0% found this document useful (0 votes)
211 views19 pages

Auditing and Assurance Standards

The document provides a summary of auditing and assurance standards (AAS). It discusses key concepts like audit risk, inherent risk, control risk, detection risk, accounting systems, and internal control systems. The standards cover objectives of an audit, audit documentation requirements, auditor responsibilities regarding fraud and errors, obtaining sufficient audit evidence, and risk assessment and internal controls. The standards provide guidance to auditors on complying with professional responsibilities and applying appropriate audit procedures.

Uploaded by

Pankaj Kumar
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
211 views19 pages

Auditing and Assurance Standards

The document provides a summary of auditing and assurance standards (AAS). It discusses key concepts like audit risk, inherent risk, control risk, detection risk, accounting systems, and internal control systems. The standards cover objectives of an audit, audit documentation requirements, auditor responsibilities regarding fraud and errors, obtaining sufficient audit evidence, and risk assessment and internal controls. The standards provide guidance to auditors on complying with professional responsibilities and applying appropriate audit procedures.

Uploaded by

Pankaj Kumar
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 19

Complete Summary of AUDITING AND ASSURANCE STANDARDS 

--------------------------------------------------------------------------------

AAS 1 : Basic principles governing an audit 

Govern the auditor’s professional responsibilities, which should be complied with


for all audits. 

Compliance with the basic principles requires the application of auditing


procedures and reporting practices appropriate to the particular circumstances. 

The standard enunciates the following principles as integral part of any audit
carried out by a member of the ICAI. They are: Integrity, Objectivity and
Independence, Confidentiality, Skills and Competence, Work Performed by
Others, Documentation, Audit Evidence, Accounting System and Internal
Control, Audit Conclusions and Reporting, 

AAS 2 : Objective and scope of the audit of financial statements 

Objective of an audit of financial statements is to enable an auditor to express


an opinion. Responsibility for the preparation of financial statements is that of
the management of the enterprise. 

The scope of an audit will be determined by the terms of the engagement, the
requirements of relevant legislation and the pronouncements of the Institute. 

The terms of engagement cannot restrict the scope of an audit in relation to


matters which are prescribed by legislation or by the pronouncements of the
Institute. 

The audit should cover all relevant aspects of the enterprise, ensure sufficiency
and reliability of the information contained in the underlying accounting
records/source data and proper disclosure. 

It reognises the test nature of audit, exercise of judgment in deciding extent


and nature of audit procedures, and judgment nature of audit opinion. 

Constraints on the scope of the audit should form part of his report, and a
qualified/disclaimer of opinion be considered. 
AAS 3 : Audit documentation 

Requires an auditor to prepare sufficient and appropriate audit documentation


that provides a record of the basis for the auditor’s report and to demonstrate
that the audit was performed in accordance with AASs and applicable legal and
regulatory requirements 

Audit documentation implies record of audit procedures performed, relevant


audit evidence obtained, and conclusions the auditor reached. 

It includes working papers (on paper or on electronic media), audit


programmes, analyses, issues memoranda, letters of confirmation and
representation, checklists, extracts of important documents, correspondence
concerning significant matters, and schedules of work the auditor performed. 

The nature of the Audit Documentation should be such that, an experienced


auditor, having no connection with the audit should be able understand nature,
timing, extent and results of the audit procedures, the audit evidence obtained,
conclusions reached on significant matters, etc.. 

If the auditor has identified audit evidence that contradicts or is inconsistent


with the auditor’s final conclusion regarding a significant matter, the auditor
should document how the auditor addressed the contradiction or inconsistency
in forming the final conclusion. 

Nature, timing and extent of audit procedures performed should include: 

Who performed the audit work and the date of such work; and 

Who reviewed specific audit documentation and the date of such review. 

Documentation of nature, timing and extent of audit procedures performed,


should contain the identifying characteristics of the specific items tested. 

Reasons for Departure from a basic principle or essential procedure in an AAS to


achieve audit objective more effectively. 

