ACCTG 163 – AUDITING THEORY (AT-3) -helpful in identifying the existence of unusual transactions,
events, amounts, ratios and trends that might indicate matters
3.0 Understanding the Entity and its Environment Including its
Internal Control and Assessing the Risks of Material Misstatement
3.1 Industry, regulatory and other external factors, including the
applicable financial reporting framework
3.1.1 Nature of the entity
3.1.2 Objectives and strategies and related business risks
3.1.3 Measurement and review of the entity's financial
performance
3.2 Internal control
3.2.1 Basic concepts and elements of internal control
3.2.2 Consideration of accounting and internal control systems
3.2.2.1 Understanding and documentation
3.2.2.2 Assessment of control risks
3.2.2.2.1 Test of controls
3.2.2.2.2 Documentation
3.3 Assessing the risks of material misstatement
3.3.1 Fraud and errors
3.3.2 Risk assessment procedures
3.3.3 Discussion among the engagement team
3.3.4 Significant risks that require special audit
consideration
3.3.5 Risks for which substantive procedures alone do
not provide sufficient appropriate audit evidence
3.3.6 Revision of risk assessment
3.4 Communicating with those charged with governance and
management
______________________________________________________
3.0 Understanding the Entity and its Environment Including its
Internal Control and Assessing the Risks of Material
Misstatement
PHASE I-C PERFORMANCE OF RISK ASSESSMENT PROCEDURES TO
IDENTIFY/ASSESS RISK OF MATERIAL MISSTATEMENT THROUGH
UNDERSTANDING THE ENTITY
PSA 315 Deals with the auditor’s responsibility to identify and
assess the risks of material misstatements in the FS, through
understanding of the entity and its environment, including its
internal control.
A. Risk assessment procedures and sources of information about
the entity and its environment, including its internal control
B. Understanding the entity and its environment, including its
internal control
C. Identifying and assessing of the risks of material misstatements
D. Material weakness in internal control
E. Documentation
I.RISK ASSESSMENT PROCEDURES AND SOURCES OF
INFORMATION ABOUT THE ENTITY AND ITS ENVIRONMENT,
INCLUDING ITS INTERNAL CONTROL
Risk assessment procedures:
-Audit procedures to obtain an understanding of the client. Some
of the information obtained may be used as audit evidence to
support assessments of the risks of material misstatements.
-The auditor may also obtain audit evidence about the classes of
transactions, account balances, or disclosures
-The auditor may choose to perform substantive procedures or
tests of control concurrently with risk assessment procedures to
be efficient.
Risk Assessment procedures:
 Inquiries of management and others within the entity
 Analytical procedures and
 Observation and inspection
Inquiries of Management and others within the entity
-about entity’s external legal counsel or valuation experts that the
entity has used
-reviewing information obtained from external sources such as
reports by analysts, banks, or rating agencies, trade and economic
journals, or regulatory or financial publications
-From management
-From those responsible for financial reporting
-From others within the firm (internal audit personnel, or
production)
-From other employees with different levels of authority
Analytical Procedures (PSA 520 “Analytical procedures – provides
additional guidance)
Auditing Theory Review Notes (AT-3) Page 1 of 13
which have FS and audit implications.
-the auditor develops expectations about plausible relationships
that are reasonably expected to exist. When comparison of those
expectations with recorded amounts or ratios yields unusual or
unexpected relationships, the auditor considers those results in
identifying risks of material misstatements
-often, such analytical procedures use data aggregated at a high
level. In such case, the auditor should consider the results of
analytical procedures along with other information gathered in
identifying the risks of material misstatement
Observation and Inspection
-supports inquiries of management and others
-provide information about the entity and its environment
Examples:
 Observation of entity activities and operations
 Inspection of documents, records and internal control
manuals
 Reading reports prepared by management (quarterly
management reports and interim financial statements)
 Reading reports prepared by those charged with
governance (minutes of board of directors’ meetings)
 Visits to entity’s premises and plant facilities
 Tracing transactions through the information system
relevant to financial reporting (walk-throughs)
Considerations
 Information about the entity obtained in prior periods
– auditor should determine whether changes have
occurred that may affect the relevance of such
information in the current audit, by audit procedures
such as walk-through of systems
 Auditor also considers other information obtained from
auditor’s client acceptance or continuance process
 Auditor also considers experience gained from other
engagements
 The members of the engagement team should discuss
the susceptibility of the entity’s FS to material
misstatements
3.1 Industry, regulatory and other external factors, including the
applicable financial reporting framework
3.1.1 Nature of the entity
3.1.2 Objectives and strategies and related business risks
3.1.3 Measurement and review of the entity's financial
performance
II. UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT
INCLUDING ITS INTERNAL CONTROL
Auditor’s understanding Consists of the ff:
A. Relevant industry, regulatory, and other external
factors including applicable financial reporting
framework
B. Nature of the entity, including:
a. Its operations
b. Its ownership and governance structure
c. The types of investments that the entity is
making and planning to make
d. The way that the entity is structured and
how it is financed
C. The entity’s selection and application of accounting
policies, including the reasons for any changes. The
accounting principles used should be evaluated if
appropriate for the business and if consistent with
applicable financial reporting framework and
accounting policies used in the relevant industry
D. The entity’s objectives and strategies, and those related
business risks that may result in risks of material
misstatements
E. The measurement and review of the entity’s financial
performance
A. Industry, regulatory, and other external factors
including applicable financial reporting framework
Factors include:
Industry conditions
- The market and competition, including demand, capacity and
price competition
-Cyclical or seasonal activity
-Product technology relating to entity’s products
-Energy supply and cost
Regulatory Environment
- Accounting principles and industry specific practices
- Regulatory framework for a regulated industry
-Legislation and regulations that significantly affect the entity’s
operations
-Regulatory requirements
-Direct supervisory activities
-Taxation (corporate and other)
-Government policies currently affecting the conduct of the
entity’s business
- Monetary controls (including foreign)
-Fiscal
-Financial incentives (government aid programs)
-Tariffs, trade restrictions
-Environmental requirements affecting the industry and the
entity’s business
Other External Factors
-General level of economic activity (recession, growth)
-Interest rates and availability of financing
-Inflation, currency revaluation
B. Nature of the Entity – refers to:
-Its operations
-Its ownership and governance structure
-The types of investments that the entity is making and planning
to make
-The way that the entity is structured and how it is financed
Understanding the nature of the client includes:
 Client’s competitive position
 Organizational structure
 Governance processes
 Accounting policies and procedures
 Ownership
 Capital structure
 Product lines
 Client’s business processes
Ex. For business processes of manufacturing company, auditors will
obtain an understanding of the ff:
 The processes used to procure, store and manage raw
materials
 The processes used to machine, assemble, package and
test products
 The processes used to create demand for products and
services and to manage relations with customers
 The processes used to establish contract terms and to
bill and collect receivables
 The processes used to take orders and deliver goods
 The activities performed after the goods and services
have been delivered (installation, training, warranty,
and customer service)
 The processes used to acquire and maintain human
resources and technology, including research and
development
*An understanding of the ownership and relations between
owners and other people or entities is also important in
determining whether related party transactions have been
identified and accounted for appropriately. PSA 550 “Related
Parties” provides additional guidance
C. Selection and Application of Accounting Policies
-Includes understanding of:
- The methods that the entity uses to account for
significant and unusual transactions
- Effect of significant accounting policies in controversial
or emerging areas for which there is lack of consensus
- Changes in accounting policies
Examples of matters that an auditor considers:
Business Operations
 Nature of revenue sources (manufacturer, wholesaler,
banking, insurance, other financial services, import/export
trading, utility, transport, and technology products and
services
Auditing Theory Review Notes (AT-3) Page 2 of 13
 Products or services and markets (major customers and
contracts, terms of payments, profit margins, market share,
competitors, exports, pricing policies, reputation of products,
warranties, order book, trends, marketing strategy and
objectives, manufacturing processes.
