International regulatory frameworks for audit and assurance services: formula sheet

Key formulas

Who does what

IFAC = global profession body; IAASB = auditing and assurance standards; IESBA = ethics and independence standards; PIOB = public interest oversight

Learn this as the core split. Do not say IFAC issues the ISAs.

Legal status of international standards

ISAs and the IESBA Code = no direct legal force until adopted by national law or regulators

Adoption can be full, with amendments, or used as a base for national standards.

Conflict with local law

Where law or regulation conflicts with a standard, follow the law and explain any departure

Local requirements can be stricter than the international standard. Stricter local rules apply.

Standard-setting due process

Identify issue → draft → public exposure → consider comments → issue final standard, under PIOB oversight

Use it to explain why standards are credible and in the public interest.

Structure of an ISA

Introduction → Objective → Definitions → Requirements → Application and other explanatory material

Requirements use "shall". Application material explains but does not add requirements.

Compliance rule

Comply with all ISAs relevant to the audit and with every requirement that applies in the circumstances

A requirement is relevant unless the whole ISA is irrelevant, or the requirement is conditional and the condition does not exist.

Departure from a requirement

Exceptional circumstances only → perform alternative procedures → document the reason

Alternative procedures must achieve the aim of the requirement.

Elements of an assurance engagement

Three parties + subject matter + suitable criteria + sufficient appropriate evidence + written assurance report

From the International Framework for Assurance Engagements.

Levels of assurance

Reasonable assurance (positive opinion) vs limited assurance (negative-form conclusion)

Audits give reasonable assurance, which is high but not absolute. Reviews give limited assurance.

Standards hierarchy

ISAs: audits | ISRE: reviews | ISAE: other assurance | ISRS: related services | ISQM: firm quality

Pick the standard that matches the engagement type.

Purpose of audit regulation

Protect public interest = competent auditors + independence + quality standards + oversight + sanctions

Use as a checklist when asked to explain why or how auditors are regulated.

Self-regulation vs independent regulation

Self-regulation = profession oversees itself; Independent regulation = body outside the profession oversees (often non-practitioner majority)

Independent oversight reduces the conflict of interest. Do not claim it is always better; it can cost more and may lack practical expertise.

Key audit partner rotation (IESBA Code, PIEs)

Time-on-engagement period, then cooling-off period

State the principle and say exact periods should be taken from the Code or local law. Do not quote periods unless you are sure.

Familiarity threat response

Long association → familiarity threat → rotation, second partner review, or other safeguards

Rotation is a safeguard for long association, mainly required for PIEs.

ISQM 1 system components

Risk assessment process + governance and leadership + ethics + acceptance and continuance + engagement performance + resources + information and communication + monitoring and remediation

Eight components that operate together as an integrated system. The risk assessment process is how objectives, risks and responses are set. Governance and leadership supports the culture.

Risk-based cycle

Quality objectives → quality risks → responses → monitoring → remediation

Use this chain to structure any ISQM 1 answer.

Responsibility at the top

Ultimate responsibility = chief executive or managing partner (or managing board of partners)

The firm also assigns operational responsibility for the system, independence, and monitoring and remediation.

Annual evaluation

Evaluate the system at least annually and conclude whether it gives reasonable assurance

Done by the person with ultimate responsibility.

Engagement partner under ISA 220 (Revised)

Partner is responsible for overall quality, even where tasks are assigned to others

Covers involvement, ethics, resources, direction, supervision, review, and consultation.

EQR timing

No audit report date until the engagement quality reviewer has notified the partner that the EQR is complete

The review is done before the report is dated, not afterwards. The reviewer's completion notification is what releases the date.

EQR required for

Listed entity audits + engagements required by law or regulation + engagements where the firm determines an EQR is an appropriate response to one or more assessed quality risks

For the last category, the firm sets its criteria based on its assessed quality risks.

Professional scepticism

Questioning mind + critical assessment of evidence + alertness to contrary information

Apply it at every stage: planning, evidence evaluation, estimates, management explanations and completion.

ISA 250 direct-effect laws

Laws with direct effect on amounts and disclosures → obtain sufficient appropriate audit evidence

Examples are tax and pension laws.

