Advanced Auditing, Assurance and Professional Ethics: formula sheet

Key formulas

Audit Risk Model

Audit Risk = Risk of Material Misstatement × Detection Risk

RMM = Inherent Risk × Control Risk (combined or separate assessment). Used for reasoning, not a precise calculation.

Detection risk relationship

Higher assessed RMM → Lower acceptable Detection Risk → More substantive work

Detection risk moves in the opposite direction to RMM.

Overall materiality

Overall materiality = Benchmark × Chosen percentage

SA 320 gives no fixed percentage. The percentage is professional judgement. State the benchmark and reason for choosing it.

Performance materiality

Performance materiality < Overall materiality

Set by judgement, often a proportion of overall materiality. Higher assessed risk means a lower proportion.

Clearly trivial threshold

Misstatements below the threshold need not be accumulated

Clearly trivial is not the same as immaterial. It is set well below materiality.

Significant risk

Significant risk → substantive procedures responsive to it; tests of controls if relying on controls

Significant risks require the auditor to understand and evaluate the related controls.

Fraud vs error

Fraud = intentional act involving deception; Error = unintentional misstatement

Intent decides the label. The auditor's duty is reasonable assurance on material misstatement from both.

Fraud risk factors (fraud triangle)

Incentive or pressure + Opportunity + Attitude or rationalisation

Use these three headings to analyse any fraud case scenario.

Presumed fraud risks

Revenue recognition (rebuttable) + Management override of controls (not rebuttable)

Management override cannot be rebutted. Always perform journal entry testing, estimate review and unusual transaction review.

Types of fraud misstatement

Fraudulent financial reporting + Misappropriation of assets

Misappropriation is often seen in small amounts but can be material.

SA 250 two-tier approach

Laws with direct effect on amounts and disclosures (e.g. tax, pension laws): obtain sufficient appropriate evidence of compliance; Other laws fundamental to operations: specified procedures to help identify non-compliance that may materially affect the financial statements, being inquiry of management and those charged with governance, and inspection of correspondence with licensing or regulatory authorities

The auditor is not responsible for preventing non-compliance and is not expected to detect all of it.

Going concern outcomes

No material uncertainty: unmodified, no special section; Material uncertainty adequately disclosed (events and conditions, management's plans, existence of material uncertainty): unmodified plus Material Uncertainty section; Inadequate disclosure: qualified or adverse; Basis inappropriate: adverse; Management unwilling to make or extend its assessment: consider qualification or disclaimer

Match the facts to one of these outcomes.

Section 143(12) reporting

Fraud of ₹1 crore or more: report to Board or audit committee within 2 days, then to Central Government within 60 days (after the Board's reply or observations, or the 45-day period); Fraud below ₹1 crore: report to audit committee or Board within 2 days, and disclosed in the Board's report

The ₹1 crore threshold decides the route. These are under the Companies (Audit and Auditors) Rules, 2014.

Opinion grid: misstatement

Material, not pervasive → Qualified; Material and pervasive → Adverse

Applies when the auditor disagrees with management about the financial statements.

Opinion grid: limitation of scope

Possible effects material, not pervasive → Qualified; Possible effects material and pervasive → Disclaimer

Applies when sufficient appropriate evidence cannot be obtained. The test is on the possible effects. In extremely rare cases with multiple uncertainties, a disclaimer can also be given.

Basis for opinion

Modified opinion ⇒ 'Basis for Qualified/Adverse Opinion' or 'Basis for Disclaimer of Opinion' section

The section must describe the matter and, where practicable, quantify the effect.

Order of sections (SA 700, illustrative)

Title → Addressee → Opinion → Basis for Opinion → Material Uncertainty Related to Going Concern (if any) → KAMs → Other Information → Responsibilities of management → Auditor's responsibilities → Report on Other Legal and Regulatory Requirements → Signature, date, place

This is the illustrative order in SA 700. Opinion comes first; for modified opinions the heading is adjusted, for example 'Qualified Opinion'. The Report on Other Legal and Regulatory Requirements comes after the auditor's responsibilities section. Learn this order, but remember that SA 700, SA 701 and SA 720 allow some positions to vary, so do not treat every position as rigid.

EOM vs OMP

EOM = matter disclosed in the financial statements; OMP = matter not disclosed in the financial statements

Neither modifies the opinion.

