ACCA Applied Skills · Audit and Assurance

Audit planning and documentation: formula sheet

Full chapter guide

Key formulas

Preconditions for an audit (ISA 210): Acceptable financial reporting framework + management agrees to its responsibilities; Management must accept responsibility for preparing the financial statements, for internal control, and for giving the auditor access to information and people.
Typical engagement letter contents: Objective and scope; auditor's responsibilities; management's responsibilities; framework; form of report; other matters; Other matters often include fees and billing, timing, limitation of liability, use of experts or internal auditors, and reporting of any other communications.
Acceptance checks memory aid: Ethics, Independence, Competence, Resources, Integrity, Predecessor; Use it to structure any acceptance answer. Add legal validity of appointment and money laundering where the scenario hints at them.
Recurring audits: Consider each period whether terms need to be revised; Revise if there is a change in management, ownership, nature of business, legal requirements or the reporting framework.
Engagement letter vs representation letter: Engagement letter: auditor to client, at start, terms. Representation letter: management to auditor, at end, confirmations; A very common exam comparison.
Audit risk model: Audit risk = Risk of material misstatement × Detection risk; Risk of material misstatement = inherent risk × control risk. Understanding the entity feeds your assessment of both.
Risk assessment procedures (ISA 315): Enquiries + Analytical procedures + Observation and inspection; These procedures alone do not provide sufficient evidence for the audit opinion. They support risk assessment.
Areas of understanding: Entity and its business model + Industry and regulation + Reporting framework and policies + Performance measurement + Internal control; Use this list as a checklist when a question asks what the auditor should understand.
Exam answer chain: Scenario fact → Business risk → Risk of material misstatement (account and assertion) → Audit response; Marks are usually earned at the risk and response steps, not for repeating the fact.
Strategy vs plan: Strategy = scope, timing, direction. Plan = detailed procedures (risk assessment + further audit procedures).; Strategy comes first and guides the plan. The plan is more detailed.
Planning is iterative: Plan → perform → learn → revise strategy and plan → document; ISA 300 requires you to update the strategy and plan as necessary during the audit.
Procedures described in the plan: Nature, timing, extent; Use these three words to structure answers on what the plan contains.
Benefits of planning: Focus on key areas, spot issues early, organise work, direct and review team, coordinate experts and others; Use these as a checklist for why planning is important.
Materiality: Materiality = benchmark × chosen percentage; ISA 320 gives no fixed percentages. In exam questions, use the percentage given or a typical range such as 5% of profit before tax, 0.5% to 1% of revenue and 1% to 2% of total assets, and state it as judgement.
Performance materiality: Performance materiality < materiality (often 50% to 75% of materiality); Lower percentage when risk is higher. Always lower than overall materiality.
Clearly trivial threshold: Clearly trivial < materiality (often a small percentage, such as 5%); Misstatements below this need not be accumulated. Use the exam's figure if given.
Revised materiality: New materiality = actual benchmark × same percentage; Recalculate if final figures differ significantly from those used at planning.
Gross profit margin: Gross profit ÷ Revenue × 100; A fall may point to understated revenue, overstated cost of sales, or inventory errors.
Operating profit margin: Operating profit ÷ Revenue × 100; Compare with gross margin to see if the change comes from expenses.
Current ratio: Current assets ÷ Current liabilities; Low or falling values raise going concern and liquidity questions.
Receivables days: Trade receivables ÷ Revenue × 365; A rise may suggest irrecoverable debts, fictitious sales or cut-off errors.
Inventory days: Inventory ÷ Cost of sales × 365; A rise may suggest obsolete or overstated inventory.
Payables days: Trade payables ÷ Cost of sales × 365; A fall may suggest unrecorded liabilities; a sharp rise may signal cash pressure.
Gearing: Debt ÷ Equity × 100 (or Debt ÷ (Debt + Equity) × 100); State which version you use. Check covenants and going concern.
Percentage change: (Current − Prior) ÷ Prior × 100; Use it to quantify each movement before commenting.
Fraud risk factors (fraud triangle): Fraud = Incentive or pressure + Opportunity + Attitude or rationalisation; Use these three headings to structure answers on why a fraud risk exists in a scenario.
Responsibility split for fraud: Management and those charged with governance: prevent and detect. Auditor: reasonable assurance on material misstatement.; The auditor is not responsible for preventing fraud.
Presumed fraud risks (ISA 240): Revenue recognition + management override of controls; Revenue is a presumption that can be rebutted with reasons. Management override cannot be rebutted. Both are treated as significant risks.
ISA 250 two categories of law: Laws with direct effect on the numbers: obtain sufficient appropriate evidence. Other laws: limited procedures (enquiry, inspection of regulator correspondence).; Always say which category a law falls into.
Going concern period: Management assessment covers at least 12 months from the date of the financial statements; The auditor considers events up to the date of the auditor's report.
Test of sufficient documentation: File must let an experienced auditor with no previous connection understand: procedures (nature, timing, extent) + results and evidence + significant matters, conclusions and judgements; This is the core ISA 230 test. Quote it when a question asks what documentation must achieve.
Items to record for each test: Who performed the work and the date + who reviewed it and the date + identifying characteristics of items tested; Identifying characteristics could be an invoice number, date, or the item selected for testing. This allows the work to be re-performed.
Departures from requirements: If an ISA requirement is not followed: document how alternative procedures achieved the aim, and the reasons for the departure; This applies only in exceptional circumstances.
Assembly of the final file: Complete assembly within a reasonable time after the date of the auditor's report; Many firms set 60 days as policy, but ISA 230 itself only says a reasonable time. Do not present 60 days as an ISA rule.
Changes after file completion: If changes or additions are needed: record when, by whom and the specific reasons, and who reviewed them; Never delete old papers to make the file look neater.