ISA 250 other laws

Laws fundamental to operating ability → limited procedures: enquiries of management and TCWG, and inspect correspondence with regulators

Examples are licences and environmental rules. Stay alert to possible non-compliance.

Response to suspected non-compliance

Understand → discuss with management/TCWG → evaluate effect → consider reporting and report implications → document

Take legal advice where unsure.

Confidentiality override

Disclosure allowed if required by law, or permitted by law and authorised by the client, or a professional duty or right exists and is not prohibited by law

Always check local law first.

Money laundering reporting

Knowledge or suspicion → report to the nominated officer → report to authority → no tipping off

Details vary by jurisdiction. Do not alert the suspect.

Quick revision

• IAASB issues the ISAs and ISQMs; IFAC is the global body for the accountancy profession that supports the standard-setting process.
• ISAs use a clarity structure: objectives, requirements, and application and other explanatory material.
• Auditors must comply with requirements that are relevant to the engagement and must meet the objective of each ISA.
• Independence has two parts: independence of mind and independence in appearance.
• Ethics threats are self-interest, self-review, advocacy, familiarity and intimidation; apply safeguards or decline or withdraw if threats cannot be reduced to an acceptable level.
• ISQM 1 requires a firm to design, implement and operate a risk-based system of quality management.
• ISQM 2 deals with engagement quality reviews; ISA 220 deals with quality management at engagement level, led by the engagement partner.
• Professional scepticism means a questioning mind and critical assessment of evidence, not assuming dishonesty.
• Non-compliance with laws and regulations: understand it, communicate it to the right level of management and those charged with governance, and consider the reporting duties.
• Money laundering and tipping off rules depend on local law, so identify the issue and advise on reporting and confidentiality carefully.
• In every answer: issue, rule, application, recommendation.

Common mistakes

• Saying IFAC issues the ISAs. Fix: Say IFAC supports the boards. The IAASB issues ISAs and the IESBA issues the Code.
• Mixing up IAASB and IESBA. Fix: Use the split: IAASB is what auditors do, IESBA is how they behave.
• Treating application material as mandatory requirements. Fix: Say that requirements use "shall" and must be followed. Application material helps the auditor apply them and explains why.
• Confusing ISA with ISAE. Fix: Link ISAs to audits of historical financial information. Link ISAE to other assurance engagements, with ISAE 3000 (Revised) as the main standard.
• Treating all audited entities as if PIE rules apply. Fix: Check whether the entity is a PIE first. For non-PIEs, say stricter rules are not mandatory but good practice may still apply.
• Quoting exact rotation periods or national laws from memory. Fix: Explain the principle and say the period is set by the IESBA Code or local law. Quote numbers only when the scenario gives them.
• Describing ISQM 1 as a list of procedures rather than a risk-based system. Fix: Always start from quality objectives and quality risks, then link responses to those risks.
• Confusing ISQM 1 with ISQM 2. Fix: ISQM 1 is the whole firm system. ISQM 2 only covers appointing and performing engagement quality reviews.
• Saying the auditor is responsible for preventing illegal acts. Fix: State that management and those charged with governance are responsible for compliance. The auditor obtains reasonable assurance and responds when non-compliance is found.
• Saying the auditor must always report to the authorities. Fix: Say it depends on law and the Code. Money laundering suspicions are normally reportable. For other non-compliance, consider legal duties, public interest and the NOCLAR framework.

Exam tips

• Write the split between IAASB and IESBA in one line early. It earns easy marks and shows clear thinking.
• Always state that standards need national adoption. Examiners reward the idea of legal force.
• Tie your answer to the scenario country or client type. Generic lists score less than applied points.
• If the question asks about public interest, mention PIOB oversight and public consultation.
• Keep answers short and structured. Use the professional skills marks by giving a clear, practical conclusion.
• When asked about standards, name the exact standard and the engagement type. Marks are lost for vague phrases like "the auditing standards say".
• Use the correct vocabulary: objective, requirements, application and other explanatory material, reasonable assurance, limited assurance, suitable criteria.
• In scenario questions, name the standard briefly and spend most of your answer applying it to the client's facts. Application earns the marks.