Advanced Audit and Assurance (International) · International regulatory frameworks for audit and assurance services

International Standards on Auditing and the Clarity Structure

Updated 11 October 2026 · Fact-checked

The ISAs are audit standards issued by the IAASB. Each one uses the clarity structure: introduction, objectives, definitions, requirements, and application and other explanatory material. You must meet the objective, follow the requirements that apply, and use the application material to understand them. ISAE covers other assurance work; ISQM covers firm quality.

Understand International Standards on Auditing and the Clarity Structure

The International Standards on Auditing (ISAs) are issued by the International Auditing and Assurance Standards Board (IAASB). They set out what an auditor must do when auditing historical financial information. ISAs are written so that auditors in different countries can work to one consistent standard.

Since the clarity project, each ISA follows the same layout. You will see:

Introduction: scope of the ISA and its link to other ISAs.
Objective: what the auditor is trying to achieve. Each ISA has its own objective.
Definitions: terms used in that ISA, where needed.
Requirements: what the auditor must do. They use the word "shall".
Application and other explanatory material: guidance on how to apply the requirements. It gives examples and explains the reasoning, but it does not add new requirements.

The objectives and requirements work together. The auditor must understand the objective, decide which requirements are relevant, and comply with every relevant one. If the objective cannot be met by following the requirements, the auditor must do more, or consider whether the objective can be achieved at all. A requirement can be departed from only in exceptional circumstances. The auditor must then perform alternative procedures that achieve the aim of the requirement and document why.

ISAs apply to audits. Other assurance work sits under different standards. The International Framework for Assurance Engagements describes the elements of any assurance engagement: a three-party relationship (practitioner, responsible party and intended users), an appropriate subject matter, suitable criteria, sufficient appropriate evidence, and a written assurance report. ISAE 3000 (Revised) applies to assurance engagements other than audits or reviews of historical financial information. ISRE standards cover review engagements, and ISRS standards cover related services such as agreed-upon procedures and compilations, which provide no assurance.

Firms must also have a system of quality management. ISQM 1 requires the firm to design, implement and operate a system to manage quality. ISQM 2 deals with engagement quality reviews. ISA 220 (Revised) deals with quality management at the level of the individual audit engagement. In short, ISQM sets firm-level quality, ISA 220 sets engagement-level quality, and the other ISAs set the audit work itself.

Key rules to remember

Structure of an ISA: Introduction → Objective → Definitions → Requirements → Application and other explanatory material; Requirements use "shall". Application material explains but does not add requirements.
Compliance rule: Comply with all ISAs relevant to the audit and with every requirement that applies in the circumstances; A requirement is relevant unless the whole ISA is irrelevant, or the requirement is conditional and the condition does not exist.
Departure from a requirement: Exceptional circumstances only → perform alternative procedures → document the reason; Alternative procedures must achieve the aim of the requirement.
Elements of an assurance engagement: Three parties + subject matter + suitable criteria + sufficient appropriate evidence + written assurance report; From the International Framework for Assurance Engagements.
Levels of assurance: Reasonable assurance (positive opinion) vs limited assurance (negative-form conclusion); Audits give reasonable assurance, which is high but not absolute. Reviews give limited assurance.
Standards hierarchy: ISAs: audits | ISRE: reviews | ISAE: other assurance | ISRS: related services | ISQM: firm quality; Pick the standard that matches the engagement type.

How to solve International Standards on Auditing and the Clarity Structure questions

Use this method for any question on ISA structure, ISAE or ISQM. It keeps your answer tied to the scenario and earns professional skills marks.

1Read the requirement and identify the task: explain, compare, advise, or evaluate. Note the role you are given, such as a manager writing to a partner.
2Identify the engagement type in the scenario: audit, review, other assurance, related service, or a firm-level quality issue.
3Name the standard that governs it: ISA, ISRE, ISAE, ISRS or ISQM. State why in one sentence.
4Explain the relevant element: the objective, the requirement, or the application material. Use the correct term for each.
5Apply it to the facts. Name the client, the figures and the specific issue. Do not give a generic list.
6State the consequence: what the auditor must do, what documentation is needed, or what the effect on assurance or the report is.
7Conclude with a clear recommendation or judgement, and communicate it in the format asked for, such as a memo or briefing note.

Quickest way: Four-question standard check

When to use it: Use when you have little time and need to place an issue in the right standard and give a focused answer.

Ask: is this an audit? If yes, think ISAs and the clarity structure.
Ask: is it other assurance? If yes, think ISAE 3000 (Revised) and the Assurance Framework elements.
Ask: is the issue about the firm's own processes? If yes, think ISQM 1 or ISQM 2.
Ask: is any assurance given? If not, as in agreed-upon procedures or compilations, think ISRS and say that no assurance is provided.
Write the answer as: standard, objective or requirement, link to the scenario, action.

