General Principles of Audit NOTES
General Principles of Audit NOTES
11)
1. The auditor should comply with relevant ethical requirements relating to audit engagement.
2. The auditor should conduct an audit in accordance with Philippine Standards on Auditing (PSAs).
3. The auditor should plan and perform the audit with an attitude of professional skepticism
recognizing that circumstances may exist that cause the financial statements to be materially
misstated.
4. The auditor should plan and perform the audit to reduce audit risk to an acceptably low level
that is consistent with the objective of an audit.
Professional Skepticism
The auditor is critical, recognizing that there may be circumstances that will cause the financial
statements of the client to be materially misstated. Therefore, the auditor has to be doubtful
and he needs to validate whether those assertions or representations of the management are
true and correct.
The auditor has the responsibility to find evidence that may corroborate or contradict the claim
of the management.
The management prepares the financial statements. The auditor's responsibility is just to find out if
the financial statements conform to the acceptable financial reporting framework.
Sham Audit - auditors don't perform the process of audit and just follows what the management
says.
The moment the auditor submits his audited report to the board of the directors of his client, his
relationship with his client ends.
You must still maintain the confidentiality of the report even if relationship ends.
RA No. 9298
Philippine Accountancy Act of 2004
Includes Code of Ethics for CPAs
Audit Procedures:
1. Risk assessment procedure - for purposes of getting the level of risk (ex: inquire, observe,
inspect)
2. Test of Control - study the internal control system
3. Substantive Test Procedures - gathering pieces of evidence (ex: confirmation letters to banks, to
suppliers, conducting ocular inspection)
Substantive Test Procedure - indispensable. It must always be performed regardless of level of risk.
Test of Control - dispensable. Its purpose is to ascertain whether the initial assessment of low
control risk is valid or not.
Under what circumstance can the test of control not be performed by the auditor (or dispensable)?
When the assessment of level of risk is high. Because in audit there is economic constraints.
When is the test of control performed? If control risk is low. The auditor will perform test of control
procedures by performing a more in-depth study of the client's internal control system.
The higher the risk, the more evidences the auditor must gather to have strong conviction in
forming his opinion.
After performing the audit procedures, then the auditor will form his opinion.
PSA - serves as the guidance on how the auditor will conduct the audit.
Why the need for an audit? The level of credibility or reliability of information is enhanced when the
auditor affixes his signature.
Audited FS - there is already a signature of the auditor attesting the reliability of the information
presented.
Assurance Services
applies to all engagement performed by other professionals.
audit of financial statements is an example.
assurers report on the quality of information.
The auditors assure the intended users that the information presented in the client's FS is in
accordance with the acceptable financial reporting framework and are fairly presented.
Criteria:
standard that the auditor needs to use in determining whether the subject matter (FS) is in
accordance with the suitable criteria.
There must be a basis of comparison.
in the audit of financial statements, the criteria is the Philippine Financial Reporting Standards
(PFRS).
If the client company is large such as banks, pawnshop and insurance company, the criteria is Full
PFRS. Do not use the PFRS for SME (Small Medium Entities).
Company is small if total assets is between P3M to P100M. (PFRS for Small Entities)
Company is medium if total assets is more than P100M to P350M. (PFRS for SME)
Company is large if assets or total liabilities is more than P350M. (PFRS for Large Entities)
At what amount should inventory be presented at balance sheet date: @ lower of cost and net
realizable value. (If it is a small entity it is @ fair value)
Audit sampling:
most common method used in a risk-based audit.
the auditor will just make an estimate, based on his professional judgement, on what would be
the appropriate amount or percentage of the samples to be tested.
Examples:
1. In the course of your audit, you obtained inconsistent evidence (the claims of management
are different from the claims of external parties). You must rely from the outside of the
company [Audit & Assurance Principle, p. 11]
2. You performed bank reconciliation and the results differ from the management's ledger.
You must rely on your bank reconciliation result.
Non-Assurance Engagement:
If one or more elements of assurance engagement is lacking it is a non-assurance engagement.
Ex:
1. You are consulted by the client regarding the assessment from the BIR (Tax Consultancy - you
just give a piece of advice, there's no written assurance report).
2. You are asked by the client to assist them in the preparation of income tax return (There's no
written assurance report)
Cost-benefit consideration:
You consider this when obtaining evidence.
In financial statement audit, there are economic constraints (time and money)
Ex: When obtaining evidence, choose an alternative audit procedure that is cheaper.
If there is no alternative, the rule is that no matter how much it costs or difficult but the
information is very critical or material, the auditor has no recourse but to perform that
procedure. [Audit & Assurance Principle, p.12]
Materiality:
common concept all throughout the audit.
When is an item considered material? When it will affect the decision of the users of financial
information and the fairness of presentation.
If the evidence is very material or very critical, he needs to dig in pieces of evidence in support
of his opinion.
Audit risk and materiality are inversely proportionate. [Salosagcol, p.176]
Materiality is relevant when the practitioner determines the nature, timing, and extent of
evidence-gathering procedure and when assessing whether the subject matter information is
free of misstatement.
2. According to Structure
a. Attestation Engagement
b. Direct Engagement
Reasonable Assurance
Ex: Financial Statement Audit
Highest level of assurance that an auditor may render in financial statement audit: Reasonable
assurance
There's no guarantee (absolute assurance) that the client's financial statement is misstated because
of the limitations of audit.
Limited Assurance
Procedures performed is less than reasonable assurance.
Level of risk is higher than reasonable assurance.
Ex: Review engagement (inquiry, observation, reconciliation, vouching can be done)
Attestation Engagement
Ex: Financial Statement Audit
The responsible party (management) will measure and prepare the financial statement and the
auditor's responsibility is whether the claims by the management is true by digging pieces of
evidence.
Direct Engagement
The practitioner measures the information related to the assurance engagement and makes the
report.
A limitation because there is sampling risk. The results of the chosen samples is assumed to be
the same with the rest of the population.
Sampling risk - the risk that the results of the sample tested may not be representative to the entire
population.
To reduce sampling risk, the auditor must increase sample size.
Ex: Despite how well designed and properly implemented the client's internal control system
may be, when there is collusion or connivance among the employees or management or from
people outside the entity, the auditor may find difficulty in determining the risk regularity or
misstatements of information as reflected in the client's financial statement.
Ex: Management uses their overriding authority (Entity is granting line of credit to a client and
their policy is up to P500,000. But one client is a close friend to the president, the policy can be
overridden by the top management for that client.)
4. Use of judgement in gathering and evaluating evidence and forming conclusions based on that
evidence
2. Assertion of Completeness
Asserting that all transactions are properly reflected in the financial statements during the
period.
4. Assertion of Valuation
Under what circumstance will disclaimer of opinion will be rendered? When in the auditor's
judgement, an item is considered so material that it is affecting the fairness of presentation of the FS
so that he was not able to gather sufficient appropriate evidence because of restrictions imposed by
the management.
Types of Audit:
1. Financial Statement Audit
2. Operational Audit
3. Compliance Audit
4. External Audit
5. Internal Audit
6. Government Audit
Internal auditor is still an employee of the audit client. His function is to ascertain whether there's
compliance with the policies and procedures imposed by the management.
Internal auditor directly reports to: the audit committee or the audit committee of board of
directors. He rarely communicates with the management to maintain independence.
Internal auditors talk to the management about administrative matters (ex: budget assigned).
Auditor in Government Audit: Commission on Audit
Objective of Financial Statement Audit: For the auditor to express an opinion whether the financial
statements are prepared in all material respects in accordance with the acceptable financial
reporting framework.
In issuing an unqualified opinion, the auditor guarantees there's no material misstatement, but
there are still misstatements but not material.
The user of financial statement cannot assume the opinion of the auditor is an assurance as to the
future viability of the entity nor the efficiency and effectiveness in which the management
conducted the affairs of the entity.
The preparation and presentation of financial statement in accordance with suitable criteria is the
responsibility of the management even if it is being audited.
1. Risk-based audit - commonly used; the auditor makes an initial assessment of level of risk
2. Top down approach - starts with identification of strategic issues affecting the audit and uses them to
determine the overall strategy for the audit.
3. Balance sheet approach - auditor audits the assets and liabilities of the entity, with little emphasis on
profit and loss account items.
4. Transaction approach - audits more on nominal accounts than real (balance sheet) account.
7. Financial risk approach - auditor considers financial risk and materiality in planning the audit work.
CHAPTER 3: THE PROFESSIONAL PRACTICE OF ACCOUNTING
CPA is now recognized to have equal footing with other professions like law and medicine because it
is possessing the attributes as required for a profession.
