ACCA F8 (INT) Audit & Assurance - 2010 - Study text - Emile Woolf Publishing
Подождите немного. Документ загружается.
Chapter 17: Other audit and assurance situations and reports
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 365
− decisions taken at board meetings and other meetings of the entity that may
affect the financial statements
− the completeness of the accounting records that were used to prepare the
financial statements.
The accountant will use analytical procedures. These should be designed to
identify unusual relationships between items in the financial statements, and
individual items that appear unusual. Analytical procedures would include:
− comparing the financial statements under review with financial statements
for prior periods
− comparing the financial statements with the anticipated results and
− financial position of the entity
− a study of the relationships between elements in the financial statements that
should be expected to conform to a predictable pattern (based on the entity’s
past experience or normal ratios/relationships for the industry as a whole).
Other procedures that will usually be carried out in a review of financial
statements include:
− discussions with the company’s auditors (if the audit firm is not the firm of
accountants that is performing the review engagement)
− obtaining representations from management
− considering the appropriateness of the accounting policies employed by the
entity
− making enquiries into subsequent events (after the reporting period)
− making a review of the statements as a whole.
If the accountant finds information indicating that misstatements might exist in the
financial statements, the scope of the work should be extended.
Paper F8: Audit and assurance (International)
366 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Not-for-profit organisations
Auditing of not-for-profit organisations (NFPOs)
NFPOs: the audit approach
2 Not-for-profit organisations (NFPOs)
2.1 Auditing of not-for-profit organisations (NFPOs)
In any audit or review, it is important to understand the entity and its environment.
A key aspect of an audit or review may be the objective that the entity is trying to
achieve.
In commercial organisations, the objective is to make a profit for the
shareholders.
In the case of not-for-profit organisations (NFPOs), the objective is very
different. It is usually the provision of a service to society as a whole or to a
group in society. Examples are charities, clubs and societies and publicly-owned
organisations.
The service provided by an NFPO will have to be provided within the
constraints of the resources it has at its disposal. In other words, an NFPO will
seek to achieve its objective as far as possible with the money and other
resources available.
Example
A charity organisation is an example of an NFPO:
It has certain defined beneficiaries, since it was established for the purpose of
providing benefits to them.
It raises funds from the public.
It seeks to spend those funds as effectively as possible to help its beneficiaries.
NFPOs may be required to have an audit performed under local law, or may choose
to have an audit performed on a voluntary basis in order to add credibility to their
financial statements.
The difference in the objectives of an NFPO, compared with the objectives of a
commercial company, will influence the approach to the audit.
In addition, there may be specific auditing and reporting requirements set out in
local law for certain types of NFPOs. This may also influence the audit work
performed and the form and content of the opinion issued.
Chapter 17: Other audit and assurance situations and reports
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 367
If the NFPO requests an audit to be performed on a voluntary basis, or requires a
review to be carried out, the scope of the work and the nature of any report issued
will be agreed in advance between the auditor and the NFPO.
2.2 NFPOs: the audit approach
The auditor should recognise the specific features of the NFPO. However, it is
important to realise that the auditor is still performing an audit, and the overall
structure of the audit of an NFPO will be similar to the audit of a commercial
organisation. However, the detail of the audit will probably differ.
The main points to bear in mind with the audit of an NFPO are summarised below.
These are general principles. They should be modified as appropriate to reflect the
circumstances of each particular NFPO.
Audit area Comments
Planning
Consider:
the objectives and scope of the audit work
any local regulations that apply
the environment in which the organisation operates
the form and content of the final financial statements and the
audit opinion
key audit areas, including risk.
Risk
Carry out an audit risk analysis under the usual headings of
inherent risk, control risk and detection risk:
inherent risk (reflecting the nature of the entity’s activities
and the environment)
control risk (internal controls, and the risk that these may be
inadequate: controls over cash collection and cash payments
may be a key area for an NFPO such as a charity, because
large amounts of cash may be collected from the public by
volunteers)
detection risk (the risk that the auditor will fail to identify
any material error or misstatement in performing the audit).
Internal control
Key areas of internal control in an NFPO might include:
segregation of duties (although this may be difficult in a
small NFPO with only a few employees)
authorisation of spending
cash controls
controls over income (donations, cash collections,
membership fees, grants)
the use of funds only for authorised purposes.
Paper F8: Audit and assurance (International)
368 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Table continues
Audit area
Comments
Audit evidence
A substantive testing approach (rather than a systems based
approach) is likely to be necessary in a small NFPO, because
of weaknesses in its internal control system.