In case of change of documentation subsequent to the date of audit report, it


should record new audit procedures carried out, new conclusions reached, when
and by whom such changes were made, and reviewed, the specific reasons for
the changes; and the effect, if any, of the changes on the auditor’s conclusions. 

Assembling of the audit file be finally completed not more than 90 days after
the date of the auditor’s report 

Any changes to the documentation after file assembling should be recorded. 

The auditor should have set procedures to maintain its confidentiality, safe
custody, protect its integrity, enable its accessibility and retrievability; and
enable its retention for a period sufficient to meet the needs of the firm, and
legal and professional requirements. 

Scanning of original documentation allowed for practical reasons so far as its


identical in all respects as it would have been in a physical form. 

AAS 4 : The auditor’s responsibility to consider fraud and error in an


audit of financial statements 

Audit planning must involve risk of material misstatements due to fraud and
errors. 

"Error" refers to an unintentional misstatement in the financial statements,


including the omission of an amount or a disclosure. 

"Fraud" refers to an intentional act by one or more individuals among


management, those charged with governance, employees, or third parties,
involving the use of deception to obtain an unjust or illegal advantage. Fraud
misstatements may include fraudulent financial reporting and misstatements
resulting from misappropriation of assets. Refer the annexure to the AAS for
circumstances indicating possibility of fraud. 

Primary responsibility for prevention and detection of fraud and errors rests with
the management. Audit cannot guarantee an absolute assurance about absence
of material misstatements due to fraud and errors. 

Auditor must plan and perform an audit with an attitude of professional


skepticism. 

When planning the audit, the auditor should make inquiries of management
about management’s assessment of misstatements resulting from fraud and
error and internal controls placed to address such risk and any known fraud or
error detected/suspected/investigated by management. 

The auditor must consider factors stated in AAS 6, AAS 29 and AAS 13 while
analysing a misstatement to be indicative of fraud. He must document the
procedures carried out and finding thereof. 

A misstatement resulting from fraud/suspected fraud/error, should be


communicated to management/regulatory authorities as appropriate. 

If the auditor unable to continue performing the audit as a result of a


misstatement then he must follow guidance in the AAS. 

AAS 5 : Audit evidence 

Auditor should evaluate whether he has obtained sufficient appropriate audit


evidence before drawing conclusions. 

Judgment as to what is sufficient appropriate audit evidence should be


evaluated by considerations such as risk of misstatement, internal controls,
materiality, trends and ratios, and so on. 

Audit evidence from compliance procedures reasonably assure the auditor in


respect of existence, effectiveness and continuity of controls. 

Audit evidence from compliance procedures reasonably assures the auditor in


respect of Existence – Valuation of assets/liability, Occurrence - Completeness –
Measurement of transaction, appropriate presentation and disclosure of items. 

Reliability of audit evidence depends on its source – internal or external, and on


its nature – visual, documentary or oral. Consistency amongst the sources and
nature will give increased assurance. 

Evidence can be obtained by performing compliance and substantive procedures


through Inspection, Observation, Computation and Analytical review. 
AAS 6

Risk Assessments and Internal Control

Introduction

1. The purpose of this Auditing and Assurance Standard (AAS) is to establish standards on
the procedures to be followed to obtain an understanding of the accounting and internal
control systems and on audit risk and its components: inherent risk, control risk and
detection risk. The principles laid down in the other AASs, issued by the Institute of
Chartered Accountants of India, would be applicable, to the extent practicable, to this AAS
also. In this Standard, the term 'financial information' encompasses 'financial statements'.
In some circumstances, specific legislations and regulations may require the auditor to
undertake procedures additional to those set out in this AAS.

2. The auditor should obtain an understanding of the accounting and internal control
systems sufficient to plan the audit and develop an effective audit approach. The auditor
should use professional judgement to assess audit risk and to design audit procedures to
ensure that it is reduced to an acceptably low level.

3. "Audit risk" means the risk that the auditor gives an inappropriate audit opinion when the
financial statements are materially misstated. Audit risk has three components: inherent
risk, control risk and detection risk.

4. "Inherent risk" is the susceptibility of an account balance or class of transactions to


misstatement that could be material, either individually or when aggregated with
misstatements in other balances or classes, assuming that there were no related internal
controls.

