Assurance Engagements Overview and Standards
Assurance Engagements Overview and Standards
Assurance is the practitioner’s satisfaction as to reliability of an assertion; Assurance engagement is an engagement when a practitioner
expresses a conclusion and enhance the decision making of users; and Assurance services is an independent professional service in
which a practitioner issues a written communication that expresses a conclusion.
Professional Skepticism: Auditor assumes that management is neither honest nor dishonest.
Typical engagements:
Audit - enabling an auditor to express an opinion Review - enabling an auditor to state whether anything comes to their
whether FS are prepared in accordance with attention that causes them to believe that the FS are not prepared in
appropriate criteria. Reasonable Assurance: “Internal accordance with appropriate criteria. Limited Assurance: “Nothing has come to
Controls are effective.” our attention.” PDF
Relationships among Auditing, Attestation, and Assurance Services:
● Similarity: they encompass the same decision-process
● Main difference/distinction: Scope of services
○ Assurance > Attestation > Audit
○ Auditing, particularly FS audit, is a type of assurance and attestation service that involves
examination of historical FS prepared in accordance with GAAP.
● Auditor ultimately determines the scope of audit for him to be more effective.
● Management is primarily responsible for the financial statements.
Noncompliance - acts which are contrary to the prevailing laws or regulations, commission or omission by individual.
Common examples of non-compliance Result of non-compliance with laws and regulations
(1) Violation of tax laws and environmental laws,
(1) Fines/penalties, (2) Damages (3) Threat of expropriation of assets,
(2) Occupational safety and health, and
(4) Enforced discontinuation of operations, and (5) Litigation
(3)Inside trading of securities
Responsibility of auditor to compliance Responsibility of the auditor
It is the responsibility of management, with the oversight of(1) Understand the nature of the act in which it has occurred and (2)
TCWG, to ensure the conduct in accordance with laws and obtain further information to evaluate the possible effects. (3)
regulations intent to deceive must be established by auditor
Communication:
● To management: Upon detecting fraud or non-compliance, report to superiors Audit procedures:
at least one level higher. 1. Auditor
● To TCWG: Communicate the matter in writing or orally asap; discussing a. understands the nature
material weaknesses in internal control and collusion among the employees; b. further information to evaluate the
possible effect
and adjustments suggested by auditor (regardless of materiality) 2. discuss with appropriate level of management
● To Regulatory and Enforcement Authorities: The auditor must consult with 3. seek legal advice
legal experts and professionals to determine the appropriate course of action 4. evaluate the effect of lack of SAE
if they are to consider reporting the fraud or non-compliance to the 5. evaluate the implications
appropriate regulatory entities. Confidentiality may be overridden by
statute or by the courts.
● Overall response to fraud risk identified: use less predictable audit procedures.
03 Agreeing the Terms of Audit Engagement
The objective of the auditor is to accept or continue an audit engagement only when:
Preconditions of
the audit is confirming that there is a common understanding
present between the auditor and management
Engagement letter
- is written to avoid misunderstandings regarding the engagement.
- It is not always required; applied to all assurance engagements.
- Common responsibilities of auditor and management.
05 Internal Controls
Internal control (IC) - to provide reasonable assurance about the achievement of an entity’s objectives. It is a process.
Used to achieve entity’s objective regarding: Responsibilities:
1. Reliability of financial reporting Management: to design, implement and maintain internal control
2. Effectiveness and efficiency of operations TCWG/BOD: to ensure the integrity of accounting and financial reporting systems
3. Compliance with laws and regulations Staff personnel: to perform their respective functions
Inherent limitations: COC CHA Classification of internal control
1. Cost-benefit relationship 1. By objectives: (control - achieve)
2. Management Overriding the internal control. a. Financial reporting controls - reliability of financial reporting objectives.
