Advanced Audit and Assurance (International) · Reporting on other assignments

Due Diligence, Forensic and Internal Controls Assignments

Updated 11 October 2026 · Fact-checked

Due diligence assesses a target business before a deal. A forensic investigation examines suspected fraud or misconduct and gathers evidence for use in proceedings. An ISAE 3402 report gives assurance on a service organisation's controls. None is a statutory audit. Answer by stating the scope, the assurance level, the user and the ethical risks.

Understand Other Assignments: Due Diligence, Forensic and Internal Controls

A statutory audit gives an opinion on financial statements for shareholders. Other assignments are different. Each has its own purpose, user and level of assurance. In AAA you must explain these differences and apply them to a scenario.

Due diligence is an investigation of a target before an acquisition or investment. The buyer wants to know what it is buying and at what price. Typical strands are financial (earnings quality, net assets, debt, working capital), commercial (market, customers, competitors), legal, tax, operational and IT. Scope is set by the client in the engagement letter. It is often agreed-upon procedures or a report of findings, not an opinion. The report is for the buyer only, and the firm should restrict reliance by others.

Forensic investigation looks into suspected fraud, misappropriation, corruption or other misconduct. Evidence may be used in court, disciplinary or insurance proceedings, so you must preserve it and keep a clear chain of custody. Tools include interviews, document and email review, computer forensics, data analytics and tracing of funds. The work is usually reactive and focused on specific allegations. It is not designed to find all errors, unlike an audit.

Reporting on internal controls covers assurance on controls at a service organisation (for example payroll or cloud hosting) that affect its clients' financial reporting. ISAE 3402 deals with this. In a Type 1 report the service auditor reports on the description of the system and the suitability of control design at a point in time. In a Type 2 report the auditor also reports on whether the controls operated effectively over a period. The user entity's auditor can use the report as evidence under ISA 402. Management of the service organisation provides a written assertion.

Ethical issues run through all three. You need competence and capacity, confidentiality (especially in due diligence, which exposes sensitive information), objectivity and independence where the work is an assurance engagement, and conflicts of interest if you advise both sides or audit the target. Self-review and advocacy threats arise if the firm audits the client and also advises on the deal. Always discuss threats and safeguards.

Key rules to remember

Audit versus due diligence: Audit = opinion on financial statements for members; Due diligence = findings for a buyer on a target's value and risk; Due diligence is forward looking, client-defined in scope and usually restricted in use. An audit is historical and follows ISAs.
ISAE 3402 Type 1: Type 1 = description of system + suitability of control design, at a specified date; It says nothing about whether controls actually operated.
ISAE 3402 Type 2: Type 2 = Type 1 content + operating effectiveness of controls over a specified period; Includes the service auditor's tests of controls and results. It is more useful to users.
Parties in a service organisation report: Service organisation (management assertion) → service auditor (opinion) → user entities and their auditors; Users' auditors apply ISA 402 when deciding how far to rely on the report.
Forensic evidence rule: Obtain → preserve → document chain of custody → report factual findings; Improper handling can make evidence inadmissible.
Level of assurance: Audit under the ISAs = reasonable assurance on the financial statements. ISAE 3402 Type 2 report = reasonable assurance opinion on the description, design and operating effectiveness of controls. ISAE 3402 Type 1 report = reasonable assurance on the description and design only, with no assurance on operating effectiveness. Agreed-upon procedures = no assurance. Forensic investigations are normally not assurance engagements and give findings or factual reports. Due diligence depends on the engagement terms and is usually findings-based with no formal assurance conclusion.; State the level in every answer, because it drives report wording and liability. For due diligence and forensic work, check what the engagement letter actually promises.

How to solve Other Assignments: Due Diligence, Forensic and Internal Controls questions

Use this method for any question on due diligence, forensic work or controls reports. It keeps you on the requirement and earns professional skills marks.

