ACCA Strategic Professional · Strategic Business Leader

Audit and compliance: formula sheet

Full chapter guide

Key formulas

Purpose of internal audit: Independent, objective assurance and consulting → adds value → improves governance, risk management and control; Use this as the opening line of any definition answer.
Three areas of focus: Governance + Risk management + Control; Link each point you make to one of these three areas.
Independence safeguards: Functional reporting to the audit committee + no operating duties + unrestricted access + audit committee involvement in appointment and removal of the head; Independence is a matter of degree. Say so in your answer.
Internal audit vs external audit (focus): Internal: scope set by the organisation, mainly for management and board, wide-ranging. External: scope set by law and standards, for shareholders, opinion on the financial statements.; A common comparison. Use purpose, reporting, scope and independence as headings.
Factors for having an internal audit function: Size + complexity + risk + culture + cost-benefit + regulatory demands + past failures; Use these when a scenario asks whether a company needs one.
Core purpose contrast: External audit = opinion on financial statements; Internal audit = evaluation and improvement of risk management, control and governance; State this first in any comparison. Everything else flows from it.
Five comparison headings: Objective, Scope, Reporting line, Independence, Users; Use these as a checklist so you do not miss a point. Add appointment, timing and legal basis if marks allow.
Reliance rule: External auditor may use internal audit work, but keeps sole responsibility for the audit opinion; Reliance depends on the internal audit function's objectivity, competence and quality of its work.
Best-practice reporting line: Head of internal audit reports functionally to the audit committee (non-executive directors); Reporting to the finance director weakens objectivity.
Decision factors for the function: Need for internal audit = f(scale, complexity, diversity of operations, risk, regulation, culture, cost-benefit, management information quality); This is a checklist, not a calculation. Use it to structure any answer on whether a function is needed.
Core cost-benefit test: Establish a function only if the expected benefit of assurance ≥ the cost of providing it; Benefits are hard to quantify, so argue them in words: fewer losses, better controls, stronger governance.
Independence rule of thumb: Internal audit reports to the audit committee; the external auditor should not run internal audit for the same client; The second part is a self-review threat. It is a firm rule for listed or public interest entities, and a safeguard issue elsewhere.
Composition rule of thumb: Independent NEDs + relevant financial experience + sector competence + not chaired by the board chair; Reflects the UK Code approach. In an exam, use the code or guidance named in the scenario.
Core duties checklist: Reporting + Controls and risk + Internal audit + External audit + Independence + Whistleblowing; Use as a prompt to cover each duty and link it to the facts.
Auditor independence safeguards: Non-audit services policy + fee review + rotation + private meetings + disclosure; The committee oversees these. It does not replace the auditor's own ethical duties.
Effectiveness test: Independence + competence + resources + access + influence on the board; A weakness in any one limits the committee's value.
Five components of internal control (COSO): Control environment + Risk assessment + Control activities + Information and communication + Monitoring; Use as a checklist to structure an evaluation of any case organisation.
Weakness analysis rule: Weakness → Risk it creates → Consequence for the organisation → Recommendation; Every point you make should follow this chain to earn application marks.
Control types: Preventive, detective, corrective; Say which type a recommendation is and why it fits the risk.
Key control activities: Authorisation, segregation of duties, reconciliation, physical security, supervision, IT access and general controls; Typical recommendations; always tailor them to the scenario.
Cost-benefit test: Cost of control < Expected loss reduced; A control is worth adding only if its cost is justified by the risk it reduces. Treat as a judgement, not an exact calculation.
The 3 Es of value for money: VFM = Economy + Efficiency + Effectiveness; Economy = cost of inputs; Efficiency = output per unit of input; Effectiveness = objectives achieved. Say which E each point relates to.
Efficiency (simple measure): Efficiency = Output ÷ Input; Use the measure that fits the scenario, such as cases processed per employee or cost per unit.
Type-to-purpose match: Financial = reliability of records; Operational = process performance; Compliance = adherence to rules; VFM = 3 Es; Fraud = investigate suspected dishonesty; Use this as a quick label list before you write.
Compliance risk: Compliance risk = likelihood of breach × impact of breach (fines, loss of licence, legal costs, reputation); A way of thinking, not a calculation. Use it to rank which rules need the strongest controls.
Comply or explain: Comply with the code, or disclose the departure and give reasons; Principles-based. It is not optional to say something. Silence on a departure is a failure.
Three lines of assurance: First line: management. Second line: compliance and risk functions. Third line: internal audit; Internal audit is independent of management. Say so when assessing assurance.
Rules-based vs principles-based: Rules-based: mandatory, specific, penalties for breach. Principles-based: broad principles, judgement, explanation of departures; Link to the scenario: rules-based gives certainty but can encourage box-ticking.
Five threats to independence: Self-interest, Self-review, Advocacy, Familiarity, Intimidation; Name the threat first, then link it to a fact in the scenario.
Independence has two parts: Independence of mind + Independence in appearance; Both must be present. Mention appearance when a fact looks bad even if no actual bias exists.
Threat response sequence: Identify threat → Evaluate significance → Apply safeguards → Decline or resign if not reducible; Use this order to structure any ethics answer.
Whistleblowing escalation: Line manager → Senior management/audit committee → Regulator or external body; Move outward only if inner routes fail or are compromised. Consider law and public interest.
Internal audit reporting line: Internal audit → Audit committee chair (functional) and CFO or CEO (administrative); Functional line to the audit committee protects objectivity.