5. "Control risk" is the risk that a misstatement, that could occur in an account balance or
class of transactions and that could be material, either individually or when aggregated with
misstatements in other balances or classes, will not be prevented or detected and corrected
on a timely basis by the accounting and internal control systems.

6. "Detection risk" is the risk that an auditor's substantive procedures will not detect a
misstatement that exists in an account balance or class of transactions that could be
material, either individually or when aggregated with misstatements in other balances or
classes.

7. "Accounting System" means the series of tasks and records of an entity by which
transactions are processed as a means of maintaining financial records. Such systems
identify, assemble, analyse, calculate, classify, record, summarise and report transactions
and other events.
8. "Internal Control System" means all the policies and procedures (internal controls)
adopted by the management of an entity to assist in achieving management's objective of
ensuring, as far as practicable, the orderly and efficient conduct of its business, including
adherence to management policies, the safeguarding of assets, the prevention and
detection of fraud and error, the accuracy and completeness of the accounting records, and
the timely preparation of reliable financial information. The internal audit function
constitutes a separate component of internal control with the objective of determining
whether other internal controls are well designed and properly operated.

9. The system of internal control must be under continuing supervision by management to


determine that it is functioning as prescribed and is modified, as appropriate, for changes in
conditions. The internal control system extends beyond those matters which relate directly
to the functions of the accounting system and comprises:

(a) "the control environment" which means the overall attitude, awareness and actions of
directors and management regarding the internal control system and its importance in the
entity. The control environment has an effect on the effectiveness of the specific control
procedures and provides the background against which other controls are operated. A
strong control environment, for example, one with tight budgetary controls and an effective
internal audit function, can significantly complement specific control procedures. However, a
strong control environment does not, by itself, ensure the effectiveness of the internal
control system. Factors reflected in the control environment include:

¨ The entity's organisational structure and methods of assigning authority and responsibility
(including segregation of duties and supervisory functions).

¨ The function of the board of directors and its committees in the case of a company or the
corresponding governing body in case of any other entity.

¨ Management's philosophy and operating style.

¨ Management's control system including the internal audit function, personnel policies and
procedures. 

(b) "control procedures" which means those policies and procedures in addition to the
control environment which management has established to achieve the entity's specific
objectives. Specific control procedures include:

¨ Reporting and reviewing reconciliations.

¨ Checking the arithmetical accuracy of the records.

¨ Controlling applications and environment of computer information systems, for example,


by establishing controls over:

· changes to computer programs


· access to data files.

¨ Maintaining and reviewing control accounts and related subsidiary ledgers.

¨ Approving and controlling of documents.

¨ Comparing internal data with external sources of information.

¨ Comparing the results of physical verification of cash, fixed assets, investments and
inventory with corresponding accounting records.

¨ Restricting direct access to assets, records and information.

¨ Comparing and analysing the financial results with corresponding budgeted figures.

10. In the audit of financial statements, the auditor is concerned only with those policies
and procedures within the accounting and internal control systems that are relevant to the
assertions made in the financial statements. The understanding of relevant aspects of the
accounting and internal control systems, together with the inherent and control risk
assessments and other considerations, will enable the auditor to:

(a) assess the adequacy of the accounting system as a basis for preparing the financial
statements;

(b) identify the types of potential material misstatements that could occur in the financial
statements;

(c) consider factors that affect the risk of material misstatements; and

(d) develop an appropriate audit plan and determine the nature, timing and extent of his
audit procedures.

11. When developing the audit approach, the auditor considers the preliminary assessment
of control risk (in conjunction with the assessment of inherent risk) to determine the
appropriate detection risk that may be accepted by the auditor for the assertions made in
the financial statements and to determine the nature, timing and extent of substantive
procedures for such assertions.

Inherent Risk
12. In developing the overall audit plan, the auditor should assess inherent risk at the level
of financial statements. In developing the audit programme, the auditor should relate such
assessment to material account balances and classes of transactions at the level of
assertions made in the financial statements, or assume that inherent risk is high for the
assertion, taking into account factors relevant both to the financial statements as a whole
and to the specific assertions. When the auditor makes an assessment that the inherent risk
is not high, he should document the reasons for such assessment.

