ACCA Applied Skills · Audit and Assurance

Understanding the entity and its environment and the applicable financial reporting framework: formula sheet

Full chapter guide

Key formulas

Areas of understanding (ISA 315 Revised 2019): External factors + Nature of entity + Objectives, strategies and business risks + Performance measurement; Use these four headings to structure any answer. Also remember the applicable financial reporting framework and accounting policies.
Risk assessment procedures: Enquiries + Analytical procedures + Observation and inspection; These procedures alone do not provide sufficient evidence for an opinion. They support risk assessment.
Business risk to audit risk link: Business risk → possible risk of material misstatement → audit response; Always finish by saying what the risk means for the financial statements.
What the auditor must understand (ISA 315): Framework + accounting policies + changes in policies + reasons for changes; Part of understanding the entity and its environment. Cover how and why policies are chosen and applied.
Test of an accounting policy: Appropriate + consistently applied + properly disclosed; Use this three-part test to judge any policy in an exam answer.
Test of a policy change: Required or voluntary? Justified? Applied correctly? Disclosed?; Voluntary changes carry higher risk. Under IAS 8, a voluntary change is made only if it gives more reliable and relevant information.
Risk link: Complex or new framework requirements → higher risk of material misstatement; Examples: a new IFRS, first-time adoption, or a lack of accounting expertise.
Five components of internal control (ISA 315): Control environment + Risk assessment process + Monitoring + Information system and communication + Control activities; Learn them as a list. Control environment, risk assessment and monitoring are entity-level. Information system and control activities are process-level.
Understanding controls: Understand = Evaluate design + Determine implementation; Design asks whether the control could prevent or detect a misstatement. Implementation asks whether it exists and is in use. Operating effectiveness is a separate test of controls.
Control objective link: Risk → Control → Test; For each risk, name the control that addresses it, then the test that shows it works.
Limitations of internal control: Human error, collusion, management override, cost versus benefit, focus on routine transactions; Controls give reasonable assurance, never absolute.
Required risk assessment procedures (ISA 315): Inquiries + Analytical procedures + Observation and inspection; These three are the minimum set. Add the engagement team discussion as a separate requirement.
Gross profit margin: Gross profit ÷ Revenue × 100; Use it to spot unusual changes in margin between years.
Operating profit margin: Operating profit ÷ Revenue × 100; A fall may point to unrecorded costs or overstated revenue.
Current ratio: Current assets ÷ Current liabilities; Useful for going concern and liquidity risk.
Receivables days: Trade receivables ÷ Revenue × 365; A rise may signal recoverability or cut-off risk.
Payables days: Trade payables ÷ Cost of sales × 365; A rise may signal cash pressure or unrecorded liabilities.
Inventory days: Inventory ÷ Cost of sales × 365; A rise may signal obsolete or overvalued inventory.
Gearing: Debt ÷ Equity (or Debt ÷ (Debt + Equity)); State which version you use. Look for covenant and going concern risks.

Quick revision

ISA 315 (Revised 2019) requires the auditor to understand the entity, its environment, the reporting framework and internal control.
The purpose is to identify and assess the risks of material misstatement at the financial statement and assertion levels.
Risk assessment procedures include inquiries, analytical procedures, and observation and inspection.
Risk of material misstatement is made up of inherent risk and control risk.
Detection risk is the risk that the auditor's procedures fail to detect a material misstatement.
Components of internal control: control environment, entity's risk assessment process, process to monitor the system of internal control, information system and communication, and control activities.
Controls can prevent or detect and correct misstatements; they give reasonable, not absolute, assurance.
Analytical procedures at the planning stage help identify unusual items, but they are only as good as the data and expectations behind them.
Always link a scenario fact to a specific risk, then to an audit response.
Understand how the applicable framework, such as IFRS Accounting Standards, affects areas like estimates, revenue and disclosures.
Significant risks need special audit consideration and a response designed specifically for them.
Objective test questions score all or nothing, so read every option carefully.

Common mistakes

Listing general facts about the industry with no link to the audit. Fix: After each fact, add one line saying which financial statement area is affected and why.
Saying every business risk is a risk of material misstatement. Fix: Business risks may or may not affect the financial statements. Say that many lead to misstatement risk and name the ones that do.
Treating the framework as just IFRS and ignoring local GAAP or special purpose frameworks. Fix: Read the scenario for the framework used. Say which it is and whether it suits the users.
Listing policies without judging whether they are appropriate. Fix: For each policy, state a conclusion: appropriate or not, and why, with reference to the business and the framework.
Confusing the control environment with control activities. Fix: Ask whether it is a general culture or governance matter (environment) or a specific procedure on transactions (activity). Tone at the top, audit committee and competence belong to the environment.
Listing the old components or inventing extra ones, such as segregation of duties as its own component. Fix: Learn the five ISA 315 components. Segregation of duties, authorisation and reconciliations are examples of control activities.
Treating risk assessment procedures as providing enough evidence for the opinion. Fix: Say that they identify risk. Evidence for the opinion comes from further audit procedures responding to the risks.
Listing ratio changes without explaining the audit risk. Fix: For each change give a reason, the misstatement risk, the assertion and the response.

Exam tips

In scenario questions, quote the facts given. Examiners reward points that are tied to the scenario.
Always finish a business risk with its effect on the financial statements. Do not stop at the business point.
Use the four headings to organise any answer so it reads clearly and you do not miss an area.
In OT questions on sources, look for the option that gives specific information matched to the area, for example board minutes for strategy.
Remember performance measures and pressure. They link this topic to fraud risk and going concern.
Start any answer on this topic by naming the framework. It earns an easy mark and anchors the rest.
In Section C, tie each policy or change to a specific balance and assertion. Generic comments score poorly.
In objective test questions, watch for the word voluntary. It usually points to the higher-risk answer.