Professional appointments: formula sheet

Key formulas

Core acceptance test

Accept or continue only if: integrity considered + competence and capability + able to comply with ethical requirements

This follows the ISQM 1 requirement. If any one fails, the firm should not proceed unless it can be resolved.

Engagement partner duty (ISA 220)

Partner must be satisfied that acceptance and continuance procedures were followed and conclusions are appropriate

Use this in answers about who is responsible for the decision on an engagement.

Risk-based decision

Engagement risk acceptable? Risks managed through safeguards, fees, staffing and terms of engagement

A high-risk client may still be accepted if the firm can manage the risk. Say what you would do.

Communication with the predecessor

Written client permission, then ethical enquiry of the existing auditor

The incoming auditor should ask about integrity and reasons for the change. The existing auditor needs consent to disclose.

Five threat categories

Self-interest, self-review, advocacy, familiarity, intimidation

Name the category for each issue. A single fact can create more than one threat, so say so when it does.

Threat response sequence

Identify → Evaluate → Address (eliminate, safeguard, or decline/end)

The Code's approach. Evaluate whether a reasonable and informed third party would conclude that compliance is not compromised.

Acceptable level test

Reasonable and informed third party would conclude principles are not compromised

This is the test for whether a threat is at an acceptable level. It is not the firm's own opinion.

Types of safeguard

Safeguards created by the profession, legislation or regulation; by the client; and by the firm's own systems and procedures

Use these groups to structure answers. Specific safeguards score better than general ones.

Declining rule

No safeguard can reduce the threat to an acceptable level → decline or end the engagement

Always give a clear conclusion on accept or decline.

Timing of agreement

Agree terms (ISA 210) → before accepting or starting the audit

Terms are agreed with management or those charged with governance, as appropriate, and recorded in writing.

Preconditions for an audit

Acceptable financial reporting framework + management accepts its responsibilities

Management's responsibilities cover preparing the financial statements, internal control, and giving access and information.

Typical letter contents

Objective and scope + auditor's responsibilities + management's responsibilities + framework + form of report

Add fees, timing, experts, other auditors and liability limits as relevant to the scenario.

Recurring audits

Each period: decide whether to revise terms or remind the client

Triggers include change in management, ownership, nature or size of business, law or framework.

Change to a lower assurance engagement

Needs reasonable justification before agreeing

If the client asks to change the engagement to one with lower assurance, the auditor considers if there is reasonable justification. If not, the auditor should not agree and, if unable to continue the audit, withdraws and considers reporting obligations.

Professional clearance sequence

Client permission → letter to existing auditor → reply → decide whether to accept

If the client refuses permission, consider declining the appointment.

Predecessor communication purpose

Find out reasons for change and any ethical or legal facts bearing on acceptance

The existing auditor must answer only with client consent or where law requires or permits.

Resignation response

Discuss with TCWG → seek legal advice if needed → give reasons or statement as required → notify regulator or owners where law requires

Exact filing rules depend on the jurisdiction in the question.

Rotation rule

Long association → familiarity threat → rotate after the required period, then a cooling-off period

Use the periods given in the scenario or legislation. Do not quote from memory.

Information flow on leaving

Consent or legal duty → disclosure to successor

Confidentiality is lifted only by consent, legal duty or legal right.

Eight components of the SoQM

Risk assessment process; Governance and leadership; Relevant ethical requirements; Acceptance and continuance; Engagement performance; Resources; Information and communication; Monitoring and remediation

Use these as headings when a scenario asks about weaknesses in a firm's quality system.

Risk-based process

Quality objectives → quality risks → responses

The firm must set objectives, identify and assess risks to achieving them, then design and implement responses to address those risks.

Acceptance and continuance judgement

Integrity of client + competence, time and resources + ability to comply with ethics and independence

These three areas drive an appointment decision. Add the specific quality risks of the engagement.

Annual evaluation

Evaluate the SoQM at a specified point in time, then at least annually, and conclude: (a) reasonable assurance; (b) reasonable assurance except for matters that are severe but not pervasive; or (c) no reasonable assurance, because deficiencies are severe and pervasive

The conclusion is made by the individual(s) assigned ultimate responsibility and accountability for the system and, where applicable, the individual with operational responsibility.

Scope distinction

ISQM 1 = firm level; ISQM 2 = engagement quality review; ISA 220 (Revised) = engagement level

This is the usual answer to the question on how the standards differ.

Quick revision

• Acceptance looks at client integrity, competence and resources of the firm, ethical compliance and the firm's own risk.
• Continuance is reviewed regularly, and new facts can change the original decision.
• Ethical threats are self-interest, self-review, advocacy, familiarity and intimidation.
• Safeguards must be matched to the specific threat, and if none is enough, decline or withdraw.
• The engagement letter sets out scope, responsibilities of management and auditor, reporting and the framework used.
• A request to reduce the scope of an engagement needs careful consideration of the reason behind it.
• Before accepting an appointment, communicate with the existing auditor, with the client's permission.
• Resignation or removal needs proper process, communication and consideration of any statements required.
• A fee that is very low raises quality and self-interest concerns, and dependence on one client's fees raises threats.
• Contingent fees for audit work are generally not acceptable.
• ISQM 1 requires a risk-based system of quality management, with responses to the risks identified.
• Always end an appointment answer with a clear, reasoned recommendation.

Common mistakes

• Listing generic factors without using the scenario. Fix: Start every point with a scenario fact. If you cannot link a point to the scenario, drop it.
• Forgetting integrity of management and owners. Fix: Always cover integrity first. Look for evidence of fraud, tax evasion, aggressive accounting, bad press or links to criminal activity.
• Listing threats from the Code without linking them to the scenario. Fix: Quote the fact, then name the threat and say why it applies. A threat with no scenario fact earns little.
• Confusing threats and safeguards. Fix: A threat is the problem. A safeguard is the action that reduces it. Keep two separate headings in your notes.
• Confusing the engagement letter with the management representation letter. Fix: Remember: engagement letter is from the auditor, at the start, recording terms. Representation letter is from management, at the end, supporting evidence.
• Saying the letter must be reissued every year. Fix: State that for recurring audits the auditor decides whether terms need revising or the client reminding. Reissue only when circumstances warrant it.
• Accepting the appointment before contacting the existing auditor. Fix: Make communication with the existing auditor part of the acceptance decision. Show it comes first.
• Letting the existing auditor talk freely without client consent. Fix: State that disclosure needs consent, a legal duty or a legal right.
• Confusing ISQM 1 with ISA 220 (Revised). Fix: Say ISQM 1 is the firm's system and ISA 220 is the engagement partner's responsibilities on one audit. Name the level before you answer.
• Listing the eight components without applying them. Fix: Use each component only where a scenario fact points to it. Explain the risk and a response for that fact.

Exam tips

• Always make the decision explicit: accept, accept with conditions, or decline. Markers reward a reasoned conclusion.
• Use scenario facts first, then the standard. Quote ISQM 1 or ISA 220 briefly rather than at length.
• For continuing clients, look for last year's problems and say that continuance is re-assessed each period.
• Show professional scepticism by questioning claims made by management or the previous auditor, and say what evidence you would seek.
• Write short points in the form fact, why it matters, action. This works well when you answer on a phone or under time pressure.
• Anchor every threat to a fact in the scenario. The marker looks for application, not recitation.
• Name the threat type in your first few words for each point so the marker can see it quickly.
• Make safeguards specific and show who acts. Avoid generic phrases.