Auditing, oriented

10 chapters

about 17 min read

free

An audit is not a search for errors. It is the process of accumulating enough evidence to say, at an acceptably low risk of being wrong, that financial statements are fairly stated. Almost every rule follows from that one sentence. "Enough" is why sampling exists. "Acceptably low risk" is why you assess risk before you plan any testing. "Fairly stated" is why materiality exists, since not every error matters. And the whole thing is worth nothing if you are not independent, which is why ethics comes before technique. Read this guide for that chain of reasoning; each standard is much easier to hold once you can see which link it defends.

Each chapter opens with the short version. Tap one to read the detail.

What an audit is for, what it does not promise, and the rungs below it

~3 min

An audit provides reasonable — not absolute — assurance that statements are free of material misstatement. That single qualifier explains sampling, materiality, and why an audit can be performed correctly and still miss something. A review gives less, a compilation none.

The opinion you give as an auditor is bounded in two directions at once, and both bounds are deliberate.

Reasonable assurance, not absolute. An audit does not examine every transaction and does not guarantee that nothing is wrong. Absolute assurance would require testing everything, which no one would pay for and which would still fail against collusion and forgery.

Material misstatement, not error. The standard is not accuracy to the cent. It asks whether a misstatement would change the decision of someone relying on the statements.

This displaces a common misconception: that an audit is a fraud investigation, or a guarantee of solvency. It is an opinion on whether statements are fairly presented, given by a party required to be independent of the people who prepared them.

Concretely: AS 1101's own chain. A company with an ineffective control environment and too little capital to keep operating — the standard's examples — carries a high risk of material misstatement at the statement level. You cannot lower that risk, so detection risk must come down instead, which means more persuasive substantive evidence. It never permits the reverse trade: more detection risk because the client is large, familiar or short of time.

An audit is the top of a ladder, and the rungs below it differ in assurance, not merely in price.

A review provides limited (negative) assurance. The practitioner states they are not aware of any material modifications needed, and the work is built mainly from inquiry and analytical procedures rather than from testing controls or corroborating evidence.

A compilation provides no assurance: the accountant assists in presenting information without verifying it.

The negative wording of a review conclusion is doing real work. "Nothing came to our attention" is a much weaker claim than "the statements are fairly presented", and it is weaker precisely because the procedures behind it are narrower.

Independence still matters below the audit line, and the rules differ by engagement type. In a compilation, a lack of independence must be disclosed rather than silently tolerated.

Attestation engagements generalize the idea beyond financial statements to other subject matter, using the same assurance vocabulary.

Rule: read every auditing requirement as protecting one of three words, reasonable, material or independent. Then match the assurance level to what the user needs and say which one you are giving; most disputes here come from a reader assuming audit-level assurance from a review-level engagement.

Independence, and why appearance counts as much as fact

~2 min

Independence must exist both in fact and in appearance, because the audit's value comes from being believed. Most rules therefore restrict relationships that would look compromising even where the auditor's judgment is genuinely unaffected.

Independence in fact is a state of mind: actual objectivity. Independence in appearance is whether a reasonable observer, knowing the facts, would conclude your objectivity was impaired. The second is why the rules look strict. A financial interest can be barred even where you would in truth be unmoved by it, because the standard is not "would this sway me" but "could this reasonably be thought to".

The relationships that matter cluster around financial interest, employment, business relationships, fees, and the provision of non-audit services to an audit client. Some are absolute prohibitions. Others turn on materiality or on who in the firm holds the interest, which is what "covered person" concepts exist to define.

Two threats are worth naming because they are the ones people rationalize. Self-review means auditing your own firm's work, which is why several non-audit services are restricted for audit clients. Self-interest arises when fee dependence or a job prospect gives you a stake in the outcome.

For public-company audits the applicable rules sit with the regulator rather than only with the profession, and they are stricter. If something is permitted for a private client, do not assume it carries over.

Concretely: under ET 101 a covered member may hold no direct financial interest in the client at all. A single share fails, with no materiality test, while an indirect interest impairs independence only when it is material. Nothing there turns on whether you would be swayed; the rule is written to the appearance.

Rule: test any relationship twice — would it change my judgment, and would a reasonable outsider believe it might? Failing the second is enough.