3. Collusion among employees. b. Operational effectiveness controls - operational effectiveness objective.
4. Changes in conditions, and compliance with c. Compliance controls - compliance.
procedures may deteriorate. 2. According to functions
5. Human error (mistakes in judgement) a. Preventive controls - to deter problems
6. Most internal controls tend to be directed at b. Detective controls - to discover problems
Anticipated types (routine transactions) c. Corrective controls - to remedy problems
Components of Internal Control: (CRIME)
Control Activities
1. Control environment - the overall tone of the organization.
APIPS
Examples are: (IM CPA HO)
a. Integrity and ethical value Authorization
Performance Review
b. Management’s philosophy and operating style
Information Processing
c. Commitment to competence Physical Controls
d. Participation by those charged with governance Segregation of duties
e. Assignment of authority and responsibility
f. Human resource policies and procedures ARICE
g. Organizational structure Authority over Transactions
Record over transactions
2. Risk assessment - management’s basis to determine the risks
Independent Checks &
to be managed. To do that: (IAM) Balances
a. Identify business risks Custody over Assets
b. Assess the likelihood of their occurrence Execution of Transactions
c. Decide how to Manage them. C/R/M Indirect controls (pervasive) CR at FS level
3. Information and communication systems – initiate, record,
process and report transactions I / E Direct control (transaction-specific) CR at assertion level
4. Monitoring - assessing the quality of internal control performance over time.
a. Ongoing – day-to-day operations (transaction authorization)
b. Separate evaluation: periodic (internal audits)
5. Existing control activities – includes human resource policies and practices relative to recruitment, orientation, training,
evaluating, counseling, promoting, compensating and remedial actions.
General authorization applies to routine transactions, whereas specific Tests of controls - are tests performed to test the operating effectiveness (at
authorization applies to non-routine transactions. least every third audit). Unlike substantive tests of details, tests of controls are
not required audit procedure.
At a minimum, CAR should be segregated. But to have an optimum Analytical Procedure is never in Test of Controls.
segregation of duties, ARICE should be segregated.
When are they Necessary? – These are tests performed to check and gather evidence as to the operating effectiveness of relevant controls
if they expect the controls to be effective and or if they expect that substantive tests alone cannot provide sufficient appr opriate
audit evidence at the assertion level.
Required Documentation – no particular form of documentation is necessary. (e.g client’s organization structure).
INTERNAL CONTROL NARRATIVES – understanding of the information system or FLOWCHARTS –
QUESTIONNAIRE specific control policies or procedures. auditor’s understanding of the system.
Compensating control – a control that reduces the risk that an existing or potential control weakness will result in a failure to meet a control
objective.
AUDIT PROCEDURES: RESPONSE TO ASSESSED RISKS
Risk Assessment Procedures Further Audit Procedures:
1 When obtaining an understanding of relevant internal control: Perform tests of controls
1. Evaluate the design. Objective: to obtain SAAE as to the operating effectiveness:
2. Determine whether it is implemented. 1. auditor intends to rely on Internal control to reduce
Substantive Test
Specific audit procedures include: 2. substantive Test will not provide SAAE
1. Inquiring of entity personnel
2. Observing the application of specific controls Specific audit procedures:
3. Inspecting documents and reports 1. Inquiry 3. Inspection
4. Analytical Procedures 2. Observation 4. Reperformance
2 Make an initial assessment of control risk (high or less than high) Make a re-assessment of control risk
Perform substantive tests
3 Identify relevant controls
Irrespective of the assessed risk of material misstatement
Re-assessment of
Audit approach Effect on substantive tests
control risk
Less effective procedures
Assessment remains at Reliance
Interim testing may be appropriate.
less than High approach
Smaller sample size
More effective procedures
Assessment is changed Switch to no
Tests moved to nearer or at year-end.
to High reliance approach
Larger sample size
TEST OF CONTROL SUBSTANTIVE TESTS
The auditor shall design and perform Test of Control to obtain ST procedures are performed in order to detect material
sufficient appropriate audit evidence when: misstatements at the assertion level, and include (1) Test of Details
Expectations that the controls are operating effectively; and of classes of transactions, account balances and disclosures and
Substantive procedures alone cannot provide. (2) Substantive Analytical Procedures.
TOC is concerned primarily with each of the ff: When the auditor has determined that an assessed risk of material
How were the controls applied? misstatement at the assertion level is a significant risk, the auditor
Were the necessary controls consistently performed? shall perform substantive procedures that are specifically
By whom were the controls applied? responsive to that risk.
OVERALL RESPONSES
1 In making a decision whether to accept or reject an engagement, the auditor’s firm should consider the following:
Integrity examples:
a. The client’s standingCompetence Independence
in the business community. Integrity of the Client
Ability
b. The client’s relations with its to Serve
previous the Client Properly (Auditability)
CPA firm.