1Read the requirement and identify the assignment type: due diligence, forensic, or controls report. Note the verb (explain, evaluate, recommend, discuss).
2Identify who the client and the intended users are, and what decision they will make.
3Set the scope and assurance level: what work is needed, what is excluded, and what the report will say.
4Apply to the scenario facts. Name the specific risks, red flags or controls from the case, not generic points.
5State the procedures or evidence you would obtain, linked to each risk.
6Raise ethical and professional issues: independence, conflicts, confidentiality, competence, and any reporting duties if fraud or non-compliance emerges.
7Cover reporting and liability: report type, restrictions on use, and engagement letter terms.
8Conclude with a clear recommendation or judgement, written in a professional tone for the stated reader.

Quickest way: Purpose, Scope, Users, Assurance, Ethics

When to use it: Use when time is short and the question asks you to explain or compare an assignment in a scenario.

Write one line on purpose: what decision or problem the assignment addresses.
Write one line on scope and who sets it.
Name the users and any restriction on use.
State the assurance level and the report form.
Add two or three specific ethical threats from the scenario with one safeguard each.
Finish with one practical recommendation.

Common mistakes in Other Assignments: Due Diligence, Forensic and Internal Controls

Treating due diligence as a type of audit and giving an audit opinion.
Students link all assignments to ISAs and audit reports.
Fix: Say due diligence is client-scoped and findings-based, normally for the buyer only, and not an opinion on financial statements unless the engagement says so.
Confusing Type 1 and Type 2 ISAE 3402 reports.
Both describe controls, so the difference in time and testing is missed.
Fix: Type 1 is design at a date. Type 2 adds operating effectiveness over a period. Link it to reliance: only a Type 2 report can provide evidence of operating effectiveness of controls, which may support the user auditor's control reliance and affect the nature, timing and extent of substantive procedures.
Writing a generic forensic answer that lists fraud types without a plan.
Students recall the fraud triangle and stop there.
Fix: Set out objectives, scope, team, evidence preservation, interviews, analytics, and reporting. Tie each to the allegation in the scenario.
Ignoring independence and conflict issues when the firm is also the auditor.
Students focus on technical work and forget the ethics marks.
Fix: Check whether the firm audits the client, target or service organisation. Identify self-review, advocacy and familiarity threats and propose safeguards, or recommend declining.
Forgetting confidentiality and reporting duties when fraud is found.
Students assume the client's instructions override everything.
Fix: Discuss the duty of confidentiality, the exceptions allowed by law, and consideration of legal advice and money laundering reporting where relevant.
Not restricting reliance on the report.
Students overlook liability to third parties.
Fix: Recommend engagement letter terms, a clear addressee, use restrictions and disclaimers to third parties, in line with local law.

Worked examples

Example 1

Your firm is asked to carry out financial due diligence for Zenith Co, which plans to buy Orbit Co. Your firm is also the external auditor of Zenith Co. Explain how the engagement differs from an audit and the ethical issues you should consider. (8 marks)

Show the solution

Difference in purpose: an audit gives an opinion on historical financial statements for members. Due diligence helps Zenith decide whether to buy and at what price. It is forward looking and covers earnings quality, net assets, debt and cash flows.
Difference in scope: the scope is agreed with Zenith in the engagement letter. It is not set by ISAs and may exclude some areas. Materiality may be lower or different, as the price depends on detail.
Difference in assurance and report: the output is usually a findings report, not an audit opinion. Use is restricted to Zenith, and the engagement letter should disclaim liability to others.
Ethical issue 1, independence: the firm audits Zenith. Advising on an acquisition is a non-assurance service. For any audit client, the firm must evaluate whether the service creates a self-review threat and whether safeguards can reduce it to an acceptable level. Whether Zenith is a public interest entity (PIE) matters because the rules are stricter: for a PIE audit client, the IESBA Code prohibits non-assurance services that might create a self-review threat. This is not an automatic ban on transaction-related work. The firm must assess whether the due diligence findings would be subject to audit procedures, for example in the acquisition accounting and goodwill. If they would, a self-review threat exists. The work could also create an advocacy threat if we promote Zenith's position in negotiations, and a management responsibility threat if we make the decision for Zenith. Safeguards: limit work to findings, use a separate team, have Zenith make all decisions, and decline if the threats cannot be reduced to an acceptable level.
Ethical issue 2, confidentiality: we will see Orbit's sensitive data. We must keep it confidential, use it only for the engagement, and agree terms with Orbit before access.
Ethical issue 3, competence and conflicts: check we have the skills and staff, and that we do not act for Orbit or a competing bidder. If conflicts cannot be managed, decline.