Key areas may include:
− the completeness of recording transactions, assets and
liabilities
− the possibility of misuse of funds.
Analytical procedures may be used to ‘make sense’ of the
reported figures.
There should be a review of the final financial statements,
including a review of the appropriateness of the accounting
policies.
Reporting
If a report on an NFPO is required by law, the standard
external audit report covered in a previous chapter can be
used.
If the audit is performed on a voluntary basis, the report
needs to reflect the agreed objective of the audit. However, it
is good practice for the report to follow the general structure
laid down by ISA 700:
− addressee
− scope of the report
− responsibilities of auditors versus the responsibilities of
management
− the audit work done
− the audit opinion
− date, name and address of auditor.
Chapter 17: Other audit and assurance situations and reports
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 369
Communicating with those charged with governance: ISA 260
Introduction
Matters to be communicated
The communication process
3 Communicating with those charged with governance:
ISA 260
3.1 Introduction
In most countries, the auditor communicates to the shareholders, as owners of the
company, via his audit report. ISA 260 Communication with those charged with
governance requires that, in addition, the external auditor should communicate
formally to those charged with governance, partly as a ‘by-product’ of the audit
process to provide useful feedback.
In the case of a company those charged with governance will be the board of
directors or the audit committee (which is a sub-committee of the board of
directors). In your exam it will usually mean the directors of the company.
The auditor’s objectives in respect of ISA 260 are to:
communicate his responsibilities and give an overview of the planned scope and
timing of the audit
obtain information relevant to the audit
provide timely observations arising from the audit which are significant to
management’s responsibility to oversee the financial reporting process
promote effective communication between him and those charged with
governance.
3.2 Matters to be communicated
The auditor is required to communicate the following matters:
His responsibilities in relation to the audit, including that:
− he is responsible for forming and giving an opinion on the financial
statements prepared by management, and
− the audit does not relieve management or those charged with governance of
their responsibilities.
An overview of the planned scope and timing of the audit.
Paper F8: Audit and assurance (International)
370 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Any significant findings from the audit, including:
− his views on the entity’s accounting policies, estimates and financial
statement disclosures
− any significant difficulties encountered during the audit
− any significant matters arising from the audit already brought to the
attention of management and written representations requested*
− any other matters arising from the audit that are significant to the oversight
of the financial reporting process.
For listed entities a statement (which must be made in writing):
− that the audit team/firm have complied with relevant ethical requirements
in respect of independence
− of all matters relevant to independence (such as relationships and non-audit
fees) and the safeguards applied.
*This requirement does not apply if those charged with government are involved in
managing the entity as they will already be aware of these issues. The significant
matters do not include material weaknesses in internal controls as such a report is a
requirement of ISA 265, not ISA 260 (see later section).
3.3 The communication process
The communication with those charged with governance may be provided either in
writing or orally. It could take place as a discussion between the auditor and an
appropriate level of management, perhaps with the audit committee in the case of a
larger company.
However, where oral communication would not be adequate ISA 260 requires that
communication is in writing. If communication is oral then the matters
communicated, to whom and when must be documented.
Communication is required to be made on a timely basis. The appropriate timing
will vary depending on the matter to be communicated. Communication in respect
of planning matters will be likely to be made early in the engagement. Any
significant difficulties encountered during the audit should be communicated as
soon as practicable, especially if likely to lead to a modified opinion.
Chapter 17: Other audit and assurance situations and reports
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 371
Communicating deficiencies in internal control: ISA 265
Introduction and requirements of ISA 265
The management letter
4 Communicating deficiencies in internal control: ISA
265
4.1 Introduction and requirements of ISA 265
ISA 315, covered largely in an earlier chapter, requires the auditor to communicate
material weaknesses in internal control identified during the audit to
management. This requirement is embodied in ISA 265 Communicating deficiencies in
internal control to those charged with governance and management.
A deficiency is defined by ISA 265 as where:
a control is designed, implemented or operated in such a way that it is unable to
prevent, or detect and correct, misstatements in the financial statements on a
timely basis, or
a control necessary to prevent, or detect and correct, misstatements in the
financial statements on a timely basis is missing.
A significant deficiency is one which merits the attention of those charged with
governance.
ISA 265 requires the auditor to:
Communicate significant deficiencies identified during the audit to those
charged with governance in writing on a timely basis.
Communicate any other deficiencies to an appropriate level of management
The communication of significant deficiencies must be in writing and is required to
cover:
A description of the deficiencies and an explanation of their potential effects.