To become a CPA, you need to finish Bachelor of Science in Accountancy and pass the CPA Licensure
Exam.
Sectors of Accounting:
1. Public practice
you may be engaged in rendering assurance engagement
you may build your own accounting office
2. Private practice
in the private sector.
employed in one big corporation like San Miguel Corporation.
you can be the president, vice president for finance, controller, or an accountant.
If employer has capital of P5M above or annual revenue of at least P10M. It is a
requirement that the one supervising the recording of financial transactions,
preparation of financial statements, or even coordinating with external auditors, must
be a CPA.
3. Practice in Education or Academe
as an instructor, professor, dean or chair in the college of accountancy.
4. Practice in Government
employed in the government.
Financial Statement Audit - main service offered by CPAs that only CPAs can render because of the
knowledge CPAs possess.
Can a CPA practice his profession in more than one sector? Yes, as long as there's no conflict of
interest.
CPAs can engage in private and public practice at the same time as long as you should not be the
external auditor of your own employer because you will not maintain independence.
CPAs in the government sector CAN'T engage in public practice because there's conflict of interest.
The fundamental ethical principle of objectivity is compromised. For example, you are assigned as
an examiner of the financial statement you audited. You can engage in other sectors such as private
or academe.
Ethical principles:
1. Integrity
2. Objectivity
3. Confidentiality
4. Professional behavior
5. Professional competence and due care
5. Sanctions and penalties against violators of the laws, rules and regulations affecting the
accounting profession.
For example, you don't have the accreditation as required by the BOA and you keep
engaging in the audit of FS. That is a violation of RA 9298.
If your client is a cooperative, you need to be accredited by the Cooperative Development Authority.
Following Grounds:
1. Neglect of duty or incompetence
2. Violation or toleration of any violation of RA 9298 and its IRR or the CPAs Code of Ethics
3. Final judgement of crimes involving moral turpitude
Supreme Court renders the final decision.
Examples of moral turpitude: murder, falsification of public documents, or bribery
If political crime like rebellion or sedition, it is not covered by RA 9298.
STANDARD-SETTING BODIES:
1. Financial Reporting Standards Council (FRSC)
2. Auditing and Assurance Standards Council (AASC)
body that develop the standards you follow in auditing financial statements.
those standards developed by an international body - the International Auditing and
Assurance Standards Board (IASB).
MRA:
is the product of a meeting among the ASEAN countries.
main objective is to allow cross border movement of professional accountants, providing external
auditing services and other accountancy related services that requires domestic licensing in ASEAN
member states and may continue to be facilitated through bilateral or multilateral MRAs between or
among ASEAN member countries.
In short, the main objective is to allow professional accountants in each countries to extend their
services to other ASEAN member countries.
Once you are an ASEAN chartered professional accountant, you can render or practice your
profession in any of the ASEAN member countries.
PROFESSIONAL ORGANIZATIONS:
Once you passed the CPA Licensure Exam you become a member of the Philippine Institute of
Certified Public Accountants (PICPA)
You need to pay annual dues. Your application for accreditation will not be renewed if you have
unpaid membership fees.
Main objective of PICPA: to protect and to provide the best interest for the members of the
organization.
SECTORAL ORGANIZATIONS:
1. Association of CPAs in Public Practice (ACPAPP)
2. Association of CPAs in Commerce and Industry (ACPACI)
3. National Association of CPAs in Education (NACPAE)
4. Government Association of CPAs (GACPA)
Once you passed the exam you will go to PRC to claim board certificate and you will be given a PRC
ID which will be renewed every three years. When you renew you have to ensure that you have
taken at least 120 CPD units.
Circumstance where a CPA passed the board exam, but the PRC refused to issue CPA Certificate and
PRC ID:
1. Was convicted by a court of competent jurisdiction of a criminal offense involving moral
turpitude.
2. Guilty of immoral and dishonorable conduct.
3. Has unsound mind.
4. Misrepresentation in the application for the CPA Examination.
Example, you cheated.
FOREIGN CPA:
Are foreign CPAs allowed to practice in the Philippines? Generally, no. Otherwise, there should
be treaties or agreements entered between the Philippine government and the country where
that foreign CPA resides, allowing the CPAs of either country to practice their profession in that
country.
Example, you go to Lebanon and want to practice your profession. Generally, you are not
allowed unless Lebanon and Philippines have an agreement that they allow the CPAs to practice
in either country.
Aside from mutual agreement, there should be compliance with other requirements the same
with Filipino CPAs.
Circumstance where foreign CPAs are issued with special and temporary permits:
1. Called for consultation or for a specific purpose essential for the development of the country,
provided that his/her practice is limited for the particular work that he/she is being engaged and
that there is no Filipino CPA qualified for such consultation or specific purpose.
2. Engaged as a professor, lecturer, or critic infield essential to accountancy education in the
Philippines, and his/her engagement is confined to teaching only.
3. Internationally recognized expert or with specialization in any branch of accountancy and
his/her service is essential for the advancement of accountancy in the Philippines.
PROFESSIONAL STANDARDS:
1. Philippine Standards on Auditing (PSAs)
for FS audit.
CPD Programs:
1. Seminars and Workshops
2. Academic track
3. Self-directed and/or Lifelong Learning
4. Other activities to be recommend by the CPD Council and approved by the BOA and the
Professional Regulation Commission.
CPD Units requirement: 120 units.
In setting up your own accounting firm, you need to secure the required permit and licenses. Then
secure the requirements needed to practice public accountancy.
If it is a partnership, you need to go first to SEC to have it registered. After securing the registration,
you’ll go to the city or municipality where the principal address your business is located. After that,
register at BIR and other government agencies like SSS and PhilHealth for your employees.
If you are an Individual CPA, no need to secure the permit and license from the city or municipality.
Just have it registered at the BIR to file for necessary taxes.
If it is an individual firm you need to register it at DTI.
Under RA 9298, the form of business organization that is allowed to be formed for practice of public
accounting: sole proprietorship and partnership.
Corporation is not allowed under RA 9298 because the owners of a corporation are the investors
and shareholders. For instance, you want to put up an accounting office as a partnership. It is
necessary for the partners to be CPAs but in a corporation, it is not a requirement for all
shareholders to be CPAs. At the same time, the objective of a corporation is to earn profit which
could affect the quality of the services rendered by the CPAs (it becomes a commercial approach)
while in partnership or in an individual firm, the main objective is to render service to the public.
Earning profit is secondary objective only. This also applies to other professions like lawyers and
doctors.
Quality Review Committee (QRC) – one of the councils formed or created to assist the BOA in their
discharge of their duties and responsibilities.
It is indicated in the audit report all required accreditations of the auditor. SEC will not accept the
financial statements filed by the client without the required accreditation numbers by the external
auditor. It is also indicated the expiry date of BIR accreditation, BOA accreditation, SEC accreditation,
your CBA accreditation.
RULES ON NAMES:
As an individual practitioner, you can use your name.
As an individual firm or sole proprietorship, you can use the name registered in the DTI.
As a partnership, you can use the name registered in SEC.
Why is there a limitation imposed regarding the advertising and marketing of the services of any
profession? It’s because they are limiting the competition. Otherwise, if they allow competition, it
can affect the quality of services. And there will be unfair competition especially to individual CPAs.
ACCEPTABLE PUBLICITY:
1. Awards
But should not be used for personal professional advantage (ex: to invite more
clients)
2. Professional Accountants Seeking Employment or Professional Business
3. Directories
4. Books, Articles, Interviews, Lectures, Radio and Television Appearances
Can’t disclose services offered because when you’re in television, its scope is wide. It
will be commercialized, and quality of services will be compromised.
5. Training Courses, Seminars, etc.
6. Booklets and Documents Containing Technical Information
7. Staff Recruitment
8. Publicity on Behalf of Clients
9. Brochures and Firm Directories
10. Stationery and Nameplates
11. Announcements
12. Inclusion of the Name of the CPA in Public Practice in a Document Issued by a Client
13. Anniversaries
After every 5 years
14. Websites
The bottom line of the regulations on the marketing of the services offered by CPAs is so that the
quality of the services offered will not be compromised. To avoid undue competition among
members of the competition. Without the regulations, the very purpose of serving the public will be
defeated.
If the client is a bank, an insurance company, a publicly listed entity (shares of stocks are publicly
listed in the stock exchange), or the assets of the company is P500M perhaps, the acceptable
financial reporting framework is Full PFRS.