 Conduct of operations (stages and methods of production,
business segments, delivery of products and services, details
of declining or expanding operations)
 Alliances, joint ventures and outsourcing activities
 Involvement in electronic commerce, including internet sales
and marketing activities
 Geographic dispersion and industry segmentation
 Location of production facilities, warehouses and offices
 Key customers
 Important suppliers of goods and services (long term
contracts, stability of supply, terms of payment, imports,
methods of delivery such as just-in-time)
 Employment (location, supply, wage levels, union contracts,
pension and other post employment benefits, stock option,
incentive bonus arrangements, government regulation
related to employment matters)
 Research and development activities and expenditures
 Transactions with related parties
Investments
 Planned or recently executed acquisitions, mergers or
disposals of business activities
 Investments and dispositions of securities and loans
 Capital investment activities, including investments in
plant and equipment technology, and any recent or
planned changes
 Investments in non-consolidated entities, including
partnerships, joint ventures and special purpose
entities
Financing
 Group structure – major subsidiaries and associated
entities, including consolidated and non-consolidated
structures
 Debt structure, including covenants, restrictions,
guarantees, and off-statement of financial position
financing arrangements
 Leasing of property, plant or equipment for use in the
business
 Beneficial owners (local, foreign, business reputation
and experience)
 Related parties
 Use of derivative financial instruments
Financial reporting
 Accounting principles and industry-specific practices
 Revenue recognition practices
 Accounting for fair values
 Inventories (locations, quantities)
 Foreign currency assets, liabilities and transactions
 Industry-specific significant categories (loans and
investment for banks, accounts receivable and
inventory for manufacturers, research and
development for pharmaceuticals)
 Accounting for unusual or complex transactions
including those in controversial or emerging areas
(accounting for stock-based compensation)
 Financial statement presentation and disclosure
D. Objectives and Strategies and Related Business Risks
-The auditor should obtain an understanding of the entity’s
objectives and the related business risks that may result in material
misstatement of the FS.
-Strategies are the operational approach by which management
intends to achieve its objectives. Objectives are defined by the
entity’s management or those charged with governance as a
means to respond to factors surrounding the entity. Such factors
include industry, regulatory and other internal or external factors
affecting the conduct of business
-Business risks result from significant conditions, events,
circumstances, actions or inactions that could adversely affect the
entity’s ability to achieve its objectives and execute its strategies,
or through setting of inappropriate objectives and strategies.
-The conduct of the entity’s business is dynamic and its objectives
and strategies change over time.
Business risk:
-Is broader than the risk of material misstatement of the FS
-May arise from change or complexity
-May result from failure to recognize the need for change
Ex. Development of new products that fail or inadequate market
for new products
An understanding of business risks increases the likelihood of
identifying risks of material misstatements.
Significant risks that may be identified:
1. Risks related to competition
2. Changes in government regulations
3. Changes in technology
4. Volatility of raw material prices
5. Interruption of supplies of critical raw materials
6. Changes in major markets
7. Increases in interest rates
-Most business risks will eventually have financial consequences
and therefore have an effect on the FS. However, not all business
risks give rise to the risks of material misstatement.
-Usually management identifies business risks and develops
approaches to address them.
-Well-operated companies use formal processes for identifying
business risks and devising ways to mitigate them.
-Smaller firms often do not set their objectives and strategies or
manage the related business risks through formal plans or
processes.
-Some firms do not document such matters. In such cases, the
auditor obtains understanding the entity’s business risk, through
inquiries of management and observation of how the entity
responds to such matters.
Examples of matters to consider:
 Existence of objectives (how the entity addresses
industry, regulatory and other external factors relating
to:
> Industry developments (potential business risk may
be lack of personnel to deal with changes in the industry)
> New products and services (potential business risk is
increased product liability)
>Expansion of the business (underestimated demand)
> New accounting requirements (incomplete, improper
or increased cost of implementation)
> Regulatory requirements (increased legal exposure)
> Current and prospective financing requirements (loss
of financing due to non-payment)
>Use of IT (systems and processes are incompatible)
 Effects of implementing a strategy
> Any effects that will lead to new accounting
requirements (potential business risk is incomplete or
improper implementation
E. Measurement and Review of the Entity’s Financial
Performance
-The auditor should obtain an understanding of the measurement
and review of the entity’s financial performance.
-Performance measures, whether external or internal, creates
pressures on the entity that may motivate management to take
action to improve business performance or to deliberately
misstate the FS
-Obtaining an understanding of the entity’s performance measures
assists the auditor in considering whether such pressures result to
management actions that may have increased the risk of material
misstatements
Various performance measurement & review techniques (Internal):
 Budgets
 Key performance indicators
 Variance analysis
 Segment performance reports
 Scorecards (financial, customer, internal business
process and learning and growth of the entity)
 Comparison with performance of competitors
 Internal measures may highlight unexpected results or
trends requiring an inquiry to determine the cause and
for management to take corrective action.
Ex. Performance measures may indicate that the entity has
unusually rapid growth as compared to competitors. If combined
with performance-based incentives, it may indicate potential risk
of management bias in the preparation of FS.
-External parties such as bond rating agencies, credit agencies and
financial analysts may also measure and review the client’s
performance
-The methods of measuring and reviewing performance are
important to the auditors in determining the incentives of
Auditing Theory Review Notes (AT-3) Page 3 of 13
management and other employees because their compensation is
often tied to the measures (Performance-based incentives)
Examples of matters to consider:
 Key ratios and operating statistics
 Key performance indicators
 Employee performance measures and incentive
compensation policies
 Trends
 Use of forecasts, budgets and variance analysis
 Analyst reports and credit rating reports
 Competitor analysis
 Period-on-period financial performance (revenue
growth, profitability, leverage)
III. IDENTIFYING AND ASSESSING OF THE RISKS OF MATERIAL
MISSTATEMENTS
-The auditor should identify and assess the risks of material
misstatement at the financial statement level, and at the assertion
level for classes of transactions, account balances and disclosures:
The auditor shall:
1. Identify risks throughout the process of obtaining an
understanding of the entity and its environment, including relevant
controls that relate to the risks, and by considering classes of
transactions, account balance and disclosures in the FS
2. Relates the identified risks to what can go wrong at the assertion
level
3. Considers whether the risks are of a magnitude that could result
in a material misstatement of the FS, and
4. Considers the likelihood that the risks could result in a material
misstatement
Risk of material misstatement may be greater for risks relating to
significant non-routine transactions arising from:
 Greater management intervention to specify
accounting treatment
 Greater manual intervention for data collection and
processing
 Complex calculations or accounting principles
 The nature of non-routine transactions, which make it
difficult for the entity to implement effective controls
over the risks
Risk of material misstatement may be greater for risks relating to
significant judgemental matters that require the development of
accounting estimates:
 Accounting principles for accounting estimates or
revenue recognition subject to different interpretations
 Required judgement may be subjective, complex, or
require assumptions about the effects of future events.
Ex. Fair value
 Conditions and events that may indicate risks of
material misstatements:
 Operations in regions that are economically unstable,
such as countries with significant currency devaluation
or highly inflationary economies
 Operations exposed to volatile markets, ex. Futures
trading
 High degree of complex regulation
 Going concern and liquidity issues including loss of
significant customers
 Constraints on the availability of capital and credit
 Changes in the industry in which the entity operates
 Changes in the supply chain
 Developing or offering new products or services or
moving into new lines of business
 Expanding into new locations
 Changes in the entity such as large acquisitions or
reorganizations or other unusual events
 Entities or business segments likely to be sold
 Complex alliances and joint ventures
 Use of off-balance sheet finance, special purpose
entities and other complex financing arrangements
 Significant transactions with related parties
 Lack of personnel with appropriate accounting and
financial reporting skills
 Changes in key personnel including departure or key
executives
 Weakness in internal control, especially those not
addressed by management
 Inconsistencies between the entity’s IT strategy and its
business strategies
 Changes in the IT environment
  Installation of significant new IT systems related to
financial reporting
 Inquiries into the entity’s operations or financial results
by regulatory or government bodies
 Past misstatements, history of errors or a significant
amount of adjustments at period end
 Significant amount of non-routine or non-systematic
transactions including intercompany transactions and
large revenue transactions at period end
 Transactions that are recorded based on
management’s intent, ex. Debt refinancing, assets to be
sold and classification of marketable securities
 Application of new accounting pronouncements
 Accounting measurements that involve complex
processes
 Events or transactions that involve significant
measurement uncertainty, including accounting
estimates
 Pending litigation and contingent liabilities, ex. Sales
warranties, financial guarantees and environmental
remediation
IV. MATERIAL WEAKNESS IN INTERNAL CONTROL
The auditor shall evaluate whether, on the basis of audit work
performed, the auditor has identified a material weakness in the
design, implementation or maintenance of internal control.
The auditor shall communicate material weakness in internal
control identified, to management (at an appropriate level of
responsibility) on a timely basis.
PSA 260 “Communication with Those Charged with Governance”
The types of material weakness in internal control:
-Risks of material misstatements that the auditor identifies and
which the entity has not controlled, or for which relevant control
is inadequate
-A weakness in the entity’s risk assessment process that the
auditor identifies as material, or the absence of a risk assessment
process in those cases where it would be appropriate for one to
have been established.
