ISA 200 Summaries: Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing ISA 200 Scope”Para 11-09″
ISA 200 deals with the independent auditor’s overall responsibilities when conducting an audit of financial statements in accordance with ISAs. Explains the scope, authority and structure of the ISAs. ISAs are written in the context of an audit of financial statements. An audit in accordanc accordance e with ISAs is conducte conducted d on the premise that manage management ment and, where appropriate, those charged with governance have acknowledged certain responsibilities that are fundamental to the conduct of the audit. The audit of the financial statements does not relieve management or those charged with governance of their responsibilities
Effective Date of ISA 200: for periods beginning on or after 15 December 2009 ISA 200 Objectives:
To obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, thereby enabling the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework; and To report on the financial statements, and communicate as required by the ISAs, in accordance with the auditor’s findings.
Definitions
For definitions refer definition page
ISA 200 Requirements
Compliance with ethical requirement relating to audit of financial statement. Auditor shall shall exercise professiona professionall judgment judgment in planning planning and performing performing audit audit of financial financial statement. Auditor shall shall obtain sufficien sufficientt appropriate appropriate audit evidence evidence to reduce audit audit risk to an acceptably low level for expression of opinion Auditor shall shall comply with all ISAs ISAs relevant to the audit. audit. Auditor shall shall comply with each requiremen requirementt of an ISA ISA unless, unless, entire ISA ISA is irrelevant irrelevant or requirement is conditional and condition doesn’t exist In case of departure from ISA auditor shall perform alternative audit procedures to achieve the aim of that requirement. If objective of ISA cannot be achieved auditor shall evaluate whether this prevents the auditor from achieving the overall objectives of the auditor and thereby requires the auditor, in accordance with the ISAs, to modify th e auditor’s opinion or withdraw from the engagement. Document the same in accordance with ISA 230.
ISA 210 Summary: Agreeing the Terms of Audit Engagements ISA 210 Scope This ISA deals with the auditor’s responsibilities in agreeing the terms of the audit engagement with management and, where appropriate, those charged with governance.
Establishing certain preconditions for an audit. Establishing responsibility which rests with management and, where appropriate, those charged with governance. governance .
Effective Date of ISA 210 for periods beginning on or after December 15, 2009.
ISA 210 Objectives: To accept or continue an audit engagement only when the basis upon which it is to be performed has been agreed.
Establishing whether the preconditions for an audit are present; and Confirming that there is a common understanding between auditor and management and where appropriate those charged with governance.
Definitions; See definition page
ISA 210 Requirements:
Financial reporting framework to be applied in the preparation of the financial statements shall be acceptable. Management acknowledges and understands its responsibility; For the preparation of the financial statements in accordance with the applicable o financial reporting framework, including where relevant their fair presentation; For such internal control as management determines is necessary to enable the o preparation of financial statements that are free from material misstatement, whether due to fraud or error; and To provide auditor with access of all information, additional information and o unrestricted access to person in company for audit. If limitation on the scope of audit prior to acceptance of audit that will result in disclaiming opinion don’t accept engagement unless required by law. Agree the terms of audit engagement engagement with management management or those charges with governance an Engagement letter shall at least include; The objective and scope of the audit of the financial statements; o The responsibilities of the auditor; o The responsibilities of management; o Identification of the applicable financial reporting framework for the preparation of o the financial statements; and Reference to the expected form and content of any reports to be issued by the o auditor and a statement that there may be circumstances in which a report may differ from its expected form and content.
If above components of engagement letter is in law and regulation, engagement letter not necessary. On recurring audit assess the change in circumstances and need to revise engagement letter. There must be reasonable justification for change in engagement letter, after it has been agreed. If change not agreeable with management, Withdraw and consider the legal or contractual obligation.
Financial Reporting Standards Supplemented by Law or Regulation
Auditor consider the conflict between law and standards; Additional disclosure or o change description of applicable financial reporting framework o
Financial Reporting Framework Prescribed by Law or Regulation —Other Matters Affecting Acceptance
Financial reporting frame unacceptable but required by law accept engagement if; Management agree to provide additional disclosures o Add emphasis of matter paragraph in audit report. o Don’t add true and fair like statement unless required and allowed by law. o If above conditions are not meet and audit required by law, evaluate effect of misleading information and include reference to that in the engagement letter.
Auditor’s Report Prescribed by Law or Regulation In some cases law prescribe wording of audit report, auditor shall consider whether users might misunderstand the assurance obtained, if so then Whether additional explanation in the auditor’s report can mitigate possible misunderstanding. If cannot be mitigated don’t accept audit engagement unless required by law. An audit conducted in accordance with such law or regulation does not comply with ISAs. Accordingly, the auditor shall not include any reference within the auditor’s report to the audit having been conducted in accordance with ISAs.