Sufficient information to allow those charged with governance and management
to understand the context of the communication, including an explanation that:
- the purpose of the audit was to express an opinion on the financial
statements
- whilst the audit did include consideration of internal controls in order to
design appropriate audit procedures, this was not done for the purpose of
expressing an opinion on the effectiveness of internal control, and
- the matters being reported are limited to those deficiencies identified
during the audit and considered of sufficient importance to be reported.
The above should make it clear that the report covers only those weaknesses that
have been discovered as a result of the audit work that has been undertaken. It is a
by-product of a statutory audit, and is not the result of a full review of systems and
Paper F8: Audit and assurance (International)
372 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
controls. As a consequence, other weaknesses may exist that are not mentioned in
the report.
Theauditorwillalsousuallystatethatsuch communication has beenprovidedfor
thepurposesof thosechargedwithgovernance,andthatitmaynotbesuitable for
otherpurposes.
4.2 The management letter
Although now a requirement of both ISA 315 and ISA 265, the management letter
or letter of weakness has long been seen as an extra service provided to the client
by the external auditor. If management address the points in the letter, the controls
in place will be improved. This may enable future audits to focus on the more
efficient systems-based approach. This in turn may reduce the cost of the audit to
the client.
The report is prepared and sent after the results of the tests of control are known –
usually after the interim audit.
The report may later be updated after the final audit, if further weaknesses have
been found, or if weaknesses that were reported to previously have not yet been
dealt with.
In line with ISA 265’s requirement to give a description of the deficiencies and an
explanation of their potential effects, the report will usually identify the following
information for each weakness reported.
The nature of the weakness in the present system, in terms of both design and
operation. (In other words, is there a control weakness ‘on paper’? If there is no
control weakness ‘on paper’, are the controls applied effectively in practice?)
The implication of this weakness in controls.
Recommendations for improvement.
The auditor should ask management to provide a response and action plan for each
weakness identified in the report. He should also mention that the contents of the
report will be followed up in future audits.
An earlier chapter looked at the identification of specific control “risks” and asked
for suggestion of controls to mitigate these risks. This topic could also be tested in
the exam in the context of the preparation of a management letter.
Example
You are the auditor of AdviceCo. During your audit of the purchases cycle you have
identified the following weaknesses:
1. Payables ledger clerks amend standing data held on the standing data
masterfile when they are instructed to do so by the buying manager.
2. The financial director signs cheques made out to suppliers without sight of any
supporting documentation.
Chapter 17: Other audit and assurance situations and reports
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 373
Required
In respect of the above weaknesses set out the consequences of each weakness and
the recommendations you would suggest as they might appear in the management
letter.
Answer
Weakness 1
Consequence
Inappropriate amendments could be made leading to a loss to AdviceCo. For
example, incorrect standing data could lead to incorrect discounts being claimed or
supplies being purchased from non-authorised suppliers.
Recommendation
All amendments to standing data should be instigated on standard documentation,
counter-signed by the buying director. This documentation should be retained and
subsequently reviewed by a responsible official (such as the financial controller) to
ensure that the correct amendments have been made and that the amendments were
properly authorised.
Weakness 2
Consequence
A supplier could be overpaid or paid twice or a cheque could be paid to an entity
which has not supplied the organisation (if an employee wishes to commit fraud).
Recommendation
Cheque signatories should inspect supporting documentation such as original
purchase invoices made out to AdviceCo. This check should be evidenced by
signature on the invoices being paid.
Paper F8: Audit and assurance (International)
374 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
The audit of smaller entities
Introduction
Audit approach to smaller entities
5 The audit of smaller entities
5.1 Introduction
TheIAASB’sGlossaryoftermsdefinesasmallerentityasonewhichtypicallypossesses
thefollowingcharacteristics:
Concentration of ownership and management in a small number of individuals
(often a single owner-manager)
One or more of the following:
- Uncomplicated transactions
- Simple record-keeping
- Few lines of business/products
- Few internal controls
- Few levels of management with responsibility for a broad range of controls
- Few personnel, many having a wide range of duties.
Standard audit practice requires the auditor to gain an understanding of the
business and its environment in developing an audit strategy. Applying this
principle to the audit of smaller entities will allow the auditor to focus attention on
the main features of the client, which will affect the audit approach.
As discussed in a previous chapter, the key point here is likely to be internal control.
Segregation of duties is likely to be weak due to the restricted numbers of staff
being employed.
Owners or senior management are likely to dominate all major aspects of the
business activities. This is useful as a form of supervisory control, but there is
often little in the way of control over management themselves.
In an expanding business, senior management may be more involved in
developing the business, leaving little time for implementing supervisory or
other controls.
Record keeping and documentation of systems and controls may be informal or
inadequate.