Matter of professional judgement Affected by size and nature of entity Based on a consideration of the financial
information needs of users of the FS
Levels of Materiality:
1. Materiality at financial statement as a whole (overall materiality, general materiality)
- applicable to entire set of FS and no specific account in the standards; it is the smallest aggregate level.
- It helps us to determine whether the proposed audit adjustment is significant or not; matched to PAJE.
- the auditor considers the following factors:
Component of FS Focus on the users Nature of entity
Ownership structure Volatility of the benchmark Laws and regulations
2. Materiality applied to specific classes of transactions, account balance or disclosures (specific or individual materiality)
- materiality level for individual or particular class of transactions
- lower than overall materiality
- the auditor considers the following factors:
Laws and regulations Key industry Disclosures Understanding of the view of those
Financial Reporting Framework Particular aspect of business charge with governance
3. Performance materiality
- calculated as a certain percentage of overall materiality to capture any uncorrected misstatements.
- Used in scoping of FS line items to be tested by the auditor
These may affect the auditor’s judgement: If management refuses to correct some misstatement:
1. Nature of entity’s business and transactions Obrain understanding of management reasons; and
2. Risk Assessment Procedures Take the understanding where evaluated whether
3. Nature and extent of misstatements identified in previous financial statements as a whole are free from MM
audit
Evaluation of Misstatements
- The objective of the auditor is to evaluate:
The effect of identified misstatements on the audit The effect of uncorrected misstatements, if any, on the financial statements
Analytical Procedures
- means evaluations of financial information through analysis of plausible relationships among both financial and nonfinancial
data.
- The auditor shall design and perform analytical procedures near the end of the audit.
- The objectives of the auditor are:
to obtain relevant and reliable audit evidence when to design and perform analytical procedures near the end of the audit
using substantive analytical procedures that assist the auditor when forming an overall opinion conclusion
Related Party
- The auditor shall inquire of management regarding:
- During the audit, the auditor shall remain alert, when inspecting records or documents, for arrangements or other information
that may indicate the existence of related party relationships or transactions and the auditor shall evaluate:
Whether the identified related party relationships Whether the effects of the related party relationships and transactions:
and transactions have been appropriately accounted i. Prevent the financial statements from achieving fair presentation (for fair
for and disclosed in accordance with the applicable presentation frameworks); or
financial reporting framework. ii. Cause the financial statements to be misleading (for compliance frameworks).
3. Completion Stage/Final To assess the validity of conclusion Check if Relationship of accounts are
Review YES
consistent or not
Source: CPAR Notes
Assertions (or management assertions) are representations by SFP Assertions SCI Assertions
management, explicit or not. These assertions relation to the fairness of Completeness Completeness
Rights and Obligations Occurrence
presentation of the FS; thus, they are directly related to applicable Existence Cut-off
reporting framework. Valuation and allocation Accuracy
Presentation and Disclosure Classification
Classification of audit evidence:
1. Examples of Accounting records (Underlying data):
a. Records of initial accounting entries.
b. Supporting records, such as checks and records of electronic fund
transfers, invoices, and contracts.
c. General and subsidiary ledgers.
d. Journal entries and other adjustments to the financial statements
that are not reflected in formal journal entries.
e. Records such as worksheets and spreadsheets supporting cost
allocations, computations, reconciliation, and disclosures.
DIRECTION
OF TESTING
07 Audit Sampling
Sampling is testing of less than 100% of the items. Audit sampling applying audit procedures to less than 100% of the items. Sampling
plan refers to the procedures an auditor applies to accomplish a sampling application.
Sampling risk the possibility that the auditor’s conclusion based on a sample may be different. To reduce:
Sample selection method Sample Size Projection
Non-sampling risk: all aspects of audit risk that are not due to sampling.
Approaches to audit sampling
TOC ST
Tolerable Error Amount Tolerable Deviation Amount
It is the maximum rate of It is the maximum total error in
Tolerable Error
deviation from the prescribed population that the auditor is
control procedure. willing to accept
DR ↑ – ST ↑ IC is not reliable. Control Risk is higher than Materially misstated, when in fact it is not
it actually is. materially misstated.