Assertions – claims or representations of the management regarding the financial statement that is
being subject to audit.
All financial information reflecting in the financial statement is good only for December 31. That’s
why the date is presented “As of December 31”. The day after December 31, the financial position
could be different.
What is the overall objective of the auditor in an audit of financial statements? For the auditor to
express an opinion whether the financial statements are prepared, in all material respects, in
accordance with an applicable financial reporting framework (PSA 200).
The auditor’s opinion enhances the credibility of the financial statements. The user cannot assume
that the opinion is an assurance to the future viability of the entity nor the efficiency or
effectiveness of which the management has conducted the affairs of the entity.
For instance, the auditor’s opinion is unqualified and after 6 months, the entity has closed its
operations. Do not blame the auditor because as of that moment, when he rendered the unqualified
opinion, it only enhances the credibility of the financial statements. On that date, there is no
indications substantially affecting the ability of the company to operate as a going concern.
Unfortunately, after the audit, there could be circumstances that have affected the operations of
the company.
What is the responsibility of the auditor? The auditor is responsible for expressing an opinion on the
financial statements from the management or those charged with governance whether it is fairly
presented.
Charged with governance – refers to the board of directors (the governing body of the entity).
It is the primary responsibility of the management or those charged with governance of the
identification of the appropriate financial reporting framework to be used. While the auditor will
determine whether such financial reporting framework is acceptable.
3 Types of Audit Procedures According to Purpose that an Auditor Performs in Financial Statement
Audit:
1. Risk Assessment Procedure
Assess the level of risk involved in the preparation and presentation of the financial
statement.
The auditor inquires, observes, and inspects to gather pieces of information which
will serves as his basis for assessing the level of risk involved.
2. Test of Control
Internal control system is being evaluated.
Example, what are their internal control policies and procedures in the handling of
cash, regarding their inventories, or their PPEs. How they are safeguarding their
assets.
More in depth study of the client’s internal control system to validate whether the
initial assessment is validating or not.
3. Substantive Test Procedure
Where the auditor will gather pieces of evidence.
For instance, sending confirmation letters or performing bank reconciliation, and the
information will be used as a basis whether the assertions of the management are
true or not.
Responsibilities of the Management and those Charged with Governance on Financial Statement
Audit:
1. For the preparation and presentation of the financial statements in accordance with the
applicable financial reporting framework. Aside from that, the management also has the
responsibility to have an internal control system that is properly designed and implemented
to have their financial information considered as reliable.
2. They also need to be cooperative with the members of the engagement team. They should
provide the auditor:
All information, such as records and documentation, and other matters that are
relevant to the preparation and presentation of the financial statements.
Any additional information that the auditor may request from management and,
where appropriate, those charged with governance
Unrestricted access to those within the entity from whom the auditor determines it
necessary to obtain audit evidence.
If you are going to ask for information, records and documentation, there must be proper planning,
and you should know who to ask for the documents. It also has to be at a time when you will not
disrupt the operations of the entity. There has to be an arrangement.
If the management is uncooperative during the time of engagement, that is the time for the auditor
to withdraw from the engagement and perhaps issue a disclaimer of opinion. For instance, they are
not giving you the records or documents, and these are material, based on your professional
judgement.
If the auditor experiences restrictions imposed by the management and the auditor can’t conduct
the audit properly, the auditor must approach the management and discuss the issues or concerns.
If after discussing and it remains to be unresolved, auditor will withdraw from the engagement.
Audit Independence:
Being independent means that he is not influenced by anybody. He is independent in mind
and in appearance.
Being independent enhances the auditor’s integrity and objectivity.
If for instance, you are invited by the president of the entity which is subject of audit to a
party, there is impairment of independence in appearance because there is ongoing
engagement.
If you meet that president in accident and you’ve talked only, then there is no impairment
because it is only circumstantial.
Fundamental Ethical Principles:
1. Integrity – he needs to be honest
2. Objectivity
3. Confidentiality
4. Professional Competence and Due Care
5. Professional Behavior
Professional Skepticism:
Refers to being critical and doubtful, recognizing that there are circumstances that will
cause the financial statements to be materially misstated.
There is potential bias on the part of the management since they are the ones who
prepared the financial statement. There may be circumstances that the amounts are
manipulated or because of motives such as they want to attract investors.
Auditor needs to perform series of procedures or gather evidences to ascertain whether
the assertion is true or not.
Audit Materiality:
Under what circumstance is information considered as material? If it affects the fairness
of the presentation of the financial statement (in the auditor’s point of view) and if its
omission could influence the decision of the financial statement users.
Under PSA 320, there is inverse relationship between materiality level and audit risk.
The higher the materiality level, the lower the audit risk and vice versa.
As the auditor starts gathering evidence, he will set up the materiality level (it can be
quantified). For instance, if the aggregate of misstatements reaches the materiality level
of P500,000 then it is considered material. Therefore, the auditor has to gather more
pieces of evidence to support his opinion.
Materiality level is a relative concept, it depends on the circumstance. For instance, the
size or nature of the entity varies the materiality level. Another instance is cash. When
you audit cash and cash equivalent, it is not the amount that matters. It could be the
entity is large, but the amount of cash and cash equivalent is now minimal. The auditor
will devote more of his time in auditing the cash and cash equivalent because of the
high degree of inherent risk that it is prone to irregularity or misappropriation.
If the auditor considers the information is material, he will dig more pieces of evidence.
Audit Risk:
Audit Risk – risk that the auditor will issue an inappropriate opinion.
To minimize the level of audit risk, the auditor will perform audit planning first.
If the level of inherent risk and control risk is high, the risk of material misstatement is also high.
(Direct Relationship)
Inherent risk and control risk are not imputable against the auditor because before the audit, these
risks are already here.
Detection risk is controllable by the auditor imputable against the auditor because it could be
perhaps his audit procedure is inappropriate.
Professional Judgement:
Professional Judgement – application of relevant knowledge and experience, within the
context provided by auditing, accounting and ethical standards, in reaching decisions
about the courses of action that are appropriate in the circumstances of the audit
engagement.
All throughout the audit, this will be used. For instance, in determining what is the
appropriate sample size, what is the appropriate audit procedure, determining the
number of pieces of evidence, and evaluating the pieces of evidence.
It is an inherent limitation because it could be that the judgement would not be correct.
4. Substantive Testing
Can’t be dispensed because it is the only way the auditor will gather pieces of
evidence.
Example: Conduct ocular inspection, vouching, preparation of bank
reconciliation, inquiry, observation, etc.
Test of the substance of the account balance.
5. Completing the Audit
Wrapping-up procedures and review of audit conclusions prior to issuance of
the audit report.
For instance, going over his working papers, the gathered pieces of evidence is
sufficient already.
For instance, identify related parties.
For instance, if there are subsequent events that happened after balance sheet
date. The auditor has to ascertain how it will affect the financial statement.
6. Issuance of the Audit Report
Preparation and issuance of the audit report.
Audit report – final output of the process.
7. Post-audit Responsibilities
Last stage of the process where the auditor, together with the engagement
team, will gather and try to recollect what happened in the previous
engagement.
Types of Opinion:
1. Unqualified opinion – if it is fairly presented (in consonance with the acceptable
financial reporting framework).
2. Qualified opinion – there are material misstatements, but the effect is not pervasive
(does not affect the financial statement as a whole. The effect is in confined in one
account only). The financial statement is still considered as fairly presented.
3. Adverse opinion – financial statement is not fairly presented. For instance, no disclosure
that the entity can’t operate on a going concern basis.
4. Disclaimer of Opinion – for instance, there are restrictions imposed so that the auditor
was not able to gather sufficient appropriate evidence.
Two Factors Affecting Audit Risk:
1. Risk of Material Misstatement
a. Inherent Risk
b. Control Risk
2. Detection Risk – auditor may not be able to detect material misstatements of an
account because of inappropriate auditing procedure.
If the assessment of inherent risk and control risk is high, what is the materiality level the
auditor should establish during the planning stage? Low so that there is a higher chance
that there would be misstatements that could be leading to a material misstatement of the
information as reflected in the client’s financial statement.
For instance, you set up P5M materiality level which is too high. Most likely, you won’t be
able to come up with misstatements approaching the P5M above. Even if you aggregate the
total misstatements of the individual accounts, the auditor will have a hard time to come up
with misstatements that could materially affect the fairness of the presentation of the
financial statement because the materiality level is so high.
