Auditing & Attestation curriculum

The assurance offered is high and deliberately not absolute, and it attaches to the statements taken as a whole rather than to any individual figure. Both qualifications are load-bearing: they are why an undetected small error is not a failed audit, and why the opinion cannot be read as a guarantee.

Four services with four different amounts of work and four different outputs, from an opinion down to no assurance at all. Clients routinely ask for the cheapest and expect the strongest, which is why the engagement letter states which one is being performed.

Attestation covers subject matter beyond financial statements, which broadens what a practitioner can report on while keeping the same independence and evidence discipline. The report's form follows the level of work performed rather than the subject.

The statements are management's assertions and the opinion is the auditor's, which is why an auditor who drafts the statements has audited their own work. That division is the reason several independence rules exist, and it is the one clients most often misunderstand.

Putting the scope, the responsibilities and the limits in writing before work begins is what prevents a later disagreement about what was promised. It is also where the division of responsibility above is stated to the client in their own terms.

Inquiry of the previous auditor before accepting is required, and the point is to learn whether there were disagreements, integrity concerns or a reason for the change. Accepting without it forfeits the cheapest source of information about a client's history.

Quality is a firm-level system rather than a per-engagement checklist, with an independent review of certain engagements before release. The distinction matters because a well-executed engagement inside a weak system is still an unmanaged risk.

Two standard-setters cover two populations, and the requirements differ in strictness rather than in direction. Applying the wrong body's rules is a real hazard on a first engagement of either type, because most of the framework looks identical.

Both are required, and the second is the one that fails without anybody intending it — a relationship that does not actually affect judgment can still make the audit look compromised. Because the test is what an informed observer would conclude, self-assessment is not the standard.

The framework names the ways independence erodes and asks which safeguard, if any, reduces the threat to an acceptable level. Naming the threat is the useful half — it converts an uneasy feeling into a category with a known response.

A direct interest and a material indirect one are treated differently, which is the distinction that decides whether an investment is prohibited outright or assessed for size. Getting the direction of that rule backwards is one of the commonest examination errors.

Certain services for an audit client are prohibited because performing them means auditing your own work later, and the prohibitions are stricter for public companies. The underlying test is self-review rather than a list to memorize.

Fee arrangements that vary with the outcome give the practitioner a stake in the result, which is why they are restricted for attest clients. The restriction is about the incentive rather than about the amount.

The duty is broad and has defined exceptions, which is what allows a subpoena or a peer review to be answered without breach. Knowing the exceptions matters more than the rule, because the rule is intuitive and the boundaries are not.

These apply to every service and every practitioner, not only to attest work, which makes them the baseline beneath the independence rules rather than a part of them. A service with no independence requirement still carries both.

The model is used to solve for the work to be done: with the acceptable overall risk fixed and the client's risks assessed, what remains determines how much substantive testing is required. It is a planning tool rather than a measurement, and reading it as arithmetic misses that.

Complexity, subjectivity and incentive all raise risk before any control is considered, which is why the assessment is about the account and the environment rather than about the client's diligence. An estimate-heavy balance is risky even in a well-run company.

An overall threshold expresses what would change a user's decision, and a lower working threshold leaves room for undetected errors to aggregate. The second exists precisely because testing at the overall level would leave no margin.

The required understanding covers the industry, the regulatory environment and the entity's own processes, because risk cannot be assessed without it. It is the step most easily reduced to a rolled-forward memo, which is how last year's risks get audited.

Planning analytics build an expectation and look for what does not fit it, which directs the work before any detail is tested. The value is entirely in forming the expectation first — comparing to last year without one finds only the obvious.

A required team discussion exists because fraud risk is identified by combining perspectives rather than by a checklist, and because the discussion itself sets the expectation of skepticism. Treating it as a form to sign defeats both purposes.

Three conditions typically present together — pressure, opportunity and a rationalization — which is what makes the model useful for classifying an observed cue. It explains risk rather than detecting fraud, and it is not a prediction about any individual.

Certain risks are presumed significant unless rebutted, which reverses the usual burden: the auditor must justify not treating them so rather than justify treating them so. The presumptions exist because these are where failures have historically concentrated.