Risk first, testing second — and materiality decides the threshold

~2 min

Audit effort is allocated by assessed risk, not spread evenly. Materiality sets what counts as an error worth finding, and it is set during planning precisely so it cannot be adjusted afterwards to suit the result.

The order is the whole discipline: understand the entity, assess where misstatement is likely, then design testing to respond. Effort follows risk. An account that is large but simple may deserve less of your attention than one that is smaller but requires estimation.

Materiality is the threshold that makes "fairly stated" operational. It is a judgment about the magnitude of a misstatement that could influence a user's decisions, and you set it in planning. Performance materiality is set lower than overall materiality deliberately, so that several individually tolerable errors cannot aggregate past the overall threshold undetected.

The reason to fix it early is procedural, not technical. A threshold chosen after you know the results is not a threshold; it is a rationalization.

Risk is usually decomposed. Inherent risk is the susceptibility of an assertion to misstatement before controls. Control risk is the risk that controls fail to catch it. Detection risk is the part you control: the risk that your procedures fail to find what got through. The relationship is the useful part. If you assess inherent and control risk as higher, you must drive detection risk lower, which means more or better testing.

Concretely: AS 2105 wants materiality for the statements as a whole expressed as a specified amount, set in planning, with tolerable misstatement for each account set below it. AS 2110 names what pushes an account up the ranking: transactions outside the normal course of business or unusual in timing, size or nature, and estimates made under pressure to hit a target. A large, reconciled cash balance can rank below a small warranty provision.

Rule: never plan a procedure without naming the risk it responds to and the assertion it addresses; a test that answers no specific risk is effort without assurance.

Controls: testing the machine instead of the output

~2 min

Testing controls asks whether the system that produces the numbers works, which is different from testing the numbers. It is efficient only when controls are actually effective — and a failed control test sends you back to substantive work, not forward.

There are two ways to get comfortable with a balance. You can examine the transactions themselves or establish that the process producing them is reliable and test less.

Controls testing takes the second route. At volume the economics are attractive: one well-tested control can support thousands of transactions. But the route closes the moment the control proves ineffective, and then you must expand substantive testing to compensate.

The distinction worth keeping is between design and operating effectiveness. A control can be well designed and not performed; it can be diligently performed and incapable of catching the error it targets. Both must hold, and they fail differently.

Automated controls change the arithmetic and introduce their own dependency. A programmed control is consistent; it will not have a bad day. But its reliability rests on general IT controls: access, change management, and operations. If those are weak, you cannot rely on the automated control however elegantly it is written, because nothing guarantees the code you tested is the code that ran.

Segregation of duties is the control most often assumed rather than verified. Small entities frequently cannot achieve it, which is a finding, not an oversight.

Concretely: AS 2201's walkthrough follows one transaction from origination to the ledger using the same documents and systems the company's people use — a purchase order, the receiving report, the invoice match, the posting. Design asks whether the control, operated as prescribed by someone with the authority and competence to perform it, would catch the error; operation asks whether it did. The standard's own note on small companies: too few accounting staff to segregate duties is met with alternative controls, which you then evaluate.

Rule: before relying on any control, ask who could override it and whether that override would leave a trace.

What makes evidence persuasive

~2 min

Evidence is judged on relevance and reliability, and reliability follows a predictable hierarchy: independent beats internal, direct observation beats inference, original beats copy. Quantity does not compensate for a weak source.

Audit evidence supports assertions, and its persuasiveness turns on two properties.

Relevance is whether the evidence addresses the assertion in question. This is where audits go quietly wrong. Examining a shipping document proves occurrence (the goods went out) but says nothing about completeness, whether other shipments went unrecorded. The direction of your test decides which assertion it can reach.

Reliability follows a hierarchy worth memorizing because it is stable. Evidence from independent external sources outranks internally generated evidence. Evidence you obtain directly outranks evidence obtained through the entity. Original documents outrank photocopies or scans. And evidence produced under effective internal control is more reliable than evidence from a weak environment.

The trap is thinking volume substitutes for quality. Fifty internally prepared schedules are not stronger than one confirmation received directly from a bank, and stacking weak evidence does not converge on strong evidence.

Confirmation requests information directly from a third party. Its characteristic failure is non-response, and your answer to that is not to give up but to apply alternative procedures, typically examining subsequent cash receipts and shipping or contract documentation. Note the difference in strength too. A positive confirmation asks for a reply either way, while a negative one asks for a reply only on disagreement, so silence proves far less.