During the planning stage, he has initial assessment, now he needs to set up what should be
the materiality level for him to be able to come up with the risk of material misstatement.
There’s material misstatement if the amount exceeds the materiality level.
Materiality level could be quantified (ex: it could be P1M).
Materiality level depends on the circumstances.
How to minimize the effect of detection risk? Proper planning and supervision.
Audit Planning – establishing the overall audit strategy for the engagement and developing an audit
plan, in order to reduce the audit risk to an acceptably low level.
For instance, there is an information that the auditor considers critical and there are alternative
procedures they can perform to obtain that information. The audit procedure they will choose must
be the one that will result to a minimum cost.
Audit Program – final output of the audit planning activities. It contains the audit procedures to be
carried out, be it test of control or substantive test procedures.
Audit program must be prepared on both test of control procedures and substantive test
procedures.
In developing an audit program for the substantive test of different accounts, it must be done
separately.
Factors the Auditor should Consider in Developing the Overall Audit Strategy:
1. Identify the characteristics of the engagement that define its scope
The characteristics of the engagement being referred to is the nature of the
business of the potential client.
For instance, if it is a bank, pawnshop, or a mining industry.
For instance, it is a bank and it has branches, what is the scope of the engagement?
Will it cover only the main branch?
The bank is also subjected to the laws, rules and regulations of the central bank, the
auditor should take information if they are complying with these rules and policies.
If there is non-compliance, the entity will be exposed to significant risk and will
affect the entity’s ability to operate as going concern.
To know the acceptable financial reporting framework. For instance, if it is a bank,
the acceptable financial reporting framework is the Full PFRS.
2. Ascertain the reporting objectives of the engagement to plan the timing of the audit and the
nature of the communications required.
For instance, the entity’s timetable for reporting to the government, agencies, and
those charged with the governance should be known by the auditor because this
will affect the reporting objectives the auditor will need to produce because the
entity’s financial statements need to be audited which will be submitted to the BIR,
SEC, or other regulatory agencies the entity is subjected to.
3. Consider the factors that, in the auditor’s professional judgement, are significant in directing
the engagement team’s efforts.
There may be procedures already performed initially by the auditor through risk
assessment procedure such as inquiry, inspection, and observation.
4. Consider the results of the preliminary engagement activities and, where applicable,
whether knowledge gained on other engagements performed by the engagement partner
for the entity is relevant.
5. Ascertain the nature, timing and extent of resources necessary to perform the engagement.
Why is it important that you should know the characteristics of the audit? So that this will help the
auditor come up with appropriate audit procedures that they will solely undertake and to know the
acceptable financial reporting framework and to know the expected audit coverage including the
number and locations of the components to be included in the audit.
Major Audit Planning Activities: (OA-EIP-DDP)
1. Obtaining an understanding of the client and its environment
Why is it important that there must be an understanding of the client and its
environment? For the auditor to be able to identify the transactions, practices, and
events the client performs which can affect the risk of material misstatement.
You can obtain an understanding by performing the risk assessment procedures and
simultaneous with study and evaluation of the client’s internal control system.
How do you call the audit procedure in obtaining an understanding of the client and
its environment including its internal control system? Risk assessment procedure.
Example, you’ll have to inquire, interview, inspect, observe, and perform analytical
procedures.
2. Assessing the possibility of non-compliance
What do you think is the non-compliance about? What is being not complied? Non-
compliance about the PFRS, the laws and regulations.
The auditor checks if the client follows the laws and regulations.
For instance, you are engaged in trading or manufacturing, the client may not be
properly registered in regulatory agencies.
If it is a manning agency, they are regulated by the Philippine Overseas Employment
Administration (POEA).
If it is a mining industry, they are regulated by the Department of Environment and
Natural Resources (DENR).
The client’s non-compliance could significantly affect their ability to operate as a
going concern because at any moment in time, the client can be subjected to
closure.
If the auditor still accepts the client even if he knows that they are engaged in
fraudulent activities and are not complying, the ethical principle of integrity is
compromised, and his license may be revoked or suspended if found out.
3. Establishing materiality and assessing risk
The purpose of establishing the materiality level is to be able to know if there are
material misstatements.
There’s inverse relationship between the level of inherent and control risk against
the level of materiality the auditor needs to set up.
If the assessment of the level of risk is high, materiality level must be low. Because if
the level of risk is high and the materiality level is also high, then the auditor may
not be able to discover material misstatements.
Materiality is a concept that the auditor considers throughout the audit.
If information is material or critical, auditor needs to gather more pieces of
evidence.
When establishing the overall audit strategy, the auditor shall determine materiality
for the financial statements as a whole, not to individual accounts. Because if you
set up the materiality per individual accounts you can’t determine the material
misstatements.
If the aggregated misstatements exceed the materiality level set up, it is not
tolerable anymore and there is material misstatement. It will affect the subsequent
audit procedures.
If in a certain account, there is misstatement of information and, based on the
auditor’s judgement, it could affect the fairness of presentation of the financial
statement as a whole, the materiality level set up for the financial statement as a
whole would be ignored. The auditor will set up a materiality level for that
particular account only.
4. Identifying related parties
What is the significance of the auditor identifying the related parties during the
planning phase? Because this could result to a high risk of material misstatement
because the transactions between the related party may not be properly accounted
or reflected in the financial statement because they are a related party.
The auditor and engagement team will think of audit procedures to uncover any
irregularities entered into between the client and the related party which could
affect the fairness of the presentation of the financial statement.
It is a requirement to disclose in the notes to financial statements who are the
related parties.
Examples of related parties: Joint venture; if you’re the investor, the associate is
the related party; for instance, the other party in the contract is the wife of the
president of your client then the president is a related party and also the wife.
Procedures the auditor could perform to identify the related party: inquire with
the management, inquire with the predecessor auditor, observation, inspection,
reading of contract, reading minutes of the meeting, review of the stockholder’s
listings, review of material investment transactions.
5. Performing preliminary analytical procedures
Analytical procedure is a risk assessment procedure alongside with inquiry, observation
and inspection and it can also be a substantive test procedure but never a test of
control procedure.
Analytical procedure is considered as a risk assessment procedure if it is performed
during the early phase of the audit such as during the pre-engagement or audit
planning. It will guide the auditor where the potential areas of material misstatements
are
As a substantive test procedure , the analytical procedure could be used to ascertain
whether an account balance is reasonable or not by performing financial statement
analysis.
Analytical Procedure – study of plausible relationship of financial statement data for the
current year and previous year so that the auditor can apply ratio analysis or financial
statement analysis so that the results of the analysis could serve as a basis for the
auditor, together with the members of the engagement team, where areas of the audit
should have to be more devoted.
For instance, the result of the inventory turnover last year is 5, but the current year it
became 50, so the difference is significant because ratios are supposed to be relatively
constant from period to period. There could be a transaction that is considered as
unusual. This will guide the auditor and the engagement team on where to concentrate
their audit.
The results of the analytical procedure used as risk assessment will serve as a guide for
the auditor where there are areas of concern, in which they are concentrated to
because based on the results of the analysis, the material misstatement risk is high. In
short, it will lead the auditor and the engagement team on where to focus more
especially if there is suspicion of fraud.
Examples of Financial Statement Ratios: Current ratios, quick asset ratio, debt to equity
ratio, inventory turnover, accounts receivable turnover.
6. Determining the need for experts
Why is there a need for the auditor to ascertain whether the nature or characteristic
of the engagement is requiring the services of the expert? As an accountant, there
are areas that you are not knowledgeable about. If the information or evidence that
you obtain from the expert could be critical then that should be taken into
consideration during the planning stage. And for you to know whether on how much
is the budget needed for that expert.
Under what circumstance will the engagement need an expert? If the auditor can’t
come up with an appropriate opinion or decision or to draw a conclusion.
For example, client is a pawnshop, so their inventory is very critical. If you do not
have the knowledge of appraising the inventories’ value, then you can’t come up
with the proper valuation of those included in the financial statement if you won’t
hire the expert in that field.
If the client is the one that hires the services of the expert, the auditor needs to
evaluate the expert’s objectivity and expertise because auditor needs to exercise
professional skepticism. Or get a second opinion from another expert.
7. Development of the overall audit strategy and detailed audit plan
Audit Strategies - refer to designing the optimized audit approaches that seek to
achieve the necessary audit assurance at the lowest cost within the constraints of
the information available.
Auditor needs to consider the cost-benefit concept.
Detailed Audit Plan – addressing the various matters identified in the overall
strategy, taking into account the need to achieve the audit objectives through the
efficient use of the auditor’s or the auditing firm’s resources.