The strategy sets scope, timing and direction while the detailed plan specifies the procedures, and the two are revised as the audit learns. Writing the plan once at the start and never revisiting it is what makes a planning file a formality.

Relying on component auditors, specialists or internal audit is permitted and does not transfer responsibility for the opinion. That is the whole rule: the work can be shared and the responsibility cannot, which shapes how much evaluation of that work is required.

Five components describing what a control system is made of, with the environment underneath the rest — a strong procedure inside a weak environment is not a strong control. The framework is a way to find gaps rather than a list to confirm.

A control is only meaningful against the assertion it is supposed to address, so the design question is which risk of misstatement it prevents or detects. A control with no assertion behind it is activity rather than control.

Following one transaction end to end confirms that the process is as described and that the controls exist as documented, which a narrative alone cannot. It frequently finds that the documented process and the actual one diverged some time ago.

Two separate questions: would this control catch the problem if it worked, and did it actually work throughout the period. A control well designed and inconsistently applied fails the second, and only testing operation reveals it.

The techniques differ in strength, with re-performance strongest and inquiry weakest, and inquiry alone is never sufficient. A combination is used because each compensates for the others' blind spots rather than because more is better.

Assessing control risk below maximum is a decision to do less substantive work, and it is only available if controls are tested and found effective. The efficiency is real and it is conditional, which is why the decision is made after testing rather than before.

Three severities with different communication consequences, judged by the likelihood and magnitude of what could go undetected rather than by what actually did. That distinction is why a deficiency with no resulting error can still be a material weakness.

The principle is that no one person should both authorize, record and hold custody, because any two combined create an opportunity to conceal. Classifying a proposed arrangement against the three functions is the practical test.

General controls govern the environment and application controls govern individual processes, and the second cannot be relied on if the first are weak. That dependency is why access and change management are examined before any automated control is trusted.

An integrated audit opines on controls as well as statements, which changes the work: a control failure becomes a reportable outcome in its own right rather than merely a reason to test more substantively.

Each assertion is a different claim about a balance or a transaction, and a procedure addresses one or two rather than all of them. Mapping the test to the assertion is what makes a procedure purposeful — and it is the step that distinguishes auditing from re-checking arithmetic.

Starting from the records and finding support tests one direction; starting from the source documents and finding records tests the other. Which direction answers which assertion is the classic trap, and it cannot be reasoned around — it has to be held the right way up.

Evidence from outside the entity outranks internal evidence, and evidence the auditor obtains directly outranks what the client supplies. Both rankings follow from who could have altered it, which is why the hierarchy is memorable once its reason is.

Quantity and quality are separate requirements and neither substitutes for the other — more weak evidence does not become strong. The pair is why a large sample of an unreliable population is still insufficient.

The two forms differ in what a silence means: one requires a reply and the other treats no reply as agreement, which makes the second far weaker and appropriate only in narrow circumstances. Nonresponse handling is where the procedure's rigor actually lives.

Attending the count tests existence directly and observes whether the client's own procedures work. Where attendance is impossible, alternative procedures may be available — and where they are not, the consequence is a scope limitation rather than a smaller test.

The assurance obtained depends entirely on how precise the expectation is: a rough expectation detects only a gross error. That is why building the expectation, independently and at a useful level of disaggregation, is the whole procedure.

Three things are examined — the method, the assumptions and the underlying data — because an estimate can be wrong through any of them. Management bias is assessed across estimates as a group, since individually reasonable choices can lean consistently one way.

Identification is the difficulty, because the transactions are frequently not flagged and the counterparty may be undisclosed. Once identified, the question is substance rather than form, since the terms may not be arm's length even when the paperwork is complete.

A letter to counsel corroborates management's representations about claims, which is one of the few places where evidence must come from outside both the entity and the auditor. A refusal or a limited reply is itself significant rather than merely unhelpful.

Written representations are required and are never a substitute for other evidence — they corroborate rather than establish. A representation offered in place of evidence that ought to exist is a scope limitation wearing a signature.