DR ↓ – ST ↓ IC is reliable. Control Risk is lower than it Not materially misstated, when in fact
actually is. materially misstated.
Applicable Sampling Attribute sampling – used to test an entity’s Variables sampling - numerical quantity of a
Approaches rate of deviation (or rate of occurrence) population.
Test of Control Sample 100%
TOO HIGH SDR > TDR = CR↑ = DR↓ (more sub) Actual DR < TDR = CR↓ = DR↑ (you do a lot more)
Nature = More detailed less detailed
Efficiency is being questioned here. Timing= Year-end interim
Extent = More extensive less extensive
TOO LOW SDR < TDR = CR↓ = DR↑ Actual DR > TDR = CR↑ = DR↓
Nature = less more detailed
detailed Timing = year-end balances
interim more extensive
Extent = less extensive (less SZ)
SDR = Sample Deviation Rate Source: CPAR notes
● Substantive Procedures – more intense substantive tests will mean that less sampling will be necessary (i.e., the less the sample,
the larger the substantive tests must compensate)
● Anomalous error – those that arise from isolated events.
● Missing – do additional audit procedure or treat it as deviation; Void – select the next number
Principal sample selection methods:
1. Random-number sampling – each item in the population has an equal chance and nonzero probability selection.
2. Systematic selection - the number of sampling units in the population is divided by the sample size to get the sampling interval.
3. Block selection (or cluster sampling) - involves selecting a block(s) of contiguous items from within the population.
4. Haphazard selection - selects the sample without regard to their size, source or other distinguishing characteristics (no bias)
5. Stratification - grouping of items of similar size and each group is treated as a separate population; least desirable by auditor.
6. Value-weighted selection - high value, less chances
7. Discovery sampling – for suspicion of fraud. The auditor is concerned that a population may contain exceptions; at least one
such exception is okay.
8. Stop-or-go (Sequential sampling)- auditor expects few errors. Until we get sufficient evidence from sample, we continue to add.
A management letter is OPTIONAL and there is no standard format or approach for writing management letters.
Those requiring adjustment (Type I event) - evidence of Those requiring disclosure (Type II event) - indicative of conditions that
conditions that existed at the date of financial arose after. No adjustments needed. Ex. (1) issuance of bonds, (2) major
statements. Ex. (1) Settlement of litigation and (2) loss on purchase of business, (3) loss on inventory due to fire, (4) loss of plant
uncollectible accounts. due to flood (5) loss on uncollectible receivable because of a major
catastrophe.
Effect of Adjusting Events – FS adjusted, but auditor will keep original date of report (condition existing before balance sheet
date, but not in subsequent event)
Requiring disclosure – change date to date of subsequent event or dual date
o This in effect will make the auditor responsible to the reliability of the report up to that date.
o Dual Dating and Redating – Done after fieldwork and issue of Audit Report but before issue of FS. This extends audit
responsibility (Dual Dating is limited to a specific matter, while redating applies when the subsequently discovered
fact is pervasive.)
TYPES OF OPINION:
Unmodified Audit Report Adverse Disclaimer
1. Reasonable Assurance of Going concern Inappropriate use of Multiple Uncertainties
2. No Reasonable assurance of going concern and adequately assumption and not adequately
disclosed (with emphasis on a matter paragraph) disclosed
Letters in Audit:
1. Engagement Letter - contract between client and audit team
2. Confirmation Letter - done in ST, to confirm the balance.
3. Management Letter - improvements in IC, suggestion to management
4. Letter of Audit Inquiry - corroborate info furnished by management about L/C
5. Management Representation Letter - to emphasize its ultimate responsibility in the FS.
6. Review of Adequacy of disclosure - disclosure checklists
7. Check of Working Paper - final checking before archiving
8. Forming an Opinion
Procedures in Wrap up audit engagement:
1. Search for unrecorded liabilities
2. Make inquiries of a client’s legal counsel Omitted Procedures:
3. Review of related party transactions 1. The auditor should assess the importance of the omitted
procedure.
4. Perform final review stage audit procedures
2. The auditor determines if there are compensating procedures.
5. Review of subsequent events
3. If yes, no need for further procedures. If there are none, the
6. Obtain management representation letter
auditor shall undertake to apply the omitted procedures or
7. Review adequacy of disclosure using a checklist
alternatives.