If the assessment of level of risk is high, the nature of the substantive test
procedures should be more of quality so the results of the evidence is more reliable,
and in terms of timing, audit procedures should be performed towards year end.
8. Preparation of preliminary audit programs
Audit programs are provisional in nature. During the audit, it could be subjected to
amendment or modification because there could be circumstances where the
procedures included in the audit program could not be performed because of
limitations or rules, laws, and regulations the client is subjected to.
What do you call the audit procedures the auditor will perform during the audit planning to have
thorough understanding of the client and its environment together with the client’s internal control
system? Risk assessment procedures. For example: inquiry, inspect, and performing analytical
procedures.
If the client is recurring, audit can be performed during the interim period.
For instance, October 1 you started to audit and the end of the reporting period is December 31.
The intervening period is October 1 to December 31. If you perform substantive test procedures
during the interim period, you need to consider the incremental risk (the risk that may arise during
the intervening period). Auditor still has to perform procedures during the intervening period to
ensure that there are no transactions that could materially affect the fairness of presentation of the
financial statement.
During the intervening period, the procedures the auditor performs is not extensive. Auditor merely
reviews, inquire, inspects, performs vouching because his initial assessment of risk is low. If risk is
high, audit should be performed at year end.
Introduction
The auditor shall design and perform audit procedures that are appropriate in the circumstances for the
purpose of obtaining sufficient appropriate audit evidence.
When designing and performing audit procedures, the auditor shall consider the relevance and reliability
of the information to be used as audit evidence.
Audit evidence is all the information used by the auditor in arriving at the conclusions on which the
audit opinion is based, and includes the information contained in the accounting records underlying the
financial statements and other information. The term evidence gathering may be used to refer to the
acquisition of evidence regarding assertions embodied in year-end financial statement balances and
disclosures; however, in a broader context the term represents most of the acts performed by auditors
to form an opinion as to the fairness of financial statements. In the latter sense evidence gathering
includes the assessment of inherent and control risk.
An audit is designed to provide reasonable assurance that the financial statements are not materially
misstated. Thus, the auditor I will not attempt to obtain evidence that would provide absolute complete
assurance, even if that were possible. Rather, the auditor evaluates the sufficiency and appropriateness
of evidence to decide whether it meets the reasonable assurance standard.
Most of the auditor's work in forming his opinion on financial statements consists of obtaining and
evaluating evidential matter concerning the assertions in such financial statements. The measure of the
appropriateness of such evidence for audit purposes lies in the judgment of the auditor; in this respect,
audit evidence differs from legal evidence, which is circumscribed by rigid rules.
Audit evidence is necessary to support the auditor's opinion and report. The purpose of gathering and
evaluating audit evidence is to acquire data and information to be used as a basis for concludes whether
an entity's financial statements are presented fairly accordance with an identified financial reporting
framework.
How is Audit Evidence Accumulated?
Audit evidence is accumulated through the use of audit procedures. PSAS describe three categories of
procedures for gathering audit evidence, as shown in Table 10-1:
Used for obtaining an understanding of the chem entity and its environment, including internal
control Risk assessment procedures are performed during the audit planning and internal
control phases of the audit
Tests of controls
Used to test the operating effectiveness of controls preventing, or detecting and correcting,
material misstatements.
Substantive tests
Audit evidence is cumulative in nature and is primarily obtained from audit procedures performed
during the course of the audit. It may, however, also include information obtained from other sources
such as previous audits (provided the auditor has determined whether changes have occurred since the
previous audit that may affect its relevance to the current audit) or a firm's quality control procedures
for client acceptance and continuance. In addition to other sources inside and outside the entity, the
entity's accounting records are an important source of audit evidence.
Evidential matter supporting the financial statements consists of the accounting records and other
information (ie, all corroborating information available to the auditor). Table 10-2 presents examples of
accounting records and other information:
Accounting Records
Other Information
minutes of meetings.
confirmations from third parties,
analysts' reports
comparable data about competitors (benchmarking).
controls manuals,
information obtained by the auditor from such audit procedures as inquiry, observation, and
inspection.
other information developed by, or available to, the auditor that permits the auditor to reach
conclusions through valid reasoning
The entries in the accounting records are often initiated, recorded, processed and reported in electronic
form. In addition, the accounting records may be part of integrated systems that share data and support
all aspects of the entity's financial reporting, operations and compliance objectives. Other information is
a residual definition - audit evidence which is not classified as accounting records are classified as other
Information.
2. Internal controls - the result of the auditor's evaluation of the client's internal control structure.
When designing tests of controls and tests of details, the auditor shall determine means of
selecting items for testing that are effective in meeting the purpose of the audit procedure.
Actually, the means of selecting items for testing which are available to the auditor are:
- The auditor may decide that it will be most appropriate to examine the entire population of
items that make up a class of transactions or account balance (or a stratum within that
population).
- based on the auditor’s knowledge of the business and the characteristics of the population of
being tested
The auditor may decide to select specific items with a population because they are of high value,
or exhibit some other characteristic, for example items that a suspicious, unusual, particularly
risk-prone or the have a history of error.
The auditor may decide to examine items whose values exceed a certain amount so as to verify
a large proportion or account of the total amount of class of transaction balance or account
balance.
The auditor may examine items to obtain information about matters such as the nature of the
entity, the nature of transactions, and internal control.
3. Audit sampling.
- Audit sampling involves the application of audit procedures to less than 100 % of items within
a class of transactions or account balance such that all sampling units have a chance of selection
- can be use statistical or non-statistical
Audit Population- may consist of all the items within a class of transactions, such as all credit sales
processed for a specified period, or all the transactions constituting an account balances, such as
accounts receivable.
RAP - The auditor performs risk assessment procedures to obtain an understanding of the entity
and its environment, including its internal control
- do not involve the use of audit sampling
TOC - Tests of controls are performed when the auditor's risk assessment includes an
expectation of the operating effectiveness of controls.
STP - concerned with amounts and are of two types: tests of details of classes of transactions,
account balances, and disclosures and substantive analytical procedures.
Purpose of STP- to obtain audit evidence to detect material misstatements at the assertion level.
Audit Risk - as the likelihood that an auditor may unknowingly fail to modify his or her opinion on
materially misstated financial statements
1. The risk that material errors will occur in the process by which financial statements are
developed (risk of misstatement); and
2. The risk that any material errors that occur will not be detected by the auditor (detection risk).
1. Inherent risk represents the susceptibility of an account balance to errors that, when combined
with errors in other accounts, could be material and that are not monitored by related control
procedures.
2. Control risk represents the likelihood that errors could occur, and could be material when
combined with errors in other accounts, but will not be prevented or detected by the entity's
internal control structure
DETECTION RISK is the likelihood that errors could occur and could be material when combined with
errors in other accounts, but will not be detected by the auditor's procedures. The risk that material
errors will not be detected is directly controllable by the auditor through substantive tests of details
and other substantive audit procedures. Detection risk may be further subdivided into: sampling risk
and non-sampling risk.
The risk that material errors may occur and remain undetected is influenced by two categories of
uncertainties:
1. Sampling risk- uncertainties related to sampling. Sampling risk arises from the possibility that
the auditor's conclusion, based on a sample may be different from the conclusion reached if the
entire population were subjected to the same audit procedure.
Sampling risk results from the fact that a particular audit sample may not be representative of the
population tested. That is, the sample may contain disproportionately more or fewer control deviations
or monetary differences than exist in the class of transactions or account balance as a whole, suggesting
that the auditor's conclusions may be different if the entire population were tested. Since sampling risk
can be reduced simply by increasing sample size, sampling risk varies inversely with sample size: the
greater the sample size, the smaller the sampling risk. This relationship is quite logical, because if sample
size were increased to include all the items in a population, there would be no sampling and therefore
no sampling risk.
2. Non-sampling risk- uncertainties arising from factors unrelated to sampling. Non-sampling risk
includes all aspects of audit risk not due to sampling.
1. Risk of assessing control risk too high (or the risk of under reliance). This is the risk that a sample
deviation rate supports assessing control risk at the maximum when, unknown to the auditor, the
true deviation rate in the population supports assessing control risk below the maximum.
2. Risk of assessing control risk too low (or the risk of over reliance). This is the risk that a sample
does support assessing control risk below the maximum when, unknown to the auditor, the true
deviation rate in the population supports assessing control risk at the maximum.