Legal letters ask the entity's lawyers about litigation and claims. The failure here is a refused or limited response, and that is not a neutral outcome. A lawyer declining to respond on a material matter is itself a scope limitation with consequences for the opinion.

Specialists supply expertise you lack: valuation, actuarial work, geology. Using one does not transfer responsibility. You must evaluate the specialist's competence and objectivity and, the part most often skipped, the assumptions and methods used. A valuation is only as good as its inputs, and those inputs frequently come from management.

Rule: for each piece of evidence, name the assertion it supports and where it came from; if it came through the client's hands, ask what a motivated preparer could have changed. For third-party evidence, plan the failure case before sending the request — non-response, refusal, and unexamined assumptions each have a defined next step.

Sampling: two risks, and only one of them is dangerous

~2 min

Sampling accepts that a subset may not represent the population. Its two errors are not symmetric — concluding wrongly that a balance is fine threatens the opinion, while concluding wrongly that it is wrong only costs extra work.

The two errors have very different consequences. Incorrect acceptance, concluding a balance is fairly stated when it is not, is the dangerous one, because it leads to a wrong opinion. Incorrect rejection, concluding a balance is misstated when it is not, is an efficiency problem: more work, same eventual conclusion. Standards are calibrated around that asymmetry, which is why the acceptable risk of incorrect acceptance is set low.

Statistical sampling lets you measure the sampling risk; non-statistical sampling relies on judgment. Both are permitted, but only the first quantifies its own uncertainty.

Two selection ideas matter in practice. Stratification groups a population by size so large items get proportionally more attention. And you will often examine items above a chosen threshold 100% and remove them from the sampled population entirely. That recognizes that some items are individually significant and should not be left to chance.

Sampling risk is only half the exposure. Non-sampling risk, applying the wrong procedure or misinterpreting a result, is unaffected by sample size. A bigger sample does not cure a badly chosen test.

Concretely: AS 2315's own example. Sample every twentieth item — 50 of 1,000 — and find 3,000 dollars of overstatement. The projection is 60,000, the sample's error divided by the fraction sampled. Add whatever you found in the items examined in full, then compare the total with tolerable misstatement for the balance. The number that matters is 60,000, not 3,000.

Rule: project every sample error to the population before concluding, and treat an unexpected error rate as information about the population rather than an anomaly to set aside.

Testing by cycle, and the direction that decides the assertion

~2 min

Work is organized by transaction cycle, and within each the crucial choice is direction. Tracing forward from source documents tests completeness; vouching backward from the records tests occurrence. They are not interchangeable.

Audits are organized around cycles — revenue and receivables, purchases and payables, inventory, payroll, cash, and so on — because transactions of a kind share the same risks and the same controls.

Within any cycle, the single most useful idea is direction of testing.

Vouching starts with a recorded entry and works back to the supporting document. It answers: is what was recorded real? That is the occurrence (or existence) assertion, and it detects overstatement.

Tracing starts with a source document and works forward into the records. It answers: did everything that happened get recorded? That is completeness, and it detects understatement.

This is the idea that makes cycle work coherent. The same population and the same documents test opposite assertions depending on which end you start from. The classic application is the search for unrecorded liabilities. You examine payments made after the year end and ask whether each belonged to the prior period, because an unrecorded payable leaves no entry to vouch.

Analytical procedures complement this. You set an expectation first and then investigate the difference. A comparison without a prior expectation is not an analytical procedure; it is a description.

Rule: state which assertion you are testing before you pick a starting point — overstatement and understatement need opposite directions, and neither test finds the other's error.

Fraud: the professional-skepticism problem

~2 min

Fraud differs from error by intent and by concealment, which is why ordinary procedures may not find it. Standards respond with required skepticism, a discussion among the team, and specific procedures aimed at management override.

Fraud is distinguished from error by intent, and its practical consequence is concealment: someone is actively working to make the evidence look normal. That is why an audit designed only against error can miss it.

The conventional framing has three conditions: incentive or pressure, opportunity, and rationalization. Treat it as a risk-assessment aid rather than a proof. The presence of all three does not establish fraud, and their absence does not rule it out.

