ACCA Applied Skills · Audit and Assurance

Obtaining, accepting and continuing audit engagements: formula sheet

Full chapter guide

Key formulas

Five elements of an assurance engagement: Three parties + subject matter + suitable criteria + sufficient appropriate evidence + written assurance report; Learn this as a list. Exam questions often ask you to identify the elements in a scenario.
Three parties: Practitioner + responsible party + intended users; The auditor is never the responsible party for the subject matter being reported on.
Reasonable assurance: High level of assurance → positive conclusion; Example: 'In our opinion the financial statements give a true and fair view.' Risk is reduced to an acceptably low level, not to zero.
Limited assurance: Lower level of assurance → negative conclusion; Example: 'Nothing has come to our attention that causes us to believe...' Fewer procedures, mainly enquiry and analytical procedures.
Characteristics of suitable criteria: Relevant, reliable, neutral, understandable, complete; Criteria that fail any of these make the engagement unsuitable or need a clear description in the report.
Five fundamental principles: Integrity, Objectivity, Professional competence and due care, Confidentiality, Professional behaviour; Memory aid: I-O-P-C-P. Name them accurately in answers.
Five threats: Self-interest, Self-review, Advocacy, Familiarity, Intimidation; Label each issue in a scenario with one threat. Some issues give more than one.
Threat response: Identify → Evaluate significance → Eliminate or apply safeguards → Decline or withdraw if unresolved; This is the conceptual framework in four moves.
Common safeguard types: Separate teams, independent review, rotation, disclosure to those charged with governance, firm-wide policies and training; Match the safeguard to the threat. Do not list generic ones.
Acceptance decision: Accept only if: independent + competent + sufficient resources + management integrity + acceptable risk and fee; If any one fails and cannot be safeguarded, decline or withdraw.
Order of key steps: Typical sequence: screen and assess risk → check ethics and resources → due diligence → client permission → contact outgoing auditor (clearance) → final acceptance → valid appointment → engagement letter; This is a typical sequence, not a fixed one. Some steps overlap or run in parallel. Permission and clearance come before final acceptance and appointment. Use it as a checklist for any 'steps' question.
Client permission rule: No contact with outgoing auditor without the client's permission; If the client refuses, consider whether to accept at all.
Outgoing auditor reply: With the client's consent, the outgoing auditor should reply stating whether there are professional reasons not to accept, giving relevant facts. Without consent they should say they cannot give details.; The outgoing auditor needs the client's consent to discuss its affairs. If the client refuses to give permission to contact, or refuses to let the outgoing auditor reply, this is a warning sign and the firm should consider declining.
Preconditions for an audit (ISA 210): Acceptable financial reporting framework + management's acknowledgement of its responsibilities; If either is missing, the auditor should not accept the engagement. The only exception is where the framework is unacceptable but law requires the engagement to be accepted. In that case, the auditor must not refer to the audit as conducted in accordance with ISAs in the report, and the engagement terms must state this. The auditor must also not describe the financial statements as giving a true and fair view unless the framework is acceptable. There is no such exception for management's acknowledgement of its responsibilities.
Engagement letter contents: Objective and scope; auditor's responsibilities; management's responsibilities; framework; form of reports; fees (and other terms); ISA 210 also expects reference to the expected form and content of reports and that the report may differ from expectations in some circumstances.
Management's responsibilities: Prepare statements + internal control + provide access to all relevant information, additional information requested and unrestricted access to people; Use this as a three-part checklist in any answer. The third part is about access to information and people. Written representations are a separate matter (ISA 580).
Recurring audits: Consider whether terms need revising or reminding; new letter not required each year; Look for changes in circumstances in the scenario.
Change in terms: Request must have a reasonable justification; otherwise do not agree; ISA 210 treats a change in circumstances affecting the need for the service, or a misunderstanding about the nature of the service, as reasonable justification. A move from an audit to a lower level of assurance is not justified merely because of restrictions imposed by management or inability to obtain evidence. Cost alone is unlikely to be a reasonable justification. Consider the work done to date.
Continuance review factors: Integrity + Ethics/independence + Competence and resources + Risk + Legal issues + Fees; A memory list, not a calculation. Use it to structure any continuance answer.
Resignation vs removal: Resignation = auditor's choice; Removal = members' decision (usually by ordinary resolution); Exact procedure depends on the local law named in the question.
Departure duties: Statement of circumstances + Client consent for disclosure + Handover to successor + Documentation; Apply to any departure. Disclosure without consent needs legal authority or a public duty.

Quick revision

Assurance gives a level of comfort on subject matter to intended users; reasonable assurance is higher than limited assurance.
An audit gives reasonable assurance, expressed positively; a review gives limited assurance, expressed negatively.
The five threat categories are self-interest, self-review, advocacy, familiarity and intimidation.
Safeguards must fit the threat. If none can reduce it to an acceptable level, decline or resign.
Gifts and hospitality should be assessed for value and intent; trivial items are usually acceptable.
Before acceptance, assess management integrity, competence, resources, independence and engagement risk.
New auditors should communicate with the outgoing auditor, with the client's permission, before accepting.
The engagement letter records the objective, scope, responsibilities, reporting framework and form of report.
Agree terms before the work starts and review them if circumstances change.
On resignation, consider the reasons, any duty to report, and what to tell the incoming auditor within confidentiality rules.
Always apply your point to the facts given in the scenario.

Common mistakes

Saying reasonable assurance means absolute assurance. Fix: Reasonable assurance is high but never absolute, because of inherent limitations such as testing, judgement and possible collusion.
Listing the five elements incorrectly, for example including 'materiality' or 'independence'. Fix: Learn the list: three parties, subject matter, criteria, evidence, report. Practise writing it from memory.
Only listing the names of the five threats without applying them to the scenario. Fix: Quote the specific fact and explain how it creates the threat in one sentence.
Mixing up self-review and self-interest. Fix: Ask whether you would be checking your own firm's work (self-review) or whether you gain financially or personally (self-interest).
Listing generic points without using the scenario. Fix: Use only the factors the scenario supports and quote its facts. Each point needs the fact, the issue and the action.
Contacting the outgoing auditor without the client's permission. Fix: State that you must first ask the client for permission. If it refuses, consider declining.
Saying the engagement letter is a legal requirement for every audit in every country. Fix: State that ISA 210 requires agreed terms to be recorded in writing, and that the form may depend on local law.
Listing only auditor responsibilities and forgetting management's. Fix: Always give both sides. Management prepares the financial statements, maintains internal control and gives access to information.
Saying the auditor can disclose everything to the new auditor freely. Fix: State that client permission is needed unless law requires or allows disclosure.
Treating resignation and removal as the same. Fix: Say who decides. The auditor resigns. The members remove.

Exam tips

Learn the five elements as a list and be ready to apply each to a scenario in one line.
In objective questions, check the wording of the conclusion first. It shows the level of assurance.
In written answers, state the level and then link the level to the amount of evidence and the form of conclusion.
Never say assurance is absolute or a guarantee. Examiners treat this as a clear error.
Use the scenario's facts: name the company, the users and the subject matter to earn application marks.
Label every issue with one specific threat name. Examiners award marks for the label and the link to the fact.
Always pair a threat with a matching safeguard. One mark is often for the threat and one for the response.
Check whether the client is listed or a public interest entity before deciding how serious a threat is.