Professional and ethical developments: formula sheet

Key formulas

Five fundamental principles

Integrity, Objectivity, Professional competence and due care, Confidentiality, Professional behaviour

Memory aid: I-O-P-C-P. Name the principle that is at risk in every answer.

Five categories of threat

Self-interest, Self-review, Advocacy, Familiarity, Intimidation

Each threat must be tied to a fact in the scenario, not just named.

Conceptual framework steps

Identify threats → Evaluate (acceptable level?) → Address (eliminate, safeguard, or decline/end)

Use this order for every ethics requirement.

Acceptable level test

Reasonable and informed third party would likely conclude compliance with the principles is not compromised

Judge from the view of a neutral outsider with the relevant facts, not from your own view.

Professional scepticism

Questioning mind + critical assessment of evidence

Applies throughout the audit, not only at the end. Use it to challenge management's assertions.

ISQM 1 approach

Set quality objectives → identify and assess quality risks → design and implement responses

The system is risk-based. The firm must evaluate it as at a specified date at least annually, and the individual(s) with ultimate responsibility must conclude on it.

ISQM 1 components

Risk assessment process; governance and leadership; relevant ethical requirements; acceptance and continuance; engagement performance; resources; information and communication; monitoring and remediation

These are the eight components. Learn them as a checklist to structure answers on firm-level weaknesses.

Engagement quality review (ISQM 1 and ISQM 2)

Objective review of significant judgements and conclusions before the report is dated

ISQM 1 requires the firm to have policies on engagement quality reviews and their timing. A review is needed for listed entity audits, engagements required by law or regulation, and engagements for which the firm determines a review is an appropriate response to assessed quality risks. ISQM 2 covers reviewer appointment, eligibility, performance and documentation, and the reviewer must notify the engagement partner when the review is complete. The reviewer must not be part of the engagement team.

ISA 220 (Revised) responsibility

Engagement partner = overall responsibility for managing and achieving quality

Includes direction, supervision and review. The partner must be sufficiently and appropriately involved, and must not date the report until a required engagement quality review is complete.

Public interest test

Does the action serve users of the financial statements, or only the client or firm?

Use this as a check when judging any ethical or quality decision in a scenario.

Drivers of audit quality

Quality = firm culture and governance + competent, scep­tical people + sound methodology + independence + effective monitoring

A memory frame, not a legal rule. Use it to structure answers.

ISQM 1 approach

Set objectives → identify and assess quality risks → design responses → monitor → remediate

This risk-based cycle underpins firm governance of quality.

Regulator toolkit

Set standards → inspect → investigate → sanction → report

Describes typical regulator functions; powers vary by jurisdiction.

Answer structure

Issue → Scenario link → Consequence → Recommendation

Gets technical and professional skills marks together.

Assurance levels

Reasonable assurance = positive conclusion; Limited assurance = negative-form conclusion

Reasonable needs more evidence and procedures. Limited gives less assurance. State which applies.

Core engagement elements

Three-party relationship + subject matter + suitable criteria + sufficient appropriate evidence + written report

Use as a checklist for any sustainability assurance scenario, along with ISAE 3000 and ISSA 5000 ideas.

Fraud responsibility split

Management and TCWG: prevent and detect. Auditor: obtain reasonable assurance that the financial statements are free from material misstatement, whether from fraud or error.

Do not say the auditor must detect all fraud.

Presumed fraud risks

Revenue recognition (presumed risk) + management override of controls (always a risk)

Both are significant risks for the audit. Auditors must respond with specific procedures.

Going concern opinion outcomes

Material uncertainty adequately disclosed → unmodified opinion + going concern section. Inadequate disclosure → qualified or adverse. Basis inappropriate → adverse.

Link the opinion to disclosure quality and appropriateness of the basis.

Quick revision

• Fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, professional behaviour.
• Threat categories: self-interest, self-review, advocacy, familiarity, intimidation.
• Always state the threat, then the significance, then the response.
• Safeguards must fit the specific facts. Generic safeguards earn little credit.
• If threats cannot be reduced to an acceptable level, decline or withdraw.
• Non-assurance services raise self-review and management responsibility concerns.
• Fee dependency and overdue fees are self-interest and intimidation issues to be managed.
• NOCLAR deals with responding to identified or suspected non-compliance with laws and regulations.
• Professional skepticism means a questioning mind and critical assessment of evidence.
• ISQM requires the firm to design and operate a risk-based quality management system.
• Link going concern, fraud and sustainability issues to risk assessment and the audit report.
• Finish every ethics answer with a clear conclusion and recommendation.

Common mistakes

• Listing threats without linking them to scenario facts. Fix: Quote the fact, then name the threat and explain the link in one sentence.
• Treating a safeguard as if it were a threat, or the reverse. Fix: Remember: threat = what could compromise the principle; safeguard = what reduces it.
• Defining scepticism as distrust or assuming management is dishonest. Fix: Say it is a questioning mind and critical assessment of evidence, without assuming either honesty or dishonesty.
• Treating ISQM 1 as the same as ISQC 1. Fix: State that ISQM 1 is a risk-based system with objectives, risks and responses, plus an annual evaluation. ISQC 1 was based on policies and procedures.
• Writing a general essay on audit reform without using the scenario. Fix: Quote or refer to specific scenario facts in every paragraph and say why they matter.
• Treating public interest as meaning the client's interest. Fix: State clearly that the auditor's duty extends to users of the financial statements, and explain how this affects the decision.
• Treating sustainability assurance as identical to a financial audit. Fix: State the subject matter, criteria, assurance level and evidence challenges first, then compare briefly with an audit.
• Saying the auditor is responsible for preventing fraud. Fix: Write that management and those charged with governance prevent and detect fraud; the auditor assesses risk, responds and reports.

Exam tips

• Always tie each threat to a named fact in the scenario. A bare list of the five threats earns very little.
• Name the principle at risk as well as the threat. Examiners look for both.
• Match safeguards to the threat, and say plainly when a threat cannot be addressed and the firm must decline or withdraw.
• Finish with a clear recommendation. This supports the professional skills marks for judgement and communication.
• Write short paragraphs, one per ethical issue, so the marker can find each point quickly.
• Always tie scepticism and bias to the scenario facts. Generic definitions earn few marks.
• Keep the levels straight: ISQM 1 is the firm, ISA 220 (Revised) is the engagement partner, ISQM 2 is the engagement quality reviewer.
• In ethics-style requirements, mention threats such as self-interest and familiarity alongside bias and pressures.