8. Form an opinion
Auditor’s Responsibility
● DO NOT MODIFY FOR UNQUALIFIED, QUALIFIED, or ADVERSE OPINIONS
● Modification on the Auditor’s Responsibility is only done when there is a DISCLAIMING OPINION
Elements of Auditor’s Report (TARA Ba KoREA O RESA D)
1. Title 6. Management’s Responsibilities
To clearly indicate that it is a report of independent Fair presentation of FS in accordance with PFRS:
auditor’s report, “Independent Auditor’s Report” TCWG is responsible for overseeing the company.
2. Addressee (Receiver) 7. Auditor’s Responsibilities
Parties whom it is prepared, either SHs or TCWG “Our objectives are to obtain reasonable assurance…”
3. Auditor’s Report 8. Other Reporting Responsibilities
“In our opinion, the accompanying FS present fairly, in all BIR requirements; legal & regulatory requirements
material respects, the FP of the company as of …” 9. Engagement partner’s Name
4. Basis for Opinion 10. Signature of the auditor
Audit is conducted with PSAS, “we have obtained is Name of the audit firm & auditor, as appropriate`
sufficient/appropriate evidence to provide a basis.” 11. Auditor’s Address
Location in the jurisdiction where the office is
5. Key Audit Matters (omitted if disclaimer is issued)
For audits of complete sets of GPFS of listed companies; 12. Date of the Auditor’s Report
Most significant aspects - discuss why they are Date when the fieldwork is completed
significant
the prior period financial statements were not audited, the auditor shall state in an Other Matter paragraph in the auditor’s report
that the corresponding figures/comparative financial statements are unaudited.
SPECIAL CONSIDERATIONS—Audits of Financial Statements Prepared in Accordance with Special Purpose Frameworks
Special Purpose Framework - a financial reporting framework designed to meet the financial information of specific users.
1. Apply PSA 700 (Revised) – Forming an Opinion and Reporting on Financial Statements.
2. The auditor’s report shall describe the purpose for which the FS are prepared and, if necessary, the intended users.
3. The auditor’s report on special purpose financial statements shall include an Emphasis of Matter paragraph.
SPECIAL CONSIDERATIONS—Audits of Single Financial Statements and Specific Elements, Accounts or Items of A Financial Statement
1. Apply PSA 700 (Revised), adapted as necessary in the circumstances of the engagement
2. If report on a single financial statement or on a specific element of a financial statement, the auditor shall express a separate
opinion for each engagement.
10 Auditing in an IT Environment
An IT environment exists when a computer of any type or size is involved in the processing by the entity of financial
information of significance to the audit, whether the computer is operated by the entity or by a third party.
The overall objective and scope of an audit does not change in an IT environment.
An IT environment may affect:
a. The procedures followed in obtaining a sufficient understanding of the accounting and internal control systems.
b. The consideration of the inherent and control risk.
c. The design and performance of tests of controls and substantive procedures
If specialized skills are needed, the auditor would seek the assistance of a professional possessing such skills, who may be
either on the auditor’s staff or an outside professional.
Fundamental Principles:
Integrity straightforward and honest, fair-dealing and truthfulness
Objectivity fair, intellectually honest, free of conflicts
Professional Competence and Due attain and maintain professional knowledge, act diligently in accordance with standards
Care (PSA)
Confidentiality respect of confidential information acquired
Professional behavior comply with relevant laws/regulations, avoid misconduct that might discredit the profession
Contingent fees are acceptable in non-assurance Cross border activities – choose the stricter of the two ethical
engagements, but not in assurance. requirements for prudence and conservatism.
Advertising - communication to the public to procure Publicity - communication of facts about the PA not designed for the
professional business. NOT ACCEPTABLE. promotion of PA. ACCEPTABLE.
Independence of mind - mental attitude or state of Independence in Appearance - from the perspective of 3rd person
mind
Threats to compliance with fundamental principles:
1. Self-interest threats - there is a financial or other interest.
2. Self-review threat - PA will appropriately evaluate the
results of a previous judgment made.
3. Advocacy threat - promoting an assurance client’s position,
acting as an advocate on behalf of an audit client.
4. Familiarity threat - too sympathetic to the client’s interests
5. Intimidation threat - PA will be deterred from acting
objectively because of actual or perceived pressures.