13. To assess inherent risk, the auditor would use professional judgement to evaluate
numerous factors, having regard to his experience of the entity from previous audit
engagements of the entity, any controls established by management to compensate for a
high level of inherent risk, and his knowledge of any significant changes which might have
taken place since his last assessment. Examples of such factors are:

At the Level of Financial Statements 


¨ The integrity of the management.

¨ Management's experience and knowledge and changes in management during the period,
for example, the inexperience of management may affect the preparation of the financial
statements of the entity.

¨ Unusual pressures on management, for example, circumstances that might predispose


management to misstate the financial statements, such as the industry experiencing a large
number of business failures or an entity that lacks sufficient capital to continue operations.

¨ The nature of the entity's business, for example, the potential for technological
obsolescence of its products and services, the complexity of its capital structure, the
significance of related parties and the number of locations and geographical spread of its
production facilities.

¨ Factors affecting the industry in which the entity operates, for example, economic and
competitive conditions as indicated by financial trends and ratios, and changes in
technology, consumer demand and accounting practices common to the industry.

AAS 6 : Risk assessments and internal control 

Obtain an understanding of the accounting and internal control systems to plan


audit, assess audit risk and design procedures to ensure it is reduced to an
acceptably low level. 

"Audit risk" means the risk that the auditor gives an inappropriate audit opinion
when the financial statements are materially misstated. It has 3 components:
inherent risk, control risk and detection risk. 

"Inherent risk" is the susceptibility of an account balance or class of


transactions to misstatement that could be material, either individually or when
aggregated with misstatements in other balances or classes, assuming that
there were no related internal controls. 
"Control risk" is the risk that a misstatement that could occur in an account
balance or class of transactions and that could be material, either individually or
when aggregated with misstatements in other balances or classes, will not be
prevented or detected and corrected on a timely basis by the accounting and
internal control systems. 

"Detection risk" is the risk that an auditor’s substantive procedures will not
detect a misstatement that exists in an account balance or class of transactions
that could be material, either individually or when aggregated with
misstatements in other balances or classes. 

Auditor should assess inherent risk at the level of financial statements. 

The auditor should make a assessment of control risk, at the assertion level, for
each material account balance or class of transactions. It means evaluating
effectiveness of accounting and internal control systems in preventing or
detecting and correcting material misstatements. 

The auditor should also evaluate the control environment, control procedures,
and assessment of control risk and test controls. He must make adopt suitable
nature, timing and extent of substantive procedures. 

There is an inverse relationship between detection risk and the combined level
of inherent and control risks. Regardless of risks assessed the auditor must
adopt suitable nature, timing and extent of substantive procedures for material
account balances and classes of transactions. 

For each of the above assessment/evaluations of risks and other items the
auditor must document his conclusions and evidence for reaching them. 

Auditor should communicate with management, at an appropriate level, of


material weaknesses in the design or operation of the accounting and internal
control systems, which have come to his attention. 

Auditor’s assessment of control risk is: 

Auditor’s assessment of inherent risk 


High 
Medium 
Low 

High 
Lowest 
Lower 
Medium 

Medium 
Lower 
Medium 
Higher 

Low 
Medium 
Higher 
Highest 

AAS 8 : Audit planning 

Plans should be made to cover at least (a) acquiring knowledge of the client’s
accounting systems, policies and internal control procedures; (b) establishing
the expected degree of reliance to be placed on internal control; (c) determining
and programming the nature, timing, and extent of the audit procedures to be
performed; and (d) co-ordinating the work to be performed. 

Planning should be continuous throughout the engagement. It must involve


overall plan for the expected scope and conduct of the audit and nature, timing
and extent of audit procedures. 

Audit plan should strive to accomplish that appropriate attention is devoted to


important areas of the audit; ensure that potential problems are promptly
identified; ensure that the work is completed expeditiously; utilise the
assistants properly; and co-ordinate the work done by other auditors and
experts. 