Quick revision

Internal audit gives independent, objective assurance and advice to improve governance, risk management and control.
Internal audit reports to the board or audit committee and is independent of the management whose work it reviews.
External audit gives an opinion on the financial statements for shareholders; internal audit serves management and the board and has a wider scope.
The decision to outsource internal audit weighs cost, expertise, independence, flexibility and loss of organisational knowledge.
The audit committee is usually made up of independent non-executive directors and oversees reporting, controls, risk and both audit functions.
Controls include preventive, detective and corrective types, and a weak control environment affects everything else.
Review controls by assessing design, whether they operate in practice, and whether they cover the key risks.
Operational audit looks at efficiency of processes; value for money audit looks at economy, efficiency and effectiveness; fraud work looks at detection and prevention.
Compliance means meeting laws, regulations and codes, and failure can bring fines, loss of licence and reputational damage.
Independence threats include self-interest, self-review, advocacy, familiarity and intimidation, and safeguards reduce them.
Whistleblowing needs a trusted channel, protection for the individual and a clear response by the board.
Always tie advice to the facts in the case and finish with a clear recommendation.

Common mistakes

Describing internal audit as only checking the accounts. Fix: State that internal audit covers governance, risk, control, operations and compliance, and that its scope is set by the organisation.
Claiming internal auditors are fully independent. Fix: Say independence is relative. Explain the safeguards: reporting to the audit committee, no operating role, and unrestricted access.
Saying internal audit exists to find fraud and external audit does not care about it. Fix: Say that external auditors consider fraud risk as it affects material misstatement, but they are not responsible for detecting all fraud. Internal audit may investigate fraud as part of its remit if management asks.
Claiming internal auditors are fully independent. Fix: Say internal auditors are employees or contractors, so independence is limited. They protect objectivity through status, audit committee reporting and no operational duties.
Listing generic pros and cons of outsourcing with no link to the scenario. Fix: Open each point with a scenario fact, such as 'With only two sites and a small finance team...', then give the effect.
Saying outsourcing is always cheaper or always more independent. Fix: Say it depends. Providers charge fees and may lack business knowledge. Independence can also be weakened if the provider wants to keep the contract.
Describing the committee's role in general terms with no link to the scenario. Fix: Tie each duty to a fact in the case, and state the consequence of the weakness.
Saying the audit committee carries out the audit or runs internal controls. Fix: State that it oversees. Management owns controls, auditors perform the audit, and the board is accountable.
Listing textbook controls without linking them to the scenario. Fix: Start from a fact in the case, name the person or process, then recommend a control for that exact issue.
Stating a weakness but not explaining the risk or consequence. Fix: Always add why it matters here: who could misstate or steal, what the loss or impact would be.

Exam tips

Always tie purpose and scope to scenario facts. A textbook definition alone earns few marks.
When comparing internal and external audit, choose the points that matter to the decision in the scenario instead of listing everything.
Treat independence as a matter of degree. Name the threat and the safeguard.
Use the requested format and address the named reader, as this earns professional skills marks.
Show balance: benefits, cost, and limits such as management resistance or skills gaps, then a clear recommendation.
Expect the comparison to be embedded in a scenario, such as a fraud, a governance weakness or a start-up. Use the case to select which differences matter most.
Use a clear structure with headings or short labelled paragraphs. A table is acceptable in a written answer, but add explanation, because lists of labels earn few marks.
Mention independence carefully on both sides. Strong answers show the external auditor's formal independence and the internal auditor's objectivity safeguards.