ISA 220 Summaries: Quality Control for an Audit of Financial Statements ISA 220 Scope This deals with the specific responsibilities of the auditor regarding quality control procedures for an audit of financial statements. It also addresses, where applicable, the responsibilities of the engagement quality control reviewer. This ISA is to be read in conjunction with relevant ethical requirements.
System of Quality Control and Role of Engagement Teams Quality control systems, policies and procedures are the responsibility of the audit firm. Under ISQC 1, the firm has an obligation to establish and maintain a system of quality control to provide it with reasonable assurance that:
The firm and its personnel comply with professional standards and applicable legal and regulatory requirements; and Reports issued by the firm or engagement partners are app ropriate in the circumstances.
This ISA is premised on the basis that the firm is subject to ISQC 1 or to national requirements that are at least as demanding. Within the context of the firm’s system of quality control, engagement teams have a responsibility to implement quality control procedures that are applicable to the audit engagement and provide the firm with relevant information to enable the functioning of that part of the firm’s system of quality control relating to independence. Engagement teams are entitled to rely on the firm’s system of quality control, unless information provided by the firm or other parties suggests otherwise. Effective Date of ISA 220 15 December 2009 ISA 220 Objectives
The objective of the auditor is to implement quality control procedures at the engagement level that provide the auditor with reasonable assurance that:
The audit complies with professional standards and applicable legal and regulatory requirements; and The auditor’s report issued is appropriate in the circumstances.
Definitions
For definitions refer definitions page ISA 220 Requirements
Leadership Responsibilities for Quality on Audits The engagement partner shall take responsibility for the overall quality on each audit engagement to which that partner is assigned. Throughout the audit engagement, the engagement partner shall remain alert, through observation and making inquiries as necessary, for evidence of non-compliance with relevant ethical requirements by members of the engagement team.
If matters come to the engagement partner’s attention through the firm’s system of quality control or otherwise that indicate that members of the en gagement team have not complied with relevant ethical requirements, the engagement partner, in consultation with others in the firm, shall determine the appropriate action. Independence
The engagement partner shall form a conclusion on compliance with independence requirements that apply to the audit engagement. In doing so the engagement partner shall:
Obtain relevant information from the firm and, where applicable, network firms, to identify and evaluate circumstances and relationships that create threats to independen ce; Evaluate information on identified breaches, if any, of the firm’s independence policies and procedures to determine whether they create a threat to independence for the audit engagement; and Take appropriate action to eliminate such threats or reduce them to an acceptable level by applying safeguards, or, if considered appropriate, to withdraw from the audit engagement, where withdrawal is possible under applicable law or regulation. The engagement partner shall promptly report to the firm any inability to resolve the matter for appropriate action.
Acceptance and Continuance of Client Relationships and Audit Engagements
The engagement partner shall be satisfied that appropriate procedures regarding the acceptance and continuance of client relationships and audit engagements have been followed, and shall determine that conclusions reached in this regard are app ropriate. If the engagement partner obtains information that would have caused the firm to decline the audit engagement had that information been available earlier, the engagement partner shall communicate that information promptly to the firm, so that the firm and the engagement partner can take the necessary action. Assignment of Engagement Teams
The engagement partner shall be satisfied that the engagement team, and any auditor’s experts who are not part of the engagement team, collectively have the appropriate competence and capabilities to:
Perform the audit engagement in accordance with professional standards and applicable legal and regulatory requirements; and Enable an auditor’s report that is appropriate in the circumstances to be issued.
Engagement Performance Direction, Supervision and Performance
The engagement partner shall take responsibility for:
The direction, supervision and performance of the audit engagement in compliance with professional standards and applicable legal and regulatory requirements; and The auditor’s report being appropriate in the circumstances.
Reviews
The engagement partner shall take responsibility for reviews being performed in accordance with the firm’s review policies and procedures. On or before the date of the auditor’s report, the engagement partner shall, through a review of the audit documentation and discussion with the engagement team, be satisfied that sufficient appropriate audit evidence has been obtained to support the conclusions reached and for the auditor’s report to be issued. Consultation
The engagement partner shall:
Take responsibility for the engagement team undertaking appropriate consultation on difficult or contentious matters; Be satisfied that members of the engagement team have undertaken appropriate consultation during the course of the engagement, both within the engagement team and between the engagement team and others at the appropriate level within or outside the firm; Be satisfied that the nature and scope of, and conclusions resulting from, such consultations are agreed with the party consulted; and Determine that conclusions resulting from such consultations have been implemented.