Material weaknesses may also be identified, in controls that
prevent, or detect and correct error, or those to prevent and
detect fraud
V. DOCUMENTATION
The auditor should document:
a. The discussion among the engagement team regarding the
susceptibility of the entity’s FS to material misstatement due to
error or fraud and the significant decisions reached.
b. Key elements of the understanding obtained regarding each of
the aspects of the entity and its environment, including each of the
internal control components, to assess the risks of material
misstatements of the FS, the sources of information from which
the understanding was obtained, and the risk assessment
procedures
c. The identified and assessed risks of material misstatement at the
FS level and at assertion level
d. The risks identified and related controls evaluated
Documentation may take the form of narrative descriptions,
questionnaires, check lists, flow charts, memorandum.
The more extensive the audit procedures, the more extensive the
auditor’s documentation will be.
PSA 230 “Audit Documentation” provides guidance regarding
documentation related to audit of FS
ASSESSING INHERENT RISK AND CONTROL RISK AT THE
ASSERTION LEVEL
-Auditors considers factors that affect the risk of material
misstatements at the FS level and at the assertion level
- Auditors test the validity of the FS assertions that
related to classes of transactions, account balances and
disclosures.
- At the assertion level, a misstatement is material if it
exceeds the tolerable misstatement specified for the
assertion.
The risk that the FS assertion is materially misstated is referred to
as “Risk of the Assertion Level”
Audit risk refers to the possibility that the auditors fail to
appropriately modify their opinions on FS that are materially
misstated. Since audit involves gathering of evidence for each
Auditing Theory Review Notes (AT-3) Page 4 of 13
material FS assertion, audit risk can also be examined at that level.
For each FS account, audit risk consists of the possibility that:
1. A material misstatement in an assertion about the
account has occured
2. The auditors do not detect the misstatement.
The risk of occurrence of material misstatement may be separated
into two components – inherent risk and control risk.
1. Inherent risk – the susceptibility of an account balance, class of
transactions or disclosures to misstatements that could be
material, individually or when aggregated with misstatements in
other balances or classes, assuming there are no related internal
controls
2. Control risk – the risk that a misstatement could occur in an
account balance, or class of transaction that could be material,
individually or when aggregated with misstatements in other
balances of classes, will not be prevented or detected and
corrected on a timely basis by the accounting and internal control
system
3. Detection risk – the risk that an auditor’s substantive procedures
will not detect a misstatement that exists in an account balance or
class of transactions that could be material, individually or when
aggregated
Audit Risk Model: Audit risk = Inherent risk x Control Risk x
Detection risk
1. Inherent risk
Complex computations for pensions and leases are more likely to
contain errors, than simple computations of straight-line
depreciation
Accounts differ in their susceptibility to loss, theft and fraud. Cash
is more likely to be stolen than plant assets. And inventories are
more likely subject to decline in value than tangible assets.
To assess inherent risk, the auditor uses professional judgement to
evaluate ff. factors
At the FS level
 Integrity of management
 Management experience and knowledge, changes in
management during the period (inexperience of
management may affect preparation of the FS of the
entity
 Unusual pressures on management or circumstances
that might predispose management to misstate the FS
(experiencing large business failures within the industry
or lack of sufficient capital to continue business
operations
 Nature of the entity’s business, ex. Potential for
technology obsolescence of its products and services
and the complexity of its capital structure, significance
of related parties and the number of locations and
geographical spread of its production facilities.
 Factors affecting the industry in which the entity
operates ex. Economic and competitive conditions as
identified by financial trends and ratios, and changes in
technology, consumer demand and accounting
practices common to the industry
At the account balance and class of transactions level
 FS accounts likely to be susceptible to misstatement ex.
Accounts which required adjustment in the prior period
which involve a high degree of estimation such as
inventories, related party transactions, intangibles
 The complexity of underlying transactions and other
events which might require using the work of an expert
 The degree of judgement involved in determining
account balances ex. Contingent liabilities
 Susceptibility of assets to loss or misappropriations ex.
Assets which are highly desirable and movable such as
cash
 The completion of unusual and complex transactions,
particularly at or near period end
 Transactions not subjected to ordinary processing
Client’s characteristics and industry:
>Inconsistent profitability relative to the industry
>Operating results that are highly sensitive to economic factors
>Going concern problems
>Large known and likely misstatements detected in prior audits
<Substantial turnover, questionable reputation or inadequate
accounting skills of management
Assertions with high inherent risk:
>Transactions or balances that are difficult to audit
>Complex calculations
>Difficult account accounting issues
>Significant judgement
>Valuations that vary significantly based on economic factors
2. Control Risk- The risk that a material error in an account will not
be prevented or detected on a timely basis by the client’s system
of internal control.
-Can never be zero because internal control systems cannot
provide absolute assurance that all material errors will be
prevented or detected.
-To assess control risk, auditors study the methods and procedures
by which the company controls its accounting process.
-If accounting procedures are well designed and consistently
followed, the FS will be accurate and complete.
-An effective internal control structure promotes reliability in the
accounting data.
-Errors are quickly and automatically brought to light by built-in
proofs and cross-checks that are in the system.
-If the auditors find that the client has designed effective internal
control for a particular account and that prescribed practices are
being consistently followed, they will assess control risk to be low,
and can accept a higher level of detection risk
Preliminary Assessment of Control Risk
-process of evaluating the effectiveness of the entity’s accounting
and internal control systems
-after obtaining an understanding of the accounting and internal
control systems, the auditor should make a preliminary
assessment of control risk, at the assertion level, for each material
account balance or class of transactions
Control risk is assessed as high if:
a) The entity’s accounting and internal control systems
are not effective
b) Evaluating the effectiveness of the entity’s accounting
and internal control systems would not be efficient
c) The auditor is not able to identify controls relevant to
the assertion which are likely to prevent or detect and
correct a material misstatement
d) The auditor does not plan to perform tests of control to
support the assessment
Documentation of Understanding and Assessment of Control Risk
-The auditor should document in the working papers:
a) The understanding obtained of the entity’s accounting
and internal control system
b) Assessment of control risk. When control risk is
assessed at less than high, document the basis for
conclusions
3. Detection Risk
-the risk that the auditor’s examination will not detect a material
error in an account balance.
-this is a function of the effectiveness of the auditor’s verification
of account balances and is influenced by the nature, timing and
extent of auditor’s procedures.
-In estimating the detection risk, the auditor should consider the
likelihood that he would make an error, such as misinterpreting
the evidence obtained or misapplying an audit procedure
-the level of detection risk is directly related to the auditor’s
substantive procedures.
-The auditor’s control risk assessment together with the inherent
risk assessment, influences the nature, timing and extent of
substantive procedures to reduce detection risk and audit risk to
an acceptably low level.
-If evidence is mostly persuasive than conclusive, then detection
risk will be present, even if the auditor examines 100% of the
account balances or class of transactions
Considerations:
a) Nature of substantive procedures, ex. Using tests
directed toward independent parties outside the entity,
rather than tests directed towards parties or
documentation within the entity or using tests of details
for a particular audit objective in addition to analytical
procedures
b) Timing of substantive procedures ex. Performing them
at period end rather than at an earlier date
c) Extent of substantive procedures ex. Using larger
sample size
There is an inverse relationship between detection risk that the
auditor can accept for an account and the inherent and control risk
Auditing Theory Review Notes (AT-3) Page 5 of 13
for the account. When inherent risk and control risk are high, then
detection risk should be reduced and vice versa
Detection risk is controllable by the auditor while inherent and
control risks relate to the client’s circumstances
When the auditor determines that detection risk regarding an FS
assertion for a material account balance or class of transactions
cannot be reduced to an acceptable level, then the auditor should
express a qualified opinion or a disclaimer of opinion
Using the Audit Risk Model to determine the nature, timing and
extent of audit procedures
Audit risk= Inherent risk x Control Risk x Detection risk or AR = IR
x CR x DR
Steps in the audit risk model:
Step 1 –Determined planned audit risk
Step 2 –Assess inherent risk
Step 3 –Assess control risk
Step 4 –Determine allowable detection risk
Step 1- Determine planned audit risk
-the auditor should plan the audit risk for each FS assertion, so that
he will be able to express an opinion on the FS taken as a whole
with an appropriate low level of audit risk.