Matters to be considered in developing the audit plan given in para 11 of the


AAS. 
Auditor should document his overall plan based on size and complexity of the
audit. A time budget, in which hours are budgeted for the various audit areas or
procedures can be effective planning tool. 

Planning should consider factors such as complexity of the audit, the


environment in which the entity operates, previous experience with the client,
discussions with client and knowledge of the client’s business. 

A written audit programme should be made setting forth procedures needed to


implement the audit plan. It may contain audit objectives for each area and
should have sufficient details to serve as a set of instructions to the assistants
involved and as a means to control. 

AAS 13 : Audit materiality 

Information is material if its misstatement (omission or erroneous statement)


could influence the economic decisions of users taken on the basis of the
financial information. 

Materiality depends on the size and nature of the item, judged in the
circumstances of its misstatement. The assessment of what is material is a
matter of professional judgment. Materiality can be considered at individual
account balances, classes of transaction, legal and regulatory requirements,
cumulative impact of small misstatements. 

Materiality should be considered while determining the nature, timing and


extent of audit procedures, evaluating the effect of misstatements and degree
of audit risk. 

If the aggregate of the uncorrected misstatements that the auditor has


identified approaches the materiality level, or if auditor determines that the
aggregate of uncorrected misstatements causes the financial information to be
materially misstated, he should consider requesting the management to adjust
the financial information or extending his audit procedures. 

AAS 14 : Analytical procedures 

"Analytical procedures" means the analysis of significant ratios and trends


including the resulting investigation of fluctuations and relationships that are
inconsistent with other relevant information or which deviate from predicted
amounts. 

Auditor should apply analytical procedures at the planning (in understanding


business and potential risks) and overall review stages of the audit. 

Analytical procedures include comparisons of the entity’s financial information


with comparable information – for prior periods, of budgets or forecasts,
estimation of depreciation charge for the year etc., and similar industry data. 

Analytical procedures also include consideration of relationships among


elements of financial information that would be expected to conform to a
predictable pattern, such as gross margin percentages and between financial
information and relevant non-financial information, such as payroll costs to
number of employees. 

In case analytical procedure is used as substantive test then auditor must


consider reliability, relevance and source of information, changes required to be
made to make the information comparable. 

When analytical procedures identify significant fluctuations or relationships that


are inconsistent with other relevant information or that deviate from predicted
amounts, the auditor should investigate and obtain adequate explanations and
appropriate corroborative evidence. 

AAS 16 : Going concern 

Appropriateness of the going concern assumption underlying the preparation of


the financial statements should be considered while planning, performing and
reviewing results of audit. 

Auditor must critically evaluate financial, operating and other indicators that
question the going concern assumption. (refer AAS para 6) 

When going concern assumption is in question, the auditor should gather audit
evidence to attempt to resolve, the question regarding the entity’s ability to
continue in operation for the foreseeable future and document that same. 

Where going concern assumption is appropriate because of mitigating factors,


the auditor should consider whether management’s plans or other factors need
to be disclosed in the financial statements. 

Where the going concern question is not satisfactorily resolved, the financial
statements should disclose adequately: 

the principal conditions that raise substantial doubt about the entity’s ability to
continue in operation for the foreseeable future; 

state that there is significant uncertainty that the entity will be able to continue
as a going concern and, therefore, may be unable to realise its assets and
discharge its liabilities in the normal course of business; and 

state that the financial statements do not include any adjustments relating to
the recoverability and classification of recorded asset amounts, or to amounts
and classification of liabilities that may be necessary if the entity is unable to
continue as a going concern. 

Where disclosure is inadequate the auditor should express a qualified or adverse


opinion, as appropriate. Where disclosure is adequate audit report should
highlight the going concern problem by drawing attention to the note giving
disclosure. 

AAS 20 : Knowledge of the business 

Auditor should have or obtain knowledge of the business to enable him to


identify and understand the events, transactions and practices that, in his
judgment, may have a significant effect on the financial statements or on the
examination or audit report. 