Engagement Quality Control Review
For audits of financial statements of listed entities, and those other audit engagements, if any, for which the firm has determined that an engagement quality control review is required, the engagement partner shall:
Determine that an engagement quality control reviewer has been appointed; Discuss significant matters arising during the audit engagement, including those identified during the engagement quality control review, with the engagement quality control reviewer; and Not date the auditor’s report until the completion of the engagement quality control review.
The engagement quality control reviewer shall perform an objective evaluation of the significant judgments made by the engagement team, and the conclusions reached in formulating the auditor’s report. This evaluation shall involve:
Discussion of significant matters with the engagement partner;
Review of the financial statements and the proposed auditor’s report; Review of selected audit documentation relating to the significant judgments the engagement team made and the conclusions it reached; and Evaluation of the conclusions reached in formulating the auditor’s report and consideration of whether the proposed auditor’s report is appropriate.
For audits of financial statements of listed entities, the engagement quality control reviewer, on performing an engagement quality control review, shall also consider the following:
The engagement team’s evaluation of the firm’s independence in relation to the audit engagement; Whether appropriate consultation has taken place on matters involving differences of opinion or other difficult or contentious matters, and the conclusions arising from those consultations; and Whether audit documentation selected for review reflects the work performed in relation to the significant judgments and supports the conclusions reached.
Differences of Opinion If differences of opinion arise within the engagement team, with those consulted or, where applicable, between the engagement partner and the engagement quality control reviewer, the engagement team shall follow the firm’s policies and procedures for dealing with and resolving differences of opinion. Monitoring
An effective system of quality control includes a mon itoring process designed to provide the firm with reasonable assurance that its policies and procedures relating to the system of quality control are relevant, adequate, and operating effectively. The engagement partner shall consider the results of the firm’s monitoring process as evidenced in the latest information circulated by the firm and, if applicable, other network firms and whether deficiencies noted in that information may affect the audit engagement. Documentation The auditor shall include in the audit documentation:
Issues identified with respect to compliance with relevant ethical requirements and how they were resolved. Conclusions on compliance with independence requirements that apply to the audit engagement, and any relevant discussions with the firm that support these conclusions. Conclusions reached regarding the acceptance and continuance of client relationships and audit engagements. The nature and scope of, and conclusions resulting from, consultations undertaken during the course of the audit engagement.
The engagement quality control reviewer shall document, for the audit engagement reviewed, that:
The procedures required by the firm’s policies on engagement quality control review have been performed; The engagement quality control review has been completed on or before the date of the auditor’s report; and The reviewer is not aware of any unresolved matters that would cause the reviewer to believe that the significant judgments the engagement team made and the conclusions it reached were not appropriate.
ISA 230 – Audit Documentation Introduction
International Standard on Auditing 230: Audit Documentation requires auditor to document the aspects of audit engagement as and when they happen. Each standard has certain requirements what to document, however, ISA 230 covers the documentation responsibility of auditor in general. Executive Summary
Auditor is required to maintain an audit file in which he shall document the findings and facts concerning audit engagement and the procedures applied by the auditor to achieve audit objectives. Audit documentation serves as an evidence that audit was conducted as per the requirements of ISAs in addition to other benefits of documentation. Auditor shall document the procedures, resultant audit evidence obtained and conclusions reached on the basis of evidence. Auditor must document how he ensures the compliance of ISAs and in case if there is any departure then how alternate approach achieved audit objectives. 1 Why Document Audit?
Audit documentation is simply the record of:
audit procedures performed Relevant audit evidence obtained by the application of audit procedures And the conclusions and interpretations drawn by the auditor on the basis of audit evidence obtained
The main purpose of audit documentation is to provide written or documented evidence regarding different audit related matters and provides evidence o f:
1. 2.
The basis for a conclusion that auditor’s overall objective has been achieved Audit planning and performance in accordance with the ISAs, applicable laws and regulatory requirements
Other important purposes audit documentation serves are as follows:
Helping the engagement team in planning and performing audit. For example issues observed in previous and current audit can help plan further procedures. Enabling team members in supervision and review responsibilities of audit work performed by junior team members. Make engagement team answerable for the work it performed. Helps in keeping the record of such matters which can aid in future audits. Making it easy to conduct quality control reviews in accordance with ISAs or other applicable regulations. Making it possible to conduct external evaluations and inspections in the light of applicable frameworks during or after engagement.