KAM exclusions

Matter giving rise to a modified opinion or a material uncertainty on going concern is not reported as a KAM

These are described in their own sections. The KAM section only cross-refers to the Basis for Opinion or Material Uncertainty section.

Five elements of assurance

Three parties + Subject matter + Criteria + Evidence + Assurance report

Missing any element means the engagement is not assurance. Use this as a checklist in case scenarios. Treat evidence and the written report as separate elements.

Levels of assurance

Reasonable assurance → positive conclusion; Limited assurance → negative conclusion

Audit gives reasonable assurance. Review gives limited assurance. The risk of wrong conclusion is lower in audit.

SA 610 evaluation factors

Objectivity + Competence + Systematic and disciplined approach (with quality control)

All three are evaluated before using internal audit work. Then decide the planned nature and extent of use.

Responsibility under SA 610

Opinion responsibility = Statutory auditor alone

Using internal audit work never reduces this responsibility. SA 610 does not require a reference to it in the report, and the report must not imply that responsibility is reduced.

Areas of limited use of internal audit

Higher judgement or risk → less use of internal audit work

Significant risks, high-judgement areas and areas needing direct evidence call for little or no use.

Direct assistance from internal auditors

Not permitted if law or regulation prohibits it, or if there are significant threats to objectivity or insufficient competence; otherwise only after evaluation and with safeguards

Direct assistance means internal auditors performing audit procedures under the auditor's direction, supervision and review.

Quick revision

• Plan first: risk assessment drives the nature, timing and extent of procedures.
• Materiality is a judgement; performance materiality is set lower to cover aggregate misstatements.
• Audit evidence must be sufficient and appropriate; quality and quantity both matter.
• Sampling risk exists whenever you do not test the whole population.
• Analytical procedures help in risk assessment, substantive testing and the overall review.
• Management is responsible for preventing fraud; the auditor obtains reasonable assurance, not a guarantee.
• Going concern: assess management's assessment, then consider disclosure and the effect on the opinion.
• Modified opinions depend on whether the matter is material and whether it is pervasive.
• KAMs are matters of most significance in the audit and are not a substitute for a modified opinion.
• Always tie your answer to the facts given, then end with a clear conclusion.
• In ethics, identify the threat first, then the safeguards, then whether the engagement can continue.

Common mistakes

• Treating detection risk as something the entity controls or assesses from its business. Fix: Inherent and control risks exist in the entity. Detection risk belongs to the auditor and is set in response to RMM.
• Saying materiality is a fixed percentage of profit or revenue. Fix: State that SA 320 requires judgement. Name the benchmark, give a reasoned percentage and say it is revisited if circumstances change.
• Saying the auditor is responsible for preventing and detecting fraud. Fix: Write that management and those charged with governance have the primary responsibility. The auditor obtains reasonable assurance and keeps skepticism.
• Rebutting the management override risk. Fix: Remember that management override is always a risk. Test journal entries, estimates and unusual transactions.
• Giving an adverse opinion for a scope limitation Fix: Adverse is for misstatement only. A pervasive inability to get evidence leads to a disclaimer.
• Treating an EOM as a modification of the opinion Fix: EOM and OMP never modify the opinion. The opinion stays unmodified.
• Saying the auditor can reduce responsibility by relying on internal audit Fix: Write that the auditor alone is responsible for the opinion. Reliance only changes the nature, timing and extent of procedures.
• Writing a positive conclusion in a review report Fix: A review gives limited assurance and a negative-form conclusion. Do not say 'true and fair view'.

Exam tips

• In case-scenario MCQs, look for the one fact that changes the risk, such as a new system, management override or an unusual deal. It usually decides the answer.
• Write in provision-facts-conclusion form: the Standard, the case fact, then the response. Do not quote paragraph numbers unless you are certain of them.
• In Paper 6 integrated cases, link audit risk to other areas, for example an Ind AS estimate that raises inherent risk or a tax dispute that affects disclosure.
• For materiality numbers, always show the benchmark, percentage and performance materiality in separate lines so marks can be awarded for each step.
• The auditor assesses inherent and control risks but cannot change the risks themselves. Only detection risk is adjusted by the auditor, in response to the assessed RMM.
• In case studies, write the standard name and number once, then spend the rest of the answer on the facts.
• For MCQs on responsibility, reject options that put sole or primary responsibility for fraud on the auditor.
• Use the going concern outcome list to decide between unmodified with a section, qualified, adverse and disclaimer.