If, based on an unrepresentative sample, an auditor estimated a 5 percent rate of deviation but was
willing to tolerate only 3 percent, and the true, but unknown, population rate of deviation was really
2 percent. In this example, the auditor would probably conclude that the control is not effective;
therefore, he would assess a higher level of control risk in determining the nature, timing, and
extent of substantive tests, because the sample indicated a higher deviation rate (i.e., 5 percent)
than the auditor was willing to tolerate (i.c., 3 percent). Unknown to the auditor, he or she would
actually be assessing control risk too high because the true population deviation rate (i.e., 2 percent)
is less than the tolerable rate which is 3 percent.
It can be concluded that assessing control risk too high results in over-auditing (doing more
substantive tests than necessary). Assessing control risk too high affects the efficiency (time, effort,
and cost) of the audit.
Assessing control risk too high results in inefficiency: when an auditor concludes that a control is
ineffective and therefore that control risk is high, he ordinarily sets a lower acceptable detection risk
and expands the scope of substantive tests to compensate for the perceived control deficiency. If
the expanded scope of substantive tests is unjustified, the audit will be less efficient since more
substantive tests will be performed than necessary.
It can be concluded that assessing control risk too low results in under-auditing (doing less substantive
tests than necessary). Assessing control risk too low affects the effectiveness of the audit (1.e., errors in
the financial statements may remain undetected) because the scope of substantive tests will be
restricted under the erroneous assumption that the control is effective and control risk in low, Thus, the
substantive tests may be ineffective in detecting material misstatements.
1. Risk of incorrect rejection is the risk that a sample supports the conclusion that a recorded
account balance is materially misstated when, unknown to the auditor, the account is not
materially misstated. Like the risk of assessing control risk too high in attribute sampling, the risk
of incorrect rejection relates to the efficiency of an audit, because an initially erroneous
conclusion that an account balance is misstated would ordinarily be revised when the auditor
considers other evidence or performs additional audit procedures. For example, an auditor
would ordinarily revise an initial conclusion that Cost of Goods Sold is misstated if a physical
inventory observation and inventory price testing revealed that Inventory was not misstated,
and other procedures revealed that Accounts Receivable and Sales were not misstated.
2. Risk of incorrect acceptance, in contrast, is the risk that a sample supports the conclusion that a
recorded account balance is not materially misstated when, unknown to the auditor, the
account is materially misstated. Like the risk of assessing control risk too low in attribute
sampling, the risk of incorrect acceptance relates to audit effectiveness and is particularly critical
to an auditor, because incorrectly accepting a misstated account balance could result in financial
statements that are materially misstated and therefore misleading.
Non-Sampling Risk
Non-sampling risk includes all aspects of audit risk not due to sampling. It includes the possibility of
selecting audit procedures that are not appropriate to achieve the specific objective. For example,
non-sampling risk could result from human errors, such as failing to detect errors contained within
sample items or overlooking or misinterpreting errors that are detected. Several factors can serve to
reduce non-sampling risk, including proper planning and supervision and encouraging effective firm-
wide quality control.
Sampling risk and non-sampling risk can affect the components of the risk of material misstatement.
For example, when performing tests of controls, the auditor may find no errors in a sample and
conclude that controls are operating effectively, when the rate of error in the population is, in fact,
unacceptably high (sampling risk). Or there may be errors in the sample which the auditor fails to
recognize (non sampling risk). With respect to substantive procedures, the auditor may use a variety
of methods to reduce detection risk to an acceptable level.
Depending on their nature, these methods will be subject to sampling and/or non-sampling risks.
For example, the auditor may choose an inappropriate substantive analytical procedure (non
sampling risk) or may find only minor misstatements in a test of details when, in fact, the population
misstatement greater than the tolerable amount (sampling risk). For both tests of controls and
substantive tests of details, sampling risk can be reduced by increasing sample size, while non-
sampling risk can be reduced by proper engagement planning supervision and review.
Statistical Sampling
Statistical sampling plans apply the laws of probability to aid an auditor in designing an efficient sample,
in measuring the sufficiency of evidence obtained, and in evaluating the sample results. It is a
mathematically derived tool that provides the auditor with an objective basis for expressing conclusions
about a population characteristic based upon a sample of items from the population.
1. It aids an auditor in determining the sample size required to meet given objectives.
2. It provides more objective audit evidence.
3. It allows an auditor to measure precision, reliability, and sampling error.
1. There is a danger of accepting statistical evidence at face value, without sufficient skepticism.
2. The cost of statistical sampling could exceed the benefits.
3. Statistical sampling may be less appropriate in some cases than non-statistical sampling or other
audit procedures for gathering evidence.
Non-Statistical Sampling
Non-statistical sampling plans rely exclusively on subjective judgment to determine sample size
and evaluate sample results. It is an auditor-derived tool for examining a sample of items from a
population. The auditor uses judgment in deciding which items should be included in the sample. It is
not appropriate to use judgment in selecting items for a sample and then use statistical sampling
techniques to express a conclusion about the population. Judgment sampling is preferable to statistical
sampling when the auditor desires to perform some operation on the sample items only (for example,
find and correct errors).
A properly designed non-statistical sampling application can provide results as effective as those
from a properly designed statistical sampling application. There is, however, one critical difference
between a statistical and non-statistical sampling application: statistical sampling allows an auditor to
measure sampling risk Statistical sampling plans measure the risk that a sample is not representative of
a population, it provides a mathematical measurement of the degree of uncertainty non statistical
sampling plans do not.
Statistical or non-statistical?
The choice between a statistical and a non-statistical sampling plan is based primarily on the
auditor's assessment of the relative costs and benefits. For example, an auditor might use non-statistical
sampling if the cost of selecting a statistical random sample was deemed too high. However, an auditor
might consider the cost justifiable if the related controls were critical, and a measure of sampling risk
was therefore deemed essential.
Note that the choice between a statistical and non-statistical sampling plan is made
independent of the selection of audit procedures. Audit sampling, whether statistical or non-statistical,
is merely a means for accomplishing audit procedures.
The objective of audit sampling is to draw conclusions about one or more population
characteristics without testing the entire population. Even with the most carefully designed sampling
plan, there is still a of uncertainty about whether sample results are representative of the population. A
sample can be evaluated in terms of probability only if the sample is randomly selected and thus free
from sampling bias. If each item in a population is not given an equal chance of selection, the sample
would be blased toward the population items with the greater chance of selection. Some common
methods of sample selection are presented below:
Random-Number Sampling
Systematic-sampling
This involves selecting every n item from a population of sequentially ordered items. Systematic
sampling eliminates the need to establish correspondence between population items and random digits,
and therefore is useful when population items lack identification numbers. The number of sequential
items to skip when selecting sample systematically is determined by dividing population size by sample
size. Systematic selection is useful for non-statistical sampling, and if the starting point is selected at
random, it can be useful for statistical sampling.
Haphazard sampling
Haphazard sampling consists of sampling units selected without special reasons, but also
without conscious bias. For example, a haphazard sample could consist of 90 items selected simply by
pulling Invoices from a file of cabinet drawer. Like block sampling, haphazard sampling may fail to select
samples that are wholly representative of the population tested. Although it may be useful for non-
statistical sampling, haphazard sampling is not appropriate for statistical sampling.
Characteristics of Interest
When designing an audit sample, the auditor should consider the objectives of the audit
procedure and the attributes of the population from which the sample will be drawn. The characteristic
of interest depends on the type of test that will be performed on the sample selected.
It is important for the auditor to ensure that the population is appropriate to the objective of
the audit procedure, and complete.
Appropriateness involves the consideration of the direction of testing. For example, if the
auditor's objective is to test for overstatement of accounts payable, the population could be defined as
the accounts payable listing. On the other hand, when testing for understatement of accounts payable,
the population is not the accounts payable listing but rather subsequent disbursements, unpaid invoices,
suppliers' statements, unmatched receiving reports or other populations that provide audit evidence of
understatement of accounts payable.
If the auditor intends to select payment vouchers from a file, conclusions cannot be drawn
about all vouchers for the period unless the auditor is satisfied that all vouchers have in fact been filed
(i.e., complete). Similarly, if the auditor intends to use the sample to draw conclusions about whether a
control activity operated effectively during the financial reporting period, the population needs to
include all relevant items from throughout the entire period. A different approach may be to stratify the
population and use sampling only to draw conclusions about the control activity during, say, the first 10
months of a year, and to use alternative audit procedures or a separate sample regarding the remaining
two months.