-in assessing planned or acceptable audit risk (AAR), the auditor
must assess the ff. factors:
1. External user’s reliance on FS – by examining the FS,
including footnotes, reading minutes of meeting of BOD
to determine future plans
2. Likelihood of financial difficulties – by analyzing the FS
for financial difficulties using ratios and other analytical
procedures, and examine historical and projected cash
flow statements for the nature of cash inflows and
outflows
3. Management integrity – by obtaining information from
local attorneys, other CPAs, banks, predecessor auditor
Step 2- Assess inherent risk
-the auditor attempts to predict where misstatements are most
likely to exist in the FS segments
-at the start of the audit, there is not much that can be done to
change inherent risk so that the auditor must assess the factors
resulting to inherent risk and modify audit evidence procedures
Factors to consider in assessing inherent risk:
1. Nature of client’s business – ex. Greater likelihood of
obsolete inventory for an electronics manufacturer
than for a steel fabricators
2. Integrity of management – greater likelihood of
misstatements if management lacks integrity
3. Client motivation – ex. Greater tendency of
misstatements if management receives a percentage of
profits as a bonus
4. Results of previous audits – Ex. If misstatements found
in the previous year’s audit have a high likelihood of
occurring again.
5. Initial versus Repeat engagement – ex. lack of previous
year’s audit results would cause auditors to use a larger
inherent risk for initial audits than for repeat
engagements in which no material misstatements had
been found
6. Related parties – ex. transactions between parent and
subsidiaries or those between management and
corporate entity, are transactions that do not occur at
arm’s length
7. Non-routine transactions – ex. where the client lacks
experience in recording them.
8. Susceptibility to defalcation – ex. likelihood of
converting company asset to personal use
9. Judgement required to correctly record account
balances and transactions – ex. for account balances
which is subject to estimates or a great deal of
management judgement. Allowances for probable
losses, uncollectible accounts, liability for warranties
10. Make-up of Population of accounts or transactions –
composition of the total population ex. If accounts
receivable are mostly overdue
Generally auditors assess inherent risk conservatively at more than
50%. If there is reasonable possibility of significant misstatements,
then at 100%
Inherent risk (high), detection risk should be (low), planned audit
procedures (high)
Step 3- Assess control risk
If after the auditor obtains understanding of internal controls, and
concludes that:
Internal controls are ineffective, auditor sets a high (100%),
maximum risk for control risk.
Before auditor can set control risk at less than 100%, the auditor
should:
1. Obtain an understanding of internal control
2. Evaluate how well it should function based on understanding
3. Test internal controls for effectiveness.
Step 4- Determine Allowable Detection Risk
Allowable detection risk or planned detection risk is the amount of
risk the auditor can allow for an assertion or measure of the risk
that audit evidence for a segment will fail to detect misstatements
exceeding a tolerable amount.
Planned detection risk is:
a) Dependent on three factors in the model
b) Determines the amount of substantial evidence that
the auditor plans to accumulate, inversely with the size
of planned detection risk
Planned detection risk (PDR)
PDR = AAR .
IR x CR
AAR=acceptable audit risk
Ex. Auditor Taylor Sweep is willing to accept a 5% risk that
existence of sales will be materiality misstated after she completes
the audit for a client, Roses, Inc. In her understanding of current
conditions, she assesses inherent risk at 60% and control risk at
40%.
PDR = .05 . specific control procedures.
0.6 x 0.4
PDR = .208 or 21% (rounded off)
-The assessed levels of inherent and control risk cannot be
sufficiently low to eliminate the need for the auditor to perform
any substantive procedures.
-Regardless of the assessed level of inherent and control risk, the
auditor should perform some substantive procedures for material
account balances and classes of transactions
-Once the auditor has accumulated evidence regarding an
assertion, he can use the audit risk model to evaluate whether the
accumulated evidence is adequate.
-The auditor would use to audit risk model to compute for the
achieved audit risk (AcAR) which would be compared with the
planned audit risk. When achieved audit risk is less than or equal
to planned audit risk, then the evidence accumulated for the
assertion is sufficient
AcAR = IR x CR AcDR
AcDR=Achieved detection Risk
Research indicates that the formula is not appropriate to be used
in calculating achieved audit risk. However, the relationships in the
formula are valid and should be used in practice. Based on the
formula, there are 3 ways to reduce achieved audit risk to an
acceptable level:
1. Reduce inherent risk – inherent risk is assessed by the auditor
based on client’s circumstances and is done during planning, and
is typically not changed unless new facts are uncovered in the
course of audit
2. Reduce control risk – assessed control risk is affected by the
client’s internal controls and tests of those controls. Auditor’s can
reduce the risk by more extensive tests of controls if the client has
effective controls
3. Reduce achieved detection risk by increasing substantive audit
tests – additional audit procedures, assuming they are effective,
and larger sample sizes, both reduce achieved detection risk
3.2 Internal control
3.2.1 Basic concepts and elements of internal control
3.2.2 Consideration of accounting and internal control systems
3.2.2.1 Understanding and documentation
3.2.2.2 Assessment of control risks
3.2.2.2.1 Test of controls
3.2.2.2.2 Documentation
OBJECTIVES OF INTERNAL CONTROL (BASED ON PSA 315)
-PSA 315 defines internal control as the process designed and
effected by those charged with governance, management and
other personnel to provide reasonable assurance about the
achievement of the entity’s objectives with regard to reliability of
financial reporting, effectiveness and efficiency of operations and
compliance with applicable laws and regulations.
Auditing Theory Review Notes (AT-3) Page 6 of 13
Objectives
1. Reliability of entity’s financial reporting
2. Effectiveness and efficiency of operations
3. Compliance with applicable laws and regulations
Internal Control System
- All policies and procedures (internal controls) adopted by
management to assist in achieving management’s objective of
ensuring the orderly and efficient conduct of it’s business,
including adherence to management policies, safeguarding of
assets, prevention and detection of fraud and error, the accuracy
and completeness of accounting records and the timely
preparation of reliable financial information.
Elements:
a. Control environment
b. Entity’s risk assessment process
c. Information system (including related business
processes relevant to financial reporting and
communication)
d. Control activities
e. Monitoring of controls
A.CONTROL ENVIRONMENT
- The overall attitude, awareness and actions of directors
and management regarding the internal control system
and its importance to the entity
- Has an effect on the effectiveness of specific control
processes.
Ex. A strong control environment with tight budgetary controls and
an effective internal audit function can significantly complement
Factors comprising the control environment:
1.Communication and Enforcement of Integrity and Ethical Values
– includes mngt’s actions to remove or reduce incentives and
temptations that might prompt personnel to engage in dishonest,
illegal or unethical acts
2. Commitment to Competence – makes sure to hire and assign
competent employees
3. Participation by those charged with governance – their
independence from mngt, experience, oversight over reviewing
effectiveness of internal control and dealing with whistleblowers
4. Management’s Philosophy and Operating Style- attitude
towards business risk, financial reporting and meeting budget,
profit and established goals
5. Organizational Structure – provides overall framework for
planning, directing and controlling operations
6. Assignment of Authority and Responsibility – clear
understanding of roles and responsibilities, business practices,
code of conduct
7. Human Resources Policies and Procedures – adequate personnel
policies enhance likelihood that the client’s policies and
procedures will be followed
B. ENTITY’S RISK ASSESSMENT PROCESS
Risk assessment
- Process of identifying and responding to business risks
- For financial reporting purposes, risk assessment
process includes identification, analysis and
management of risks pertaining to preparation of FS
- Management may initiate plans, programs or actions to address
specific risks
Risk can arise or change due to circumstances:
 Changes in operating environment – can result in
changes in competitive pressures
 New personnel – may have different focus on or
understanding of internal control
 New or revamped information systems – significant and
rapid changes can change risk relating to internal
control
 Rapid growth – can strain controls and increase risk in
breakdown in controls
 New technology-if incorporated into production
processes or information systems,may change the risks
associated with internal control
 New business models, products or activities – new
areas where entity has little experience may introduce
new risks
 Corporate restructuring – may be accompanied by staff
reductions and changes in supervision and segregation
of duties that may change the risk in internal control
  Expanded foreign operations – foreign operations
carries new and unique risks ex. Risks in foreign
currency transactions
 New accounting pronouncements- may affect risk in
preparing FS
C. INFORMATION SYSTEM, INCLUDING BUSINESS PROCESSES
RELEVANT TO FINANCIAL REPORTING AND COMMUNICATION
Information systems consists of procedures and records designed
and established to:
 Initiate, record, process and report entity transactions
and to maintain accountability for related assets,
liabilities and equity
 Resolve incorrect processing of transactions ex.
Automated suspense files and procedures followed to
clear suspense items out on a timely basis (temporary
accounts used)
 Process and account for system overrides or bypasses
to controls
 Transfer information from transaction processing
systems to the general ledger
 Capture information relevant to financial reporting for
events and conditions other than transactions such as
the depreciation and amortization of assets and
changes in the recoverability of accounts receivable
(allowances)
 Ensure information required to be disclosed by the
applicable financial reporting framework is
accumulated, recorded, processed, summarized and
appropriately reported in the FS
Journal Entries
- An entity’s information system typically includes the
use of standard journal entries required on a recurring
basis ex. Sales, purchases, cash disbursements, loans
collection, automated period end entries, etc
- Non standard journal entries are used to record non-
recurring, unusual transactions or adjustments
- When automated procedures are used to maintain the
GL and prepare FS, such entries exist only in electronic
form and are more easily identified using computer
assisted audit techniques
Related Business Processes
-activities designed to:
 Develop, purchase, produce, sell and distribute an
entity’s products and services
 Ensure compliance with laws and regulations
 Record information, including accounting and financial
reporting information
Business processes
-result in the transactions that are recorded, processed and
reported by the information system
-Obtaining an understanding of the entity’s business processes,
which include how transactions are originated, assists the auditor
obtain an understanding of the entity’s information system
relevant to financial reporting
Information system encompasses methods and records that:
 Identify and record all valid transactions
 Describe on a timely basis the transactions in sufficient
detail to permit proper classification of transactions for
financial reporting
 Measure the value of transactions in a manner that
permits recording their monetary value in the FS
 Determine the time period in which transactions
occurred to permit recording of transactions in the
proper accounting period
 Present properly the transactions and related
disclosures in the FS
Communication
-involves providing an understanding of individual roles and
responsibilities pertaining to internal control over financial
reporting.
-includes extent to which personnel understand how their
activities in the financial reporting system relate to the work of
others and the means of reporting exceptions to an appropriate
higher level within the entity.
-May be in the form such as policy, manuals, accounting and
financial reporting manuals, and memoranda.
D. CONTROL ACTIVITIES
-policies and procedures that help ensure that management
directives are carried out
Auditing Theory Review Notes (AT-3) Page 7 of 13
-are applied at various organizational and functional level, whether
within IT or manual systems
Major Categories of Control Procedures:
A. Performance review
B. Information Processing Controls
1. Proper authorization of transactions and
activities
2. Segregation of duties
3. Adequate documents and records
4. Safeguards over access to assets
5. Independent checks on performance
C. Physical Controls
A.Performance review -management accounting and operating
data to assess performance
Ex. 1. Comparison of actual performance with budgets, forecasts,
prior period performance, or competitor’s data or tracking major
initiatives such as cost-containment or cost-reduction programs to
measure the extent to which targets are being met
2. Investigating performance indicators based on operating or
financial data such as quantity or purchase price variances or
percentage of returns to total orders
3. Reviewing functional or activity performance, such as relating
the performance of a manager responsible for a bank’s consumer
loans with some standard, such as economic statistics or targets
B. Information Processing Controls
Control Activities related to proper processing
1. Proper authorization of transactions and activities
2. Segregation of duties
3. Design and use of adequate documents and records
4. Access to assets
5. Independent checks on performance
Control Activities related to proper processing
1.Proper authorization of transactions and activities
–authorization for execution of transactions flows from the
stockholders to management and its subordinates.
-before a transaction is entered into, certain conditions must be
met
-as part of evaluation of the transaction, documentation will be
created
-auditor uses the documentation to determine whether
transactions are properly authorized.
-Ex. Purchase of inventory may create a purchase order, receiving
report and vendor invoice.
-The auditor should compare these documents and compare them
with company policy to be satisfied that the transaction was
authorized and executed in accordance with company policies
2. Segregation of Duties
-No one person should be assigned duties that would allow that
person to commit an error or perpetuate fraud and conceal the
error or fraud
-Ex. Same person should not be responsible for recording the cash
received on account and posting the receipts to the accounting
records
3. Adequate documents and records
-allows the company to obtain reasonable assurance that all valid
transactions are recorded
4. Access to assets
-assets can be protected by establishment of physical barriers and
appropriate policies
-Ex. Inventories kept in a storeroom, negotiable instruments kept
in safety deposit box.
-appropriate policies are adopted so that only authorized persons
have access to company assets.
-entity should design their internal accounting control system so
that documents authorizing the movement of assets in or out of
an organization are adequately controlled
5. Independent checks on performance
-procedures that periodically compare the actual asset with its
recorded balance
-Ex. Inventory count, cash count, monthly bank reconciliation
General controls
– are control activities that prevent or detect errors and
irregularities for all accounting systems.
- Affect all transaction cycles and apply to information processing
as a center, hardware and systems software acquisitions and
maintenance and back-up and recovery procedures
Application controls
-controls that pertains to the processing of a specific type of
transactions, such as payroll, sales and collections.
-help ensures that transactions occurred, are authorized and are
completely and accurately recorded and processed.
- Ex. Checking the arithmetical accuracy of records, maintaining
and reviewing accounts and trial balances, automated controls
such as input data and numerical sequence checks, manual follow
up of exception reports
General IT controls
-policies and procedures that relate to many applications and
support the effective functioning of application controls by helping
to ensure the continues proper operation of information systems
-include controls over data center and network operations,
systems software acquisitions, change and maintenance, access
security, and application system acquisition development and
maintenance
-Apply to mainframe, miniframe and end-user environments
-Ex. Program change controls, controls that restrict access to
programs or data, controls over implementation of new releases
of packaged software applications, and controls over system
software that restrict access to or monitor the use of system
utilities that could change financial data or records without leaving
an audit trail
Internal controls relating to the accounting system are concerned
with achieving objectives such as:
 Transactions are executed in accordance with
management’s general or specific authorization
 All transactions and other events are promptly
recorded in the correct amount, in the appropriate
accounts in the proper accounting period
 Access to assets and records is permitted only in
accordance with management’s authorization
 Recorded assets are compared with the existing assets
at reasonable intervals and appropriate action is taken
regarding any differences
C. Physical controls
 Physical security of assets, including adequate
safeguards, such as secured facilities over access to
assets and records
 Authorization for access to computer programs and
data files
 The periodic counting and comparisons with amounts
shown on control records
E. MONITORING OF CONTROLS
- Process used to assess the quality of internal control
over time.
- Assessing the design and operations of controls on a
timely basis and taking corrective actions as necessary
- Controls are monitored to consider whether they are
operating as intended and to modify as appropriate
- Internal auditors evaluate the design and operation of
internal control and communicate information about
strengths and weaknesses and recommendations for
improving internal control
- Include communications from external parties such as
customers, bank regulators and other auditors
- Ex. Customers corroborate sales data by paying their
bills or complaining about their charges
OBJECTIVE OF THE STUDY OF INTERNAL CONTROL
-the auditor should obtain an understanding of the accounting and
internal control systems sufficient to plan the audit and develop an
effective audit approach
-the auditor should use professional judgement to assess audit risk
and to design audit procedures to ensure risk is reduced to an
acceptable level
The auditor’s understanding of internal control provides basis for
1. Planning the audit
2. Assessing control risk
In planning an audit, the auditor develops a preliminary audit
strategy for each FS assertion based on their understanding of
internal control
In assessing control risk, the auditor considers the design of
controls and their effectiveness. Design refers to controls that have
been established. Effectiveness refers to how the controls function
To assess control risk below maximum, the auditor should identify
specific controls relevant to each assertion, that are likely to
prevent or detect material misstatements in those assertions
Auditing Theory Review Notes (AT-3) Page 8 of 13
To evaluate the effectiveness of controls established, the auditor
performs tests to determine that they are being applied
STAGES OF STUDY AND EVALUATION OF INTERNAL CONTROL
A. Obtaining an understanding of the entity’s internal
control structure
B. Assessing the preliminary level of control risk
C. Obtaining evidential matter to support the assessed
level of control risk
D. Evaluating the results of evidential matter
E. Determining the necessary level of detection risk
A. Obtaining an understanding of the entity’s internal control
structure
The auditor should obtain an understanding about:
1. Control environment – Mgnt/BOD’s attitude,
awareness and actions in the control environment
2. Control Procedures – presence or absence of control
procedures
3. Accounting and Internal Control - auditor determines:
a. Major classes of transactions
b. How transactions are initiated
c. Nature & existence of accounting records
d. How transactions are processed from
initiation to completion
e. Nature and details of financial reporting
process followed.
– Understanding is accomplished and documented by a narrative
description or by flowcharting or by transaction walk-through
The nature, timing and extent of the procedures performed by the
auditor to obtain understanding of accounting & internal control
system will depend on:
 Size and complexity of entity and its computer system
 Materiality consideration
 Type of internal controls involved
 Nature of entity’s documentation of specific internal
controls
 Auditor’s assessment of inherent risk
Auditor’s understanding is supplemented by conducting:
a) Inquiring of appropriate management, supervisory and
other personnel at various organizational levels, along
with reference to documentations such as procedures
manuals, job descriptions and flow charts
b) Inspection of documents and records produced by
accounting and internal control systems
c) Observation of the entity’s activities and operations,
including organization of computer operations,
management personnel and nature of transaction
processing
DOCUMENTATION OF UNDERSTANDING
1. Internal Accounting Control Questionnaire
-contains a series of questions designed to detect control
weaknesses. Most questionnaires are designed to yield “yes” or
“no” or “not applicable” answers to the questions.
-A “yes” indicates a satisfactory degree of internal accounting
control
-A “no” indicates a possible weakness in control or at least
indicates that further investigation is required.
-When negative answers do indicate a weakness in a control, they
should be completed on a separate weakness investigation work
sheet, which should include a description of the possible effects of
the weakness and indication whether such effects could lead to
material errors
-If the weakness is material, it should be reported to senior
management, BOD and audit committee
Advantages:
1. Provides audit assurance that attention is given to
presence or absence of controls listed and certain
features of the system are not overlooked
2. Provide a means obtaining uniform documentation of
internal control system reviewed
3. Provide inexperienced audit staff members with
guidance in performing internal control reviews
4. Facilitates the early detection of potential weakness in
the system
Disadvantages:
1. Auditor may view the questionnaire device for
accomplishing an automatic evaluation of internal
control
2. Controls listed on questionnaires may not suit the
particular circumstances of a specific audit
 3. The auditor may overlook pertinent control not
included in the questionnaires
2. Flow Charts
-a symbolic diagram of a specific part of an internal accounting
control system, including the sequential flow of data/authority.
-an internal control flowchart uses standardized symbols,
interconnecting lines and annotations to represent information,
documents and document flow.
-provides a pictorial view of a client’s internal control activities
-illustrates the interaction of individuals, records, and controls
related to a particular department or class of transactions.
-reflect the segmentation of duties by using a column across the
top to reflect different departments and the flow of documents
from left to right
-reflect all operations, movements, delays and filing procedures
associated with whatever is being charted and also indicates
conversion of source documents into accounting information
(journal, ledger, computer-generated document)
Guide in preparing flowcharts
 Standardized symbols – auditors should use a uniform
set of symbols developed by the American National
Standards Institute (ANSI)
 Flowlines – the flow of documents should be from top
to bottom and left to right. Arrowheads may used on all
lines and should be used when flow is not standard or
is bi-directional
 Documents – when a document is created, its source
should be indicated. Multiple-document symbols are
required when multiple copies of the document are
prepared. The disposition of every copy of each
document should be shown
 Processing – processing symbols are used to identify
any procedures applied to documents such as their
being filled
 Annotations – Comments and explanations should be
used to make the flowchart easier to understand and
more complete
Guidelines in preparing a flowchart:
1. Determine the class of transactions or transaction cycle
to be flowcharted
2. Obtain an understanding of internal control by making
inquiries of client personnel, observing employee
activities and examining documents, records, and
policies and procedures
3. Organize the flowchart into columns, using different
columns for each department, function or individual.
Draw a sketch of the flowchart
4. Draw the flowchart and insert comments and
annotations
5. Test the flowchart for completeness by following a few
transactions through the chart
Advantages:
1. Easily understood – visual description which is
supported by a written narrative
2. Better overall picture of a complex system
3. Parallels with EDP (electronic data processing)
documentation – EDP systems are commonly
documented with flowcharts which make it easier for
EDP purchase personnel to relate to auditors
4. Easy to update
Disadvantages:
1. Higher level of knowledge and training are required to
prepare a good flowchart of a complex system
2. Flowcharts take more time to prepare
3. It is more difficult to spot internal control weakness
3. Narrative Description
-a written description of a particular phase or phases for a control
system
-If systems are extensive/complex, separate narratives may be
prepared for smaller groups of controls which relate to specific
classes of transactions or accounts.
-Some auditors prepare narrative descriptions to accompany
internal control questionnaires or flow charts in order to provide
information not otherwise included
Advantages:
1. Narrative is flexible and may be tailor-made for the
engagement
2. Requires a detailed analysis and thus forces the auditor
to understand the functioning of the system
Disadvantages:
Auditing Theory Review Notes (AT-3) Page 9 of 13
1. Auditor may not have the ability to describe the system
correctly & concisely
2. This may require more time and careful study
3. Auditor may overlook important portions of internal
control system
4. A poorly written internal accounting control narrative
can lead to a misunderstanding of the system, thus
resulting in the improper design and application of
compliance tests
4. Internal Control Checklist
-detailed enumeration of the methods and practices which
characterize good internal control or of an item to be considered
in reviewing internal control
-is only a guide in reviewing the internal control and does not
represent a record of the auditor’s findings
- This tool is used together with the narrative approach
5. Decision Tables
-the system is depicted points
-advantages and disadvantages are similar to the flowchart
approach
B. Assessing the Preliminary Level of Control Risk
-after obtaining an understanding of the accounting and internal
control system, the auditor should make a preliminary assessment
of control risk at the assertion level for each material account
balance or class of transactions
Preliminary assessment of control risk
-Process where the auditor evaluates the effectiveness of the
client’s internal control policies and procedures in preventing or
detecting material misstatements in the FS assertions
Assessing control risk at below the maximum level involves:
1. Identifying specific internal control structure policies
and procedures relevant to specific assertions that are
likely to prevent or detect material misstatements in
those assertions
2. Performing tests of controls to evaluate the
effectiveness of such policies and procedures
Identification of Specific Internal Control policies to specific
assertions
Controls that enhance the reliability of the FS:
1. Preventive Controls – avoids errors and irregularities
2. Detection Controls – recognizes that errors will occur
even under ideal conditions and provides for double-
checking to locate significant occurrences
Considerations:
-internal control policies and procedures can have either a
pervasive effect on many assertions or specific effect on an
individual assertion
-the control environment and accounting system often have a
pervasive effect on a number of account balances or classes of
transactions
Ex. The conclusion that the entity’s control environment is highly
effective may influence the auditor’s decision about the number
of an entity’s location at which auditing procedures are to be
performed or whether to perform certain auditing procedures for
some account balances of classes of transactions at an interim date
-Some control procedures often have a specific effect on an
individual assertion embodied in a particular account balance or
class of transaction.
Ex. Control procedures that an entity established to ensure that its
personnel are properly counting and recording the annual physical
inventory relate directly to the existence assertion for the
inventory account balance
-Internal control structure policies and procedures can be either
directly or indirectly related to an assertion. The more indirect the
relationship, the less effective that policy or procedure may be in
reducing the control risk
Ex. A sales manager’s review of a summary of sales activity for
specific stores by region ordinarily is indirectly related to the
completeness assertion for sales revenue. Accordingly, it may be
less effective in reducing the control risk for that assertion as
compared to policies and procedures that are more directly related
to that assertion such as matching shipping documents with billing
documents.
Based on the assessed level of control risk that the auditor expects
to support and audit efficiency considerations, the auditor plans to
perform some tests of control concurrently with obtaining an
understanding of the internal control structure.
-In addition, even though some of the procedures performed to
obtain the understanding may not have been specifically planned
as tests of controls, they may also provide evidential matter about
the effectiveness of the design and operation of the policies and
procedures, and consequently, serve as tests of internal control
Type of Control Activities that relate to Financial Statement
Assertions
Assertion: A/B. Existence/Occurrence
Related Control Activities: Procedures that require documentation,
approvals, authorizations, verification and reconciliations
Ex 1. An employee or official who does not handle cash receipts or
credit approval authorizes the write-off of an uncollectible account
Ex 2. Cash disbursements should be supported by complete
documentations such as purchase requisition, abstract of canvass,
purchase order, receiving/inspection report and vendor’s invoice
Assertion: C. Completeness
Related Control Activities: Procedures that ensure that all
transactions that occur are recorded such as accounting for a
numerical sequence of documents
Ex. Transfer of goods should be accompanied by prenumbered
documents such as delivery ticket or bill of lading and accounted
for in the period issued to ensure proper recording
Assertion: D. Rights and Obligations
Related Control Activities: Procedures that ensure that the entity
has a right to assets or an obligation to pay arising from the
transaction.
Ex. A sale to a customer should be supported by a sales invoice and
acknowledged delivery receipt
Assertion: E/F. Valuation/Measurement
Related Control Activities: Procedures that ensure that a proper
price is charged and that mathematical accuracy are present in
recording and in developing accounting records and the financial
statement
Ex. A sales employee traces the price used in an invoice to a price
list (in effect) at the time.
Assertion: G. Presentation and Disclosure
Related Control Activities: Procedures that indicate that a review
has been made to ascertain that a transaction has been recorded
in the proper account and that FS disclosure have been reviewed
by a competent personnel
Ex. The chief accountant reviews the correctness of journal entries
made by an accounting clerk
C. Obtaining Evidential Matter to Support the Assessed Level of
Control Risk
-The auditor obtains evidential matter to enable him to determine
the proper level of control risk by performing tests of controls or
compliance tests on selected policies and procedures
-Compliance procedures are designed to obtain reasonable
assurance that those internal controls on which tests requiring
inspection of documents supporting transactions gain evidence
that controls have operated properly and inquiries about and
observation of controls which leave no audit trail.
-Auditors may also review journal entries for a test period to
determine whether they are properly approved and are
adequately supported and they trace the postings to the ledger.
Tests of Control
-are performed in order to obtain evidence about the effectiveness
of the:
a. Design of the accounting and internal control systems,
whether they are suitably designed to prevent or detect
material misstatements
b. Operation of the internal controls throughout the
period
-procedures directed toward either the effectiveness of the design
or operations of an internal control structure policy or procedures
-concerned whether the policy or procedure is suitably designed
to prevent or detect material misstatement in specific FS
assertions.
-for entities with complex internal control structure, the auditor
should consider the use of flowcharts, questionnaires, or decision
tables
-that are directed towards the operating effectiveness of an
internal control structure policy are concerned with how the policy
or procedure was applied, the consistency with which it was
applied during the audit period and by whom it was applied.
Tests of Control procedures
a. making inquiries of appropriate entity personnel
b. inspection of documents and reports
c. observation of the application of internal control
policies and procedures
d. Reperformance of the policies and procedures by the
auditor himself
Auditing Theory Review Notes (AT-3) Page 10 of 13
-The auditor should obtain audit evidence(evidential
matter)through tests of control to support any assessment of
control risk which is less than high (maximum). The lower the
assessment of control risk, the more support the auditor should
obtain that the accounting and internal control systems are
suitably designed and operating effectively.
-The evidential matter that is sufficient to support a specific
assessed level of control risk will depend on the professional
judgement of the auditor
-When obtaining evidence about the effectiveness of internal
controls, the auditor considers how they are applied, the
consistency with which they were applied and by whom they were
applied.
-The concept of effective operation recognizes that some
deviations from prescribed controls may have occurred. Such
deviations may be caused by factors such as changes in key
personnel, significant seasonal fluctuations in volume of
transactions and human error.
When deviations are detected, the auditor makes specific inquiries
and ensures that tests of controls appropriately cover the period
of change or fluctuation.
-In a computer information systems environment, the objectives
of tests of control do not differ from those in a manual
environment. The auditor may need to use computer-assisted
audit techniques such as file interrogation tools or audit test data
when the accounting and internal control systems do not provide
visible evidence documenting the performance of internal controls
which are programmed into a computerized accounting system.
D. Evaluating the Results of Evidential Matter
Based on the results of tests of control, the auditor should evaluate
whether the internal controls are designed and operating as
contemplated in the preliminary assessment of control risk
The evaluation of deviations may lead to change in the assessed
level of control risk
In such cases, the auditor would modify the nature, timing and
extent of planned substantive procedures
Certain types of audit evidence are more reliable than others. The
auditors observation provides more reliable audit evidence rather
than merely making inquiries.
Ex. The auditor might observe the individual who applies a control
procedure or inquire from appropriate personnel.
However, audit evidence obtained through observation, pertains
only to a certain point in time. The auditor needs to supplement
that procedure with other tests of control capable of providing
audit evidence about other periods of time.
In determining the appropriate evidence to support the conclusion
about control risk, the auditor may consider audit evidence
obtained in prior audits.
In a continuing engagement, the auditor will be need to update the
knowledge gained of the accounting and internal control systems,
and consider the need to obtain further audit evidences of any
changes in control.
Before relying on the procedures performed in prior audits, the
auditor should obtain audit evidence which supports this reliance.
The auditor should obtain audit evidence as to the nature, timing
and extent of any changes in the entity’s accounting and internal
control systems and assess their impact on the auditor’s intended
reliance. The longer the time elapsed since the performance of
procedures in prior audit, the lesser the assurance to the auditor
The auditor should consider whether internal controls were in use
throughout the period. If substantially different controls were used
at different times during the period, the auditor would consider
each control separately.
A breakdown in internal controls for a specific portion of the period
requires separate consideration of the nature, timing and extent
of audit procedures to be applied.
The auditor may perform tests of control during the interim visit in
advance of period end. The auditor should consider the need to
obtain further audit evidence relating to the remainder of the
period, before he can rely on the results of the tests during interim
visit.
Factors to be considered:
 Results of the interim tests
 The length of the remaining period
 Whether any changes have occurred in the accounting
and internal control systems during the remaining
period
  The nature and amount of the transactions and other
events and the balances involved
 The control environment, especially supervisory
controls
 The substantive procedures which the auditor plans to
carry out
E. Determining the Necessary Level of Detection Risk
Considerations:
a. The nature of substantive procedures Ex. Using tests
directed toward independent parties outside the entity
rather than tests directed toward parties or
documentation within the entity, or using tests of
details for a particular audit objective
b. The timing of substantive procedures, ex. Performing
them at period end, or at earlier date
c. Extent of substantive procedures, ex. Using larger
sample size
As acceptable level of detection risk decreases, the assurance
provided from substantive test should increase.
When both inherent and control risks are assessed as high, the
auditor should consider whether substantive procedures can
provide sufficient appropriate audit evidence to reduce detection
risk.
When the auditor determines that detection risk cannot be
reduced to an acceptable level, then he should express a qualified
or disclaimer of opinion
3.3 Assessing the risks of material misstatement
3.3.1 Fraud and errors (PSA 240 THE AUDITOR’S RESPONSIBILITIES
RELATING TO FRAUD IN AN AUDIT OF FINANCIAL STATEMENTS)
-Misstatements in the financial statements can arise from either
fraud or error. The distinguishing factor between fraud and error
is whether the underlying action that results in the misstatement
of the financial statements is intentional or unintentional.
-Although fraud is a broad legal concept, for the purposes of PSA
240, the auditor is concerned with fraud that causes a material
misstatement in the financial statements. Two types of intentional
misstatements are relevant to the auditor – misstatements
resulting from fraudulent financial reporting and misstatements
resulting from misappropriation of assets
(a) Fraud – An intentional act by one or more individuals among
management, those charged with governance, employees, or third
parties, involving the use of deception to obtain an unjust or illegal
advantage.
(b) Fraud risk factors – Events or conditions that indicate an
incentive or pressure to commit fraud or provide an opportunity
to commit fraud.
Professional Skepticism
-In accordance with PSA 200, the auditor shall maintain an attitude
of professional skepticism throughout the audit, recognizing the
possibility that a material misstatement due to fraud could exist,
notwithstanding the auditor’s past
experience of the honesty and integrity of the entity’s
management and those charged with governance.
-Unless the auditor has reason to believe the contrary, the auditor
may accept records and documents as genuine. If conditions
identified during the audit cause the auditor to believe that a
document may not be authentic or that terms in a document have
been modified but not disclosed to the auditor, the auditor shall
investigate further.
-Where responses to inquiries of management or those charged
with governance are inconsistent, the auditor shall investigate the
inconsistencies.
3.3.2 Risk assessment procedures – see page 1
When performing risk assessment procedures and related
activities to obtain an understanding of the entity and its
Tests of details of transactions
May also be used to Used in substantive
conduct tests of control testing
Objective is to evaluate Objective is to detect
whether an internal material misstatements in
control policy or the FS
procedure operated
effectively
Both objectives may be accomplished concurrently by
performing tests of details on the same transaction.
Auditing Theory Review Notes (AT-3) Page 11 of 13
environment, including the entity’s internal control, required by
ISA 315, the auditor shall perform the procedures below to obtain
information for use in identifying the risks of material
misstatement due to fraud.
The auditor shall make inquiries of management regarding:
(a) Management’s assessment of the risk that the financial
statements may be materially misstated due to fraud, including the
nature, extent and frequency of such assessments;
(b) Management’s process for identifying and responding to the
risks of fraud in the entity, including any specific risks of fraud that
management has identified or that have been brought to its
attention, or classes of transactions, account balances, or
disclosures for which a risk of fraud is likely to exist;
(c) Management’s communication, if any, to those charged with
governance regarding its processes for identifying and responding
to the risks of fraud in the entity; and
(d) Management’s communication, if any, to employees regarding
its views on business practices and ethical behavior.
-The auditor shall make inquiries of management, and others
within the entity as appropriate, to determine whether they have
knowledge of any actual, suspected or alleged fraud affecting the
entity
-For those entities that have an internal audit function, the auditor
shall make inquiries of internal audit to determine whether it has
knowledge of any actual, suspected or alleged fraud affecting the
entity, and to obtain its views about the risks of fraud.
-Unless all of those charged with governance are involved in
managing the entity, the auditor shall obtain an understanding of
how those charged with governance exercise oversight of
management’s processes for identifying and responding to the
risks of fraud in the entity and the internal control that
management has established to mitigate these risks
-The auditor shall make inquiries of those charged with governance
to determine whether they have knowledge of any actual,
suspected or alleged fraud affecting the entity. These inquiries are
made in part to corroborate the responses to the inquiries of
management.
-The auditor shall evaluate whether unusual or unexpected
relationships that have been identified in performing analytical
procedures, including those related to revenue accounts, may
indicate risks of material misstatement due to fraud
-The auditor shall consider whether other information obtained by
the auditor indicates risks of material misstatement due to fraud
-The auditor shall evaluate whether the information obtained from
the other risk assessment procedures and related activities
performed indicates that one or more fraud risk factors are
present. While fraud risk factors may not necessarily indicate the
existence of fraud, they have often been present in circumstances
where frauds have occurred and therefore may indicate risks of
material misstatement due to fraud.
3.3.3 Discussion among the engagement team - The members of
the engagement team should discuss the susceptibility of the
entity’s FS to material misstatements. Including how fraud might
occur. The discussion shall occur setting aside beliefs that the
engagement team members may have that management and
those charged with governance are honest and have integrity.
Their discussion should be duly documented.
The discussion among the engagement team:
 Provides an opportunity for more experienced
engagement team members, including the engagement
partner, to share their insights based on their
knowledge of the entity.
 Allows the engagement team members to exchange
information about the business risks to which the entity
is subject and about how and where the financial
statements might be susceptible to material
misstatement due to fraud or error.
 Assists the engagement team members to gain a better
understanding of the potential for material
misstatement of the financial statements in the specific
areas assigned to them, and to understand how the
results of the audit procedures that they perform may
affect other aspects of the audit including the decisions
about the nature, timing, and extent of further audit
procedures.
 Provides a basis upon which engagement team
members communicate and share new information
obtained throughout the audit that may affect the
assessment of risks of material misstatement or the
audit procedures performed to address these risks. PSA
 240 provides further requirements and guidance in
relation to the discussion among the engagement team
about the risks of fraud.
It is not always necessary or practical for the discussion to include
all members in a single discussion (as, for example, in a multi-
location audit), nor is it necessary for all of the members of the
engagement team to be informed of all of the decisions reached in
the discussion. The engagement partner may discuss matters with
key members of the engagement team including, if considered
appropriate, specialists and those responsible for the audits of
components, while delegating discussion with others, taking
account of the extent of communication considered necessary
throughout the engagement team. A communications plan, agreed
by the engagement partner, may be useful.
3.3.4 Significant risks that require special audit consideration
-As part of the risk assessment, the auditor should determine
which of the risks identified will require special audit
consideration. Such risks are defined as significant risks.
-The determination of what are significant risks depends on the
professional judgement of the auditor. In exercising this
judgement, the auditor excludes the effects of identified controls
related to the risk.
Considerations whether to determine a risk as significant:
 Whether the risk is a risk of fraud
 Whether the risk is related to significant economic,
accounting or other developments and therefore
requires specific attention
 The complexity of transactions
 The degree of subjectivity in the measurement of
financial information related to the risk, especially
those involving a wide range of measurement
uncertainty
 Whether the risk involves significant transactions that
are outside the normal course of business for the entity,
or that otherwise appear to be unusual.
3.3.5 Risks for which substantive procedures alone do not provide
sufficient appropriate audit evidence
-In respect of some risks, the auditor may judge that it is not
possible or practicable to obtain sufficient appropriate audit
evidence only from substantive procedures. Such risks may relate
to the inaccurate or incomplete recording of routine and significant
classes of transactions or account balances, the characteristics of
which often permit highly automated processing with little or no
manual intervention. In such cases, the entity’s controls over such
risks are relevant to the audit and the auditor shall obtain an
understanding of them.
3.3.6 Revision of risk assessment
-The auditor’s assessment of the risks of material misstatement at
the assertion level may change during the course of the audit as
additional audit evidence is obtained. In circumstances where the
auditor obtains audit evidence from performing further audit
procedures, or if new information is obtained, either of which is
inconsistent with the audit evidence on which the auditor
originally
based the assessment, the auditor shall revise the assessment and
modify the further planned audit procedures accordingly.
3.4 Communicating with those charged with governance and
management
COMMUNICATION OF PERFORMANCE, IMPROVEMENTS AND
OBSERVATIONS IN INTERNAL CONTROL TO MANAGEMENT
-Any material weakness in the design or operation of the
accounting and internal control systems discovered by the auditor
should be made known to management as soon as practicable and
at an appropriate level of responsibility.
-It should be indicated in the communication that only material
weaknesses that was noticed by the auditor have been reported,
and that the study of internal control was not designed to
determine the adequacy of internal for management purposes,
which is actually the function of the internal audit department.
Reportable Conditions (Matters that should be reported to
management):
A.Deficiencies in the design of internal control structure
>Inadequate overall internal control structure design
>Absence of appropriate segregation of duties consistent with
appropriate control objectives
>Absence of appropriate reviews and approval of transactions,
accounting entries or systems output
Auditing Theory Review Notes (AT-3) Page 12 of 13
>Inadequate procedures for appropriately assessing and applying
accounting principles
>Inadequate provisions for safeguarding assets
>Absence of other control techniques appropriate for the type and
level of transaction activity
>Evidence that a system fails to provide completeness and
accurate output that is consistent with objectives and current
needs because of design flaws
B. Failures in the operation of the internal control structure
>Evidence of failure of identified controls in preventing or
detecting misstatements of accounting information
>Evidence that a system fails to provide complete accurate output
consistent with the entity’s control objectives because of the
misapplication of control procedures
>Evidence of failure to safeguard assets from loss, damage or
misappropriation
Evidence of intentional override of the internal control system by
those in authority to the detriment of the overall objectives of the
system
>Evidence of failure to perform tasks that are part of the internal
control, such as not preparing timely reconciliations
>Evidence of willful wrongdoing by management or employees
>Evidence of manipulation, falsification or alteration of accounting
records or supporting documents
>Evidence of intentional misapplication of accounting principles
>Evidence of misrepresentation by client personnel to the auditor
>Evidence that employees or management lack the qualifications
and training to fulfill their functions
C. Other matters
>Absence of a sufficient level of control consciousness within the
organization
>Failure to follow up and correct previously identified internal
control structure deficiencies
>Evidence of significant or extensive undisclosed related party
transactions
>Evidence of undue bias or lack of objectivity by those responsible
for accounting decisions
Reporting: Form and Content
-Conditions noted by the auditor that are considered reportable
should be reported, preferably in writing. If information is
communicated orally, the auditor should document the
communication by appropriate memoranda or notation in the
working papers.
-The report should state that the communication is intended solely
for the use of the audit committee, management and others within
the organization.
When there are requirements established by governmental
authorities to furnish such reports, the specific governmental
authority may be referred in the report
Reporting: Form and Content
Content of the Report
-Indicate that the purpose of the audit was to report on the FS and
not to provide assurance on the internal control structure
-Include the definition of reportable conditions
-Include the restriction on distribution of the report
Management Letter to Client
-Auditors may write management letters to clients containing
suggestions for improving operations and internal control.
-This is not required by auditing standards
COMMUNICATION ABOUT SUSPECTED OR IDENTIFIED FRAUD
-If the auditor has identified a fraud or has obtained information
that indicates that a fraud may exist, the auditor shall
communicate these matters on a timely basis to the appropriate
level of management in order to inform those with primary
responsibility for the prevention and detection of fraud of matters
relevant to their responsibilities.
-Unless all of those charged with governance are involved in
managing the entity, if the auditor has identified or suspects fraud
involving:
(a) Management;
(b) Employees who have significant roles in internal control; or
(c) Others where the fraud results in a material misstatement in
the financial statements, the auditor shall communicate these
matters to those charged with governance on a timely basis. If the
auditor suspects fraud involving management, the auditor shall
communicate these suspicions to those charged with governance
and discuss with them the nature, timing and extent of audit
procedures necessary to complete the audit
COMMUNICATIONS TO REGULATORY AND ENFORCEMENT
AUTHORITIES
-If the auditor has identified or suspects a fraud, the auditor shall
determine whether there is a responsibility to report the
occurrence or suspicion to a party outside the entity. Although the
auditor’s professional duty to maintain the confidentiality of client
information may preclude such reporting, the auditor’s legal
responsibilities may override the duty of confidentiality in some
circumstances.

Auditing Theory Review Notes (AT-3) Page 13 of 13