Answer: Due diligence is a client-defined, forward-looking investigation reported as findings to Zenith only, unlike an audit opinion. The firm should evaluate self-review, advocacy and management responsibility threats for any audit client. It should check whether Zenith is a PIE, where services that might create a self-review threat are prohibited, and so assess whether the findings would be subject to audit procedures. It should accept only if these threats, together with confidentiality and conflict issues, can be reduced to an acceptable level by safeguards such as separate teams and clear terms. Otherwise it should decline.

Example 2

A payroll processor, Paylink Co, provides services to many clients. A user entity's auditor receives an ISAE 3402 Type 2 report on Paylink. Explain what the report tells the user auditor and what the auditor should still consider before relying on it. (7 marks)

Show the solution

What it is: a Type 2 report contains management's assertion, a description of Paylink's system, and the service auditor's opinion on whether the description is fairly presented, controls were suitably designed, and controls operated effectively over a stated period.
What the user auditor gains: evidence on payroll controls at Paylink, which may reduce the need for the user auditor's own tests of controls and may affect substantive procedures. This is relevant under ISA 402.
Consider the period: check the report covers the relevant part of the user entity's financial year. If there is a gap, consider a bridging letter or extra procedures.
Consider the opinion: check it is unmodified and review any deviations noted in the tests of controls.
Consider scope: check that the controls covered are relevant to the user's payroll assertions and that complementary user entity controls are in place at the client.
Consider the service auditor: assess competence, professional standing and independence. Consider subservice organisations and whether they are included or carved out.

Answer: The Type 2 report gives evidence on design and operating effectiveness of Paylink's controls over a period. The user auditor can rely on it only after checking the period covered, the opinion and deviations, relevance of the controls, the client's own complementary controls, and the competence and independence of the service auditor.

Exam tips

Always state the assurance level and the intended user. Many answers lose marks by not saying who can rely on the report.
For ISAE 3402 questions, name Type 1 versus Type 2 and link to reliance by the user auditor under ISA 402.
In forensic questions, include evidence preservation, chain of custody, interview approach and legal advice, not only fraud risk factors.
Use the case facts. Name the entity, the people and the red flags. Generic lists score poorly and lose professional skills marks.
Finish ethical points with a decision: safeguard, decline, or escalate. Examiners reward judgement.

Practice questions from Reporting on other assignments

Other Assignments: Due Diligence, Forensic and Internal Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Other Assignments: Due Diligence, Forensic and Internal Controls: frequently asked questions

What is the difference between due diligence and an audit?

An audit gives an opinion on historical financial statements for shareholders and follows ISAs. Due diligence is a client-scoped investigation of a target to support a deal decision. It is usually reported as findings for the buyer only.

What is an ISAE 3402 report?

It is an assurance report by a service auditor on controls at a service organisation that affect its clients' financial reporting. Type 1 covers design at a date. Type 2 also covers operating effectiveness over a period.

How is a forensic investigation different from an audit?

A forensic investigation targets specific suspected fraud or misconduct and gathers evidence that may be used in proceedings. An audit gives reasonable assurance that financial statements are free from material misstatement and is not designed to find all fraud.

Can the auditor also carry out due diligence for the same client?

It may be possible, but it is a non-assurance service that can create self-review and management responsibility threats. You must assess these threats and apply safeguards, or decline if they cannot be reduced to an acceptable level.