Common mistakes in International Standards on Auditing and the Clarity Structure

Treating application material as mandatory requirements.
Students see detailed lists and assume they are all compulsory.
Fix: Say that requirements use "shall" and must be followed. Application material helps the auditor apply them and explains why.
Confusing ISA with ISAE.
The names are similar and both come from the IAASB.
Fix: Link ISAs to audits of historical financial information. Link ISAE to other assurance engagements, with ISAE 3000 (Revised) as the main standard.
Saying an audit gives absolute assurance.
Students mix up high assurance with a guarantee.
Fix: Say an audit gives reasonable assurance, a high level but not absolute, because of inherent limitations such as sampling and judgement.
Mixing up ISQM 1 with ISA 220.
Both deal with quality, so students treat them as one thing.
Fix: ISQM 1 is the firm's system of quality management. ISA 220 (Revised) covers quality management on a single audit. ISQM 2 covers engagement quality reviews.
Listing the structure of an ISA without applying it to the scenario.
Students recall the headings from memory and stop there.
Fix: Tie each point to the facts. For example, state which objective is at risk and which requirement the auditor has failed to meet.
Claiming agreed-upon procedures or compilations give assurance.
They are carried out by auditors, so students assume assurance follows.
Fix: State that these are related services under ISRS. The practitioner reports findings or compiled information and expresses no assurance conclusion.

Worked examples

Example 1

A junior colleague says: "The application material in ISA 500 lists examples of audit procedures, so we must perform every one of them." As the audit senior, explain whether this is correct, using the structure of an ISA. (6 marks)

Show the solution

State the structure: each ISA has an introduction, an objective, definitions where needed, requirements, and application and other explanatory material.
Identify the colleague's error: the colleague treats application material as if it were requirements.
Explain requirements: these are stated with "shall" and the auditor must comply with each one that is relevant in the circumstances.
Explain application material: it gives guidance and examples to help the auditor apply the requirements. It does not add new requirements, so the auditor chooses procedures that fit the risk assessed.
Link to the objective: the auditor must achieve the ISA's objective. If the requirements alone do not achieve it, the auditor must perform further procedures.
Add the professional judgement point: the auditor decides which procedures give sufficient appropriate evidence for this client and documents the reasoning.

Answer: The colleague is wrong. The ISA 500 requirements are mandatory where relevant. The application material only explains and illustrates them, so the team selects procedures suited to the assessed risks, ensures the objective is met, and documents its judgement.

Example 2

Your firm audits Vara Ltd. Vara's board asks the firm to give a report on the effectiveness of its internal controls over greenhouse gas reporting, and separately to compile its management accounts. Explain which standards govern each engagement and what level of assurance each gives. (8 marks)

Show the solution

Engagement 1: a report on greenhouse gas reporting controls is assurance on a subject matter that is not historical financial information. It falls under ISAE 3000 (Revised) and the International Framework for Assurance Engagements.
Check the elements: three parties (the firm, Vara's management as the responsible party, and the intended users), a suitable subject matter, suitable criteria, sufficient appropriate evidence, and a written assurance report. The firm must confirm that suitable criteria exist before accepting.
Level of assurance: the firm could provide reasonable assurance or limited assurance. Reasonable assurance gives a positive opinion. Limited assurance gives a conclusion in negative form and involves less evidence. The level must be agreed in the engagement terms.
Engagement 2: compiling management accounts is a related service. ISRS 4410 governs compilation engagements.
Level of assurance: the compilation gives no assurance. The firm uses its accounting expertise to assemble the information and reports on it, but expresses no opinion or conclusion on it.
Firm-level point: both engagements must be performed within the firm's system of quality management under ISQM 1, and the firm must also meet ethical requirements, including independence where assurance is given.

Answer: The controls report is an assurance engagement under ISAE 3000 (Revised), with reasonable or limited assurance as agreed. The management accounts work is a compilation under ISRS 4410 and provides no assurance. Both fall under the firm's ISQM 1 system.

Exam tips

When asked about standards, name the exact standard and the engagement type. Marks are lost for vague phrases like "the auditing standards say".
Use the correct vocabulary: objective, requirements, application and other explanatory material, reasonable assurance, limited assurance, suitable criteria.
In scenario questions, name the standard briefly and spend most of your answer applying it to the client's facts. Application earns the marks.
For professional skills marks, write in the format requested and give a clear recommendation. Show scepticism by questioning whether criteria, evidence or compliance are really adequate.
Always separate firm-level quality (ISQM 1 and ISQM 2) from engagement-level quality (ISA 220) when a question mentions quality.

Practice questions from International regulatory frameworks for audit and assurance services

International Standards on Auditing and the Clarity Structure: frequently asked questions

What is the clarity structure of an ISA?

It is the standard layout used in every ISA: introduction, objective, definitions, requirements, and application and other explanatory material. It makes clear what is mandatory and what is guidance. Requirements use "shall".

What is the difference between ISA and ISAE?

ISAs apply to audits of historical financial information. ISAE standards apply to assurance engagements other than audits or reviews of historical financial information, with ISAE 3000 (Revised) as the main standard. Both are issued by the IAASB.

Does the International Framework for Assurance Engagements contain requirements?

No. It describes the elements and objectives of assurance engagements and provides context for the standards. The requirements are in the standards themselves, such as the ISAs and ISAE 3000 (Revised).

Can an auditor ignore a requirement in an ISA?

Only in exceptional circumstances. The auditor must then perform alternative procedures that achieve the aim of the requirement and document the reasons. A requirement that is not relevant to the circumstances, because its condition does not exist, does not apply.

How does ISQM 1 relate to the ISAs?

ISQM 1 deals with the firm's overall system of quality management, covering areas such as governance, ethics, resources and monitoring. The ISAs deal with how individual audits are performed. ISA 220 (Revised) links the two by setting out engagement-level quality responsibilities.