days
compared to previous years might indicate that the company is having difficulty
in paying its debts. As a result, the auditor may plan to do more work on this
area. (Information technology may be of use here in calculating changes to
balances in the financial statements from previous years and graphing trends).
Observation and inspection (for example, inspecting internal control manuals
or business plans).
Each of these procedures or methods will be described in more detail in later
chapters that deal with the techniques of gathering audit evidence as each of them is
also a technique for gathering audit evidence. However, they are all used at this
stage to help the auditor identify areas of risk and to plan his audit approach.
With regard to the entity and its environment ISA 315 requires the auditor to obtain
an understanding of the following (requirements in respect of internal controls are
considered below):
Relevant industry, regulatory and other external factors, including the
applicable financial reporting framework.
The nature of the entity, including its operations, ownership and management
structures.
The entity’s selection and application of accounting polices, including whether
they are appropriate for its business and consistent with the industry and the
applicable financial reporting framework.
The entity’s objectives and strategies and those related business risks that may
result in risks of material misstatement.
The measurement and review of the entity’s financial performance.
When the auditor draws on knowledge he has gained from audits of the client in
previous years, it is important that he should take into account any significant
changes in circumstances, or changes in the general environment. He should not
routinely follow the same plan as in the previous year, because a significant change
in circumstances may mean that the audit plan used in the previous year is no
longer appropriate.
Business risks are risks occurring as a result of significant conditions, events,
circumstances, actions or inactions that could affect an entity’s ability to reach its
objectives and carry out its strategies. Business risks can also occur as a result of
setting of inappropriate objectives, strategies or goals.
2.2 Understanding the accounting and internal control systems
ISA 315 requires the auditor to obtain an understanding of internal controls
relevant to the audit. Although most of the entity’s internal controls will relate to
financial reporting, not all will be relevant to the audit.
Paper F8: Audit and assurance (International)
112 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
The auditor should try to reach a judgement about how strong (or weak) the
internal controls are, in order to make a decision about the amount of testing that
should be carried out in the audit. He should consider:
his previous knowledge of the client company
any recent changes
any known problems in the internal controls of the client
the effect of any new auditing or accounting requirements.
The auditor’s assessment of the entity’s internal control systems is dealt with in
more detail in later chapters.
2.3 Risk and materiality
The auditor is required by ISA 315 to identify and assess the risks of material
misstatement at both the financial statement and assertion levels.
The financial statement level refers to risks which are pervasive to the financial
statements as a whole and which potentially affect many assertions (see below). An
example might be if management have a tendency to override internal controls –
this would affect all areas of the accounting systems.
The assertion level refers to specific objectives of the financial statements, for
example, that all liabilities have been recorded and that recorded assets exist. The
use of financial statement assertions is considered in detail in a later chapter.
Risk assessment is an important aspect of planning an audit. Issues to consider are:
the areas where risk of misstatement (error) appear to exist, and the nature of the
risk
when an error should be considered material, and when it may be ignored
what aspects of the audit will be the most difficult to plan because of the high
risk of misstatement.
The auditor should consider:
assessments of inherent risks and control risks, and the identification of
significant audit areas
setting materiality levels
the possibility of material misstatements, including those arising because of
fraud (rather than unintentional error)
the identification of complex accounting areas, particularly those involving
accounting estimates. (Areas of accounting where the estimates used will be
more difficult to audit.)
The auditor will then focus his work on balances in the financial statements where
he considers there is a material risk of misstatement. High risk/material items will
be audited in detail, but low risk/immaterial items will receive less attention.
Inherent risk, control risk and risk assessment are explained in detail later in this
chapter.
Chapter 6: Audit planning and risk assessment
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 113
This audit risk approach was developed in the 1980s. Previous approaches included
the following:
The substantive approach whereby every item in the financial statements is
tested and vouched to supporting documents. This approach is still sometimes
used for small entities where internal controls are weak and there are few
transactions. It may be more efficient to just test everything (especially if the
auditor is also providing accountancy services, where he will see all of the
supporting documents in any case).
The systems approach which was developed to avoid over-auditing. Under this
method the underlying accounting systems were tested with less emphasis on
the testing of individual transactions and balances. However, this approach
could still lead to over-auditing as systems covering low-risk/immaterial areas
were also tested.
Most firms now use a mixture of the audit risk approach and a systems-based
approach.
2.4 Materiality: ISA 320
Materiality is a fundamental concept in both auditing and accounting. It reflects the
fact that the users of financial statements find the statements useful even if they are
not 100% accurate. Financial statements will normally be useful provided they do
not contain ‘material’ errors or misstatements. The IASB’s Framework for the
preparation and presentation of financial statements states that:
“Information is material if its omission or misstatement could influence the
economic decisions of users taken on the basis of the financial statements.”
ISA 320 Materiality in planning and performing an audit states that, in assessing what
is or is not material, auditors are entitled to assume that users:
have a reasonable knowledge of business and are willing to study the
information in the financial statements diligently
understand that financial statements are prepared and audited to levels of
materiality
recognise the uncertainties inherent in certain amounts in the financial
statements (such as provisions)
make reasonable economic decisions based on the information in the financial
statements.
Paper F8: Audit and assurance (International)
114 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
ISA 320 requires the auditor to apply the concept of materiality:
when planning and performing the audit, and
when evaluating the effect of misstatements on the financial statements and
therefore on his audit opinion (covered in a later chapter under ISA 450
Evaluation of misstatements identified during the audit).
At the audit planning stage, risk and materiality are the two key factors which
determine the auditor’s answer to the ‘what audit work is to be done?’ question.
ISA 320 contains the following requirements.
At the planning stage, the auditor must determine materiality for the financial
statements as a whole. This is often referred to as the materiality level or
materiality threshold. If lower thresholds are required for some areas (for example,
directors’ remuneration, as discussed below) these must also be set at this stage.
The auditor must also set what ISA 320 refers to as performance materiality.
Performance materiality recognises the fact that if all areas of the audit are carried
out to detect all errors/omissions under the (overall) materiality level, that objective
could be achieved, but when all the individual immaterial errors/omissions are
added together, overall materiality could in fact be breached. Performance
materiality is a way of taking this risk into account and will be set at a lower figure
than overall materiality. There may be one or more performance materiality levels,
as the level could vary by area.
As the audit progresses, the auditor must revise materiality (and, if appropriate,
materiality for particular areas and performance materiality) if he becomes aware of
information which would have caused him to have initially set different levels, had
that information been known to him at the time.
Documentation must include details of all materiality levels set and any revision of
these levels as the audit progresses.
Setting materiality levels
Materiality levels are often based on ‘quantitative’ factors, and expressed as a
percentage of revenue, profit or asset values, such as 1% of revenue or 5% of post-
tax profit. For example, the materiality level for inventory valuation may be set at
5% of post-tax profit. If the auditor finds, as a result of audit tests, that his estimate
of inventory differs from the client’s measurement by an amount that is more than
5% of post-tax profit, the error would be considered material.
However, it is important to bear in mind that ‘qualitative’ characteristics may also
be taken into account. For example, many auditors would take the view that certain
figures in financial statements should be absolutely correct and that any errors in
those figures would be judged to be material. Examples might include a
requirement for 100% accuracy in reporting issued share capital and directors’
remuneration.