2 Objectives
Auditor’s objective is to prepare documentation in such a way that it provides:
sufficient appropriate record of the basis on which auditor’s report is issued. sufficient evidence that audit was carried out in accordance with applicable ISAs, legal and regulatory requirements
Achieving objectives – Requirements
In order to achieve the objective, auditor has to take care of number of things related to documentation which are:
Prepare audit documentation on timely basis Document the audit procedures performed and evidence o btained Assemble the audit documentation in a file called audit file
2.1 Timely preparation of audit documentation
The auditor shall assure timely preparation of audit docu mentation as it:
reinforces audit quality Aids in review of work performed and evaluation of evidence gathered Enables the assessment of conclusions reached before audit report is finalized
Documentation should be done while performing the audit as documentation prepared after the work will not be as accurate if it was prepared during the engagement. 2.2 Documentation of procedures performed and evidence obtained
Auditor shall document in such a way that an experienced auditor even having no connection with the audit engagement can understand the following: 1. 2. 3.
The nature, timing and extent of the audit procedures performed to comply with the ISAs and applicable legal and regulatory requirements; The results of the audit procedures per formed, and the audit evidence obtained; and Significant matters arising during the audit, the conclusions reached thereon, and significant professional judgments made in reaching those conclusions.
In documenting the audit procedures performed, the auditor shall also include in the documentation following items:
Identifying characteristics of items and matters examined Who conducted the audit work and when such work completed? Who reviewed the work and when such review took place including the extent of such review?
The way the documentation is prepared and what should be included and what depends on number of factors such as:
The size and complexity of the entity. The nature of the audit procedures to be performed. The identified risks of material misstatement. The significance of the audit evidence obtained. The nature and extent of exceptions identified. The need to document a conclusion or the basis for a conclusion not readily determinable from the documentation of the work performed or audit evidence obtained. The audit methodology and tools used.
The audit documentation may be kept in paper form or electronic form or any media deemed fit. The auditor however needs not to include the following in the documentation:
superseded drafts of working papers and financial statements, notes that reflect incomplete or preliminary thinking, previous copies of documents corrected for typographical or other errors, duplicates of documents.
Oral description i.e. undocumented explanations cannot adequately supplement the work performed but can be used to clarify the documented information. 2.2.1 Documenting compliance with ISAs
If entity follows the instructions stated in ISA 230 then it will automatically result in sufficient appropriate documentation. However, other standards may contain additional instructions regarding documentation which are given NOT to overrule the requirements of this standard rather supplement and clarify the requirements of ISA 230. Further, if no instruction is given
regarding documentation in other standard then it does not mean that no documentation should be made and in such cases ISA 230 will still be applicable. It is neither possible nor required by the auditor to document each and every aspect of audit engagement. Also, auditor is not required to document compliance in such matters where compliance is confirmed by the documents included in audit file. For example:
Inclusion of detailed audit plan evidences the fact that auditor conducted a planned audit Presence of engagement letter duly signed proves that auditor and client agreed upon terms of engagement A qualified report indicates that auditor complied with relevant standard’s requ irements. Some requirements are applied in general to the engagement e.g. professional skepticism, which cannot be documented directly. But documentation may demonstrate that auditor performs audit with skeptic attitude as he applied specific audit procedures to confirm the evidence provided by the management.
2.2.2 Documenting significant matters and related professional judgement
Significant matters are such matters that give risk to special audit consideration, treatment, conclusion or opinion. What is significant matter is not clearly defined in International Standards on Auditing (ISAs) and therefore what amounts to significant matter while conducting audit engagement is left over the auditor to decide by exercising his professional judgement. While deciding on significance of a matter, auditor is required to take an objective approach in analysing the circumstances surrounding the matter in consideration. Examples of significant matters include:
Matters that give rise to significant risks Results of audit procedures indicating: that the financial statements could be materially misstated, or o o a need to revise the auditor’s previous assessment of the risks of material misstatement and the auditor’s responses to those risks. Circumstances that cause the auditor significant difficulty in applying necessary audit o procedures. Findings that could result in a modification to the audit opinion or the inclusion of an o Emphasis of Matter paragraph in the auditor’s report.