Two categories behave differently. Fraudulent financial reporting misstates the statements themselves, typically to meet expectations, and tends to come from higher in the organization. Misappropriation of assets is theft: usually smaller, more common, and often concealed by ordinary-looking entries.

The requirement that most defines the area is professional skepticism, an attitude that assumes neither dishonesty nor honesty. The standards make it concrete. Your team must discuss where the statements might be susceptible, and you must run specific procedures directed at management override of controls, since that risk is present in every audit and no control system can address it by design.

Concretely: AS 2401 says what a fraudulent entry tends to look like. It is posted to unrelated or seldom-used accounts, by someone who does not normally make entries, at period end or after closing with little or no explanation, or in round numbers. A controller's 400,000-dollar top-side credit to revenue on the last night of the quarter, described only as "adjustment", ticks four of the five. The standard's response is to select exactly such entries and examine their support.

Rule: when evidence is unexpectedly convenient, treat that as a reason to look harder rather than a reason to be reassured — convenience is what concealment produces.

The opinion, and what each modification actually says

~2 min

The report's wording is a code with defined meanings. The choice among unmodified, qualified, adverse and disclaimer turns on two questions: is the problem material, and is it pervasive.

An unmodified (unqualified) opinion states that the statements are fairly presented in all material respects. Modifications follow a two-axis test: how material is the problem, and how pervasive?

•

Qualified — a material problem confined to a specific area. "Except for" this, the statements are fair.

•

Adverse — a material and pervasive misstatement. The statements as a whole are not fairly presented.

•

Disclaimer — the auditor could not obtain sufficient evidence, and the limitation is pervasive. No opinion is expressed at all.

The distinction most often confused is adverse versus disclaimer. Adverse says the statements are wrong; disclaimer says I do not know. One is a conclusion, the other is the absence of one.

Emphasis and explanatory paragraphs do not modify the opinion. They draw attention to something properly presented, such as a substantial-doubt-about-going-concern disclosure. For issuer audits, critical audit matters communicate matters involving especially challenging or subjective auditor judgment, and they are not modifications either.

Completion work comes before all this: subsequent events, the evaluation of accumulated uncorrected misstatements, going-concern assessment, and management representations. Representations supplement evidence; never let them substitute for it.

Concretely: AS 3105's own example of a scope restriction is a physical inventory you could not observe. For a manufacturer, inventory is the significant item the standard itself names, so a count nobody witnessed or reconstructed by other means reaches the statements as a whole — disclaimer territory. For a software company with a few boxes of merchandise, the same failure is confined: "except for" that balance, the statements are fair. One missed procedure yields two different reports, decided by significance and pervasiveness.

Rule: decide materiality and pervasiveness before choosing report wording, and keep cannot determine separate from determined it is wrong — they lead to different reports.

Government auditing, and what gets added

~2 min

Government audits keep the financial-statement audit and add to it — compliance with laws and grant terms, and reporting on internal control. The standards also impose stricter independence and continuing-education requirements.

The Government Auditing Standards, issued by the Government Accountability Office and commonly called the Yellow Book, add three things in particular. The first is compliance: whether the entity followed the laws, regulations and grant terms attached to its funding, because a spend can be accurately recorded and still unauthorized. The second is reporting on internal control in a way the financial-statement audit alone does not require. The third is stricter independence and continuing-professional-education requirements than the baseline.

In a commercial audit you ask "is this recorded correctly?"; in a government audit, "was this permitted?" is a second question with its own procedures and its own report.

Independence analysis is also harder here, because you will often be asked to perform non-audit services for the same entity. The standards set out how to evaluate whether doing so impairs independence.

Concretely: a state agency buys forty laptops with federal grant money, records the purchase perfectly, and chose the vendor without the competitive bidding the grant terms required. A commercial audit finds nothing, because the expense is accurately stated. A government audit reports a compliance finding, because the second question has its own answer.

Rule: in a government engagement, keep the compliance question separate from the accuracy question — they have different evidence, different thresholds and different reports.

Start practicing Auditing & Attestation

See the full Auditing & Attestation curriculum

Browse all free study guides

Written by Keentune. We are not affiliated with or endorsed by the organizations whose documentation informs this guide, and any linked sources belong to their respective owners.

Also on your phone

App Store Google Play

All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.