The standard is that an experienced auditor with no previous connection could understand what was done, by whom, and what was concluded. Retention and lockdown rules exist because the file is the evidence that the audit happened as described.

One asks how often a control failed and the other how much a balance is misstated, which are different questions with different mathematics. Choosing the wrong lane produces a valid calculation answering something nobody asked.

Two pairs of risks, and within each pair one threatens effectiveness while the other threatens efficiency. The effectiveness risks are the serious ones — concluding wrongly that things are fine — and the efficiency ones merely cost work.

Each driver moves the size in a predictable direction: tolerating less, expecting more error, or wanting more confidence all increase it. Knowing the directions is more useful than any formula, because it is what lets you sanity-check a computed size.

Errors found in the sample are projected to the population and compared against tolerable misstatement with an allowance for sampling risk. Stopping at the raw errors found is the common shortcut, and it understates the conclusion the sample supports.

Selecting by monetary unit gives larger items a proportionally greater chance of selection, which concentrates the work where the money is. It suits overstatement testing and handles understatement poorly, which is the constraint that decides when to use it.

The risk concentrates at the period boundary and in what happens after it, which is why cutoff work and post-year-end credit memos are as informative as the confirmations. Revenue is also where the presumed significant risk sits, so the work is expected to be substantial.

The characteristic risk is understatement, so the procedure searches for liabilities that were never recorded rather than testing what is on the ledger. That is the clearest example of the direction principle — testing the recorded population cannot find an omission.

Three separate questions — does it exist, is it priced correctly, and is it still worth what it says — which is why observing the count is only part of the work. Obsolescence is the one most often under-tested and most often where the misstatement is.

The distinctive risks are people who do not exist and rates or hours that were never authorized, which makes the work about existence and authorization rather than about arithmetic. Analytical procedures are unusually effective here because the population is regular.

The classic schemes exploit timing between accounts or between receipts and recording, which is why the procedures look at transfers around the period end and at the pattern of postings rather than at the balance. A reconciliation that agrees proves less than it appears to.

Confirmation covers existence and terms, and the covenant review is what connects the balance to a consequence — a breach can affect classification and going concern. Testing the balance without reading the agreement misses the part that matters.

Additions are tested by tracing to support, and the informative procedure is scanning repairs for items that should have been capitalized. The misstatement usually lives in the classification decision rather than in the amount.

The report's structure is standardized so that any departure is visible, which is why the wording matters as much as the conclusion. The sections describing the most significant matters communicate judgment without modifying the opinion.

Two questions decide the outcome: is the issue material, and is it pervasive. That grid maps to qualified, adverse and disclaimer, and reasoning from the grid rather than from instinct is what makes the conclusion defensible.

A limitation imposed by the client is treated more severely than one imposed by circumstances, because the client chose it. That distinction frequently decides between a qualification and a disclaimer on otherwise identical facts.

Substantial doubt does not by itself modify the opinion — adequate disclosure and a separate report section is the normal path. The modification arises when disclosure is inadequate, which makes this a disclosure question before it is a reporting one.

One draws attention to something already in the statements and the other to something not in them, which is the distinction that decides which paragraph is appropriate. Neither modifies the opinion, and using one where a modification is required is a reporting failure.

Prior periods carry their own opinions, which may differ from the current one and may have been issued by someone else. Handling the predecessor's involvement correctly is what makes the report accurate about what was and was not audited by whom.

Events are treated differently depending on whether they provide evidence about conditions existing at the balance sheet date or arose afterwards. Dual dating limits the auditor's responsibility for the later period to the specific matter.

Learning after issuance that the statements were misstated triggers a defined sequence of steps, because third parties may be relying on the report. Doing nothing is not among the options, which is the point most often overlooked.

The group auditor either takes responsibility for a component auditor's work or refers to it in the report, and those choices carry different evaluation obligations. Referencing divides responsibility explicitly; assuming it does not reduce the work.

There is a duty to read the rest of the annual report and consider whether it is inconsistent with the audited statements or with what was learned. It is not an audit of that information, which is why the reporting language is carefully limited.