Due to their significance auditor has to ensure that they are resolved on timely basis. In addition to that such matters are required to be discussed with reasonable authority inside an entity like management or those charged with governance as the case may be. The form, content and extent of documentation related to significant matters depend upon the extent of judgement exercised. This helps in:
explain auditor’s conclusion
later review by other auditors and subsequent audits
Sometimes a summary named completion memorandum is prepared that summarizes the matters identified and how it was resolved. It may contain references to other supporting documents. This helps in conducing quality assurance review being conducted efficiently and effectively. The auditor should also document the significant matters raised in front of management or those charged with governance and the discussions on such matters including the date of discussions. For this auditor may include minutes of meeting or discussions with third parties who advise entity on professional matters. If auditor discovers any inconsistency with his conclusion related to significant matters than auditor shall document how such inconsistency was resolved. For this auditor does not have to retain superseded and incorrect documents 2.2.3 Departure from ISA’s requirement
If auditor concludes that it is necessary to depart from the requirement of the ISA then he shall document how alternative treatment achieved auditor’s objective including the reasons for departure. However, documentation is necessary only if auditor departed from relevant requirement. Requirement is not relevant when:
Whole standard is irrelevant in the circumstances Requirement of standard is conditional and condition is not present
2.2.4 Matters arising after the date of auditor’s report
Auditor is not required to carry out any procedures once the auditor’s report has been issued. But in some circumstances auditor may perform additional audit procedures or draw new conclusions even after the date of auditor’s report e.g. subsequent events. In such circumventers auditor shall:
The circumstances arisen Additional audit procedures performed, conclusions reached and resultant changes in audit documentation Who made and reviewed changes in audit documentation and when such changes were made and reviewed.
2.3 Assembly of audit file
All the audit documentation are assembled in a file named as audit file and auditor is required to complete the work related to assembling the audit file on timely basis. Usually completion of audit file should not take more than 60 days after the date of auditor’s report to complete.
Assembling the audit file involves administrative tasks and does not amount to additional audit procedures being performed. Once the assembly of audit file is complete the auditor shall not made any changes to documentation until the end of retention period which is usually not be shorter than five years from the date of auditor’s report, or, if later, from the date of group auditor’s report. However, during retention period, auditor may make administrative changes to audit file. For example;
Sorting, collating and cross-referencing working papers Deleting or discarding superseded documents Signing off audit file assembly checklists Documenting evidence which was obtained, discussed and agreed with members of engagement team before the date of auditor’s report
In some circumstances after audit file is complete, auditor may conclude that modification to existing audit file is necessary then irrespective of nature of modification, auditor shall document:
The reason for making such change When and by whom such changes were made and reviewed
International Standard on Auditing 240
Introduction
International Standard on Auditing 240: The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements is probably one of those standards that got highlighted and massively overhauled after the scandals in business cosmos like Enron. This standard clarifies the responsibilities of management auditors pertaining to fraud and its effects on financial statements and due to this fact it considered one of the important guidelines in auditing profession.
Executive Summary ISA 240 clarifies that it is management who is responsible to manage fraud. Auditor on the other hand is interested in those fraudulent activities that affect the financial information and ultimately increase audit risk. Auditor is required to carry out audit engagement with an attitude of professional skepticism. To make audit engagement effective discussions among team members, inquiries of personnel involved in the management of the entity and communicating with those charged with governance is important. If fraud is suspected or identified, auditor shall determine its effects on audit engagement. Audit is also required to document fraud suspected or identified and how it was dealt.
1 It’s all about expectations Fraud is nothing new to business world. We have witnessed enormous scandals but one thing remained the same and that is auditors are expected to find fraudulent activity. The question is are they are really responsible as the duty of preparing true and fair financial statements is of management and thus management is responsible but still as auditor is thought to be investigating the matters (which is not really an investigation) users of financial statements expects from auditor to unearth it. ISA 240 lays down the requirements on:
1. fraud in auditing 2. the responsibility of auditor towards it and 3. dealing with fraudulent activities if found
2 What is Fraud in audit? It’s a generic philosophy and can be defined in many ways. But in concise manner we can define fraud as: I ntenti onal act of misrepresentati on
In real world misrepresentation may arise due to number of reasons but auditor is interested in those fraudulent activities that have the potential of causing material misstatements in the financial statements. Therefore in case of independent auditor’s audit engagement the following two acts are considered: 1. Misstatements in the financial statements arising out of fraudulent reporting 2. Misstatements in the financial statements arising out of misappropriate of assets
2.1 Are misstatements always caused by fraud? Misstatements are caused either by fraud or error. The factor that separates the two from each other is whether misstatement is a result of intentional or unintentional action. If it is unintentional then most probably its effects are not that deep and might be a one-off event of misstatement caused by human error, carelessness etc. Although error or errors may cause material misstatements but it is not always the case. However, if it is intentional then perpetrator will try to cover it up so that it looks normal and is not easily discovered. In the process of dressing up misstatement as true and fair representation will affect many aspects of financial information and that is why fraud will most probably results in material misstatement. That is why if material misstatement is identified by the auditor as a result of audit procedures auditor considers if it is due to fraud or error and designs the responses accordingly.