Quick revision

The engagement letter is agreed before the audit starts and sets out scope, responsibilities, the framework and the form of the report.
Management is responsible for the financial statements and internal control. The auditor is responsible for the audit opinion.
The audit strategy sets the overall approach. The audit plan sets the detailed procedures.
Materiality is a judgement. Benchmarks such as profit or revenue are a starting point, and nature matters as well as size.
Performance materiality is set below materiality to reduce the chance that uncorrected and undetected errors add up to a material amount.
Audit risk = risk of material misstatement × detection risk. The risk of material misstatement is inherent risk combined with control risk.
Inherent and control risks belong to the entity. The auditor cannot change them, only assess them.
Lower detection risk means more or better audit work.
In analytical procedures, calculate the ratio, spot the change, then give possible causes and the audit response.
The auditor must plan with professional scepticism and discuss fraud risk within the team.
Going concern is assessed by management first. The auditor considers whether management's assessment is appropriate.
Documentation must let an experienced auditor with no prior link to the audit understand the work done, the evidence obtained and the conclusions.

Common mistakes

Mixing up the engagement letter and the letter of representation. Fix: Remember the direction and timing: the engagement letter goes from the auditor at the start; the representation letter comes from management at the end.
Listing acceptance checks without applying them to the scenario. Fix: Pick the facts in the scenario, name the issue, and give the action. One applied point earns more than three bare headings.
Listing generic sources of information without relating them to the client. Fix: Name the source and say what it will tell you about this client, for example board minutes to identify disputes or major decisions.
Treating every business risk as a risk of material misstatement. Fix: Business risks become audit concerns only when they could affect the financial statements. Say which balance or disclosure is affected.
Using strategy and plan as if they mean the same thing. Fix: Remember that the strategy sets scope, timing and direction, while the plan lists detailed procedures.
Saying planning is a stage that finishes before fieldwork. Fix: State that planning is continuous and iterative, and the strategy and plan are updated as needed.
Applying the percentage to the wrong figure, for example using revenue when profit was asked for. Fix: Underline the benchmark in the question. Write it next to the percentage before multiplying.
Setting performance materiality equal to or above materiality. Fix: Always reduce it. Remember it exists to cover undetected and uncorrected errors adding up.
Calculating ratios but giving no interpretation. Fix: After each ratio write what changed, why it might have happened and what risk it creates.
Saying analytical procedures at planning give conclusive evidence. Fix: Say they identify risk and direct work. Evidence comes from later procedures, including substantive analytical procedures.

Exam tips

Structure acceptance answers with the six headings and tie every point to a scenario fact. The scenario is usually built to trigger two or three of them.
Use ISA 210 wording for the engagement letter: scope, responsibilities of both sides, framework, form of the report. Add practical terms such as fees last.
In OT questions, check who writes the letter and when. This is the standard trap in options.
If asked for a conclusion, give a firm one: accept, accept with safeguards, or decline, with a one-line reason.
Learn the predecessor sequence: client permission, then written enquiry, then consider the reply. Never skip the permission step.
Always tie your answer to the scenario. A point that could be written about any client earns few marks.
In OT questions, read the verb carefully. 'Risk assessment procedure', 'business risk' and 'substantive procedure' are different things.
Group scenario facts by theme (growth, IT, regulation, finance) to keep a written answer organised and avoid missing points.