Certain matters must be communicated to those charged with governance, which exists so that the board hears directly rather than through management. The required list is deliberately specific because the important items are the ones management would prefer to summarize.

Each service has its own report form, and the review's conclusion is expressed negatively because the work supports limited assurance only. Using audit language for a review is the misrepresentation the standardized wording exists to prevent.

Government auditing adds requirements on top of the general standards rather than replacing them, particularly around independence, competence and reporting. The additions are what a practitioner moving into that work has to learn; the base remains familiar.

An audit of an entity receiving federal awards covers compliance with the conditions attached to those awards as well as the statements. It introduces a second set of criteria, which is what makes the scoping and the reporting materially different.

Statements prepared on a basis other than the general framework are auditable, and the report has to make the basis clear so a reader does not assume the usual one. The emphasis on the framework is the distinguishing feature of these reports.

These are attestation engagements reporting on a service organization's controls for the benefit of its customers' auditors. Understanding them from the practitioner side is also what makes a user auditor able to read one properly.

Auditing through the system rather than around it means examining processing itself rather than inferring from inputs and outputs. It becomes necessary when the audit trail is electronic and there is nothing visible to inspect.

Running known data through the client's own system tests whether the processing behaves as documented, and simulating the processing independently tests the same thing from the other direction. Each has a different exposure — one touches live systems, the other must faithfully replicate them.

Who can change what, and how changes are approved and moved to production, are the two questions that determine whether any automated control can be relied upon. A weakness here undermines every application control resting on it.

An automated control that is configured once behaves identically every time, so testing one instance can be sufficient — provided the general controls establish that it did not change. That dependency is the whole basis of the efficiency.

Examining the whole population removes sampling risk and introduces different questions: whether the data is complete, whether it is what it claims to be, and what an exception actually means. It is not simply a larger sample.

Testing entries is required because the management-override risk is presumed, and the selection criteria target what an override would look like — unusual accounts, unusual timing, unusual preparers. Selecting randomly here misses the point of the procedure.

The recognizable patterns share a shape: moving revenue into the period by moving goods, terms or paperwork. Knowing the named schemes is useful because each leaves a characteristic trace that ordinary substantive work can find once you know to look.

The categories differ in when the asset is taken relative to its recording, which determines what evidence exists and therefore what procedure finds it. Theft before recording leaves no ledger trace at all, which is why it needs a different approach.

The required responses target the ways management can circumvent controls — reviewing estimates for bias, examining unusual transactions, and testing entries. They are required precisely because no control system constrains the people who operate it.

Suspected fraud triggers escalation, and the level it is escalated to depends on who is implicated — which is why involvement of senior management changes the path. Withdrawal is a genuine option and its consequences have to be considered before it is chosen.

A payroll population is regular enough that an expectation can be built precisely, which makes analytical testing unusually powerful here. The precision is what gives the assurance, so a comparison against last year's total achieves very little.

Testing occurrence means starting from the recorded expense and finding the support, because the risk is charges that should not be there. It is the mirror of the completeness work done on liabilities, and the two are frequently confused.

Developing an independent range and comparing it with management's point estimate is a stronger procedure than evaluating their reasoning alone. Where the point falls within the range matters — consistently near one end is evidence of bias.

On a first engagement the prior balances were audited by someone else or not at all, and they affect this period's results. The work required depends on what is available, and its absence is a scope limitation rather than an acceptable starting point.

Discovering after issuance that a necessary procedure was omitted triggers an assessment of whether the opinion is still supported, and then of what others are relying on it. It is a defined sequence rather than a judgment call about embarrassment.

Testing before the period end requires work covering the remaining period, and how much depends on the assessed risk and the control environment. The saving is real and it is not free, which is the trade the timing decision makes.

A required overall review near the end asks whether the statements as a whole make sense given everything now known, which is a different question from any individual test. It is the last opportunity to notice something no procedure was aimed at.

Misstatements are accumulated rather than assessed individually, because items immaterial alone can be material together. The accumulation also reveals direction — several small errors all one way is a different finding from several offsetting ones.