3 Responsibility towards fraud 3.1 Entity
Primarily it is the responsibility of both management and those charged with governance. Management under the supervision of those charged with governance works to prevent fraud by eradicating possibilities of fraud by creating an entity-wide culture of strong ethics and honesty. Supervision by management includes keeping close eye on management overriding controls or in any way controlling the financial reporting process for their own personal benefits. 3.2 Auditor
Auditor’s responsibility is to express an opinion on the financial statements for which he is required to obtain reasonable assurance. Reasonable assurance means that in order to express an opinion that financial statements are giving true and fair view he must be reasonably sure that financial statements are free from material misstatements due to fraud or error. 3.2.1 Why reasonable assurance? – Revisited
In ISA 200 we understood that auditor cannot provide absolute assurance because of inherent limitations of audit and thus he is restricted to provide reasonable assurance. That alternatively means that there might be some material misstatements that go undetected even if audit is properly planned and executed. And under fraudulent activities the risk of not detecting misstatement is higher than the risk of not detecting error. Reason is, as discussed above, activities involving fraud are followed by cover up activities and misinformation that legitimize the existence of fraud. And thus makes it hard to detect it. This becomes even more difficult if fraud involves management (management fraud) as opposed to employee (employee fraud) because they are able to circumvent control activities, design and change policies and reporting process and collusion. For example, employees are offered to buy vehicles at book value. To buy vehicles at cheaper rate from organization, directors may increase depreciation rate to reduce book value.
4 Objectives of ISA 240 Auditor is required to:
Identify and assess the risks of material misstatements due to fraud Design further audit procedures to obtain sufficient appropriate audit evidence against assessed risk Design appropriate responses to detected or suspected fraud
5 Assessing Risk of Fraud
5.1 Auditor and Professional skepticism
ISA 200 required auditor to conduct audit with an attitude of professional skepticism which is involves staying vigilant towards indicators and possibilities that may lead to fraud or can potentially result in fraud. Being skeptic does not mean that auditor is required to assess the correctness of each and every record by management. Auditor will only suspect if there are reasons to suspect in which case auditor will probe further. Auditor’s experience and knowledge regarding management’s honesty shall not reduce auditor’s skeptic approach to ignore the reasons why financial information is misstated and generalize it as error. If inconsistency is found au ditor shall investigate the matter.
5.2 Discussions among team members
Discussions among team members increase effectiveness of audit. Engagement partners shall decide what matters need to be discussed with team members not present in the discussion. The purpose of discussions is to reinforce on the areas where fraud is suspected and expectation of its occurrence. 5.3 Risk assessment procedures Inquiries
Inquiring management, employee, internal auditors and others helps auditor identify the conditions and events that indicate fraud. This also helps auditor in learning if management and those charged with governance are performing their duties to prevent and detect fraud. Inquiries of management
Inquire management about: 1. Any assessment of fraud conducted by management 2. What system management has in place to prevent, detect and respond to fraud identified or suspected 3. Communication between management and those charged with governance regarding system in place to assess and respond to fraud risks 4. Management’s instructions to employees like best practices or code of cond uct etc. Auditor shall also inquire management or relevant individuals if they have any knowledge of suspected or identified fraud. Also inquire those responsible to conduct internal audit function if they know of any fraud actual or suspected and if there are conditions indicative of potential fraud. Unless those charged with governance are part of management, auditor shall inquire:
1. About supervising management and its functions including internal control system to eradicate fraud and associated risks 2. About suspected or actual fraud, if any, in their knowledge. This helps auditor to corroborate inquiries of management. Analytical procedures helps auditor in identifying information not consistent with expectations. Auditor can use these procedures as part of assessment of risk of fraud. If such inconsistencies are found auditor shall evaluate the information. Any other information in addition to entity’s reporting system if auditor obtains information that is inconsistent with the information auditor already holds then auditor shall investigate the matter. While performing risk assessment procedures auditor often obtain information regarding existence of fraud risk factors. Fraud risk factors are simply the conditions that provide indication of fraud committed under motivation or pressure. Although existence of such factors does not automatically mean that fraud also exist but most often if such conditions exist it is found that fraud also exist and thus material misstatements in financial statements. The auditor shall treat those assessed risk related to fraud as significant risks and auditor is required to gain understanding of relevant controls expected to control such fraud occurrences.
6 Responses to Assessed Risk 6.1 General responses:
1. Make procedures unpredictable giving less room to those doing fraud or can do fraud to adjust 2. Supervise and assign work to team members depending on their knowledge, skill and experience and the risk of fraud 3. Evaluate accounting policies selected and applied that are indicative of fraudulent reporting 6.2 Responses to risk of management override
As management has the prime control of business activities they have the authority to make or break the control activities. Due to this fact they may override controls to commit fraud and thus materially misstatement financial statements. In response to assessed risk arising due to management’s ability to override controls auditor shall: 1. Examine books of prime entry for routine and adjusting entries. Examination includes inquiring personnel making entries for unusual entries, testing period end entries etc. 2. Assess possible influence in making accounting estimates and check if they are reasonable. 3. Identify unusual entries and assess their nature and check if they are indicative of any fraudulent reporting
Auditor shall decide if additional procedures are needed to be carried out to appropriate respond risks associated with management override.