The auditor is required to obtain audit evidence about the accuracy and completeness of
information produced by the entity's information system when that information is used in performing
audit procedures. When performing audit sampling, the auditor performs audit procedures to ensure
that the information upon which the audit sampling is performed is sufficiently complete and accurate.
Stratification
Audit efficiency may be improved if the auditor stratifies a population by dividing it into discrete
sub-populations which have an identifying characteristic. The objective of stratification is to reduce the
variability of items within each stratum and therefore allow sample size to be reduced without a
proportional increase in sampling risk. Sub-populations need to be carefully defined such that any
sampling unit can only belong to one stratum.
When performing tests of details, a class of transaction or account balance or is often stratified
by monetary value. This allows greater audit effort to be directed to the larger value items which may
contain the greatest potential monetary error in terms of overstatement. Similarly, a population may be
stratified according to a particular characteristic that indicates a higher risk of error, for example, when
testing the valuation of accounts receivable, balances may be stratified by age.
The results of audit procedures applied to a sample of items within a stratum can only be
projected to the items that make up that stratum. To draw a conclusion on the entire population, the
auditor will need to consider the risk of material misstatement in relation to whatever other strata make
up the entire population.
Example: 20% of the items in a population may make up 90% of the value of an account
balance. The auditor may decide to examine a sample of these items. The auditor evaluates the results
of this sample and reaches a conclusion on the 90% of value separately from the remaining 10% (on
which a further sample or other means of gathering audit evidence will be used, or which may be
considered immaterial).
Value-Weighted Selection
It will often be efficient in performing tests of details, particularly when testing for
overstatements, to identify the sampling unit as the Individual monetary units (for example, pesos) that
make up a class of transactions or account balance. Having selected specific monetary units from within
the population, for example, the accounts receivable balance, the auditor then examines the particular
items, for example, individual balances, that contain those monetary units. This approach to defining the
sampling unit ensures that audit effort is directed to the larger value items because they have a greater
chance of selection, and can result in smaller sample sizes. This approach is ordinarily used in
conjunction with the systematic method of sample selection and is most efficient when selecting items
using CAATS.
Attributes Sampling
2. Define the attribute (characteristic of a control) and deviation (absence of an attribute) conditions.
3. Define the population.
Table 11-4 enumerates the following factors that affect the sample size for tests of controls. The
following are factors that the auditor considers when determining the sample size for a test of control.
These factors need to be considered together.
Table 11-4
Factors
1. An increase in the auditor's intended reliance on accounting and internal control systems
2. An increase in the rate of deviation from the prescribed control procedure that the auditor is
willing to accept (Tolerable deviation rate)
3. An increase in the rate of deviation from the prescribed control procedure that the auditor
expects to find in the population (Expected deviation rate)
4. An increase in the auditor's required confidence level (or conversely, a decrease in the risk that
the auditor will conclude that the control risk is lower than the actual control risk in the
population-risk of assessing control risk too low)
5. An increase in the number of sampling units in the
1. Increase
2. Decrease
3. Increase
4. Increase
5. Negligible Effect
1. The extent to which the risk of material misstatement is reduced by the operating effectiveness of
controls. The more assurance the auditor intends to obtain from the operating effectiveness of controls,
the lower the auditor's assessment of the risk of material misstatement will be, and the larger the
sample size will need to be. When the auditor's assessment of the risk of material misstatement at the
assertion level includes an expectation of the operating effectiveness of controls, the auditor is required
to perform tests of controls. Other things being equal, the more the auditor relies on the operating
effectiveness of controls in the risk assessment, the greater is the extent of the auditor's tests of
controls (and therefore, the sample size is increased).
2. The rate of deviation from the prescribed control activity the auditor is willing to accept (tolerable
error). The lower the rate of deviation that the auditor is willing to accept, the larger the sample size
needs to be.
3. The rate of deviation from the prescribed control activity the auditor expects to find in the
population (expected error). The higher the rate of deviation that the auditor expects, the larger the
sample size needs to be so as to be in a position to make a reasonable estimate of the actual rate of
deviation. Factors relevant to the auditor's consideration of the expected error rate include the auditor's
understanding of the business (in particular, risk assessment procedures understanding of internal
control), changes in personnel or in internal control, the results of audit periods and the results
undertaken obtain an to procedures applied in prior of other audit procedures. High expected error
rates ordinarily warrant little, if any, reduction of the assessed risk of material misstatement, and
therefore in such circumstances tests of controls would ordinarily be omitted.
4. The auditor's required confidence level. The greater the degree of confidence that the auditor
requires that the results of the sample are in fact indicative of the actual incidence of error in the
population, the larger the sample size needs to be.
5. The number of sampling units in the population. For large populations, the actual size of the
population has little, if any, effect on sample size. For small populations however, audit sampling is often
not as efficient as alternative means of obtaining sufficient appropriate audit evidence.
Sequential sampling is used when the auditor expects very few deviations within the population
being tested. Under this method, the auditor has no fixed sample size. After testing a sample, the
auditor makes a decision whether to stop testing or to continue with the sampling plan (hence the name
stop-or-go sampling).
Discovery sampling is most appropriate when no deviations are expected within the population
(thus, even a single deviation is a o cause for concern). This is normally used when the auditor suspects
froad. Discovery sampling involves the determination of a sample size which is sufficient to discover at
least one deviation to confirm whether fraud has occurred.
An external auditor is testing the authorization controls over purchases. Accordingly, the auditor
decided to sample purchase invoices and trace them to the related approved purchase orders. Suppose
that the auditor decided that based on an understanding of the client's internal control and the auditor's
judgment, the auditor
expects that there are three purchases with improper authorization (deviations) for every 100
purchase transactions (ie., expected population deviation rate is 39%);
believes that he can tolerate up to six deviations for every 100 purchase transactions (ie,
tolerable deviation rate is 6%);
Accordingly, the auditor assesses control risk at a LESS THAN HIGH because the expected population
deviation rate (3%) is less than the tolerable deviation rate (5%).
The auditor selected 100 samples and noted four deviations in the sample (sample deviation rate is
49%).
If non-statistical sampling is used, the sample deviation rate shall be compared against the tolerable
deviation rate and evaluated as follows
If SDR or TDR controls may be effective (CR-Less than High) If SDR TDR controls are not effective (CR-
High)
In the above example, SDR of 4% is less than the TDR of 6%; hence, the conclusion is that the
authorization controls over purchases are effective.
If statistical sampling is used, the auditor must first consider the effect of sampling risk Assume that in
the above example, the appropriate allowance for sampling risk is 1%.
The sample deviation rate shall first be added to the allowance for sampling risk (4% + 1%) to compute
the upper deviation rate (5 %). Then the upper deviation rate shall be compared against the tolerable
deviation rate and evaluated as follows:
In the above example, the UDR of 5% is less than the TDR of 6%; hence, the conclusion is that the
authorization controls over purchases are effective.
Variables Sampling
Table 11-5 presents factors that the auditor considers when determining the sample size for
sampling in substantive audit procedures. These factors need to be considered together.
Table 11-5
Factors
1. Increase
2. Increase
3. Decrease
4. Increase
5. Decrease
6. Increase
7. Decrease Negligible Effect
1. The auditor's assessment of the risk of material misstatement. The higher the auditor's
assessment of the risk of material misstatement, the larger the sample size needs to be. The auditor's
assessment of the risk of material misstatement is affected by inherent risk and control risk.
For example, if the auditor does not perform tests of controls, the auditor's risk assessment
cannot be reduced for the effective operation of internal controls with respect to the particular
assertion. Therefore, in order to reduce audit risk to an acceptably low level, the auditor needs a low
detection risk and will rely more on substantive procedures. The more audit evidence that is obtained
from tests of details (that is, the lower the detection risk), the larger the sample size will need to be.
2. The use of other substantive procedures directed at the same assertion. The more the auditor is
relying on other substantive procedures (tests of details or substantive analytical procedures) to reduce
to an acceptable level the detection risk regarding a particular class of transactions or account balance,
the less assurance the auditor will require from sampling and, therefore, the smaller the sample size can
be.
3. The auditor's required confidence level. The greater the degree of confidence that the auditor
requires that the results of the sample are in fact indicative of the actual amount of error in the
population, the larger the sample size needs to be.
4. The total error the auditor is willing to accept (tolerable error). The lower the total error that the
auditor is willing to accept, the larger the sample size needs to be.