Two approaches to evaluating an error that originated in a prior period, one looking at the balance sheet effect and the other at the income statement effect. They can give different answers on the same facts, which is why the approach has to be stated.

Uncorrected misstatements are communicated along with a request to correct them, and management's refusal is itself information for governance. Summarizing them is also what forces the aggregate materiality question to be answered explicitly.

An independent review before release is a check on the significant judgments by someone not involved in making them. Its value depends on the reviewer having genuine independence from the engagement rather than being a second signature.

Three levels of work producing three different reports — an opinion, a negative conclusion, and findings with no conclusion at all. The last is frequently misread by users as assurance, which is why its report is restricted.

The distinction is the assumptions: one uses expected conditions and the other hypothetical ones, which is why the second has restricted distribution. Offering a projection to general users is the error the restriction exists to prevent.

Reporting on hypothetical adjustments to historical statements tests whether the assumptions and the computations are appropriate, not whether the hypothetical outcome will occur. Keeping that boundary clear is most of the engagement's reporting work.

Attesting compliance with requirements needs criteria that are suitable and available, which is the gating question — vague requirements cannot be attested to. Establishing the criteria is therefore part of accepting the engagement.

Inquiry and analytical procedures support limited assurance, expressed negatively, and there is no opinion. The procedures are far narrower than an audit's, which is why the report explicitly states what was not done.

Independence is not required, and where it is impaired that fact must be disclosed in the report. Disclosing it without stating the reason is permitted, which is a deliberate accommodation rather than an oversight.

A compilation may omit substantially all disclosures provided the omission is disclosed and the statements are not intended to mislead. Both conditions are required, and the second is a judgment rather than a formality.

Preparing statements without any report is a non-attest service, which changes what the practitioner is responsible for and how the statements must be marked. The absence of a report is the defining feature and the source of most confusion about it.

Rotation with a cooling-off period addresses the familiarity threat that builds over a long relationship. The mechanism is time away rather than a change of attitude, which is why it is a rule rather than a judgment.

Services must be approved by the audit committee in advance, which moves the decision away from the management the auditor would be serving. It is a structural safeguard rather than a paperwork step.

Firms auditing public companies are inspected, and inspection findings shape firm practice well beyond the engagements examined. Knowing the regime exists explains a good deal about why documentation standards are enforced as they are.

Some tax services are permissible and others are not, with the boundary drawn around advocacy and self-review rather than around difficulty. The permissible set is narrower for public-company clients, which is the pattern throughout these rules.

A former engagement team member joining a client in a financial reporting role creates a familiarity and self-review threat, addressed by a required interval. The rule attaches to the role taken rather than to the individual's seniority alone.

Reporting on information accompanying the statements is done in relation to the statements as a whole rather than as a separate opinion. That phrasing limits what is being asserted, which users frequently read more broadly than intended.

Information a framework requires but does not include in the statements gets limited procedures and a report paragraph describing them. It sits between audited and unaudited, which is exactly why the paragraph is prescribed.

Derived statements are reported on by reference to the full statements they came from, since they cannot be understood alone. The report therefore has to identify the source and state that reading the summary is not a substitute.

Reviews of interim information for public companies follow their own standards and produce limited assurance. They are also where an auditor first sees the year's emerging issues, which makes them useful to the annual audit beyond the report.

Some reports are restricted to specified parties because the criteria or the procedures were agreed with them and would mislead anyone else. The restriction is part of the report rather than a covering-letter formality.

Internal auditors may provide direct assistance within limits, and the external auditor remains responsible for the work and must supervise it. The limits turn on objectivity and on the significance of the area, not on the individuals' competence.

Transactions either side of the period end are examined to establish that they fell in the right period, which is the assertion most easily manipulated and most easily got wrong innocently. The test is bidirectional because errors run both ways.

Listing transfers around the period end exposes amounts recorded as received in one account before being recorded as paid from another, which is the pattern that overstates cash. The schedule is mechanical and it is what makes the scheme visible.

Payment received after the period end is strong evidence that a receivable existed and was collectable, which makes it the standard alternative when a confirmation goes unanswered. It addresses existence well and valuation better than the confirmation would have.