7 Evaluation of evidence obtained The auditor shall consider if analytical procedures performed in finalizing audit engagement indicate fraud and associated risk not recognized in preliminary assessment of risk On identifying misstatement auditor shall consider whether it is caused by fraud or error. If it is considered to be a resultant of fraud then notwithstanding materiality of misstatement, auditor shall review risk assessment related to fraud and consider if responsive procedures are appropriate. Auditor shall also revisit the audit evidence already obtained from management as its reliability may be affected by colluding employees, manag ement and/or third parties. Auditor shall consider implications on audit and auditor’s report if: 1. Fraud is confirmed 2. Auditor is unable to confirm if material misstatement is by fraud or not
8 Auditor’s inability to continue engagement If auditor is unable to continue working on engagement as a result of fraud, actual or suspected, auditor shall: Determine responsibilities imposed by law and profession including communicating the matter with those who appointed auditor and regulatory authorities. If appropriate and permitted by applicable laws, decide whether to withdraw from engagement If auditor withdraws then discuss withdrawal and reasons of withdrawal with: 1. Management and those charged with governance 2. those who appointed auditor after determining professional legal responsibilities for such
9 Written Representation Auditor shall obtain written representation from management that it is the responsibility of management to design and implement internal control system capable of preventing and detecting fraud. Written representations hall contain a disclosure by management that the y have disclosed: 1. Management’s assessment that financial statements may be materially misstated due to fraud 2. Any actual or suspected fraud in their knowledge involving employee, management or third party.
3. Any actual or suspected fraud or allegations of the same affecting financial statements as brought to attention by employee, analysts, regulators or others
10 Communication with those charged with governance Auditor shall communicate to those charged with governance or appropriate level of management regarding their responsibilities to prevent and detect fraud. If auditor identifies fraud or suspects it that involves management or employee having significant employee on internal control system or others that can affect financial reporting then auditor shall communicate the matter to those charged with governance.
11 Communication to regulatory authorities As per code of conduct auditor is required to keep client’s information confidential but where legal responsibilities override this duty then auditor shall consider his responsibilities of disclosing the matters to responsible authorities if fraud is detected or suspected
12 Documenting fraud The auditor shall document following as part of audit documentation related to fraud: 1. 2. 3. 4. 5. 6.
Significant decisions reached during engagement team discussions Risk of material misstatement due to fraud at financial statement and assertion level Responsive procedures based on assessed risk i.e. their nature, timing and extent Evidence obtained as a result of application of responsive procedures Communication with those charged with governance, authorities, regulators etc Reasons of auditor’s conclusion that risk of material misstatement due to fraud in certain aspect of financial information is not related to engagement
ISA 250 – Consideration of Laws and Regulations in an Audit of Financial Statements Introduction
International Standard on Auditing 250: Consideration of Laws and Regulations in an Audit of Financial Statements provides guidance regarding auditor’s responsibility of compliance with laws and regulations in audit of financial statements. Executive Summary
ISA 250 requires auditor to identify misstatements that could be material if applicable laws and regulations are violated by the entity. It is the duty of management to ensure that entity has
complied with all the requirements of relevant laws. In order to identify non-compliance auditor must maintain an attitude of professional skepticism. If non-compliance is found then auditor shall take necessary steps in light of ISA 250 and consider its effects on auditor’s report. 1 Matter of legal compliance
Auditor has to deal with applicable laws and regulations as well. For the purpose of considering compliance with laws and regulations assurance engagements can be divided into two classes as follows:
Other assurance engagements carried out specifically to provide opinion on compliance with specific laws and regulation Rest of the assurance engagements e.g. audit, review etc
This standard deals only with the later and not the former type of engagements. Effect of laws and regulation on the entity can be classified in two ways as follows:
The rules and regulations that affect the measurement, presentation or disclosure of items or elements of the financial statements and thus affecting the financial reports directly The rules and regulations regarding the business activities of the entity and not the reporting responsibilities therefore affecting financial statements indirectly
The level of regulation on the entity under consideration depends on the type of industry it falls and related legal practices. Some industries are under strict legal framework whereas the others are not. However, strict or not if the laws and relevant legislations are not followed then entity may fall to financial and non-financial consequences like fines, restriction to carry activities or altogether cancellation of its operations. 2 Responsibility of compliance
2.1 Management’s responsibility
It is the responsible of management working under the supervision of those charged with governance that business activities are conducted in accordance with applicable laws and management ensures that all the requirements have been followed relevant to preparation of financial statements. 2.2 Auditor’s responsibility
Auditor is responsible to the extent of identifying material misstatements caused by not complying with legal requirements. Auditor’s responsibility does not include prevention against non-compliance and is not expected to detect violations of law. Auditor is responsible to gather sufficient appropriate audit evidence to ensure financial statements are free from material misstatements however; auditor’s ability to detect such
misstatements is affected due to inherent limitations of audit engagement. However inability to detect material misstatement due to non-compliance can be caused by the following factors and adds up to inherent limitations:
Laws and requirements so violated do not relate to preparation of financial statements While disobeying the provisions of laws methods like concealment and intentional misstatement makes it difficult to trace such non-compliance Verdict of court of law is awaited to conclude whether violation occurred.
3 Auditor’s objectives
For laws directly related to preparation of financial statements auditor is required to obtain sufficient appropriate audit evidence whether requirements of law we re followed For laws that do not relate to financial statements preparation then auditor is required gather evidence of compliance for only such requirements of law if violated may cause material misstatements
In identifying such non-compliance auditor’s attitude of professional skepticism is of importance that auditor must maintain during audit engagement 4 Auditor’s consideration
Auditor is required to gain understanding regarding:
Applicable laws and regulations related to entity and the industry of which it is a part How management (or those charged with governance) ensures compliance of applicable laws and regulations
4.1 Audit procedures – identifying non-compliance
Question management (or those charged with governance) regarding how matters of compliance are dealt Reading letters, memos, summons and other communication that has taken between entity and relevant authorities Obtaining written representation from management that all events of violations or expected violations that affect the financial statements has been brought to auditor’s knowledge
Auditor must stay vigilant that procedures applied not mainly to verify compliance can also reveal events of non-compliance. However if violations are not identified or expected then auditor is not required to extend audit procedures beyond the procedures mentioned above. 4.2 Audit procedures – non-compliance identified or suspected
In case violations are identified or expected auditor shall assess its effects on reliability of representations made by management, assessed risk etc.
If auditor has identified a violation then auditor shall:
o o o
gain understanding of its nature and the circumstances in which it happened assess the effect of such violation on financial statements If auditor expects a violation then auditor shall: Communicate his concerns to management or those charged with governance. But if auditor is not satisfied with representations made by client concerning compliance and in the eyes of auditor expected violations may affect materially then auditor may seek legal advice. If auditor is unable to gather sufficient evidence regarding expected violations then auditor shall assess its effect on auditor’s opinion
5 Communicating non-compliance
Auditor shall communicate non-compliance to those charged with governance regarding identified or expected non-compliance Where auditor expects violation is with the intent of management then auditor shall communicate this to those charged with governance at his earliest If auditor finds management or those charged with governance are involved in violating the provisions of law then auditor shall seek the higher authority, if any, and communicate the matter. If there is no such higher exists then auditor may seek legal advice in this r egard
6 Auditor’s report
If identified or expected contradictions are not reported appropriately in the financial statements then auditor shall provide a qualified or adverse opinion
If auditor was unable to obtained sufficient appropriate audit evidence regarding known or expected violations that may affect financial statements materially then au ditor shall see if:
Limitation is clearly imposed by management or those charged with governance then auditor expresses a qualified or disclaimer of opinion He is unsure if limitations are a result of conditions restrictions of management then auditor shall decide in the light of circumstances
7 Disclosure to legal authorities
For identified or suspected contraries auditor shall assess if he is required to disclose such matter in front of legal authorities
ISA 260 Summary : Communication with Those Charged with Governance ISA 260 definitions Those charges with governance
The person(s) or organization(s) (for example, a corporate trustee) with responsibility for overseeing the strategic direction of the entity and obligations related to the accountability of the entity. This includes overseeing the financial reporting process. For some entities in some jurisdictions, those charged with governance may include management personnel, for example, executive members of a governance board of a private or public sector entity, or an ownermanager. ISA 260 Scope
ISA 260 deals with the auditor’s responsibility to communicate with those charged with governance in an audit of financial statements. ISA 260 effective date on or after 15 December 2009 ISA 260 Objective
ISA 260 objective are;
To communicate clearly with those charged with governance the responsibilities of the auditor in relation to the financial statement audit, and an overview of the planned scope and timing of the audit; To obtain from those charged with governance information relevant to the audit; To provide those charged with governance with timely observations arising from the audit that are significant and relevant to their responsibility to oversee the financial reporting process; and To promote effective two-way communication between the auditor and those charged with governance.