5. The amount of error the auditor expects to find in the population (expected error). The greater the
amount of error the auditor expects to find in the population, the larger the sample size needs to be in
order to make a reasonable estimate of the actual amount of error in the population. Factors relevant to
the auditor's consideration of the expected error amount include the extent to which item values are
determined subjectively, the results of risk assessment procedures, the results of tests of control, the
results of audit procedures applied in prior periods, and the results of other substantive procedures.
6. Stratification. When there is a wide range (variability) in the monetary size of items in the population.
It may be useful to group items of similar size into separate sub-populations or strata. This is referred to
stratification. When a population can be appropriately stratified, the aggregate of the sample sizes from
the strata generally will be less than the sample size that would have been required to attain a given
level of sampling risk, had one sample been drawn from the whole population.
7. The number of sampling units in the population. For large populations, the actual size of the
population has little, if any, effect on sample size. Thus, for small populations, audit sampling is often not
as efficient as alternative means of obtaining sufficient appropriate audit evidence. (However, when
using monetary unit sampling, an increase in the monetary value of the population increases sample
size, unless this is offset by a proportional increase in materiality.)
The auditor should consider the sample results, the nature and cause of any errors Identified, and
their possible effect on the particular audit objective and on other areas of the audit.
When performing tests of controls, the auditor is primarily concerned with obtaining audit evidence
that controls operated effectively throughout the period of reliance. This includes obtaining audit
evidence about how controls were applied at relevant times during the period under audit, the
consistency with which they were applied, and by whom or by what means they were applied. The
concept of effectiveness of the operation of controls recognizes that some errors in the way controls are
applied by the entity may occur. However, when such errors are identified, the auditor makes specific
inquiries to understand these matters and also needs to consider matters such as:
In these cases, the auditor determines whether the tests of controls performed provide an
appropriate basis for use as audit evidence, whether additional tests of controls are necessary, or
whether the potential risks of misstatement need to be addressed using substantive procedures.
In analyzing the errors discovered, the auditor may observe that many have a common feature, for
example, type of transaction, location, product line or period of time. In such circumstances, the auditor
may decide to identify all items in the population that possess the common feature, and extend audit
procedures in that stratum. In addition, such errors may be intentional, and may indicate the possibility
of fraud.
Sometimes, the auditor may be able to establish that an error arises from an isolated event that has
not recurred other than on specifically identifiable occasions and is therefore not representative of
similar errors in the population (an anomalous error). To be considered an anomalous error, the auditor
has to have a high degree of certainty that such error is not representative of the population. The
auditor obtains this certainty by performing additional audit procedures. The additional audit
procedures depend on the situation, but are adequate to provide the auditor with sufficient appropriate
audit evidence that the error does not affect the remaining part of the population. One example is an
error caused by a computer breakdown that is known to have occurred on only one day during the
period.
In that case, the auditor assesses the effect of the breakdown, for example by examining specific
transactions processed on that day, an considers the effect of the cause of the breakdown on audit
procedure and conclusions. Another example is an error that is found to be caused by use of an
incorrect formula in calculating all inventor values at one particular branch. To establish that this is an
anomalous error, the auditor needs to ensure the correct formula has been use at other branches.
Projecting Errors
For tests of controls, no explicit projection of errors is necessary since the sample error rate is also
the projected rate of error for the population as a whole.
For tests of details, the auditor should project monetary errors found in the sample to the
population, and should consider the effect of the projected error on the particular audit objective and
on other areas of the audit. The auditor projects the total error for the population to obtain a broad
view of the scale of errors, and to compare this to the tolerable error. For tests of details, tolerable error
is the tolerable misstatement, and will be an amount less than or equal to the auditor's materiality used
for the individual class of transactions or account balances being audited.
Anomalous Errors
When an error has been established as an anomalous error, it may be excluded when projecting
sample errors to the population. The effect of any such error, if uncorrected, still needs to be considered
in addition to the projection of the non-anomalous errors.
Stratification
If a class of transactions or account balance has been divided into strata, the error is projected for
each stratum separately. Projected errors plus anomalous errors for each stratum are then combined
when considering the possible effect of errors on the total class of transactions or account balance.
Commonly used projection techniques are difference estimation, ratio estimation, and mean-per-
unit estimation.
Difference estimation is used to measure the estimated total misstatement amount in a population
when there is both a recorded value and an audited value for each item in the sample. This method
frequently results in smaller sample sizes than any other method, and it is relatively easy to use. The use
of difference estimation is appropriate when the misstatement in an account is not affected by the book
value of the item being examined.
Ratio estimation is similar to difference estimation except that the point estimate of the population
misstatement is determined by multiplying the portion of sample amount misstated times the total
recorded population book value. The ratio estimates result in even smaller sample sizes than difference
estimation if the size of the misstatements in the population is proportionate to the recorded value of
the population items. The use of ratio estimation is appropriate when the misstatement in an account is
directly proportional to its book value.
Under mean-per-unit estimation, the auditor is concerned with the audited value rather than the
misstatement amount of each item in the sample. Except for the definition of what is being measured,
this method is calculated in exactly the same manner as the difference estimate. The point estimate of
the audited value is the average audited value of items in the sample times the population size. The
computed precision interval is computed on the basis of the audited value of the sample items rather
than the misstatements. The use of mean-per-unit estimation is appropriate when individual
populations do not have recorded values.
An external auditor sent out positive confirmation requests to 2,000 customers. Population size
is 4,800 accounts, with a total recorded value of P380,000. Presented below are the summary results of
the examination of confirmation replies received from customers:
Difference P 8,600_
Average/mean book value
(P159,960+ 2,000) P80 (rounded)
Average/mean audited value
(P151,360 2,000) P76 (rounded)
Ratio estimation
1. Compute for the ratio of sample audited value to sample book value
2. Compute for the Estimated Audited Value (EAV) or estimated population audited value (EPAV)
=0.9462 x P380,000
Answer: P359,556
= SAV-SBV
=P151,360-P159,960
Answer: P8,600.overstated
=EPAV PBV
=P359,556-P380,000
Difference estimation
1. Compute for the average difference between SAV and SBV Average or mean audited value
=Average or mean book value
=P76-P80
Answer: P4 overstated
2. Compute for projected misstatement
=Average difference (number 1) x number of items in the population
=P4 x 4,800 accounts
Answer: P19.200 overstated
3. Compute for the EPAV
=PBV projected misstatement
=P380,000-P19,200 overstatement
Answer: P360,800
Answer: P364.800
Note: Assume that there is an allowance for sampling risk amounting to P40,000, then the EPAV would
be in the range of P324,800 and P404,800.
Sample selection of individual peso amounts in a population by the use of random or systematic
sample selection. PPS sampling is a sampling technique that uses attribute a sampling theory to evaluate
the results when a large number of transactions are captured within a single account. In PPS sampling,
the auditor randomly selects individual pesos from a population and then audits the balances,
transactions, or documents called logical units that include the pesos selected. Each peso in the
population has an equal chance of being selected, but the likelihood of selecting any one logical unit for
testing is directly proportional to its size. PPS sampling is most appropriate when no errors are expected
(although it is also appropriate when one or few errors are expected); and testing for overstatement
(normally for assets and income).
The auditor should evaluate the sample results to determine whether the assessment of the
relevant characteristic of the population is confirmed or needs to be revised. In the case of tests of
controls, an unexpectedly high sample error rate may lead to an increase in the assessed risk of material
misstatement, unless further audit evidence substantiating the initial assessment is obtained. In the case
of tests of details, an unexpectedly high error amount in a sample may cause the auditor believe that a
class of transactions or account balance is materially misstated, in the absence of further audit evidence
that no material misstatement exists.
If the total amount of projected error plus anomalous error is less than but close to that which
the auditor deems tolerable, the auditor considers the persuasiveness of the sample results in the light
of other audit procedures, and may consider it appropriate to obtain additional audit evidence. The total
of projected error plus anomalous error is the auditor's best estimate of error in the population.
However, sampling results are affected by sampling risk. Thus, when the best estimate of error is close
to the tolerable error, the auditor recognizes the risk that a different sample would result in a different
best estimate that could exceed the tolerable error. Considering the results of other audit procedures
helps the auditor to assess this risk, while the risk is reduced if additional audit evidence is obtained.
If the evaluation of sample results indicates that the assessment of the relevant characteristic of
the population needs to be revised, the auditor may:
1. Request management to investigate identified errors and the potential for further errors, and
to make any necessary adjustments; and/or
2. Modify the nature, timing and extent of further audit procedures. For example, in the case of
tests of controls, the auditor might extend the sample size, test an alternative control or modify related
substantive procedures; and/or