A refusal or a materially limited reply is a scope limitation rather than a neutral outcome, because the information is not obtainable elsewhere. Treating it as an unreturned item to chase understates what it means for the report.

Using a specialist requires evaluating their competence, capability and objectivity, and understanding their work well enough to assess it. The responsibility for the conclusion stays with the auditor, which is why accepting the output unexamined is not an option.

Choosing the base for materiality is a judgment about what users care most about, which differs between a profitable operating company, a break-even one and an asset-holding entity. Defaulting to one benchmark regardless is how materiality becomes arbitrary.

Allocating below the group level must leave room for aggregation, so component thresholds together exceed the group figure while each stays low enough to be useful. Setting them by simple division either over-audits or leaves a gap.

Testing earlier spreads the work and requires covering the gap; testing at the end is cleaner and concentrates the effort. The choice is driven by assessed risk and by the control environment rather than by the calendar alone.

Reviewing the previous auditor's files informs the opening balances and the understanding of the entity, subject to the predecessor's consent and the client's. What is available shapes how much independent work the first year requires.

Scoping which systems and which reports the audit will rely on is what determines the extent of technology work, and it has to happen early. Discovering late that a relied-upon report comes from an untested system is an expensive planning failure.

Any report or schedule produced by the entity and used as audit evidence has to be tested for completeness and accuracy, because its reliability is an assumption otherwise. It is the most frequently overlooked evidence question, since such reports look like data rather than like assertions.

A service auditor's report lets a user auditor rely on controls at an outsourced provider, subject to reading what it covers and what it assumes the user does. Those complementary user controls are the part most often skipped.

They are permitted only in narrow circumstances, because treating silence as agreement is weak evidence — a non-reply may mean nobody opened the envelope. The conditions all exist to make that inference less unsafe.

Authenticity is harder to establish for something that can be altered without trace, which changes what the evidence is worth rather than whether it can be used. The controls over the system producing it become part of the evaluation.

Examining an entire population for characteristics of interest is a legitimate procedure with different properties from sampling — no projection is needed, and what counts as an exception has to be defined in advance. It suits identifying items rather than quantifying misstatement.

A count that could not be observed, with no adequate alternative procedure, produces a scope limitation whose severity depends on materiality and pervasiveness. Working the grid from those two questions is what gives the report path.

A departure from the framework can be justified where following it would mislead, and the report then explains the departure and its effects. The circumstances are rare, which is why the justified case is usually a distractor rather than the answer.

Omitted or insufficient disclosure is a departure from the framework like any other and modifies the opinion accordingly, with the auditor providing the information where practicable. Treating a missing note as a lesser problem than a wrong number is the error.

Different opinions across periods presented together is normal and the report has to make clear which applies to which. Updating a prior opinion is a separate decision from reporting on the current period.

Referring to another auditor divides responsibility and must be worded so a reader understands what each party covered. Choosing to refer is not a criticism of the other firm, which is a common misreading of the wording.

Restating prior figures or reissuing a report raises the question of whether the previous opinion still stands, and the answer is stated explicitly rather than implied. Silence about a changed prior opinion is itself misleading.

Rules extend to close family and to the household, because the threat comes from the relationship rather than from the individual's own holdings. Whose interests are attributed to whom is the part that has to be known precisely rather than reasoned out.

Ordinary banking arrangements are permitted under defined conditions while other lending relationships are not, which is a narrow exception rather than a general tolerance. The conditions attach to the terms and the timing, not to the amount alone.

Acceptability turns on whether the item is reasonable in the circumstances, which is a judgment rather than a fixed figure — and one an outside observer has to find reasonable too. The appearance test does most of the work here.

A client's own records must be returned on request regardless of unpaid fees, while the practitioner's working papers are their own property. Confusing the categories is how a fee dispute becomes an ethics complaint.

Promotion is permitted provided it is not false, misleading or deceptive, which is a conduct standard rather than a prohibition. The boundary is about what is claimed, so an accurate description of services is unproblematic however prominent.