Knowledge of business, which is a continuous and cumulative process, should


be used by the auditor in assessing inherent and control risks planning and
performing the audit effectively and efficiently, in determining the nature,
timing and extent of audit procedures, evaluating audit evidence and providing
better service to the client. 

For continuing engagements, the auditor would update and re-evaluate


information gathered previously, including information in the prior year’s
working papers. He must document all his finding. 

Auditor should ensure that his staff also is communicated with this knowledge. 
Refer the AAS appendix for matters for a illustrative list of matters to consider. 

AAS 21 : Consolidation of laws and regulations in an audit of financial


statements 

The Standard deals with Auditor’s consideration of compliance with laws and
regulations and the audit procedures where non-compliance is observed. 

Management is responsible for ensuring that entity’s operations are as per the
relevant laws and regulations; i.e., Responsibility for prevention and detection
rests with management. 

Auditor must obtain: 

a general understanding of the legal and regulatory framework applicable to the


entity and the procedures adopted by entity to comply with such framework. 

a written representations from management that management has disclosed all


known or possible non-compliances of laws and regulations. 

sufficient appropriate audit evidences of the compliances with laws and


regulations affecting determination of material amounts and disclosures in
financial statements. 

Appropriate planning and performing of such audit tests are required to identify
non-compliance with applicable laws and regulations. Sufficient evidences
should be obtained of such non-compliances and they be considered while
preparing financial statements. 

AAS 23 : Audit considerations relating to entities using Service


organisations 

The Standard is prescribed for an auditor whose client uses service


organisations. Service organisations undertake activities such as information
processing, maintenance of accounting records, facilities management etc. 

Auditor of the client should determine the significance of activities of service


organisations and their relevance to the audit. 
Instances of factors to be to be considered are the nature of services, terms of
contract, material financial statements affected by use of service organisations
and their inherent risks, client accounting and internal control interactions with
those of service organisations, financial strength and capabilities of service
organisations etc. 

Auditor of the client who is using a service organisation auditor’s ("other


auditor") report should consider the nature, scope of and content of his report.
The service organisation’s auditor report shall be any one of the following: Type
A or Type B reports. 

Type A Reports are on suitability of design that provides an understanding of


the service organisation’s accounting and internal control systems and the
service organisations auditors’ opinion on the same. Such report would not be
used as a basis for reducing the assessment of control risk. 

Type B Reports are on suitability of design and operating effectiveness that


covers besides matters stated in Part A, the details of tests of controls identified
and performed by the other auditor and their related results. The client auditor
uses such reports as evidences to support a lower control risk assessment. 

The service organisation’s auditor may be engaged to perform substantive


procedures that are of use to the client’s auditor. 

AAS 26 : Terms of audit engagement 

The Standard deals with agreeing to terms of engagement and the auditor’s
response to changes in the terms of an engagement to one that gives a lower
level of assurance. 

Auditor and Client must agree on the terms of engagement that is recorded in a
contract or any other suitable form of contract. To avoid misunderstandings the
engagement letter must be sent to client before the commencement of the
engagement. 

Audit engagement letter must be clear and precise and must include the scope
of assignment, declaration that the audit process are subjected to peer review,
the objectives of financial statements, communicating matters of conflicts of
interest, and the responsibilities of the management. 
Management responsibilities are the selection and implementation of accounting
standards and their departures, records maintenance, efficient internal controls
for safeguarding assets and prevention of frauds and other irregularities 

The changes in terms of engagement letter must be agreed between the client
and auditor. If in a situation the auditor is not in agreement with suggested
changes than he should withdraw from the engagement. Subsequently on
withdrawal, the auditor will need to consider whether there is any contractual
obligation or otherwise to report the circumstances necessitating his withdrawal
to parties like the board of directors or shareholders. 

AAS 27 : Communication of audit matters with those charged with


governance 

This Standard deals with establishing standards on communications of audit


matters arising from the audit of financial statements between the auditor and
those charged with governance of an entity. The Standard does not provide
guidance on communication by the auditors to outside agencies like the external
regulator or supervising agencies. 

The Standard also includes guidance on confidentiality requirements, laws and


regulations. 

"Governance" refers to the role of persons who are entrusted with the
supervision, control and direction of an entity. Auditors to determine the
relevant persons who are charged with Governance and with whom audit
matters of Governance are required to be communicated. 

The structure of Governance may be different for very entity. Example in case
of companies the board, audit committee, corporate governance committee; in
case of trusts the trustees or the management etc. 

The communications of matters of Governance are required to be reported on a


timely basis. This may be either orally or in writing. In case of oral
communications, the auditor must document such facts and responses of the
entity in his working papers. 

Instances of Matters of Governance of Interest are limitations in the scope of


audit, changes in accounting polices which are having a material effect,
modification in the auditors report, continuity of the entity as a going concern,
disclosures of significant risks and exposures in financial statements, any other
matters agreed in the audit engagement letter. 

Auditors are not required to design procedures for specific purposes of


identifying the matters of Governance. 

AAS 29: Auditing in a computer information systems environment 

This AAS sets the standards on procedures to be followed when an audit is


conducted in a computer information systems (CIS) environment. 

Auditor to have sufficient knowledge of the computer information systems to


plan, direct, supervise, control and review the work performed. 

In planning audit in a CIS environment, the auditor should obtain an


understanding of the significance and complexity of the CIS activities and the
availability of the data for use in the audit. 

When the CIS are significant, the auditor should also obtain an understanding of
the CIS environment and how it may influence the assessment of inherent and
control risks. 

He must evaluate risks and controls in the light of the following – Lack of
transaction trails, Uniform processing of transactions, Lack of segregation of
functions, Potential for errors and irregularities, Initiation or execution of
transactions, Dependence of other controls over computer processing, Potential
for increased management supervision, Potential for the use of computer-
assisted audit techniques. 

Auditor should consider whether CIS: 

ensure that authorised, correct and complete data is made available for
processing; 

provide for timely detection and correction of errors; 

ensure that in case of interruption in the working of the CIS environment due to
power, mechanical or processing failures, the system restarts without distorting
the completion of the entries and records; 
ensure the accuracy and completeness of output; 

provide adequate data security against fire and other calamities, wrong
processing, frauds etc.; 

prevent unauthorised amendments to the programmes; and 

provide for safe custody of source code of application software and data files. 

Auditor should document his audit plan and also assessment of risks as per AAS
6 and design audit procedures to reduce the audit risk. 

Notes: 

Only selected AAS are covered here considering their pervasive importance and
applicability. 

All AAS should be read with reference to the "Preface to the Statements on
Standard Auditing Practices". AAS are mandatory with respect to all attest
engagements carried out by the members. Any audit not done in accordance
with the AAS, the auditor draw attention to material departures therefrom in his
report. 

Points covered in one AAS but are otherwise covered in detail in another AAS
are ignored in the first one. 

Detailed definitions should be read from the AAS. 

Subjects of AAS that are covered by an AS are not produced here. 

For a detailed illustrative checklists on AAS and AS refer the Society’s


publication Audit Checklists for Companies. 

For exhaustive List of AAS [click here] 

AAS 33 : Engagements to review financial statements 

This Standard provides guidance to the auditor’s professional responsibilities,


the formats and contents for a review of financial statements. 
Auditor needs to comply with the code of ethics prescribed by the Institute of
Chartered Accountants of India. 

The procedures for a review shall be governed by the requirements of this


Standard, the relevant laws and regulations governing the entity and where
appropriate the terms of the review engagement and its reporting
requirements. 

The auditor must plan the work for an effective review by way of obtaining or
updating knowledge of the client businesses, accounting and operating systems
etc. Important matters of review should be documented including making
inquiries on matters subsequent the balance sheet dates that may require
adjustment or disclosures in the financial statements. 

Review reports wherever possible to quantify the matters that impair the true
and fair view with either express a negative assurances or adverse statements
on the financial statements. Limitation of scope must be specified by way of
qualification or negative assurances when such limitations are significant in
nature. 

The date of review report must not be a date when the financial statements are
signed or approved by the management. Review reports must include
performing procedures relating to events occurring up to date of signing of the
report.
_________________

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy