Auditing and Assurance Standards
Auditing and Assurance Standards
--------------------------------------------------------------------------------
The standard enunciates the following principles as integral part of any audit
carried out by a member of the ICAI. They are: Integrity, Objectivity and
Independence, Confidentiality, Skills and Competence, Work Performed by
Others, Documentation, Audit Evidence, Accounting System and Internal
Control, Audit Conclusions and Reporting,
The scope of an audit will be determined by the terms of the engagement, the
requirements of relevant legislation and the pronouncements of the Institute.
The audit should cover all relevant aspects of the enterprise, ensure sufficiency
and reliability of the information contained in the underlying accounting
records/source data and proper disclosure.
Constraints on the scope of the audit should form part of his report, and a
qualified/disclaimer of opinion be considered.
AAS 3 : Audit documentation
Who performed the audit work and the date of such work; and
Who reviewed specific audit documentation and the date of such review.
Assembling of the audit file be finally completed not more than 90 days after
the date of the auditor’s report
The auditor should have set procedures to maintain its confidentiality, safe
custody, protect its integrity, enable its accessibility and retrievability; and
enable its retention for a period sufficient to meet the needs of the firm, and
legal and professional requirements.
Audit planning must involve risk of material misstatements due to fraud and
errors.
Primary responsibility for prevention and detection of fraud and errors rests with
the management. Audit cannot guarantee an absolute assurance about absence
of material misstatements due to fraud and errors.
When planning the audit, the auditor should make inquiries of management
about management’s assessment of misstatements resulting from fraud and
error and internal controls placed to address such risk and any known fraud or
error detected/suspected/investigated by management.
The auditor must consider factors stated in AAS 6, AAS 29 and AAS 13 while
analysing a misstatement to be indicative of fraud. He must document the
procedures carried out and finding thereof.
Introduction
1. The purpose of this Auditing and Assurance Standard (AAS) is to establish standards on
the procedures to be followed to obtain an understanding of the accounting and internal
control systems and on audit risk and its components: inherent risk, control risk and
detection risk. The principles laid down in the other AASs, issued by the Institute of
Chartered Accountants of India, would be applicable, to the extent practicable, to this AAS
also. In this Standard, the term 'financial information' encompasses 'financial statements'.
In some circumstances, specific legislations and regulations may require the auditor to
undertake procedures additional to those set out in this AAS.
2. The auditor should obtain an understanding of the accounting and internal control
systems sufficient to plan the audit and develop an effective audit approach. The auditor
should use professional judgement to assess audit risk and to design audit procedures to
ensure that it is reduced to an acceptably low level.
3. "Audit risk" means the risk that the auditor gives an inappropriate audit opinion when the
financial statements are materially misstated. Audit risk has three components: inherent
risk, control risk and detection risk.
5. "Control risk" is the risk that a misstatement, that could occur in an account balance or
class of transactions and that could be material, either individually or when aggregated with
misstatements in other balances or classes, will not be prevented or detected and corrected
on a timely basis by the accounting and internal control systems.
6. "Detection risk" is the risk that an auditor's substantive procedures will not detect a
misstatement that exists in an account balance or class of transactions that could be
material, either individually or when aggregated with misstatements in other balances or
classes.
7. "Accounting System" means the series of tasks and records of an entity by which
transactions are processed as a means of maintaining financial records. Such systems
identify, assemble, analyse, calculate, classify, record, summarise and report transactions
and other events.
8. "Internal Control System" means all the policies and procedures (internal controls)
adopted by the management of an entity to assist in achieving management's objective of
ensuring, as far as practicable, the orderly and efficient conduct of its business, including
adherence to management policies, the safeguarding of assets, the prevention and
detection of fraud and error, the accuracy and completeness of the accounting records, and
the timely preparation of reliable financial information. The internal audit function
constitutes a separate component of internal control with the objective of determining
whether other internal controls are well designed and properly operated.
(a) "the control environment" which means the overall attitude, awareness and actions of
directors and management regarding the internal control system and its importance in the
entity. The control environment has an effect on the effectiveness of the specific control
procedures and provides the background against which other controls are operated. A
strong control environment, for example, one with tight budgetary controls and an effective
internal audit function, can significantly complement specific control procedures. However, a
strong control environment does not, by itself, ensure the effectiveness of the internal
control system. Factors reflected in the control environment include:
¨ The entity's organisational structure and methods of assigning authority and responsibility
(including segregation of duties and supervisory functions).
¨ The function of the board of directors and its committees in the case of a company or the
corresponding governing body in case of any other entity.
¨ Management's control system including the internal audit function, personnel policies and
procedures.
(b) "control procedures" which means those policies and procedures in addition to the
control environment which management has established to achieve the entity's specific
objectives. Specific control procedures include:
¨ Comparing the results of physical verification of cash, fixed assets, investments and
inventory with corresponding accounting records.
¨ Comparing and analysing the financial results with corresponding budgeted figures.
10. In the audit of financial statements, the auditor is concerned only with those policies
and procedures within the accounting and internal control systems that are relevant to the
assertions made in the financial statements. The understanding of relevant aspects of the
accounting and internal control systems, together with the inherent and control risk
assessments and other considerations, will enable the auditor to:
(a) assess the adequacy of the accounting system as a basis for preparing the financial
statements;
(b) identify the types of potential material misstatements that could occur in the financial
statements;
(c) consider factors that affect the risk of material misstatements; and
(d) develop an appropriate audit plan and determine the nature, timing and extent of his
audit procedures.
11. When developing the audit approach, the auditor considers the preliminary assessment
of control risk (in conjunction with the assessment of inherent risk) to determine the
appropriate detection risk that may be accepted by the auditor for the assertions made in
the financial statements and to determine the nature, timing and extent of substantive
procedures for such assertions.
Inherent Risk
12. In developing the overall audit plan, the auditor should assess inherent risk at the level
of financial statements. In developing the audit programme, the auditor should relate such
assessment to material account balances and classes of transactions at the level of
assertions made in the financial statements, or assume that inherent risk is high for the
assertion, taking into account factors relevant both to the financial statements as a whole
and to the specific assertions. When the auditor makes an assessment that the inherent risk
is not high, he should document the reasons for such assessment.
13. To assess inherent risk, the auditor would use professional judgement to evaluate
numerous factors, having regard to his experience of the entity from previous audit
engagements of the entity, any controls established by management to compensate for a
high level of inherent risk, and his knowledge of any significant changes which might have
taken place since his last assessment. Examples of such factors are:
¨ Management's experience and knowledge and changes in management during the period,
for example, the inexperience of management may affect the preparation of the financial
statements of the entity.
¨ The nature of the entity's business, for example, the potential for technological
obsolescence of its products and services, the complexity of its capital structure, the
significance of related parties and the number of locations and geographical spread of its
production facilities.
¨ Factors affecting the industry in which the entity operates, for example, economic and
competitive conditions as indicated by financial trends and ratios, and changes in
technology, consumer demand and accounting practices common to the industry.
"Audit risk" means the risk that the auditor gives an inappropriate audit opinion
when the financial statements are materially misstated. It has 3 components:
inherent risk, control risk and detection risk.
"Detection risk" is the risk that an auditor’s substantive procedures will not
detect a misstatement that exists in an account balance or class of transactions
that could be material, either individually or when aggregated with
misstatements in other balances or classes.
The auditor should make a assessment of control risk, at the assertion level, for
each material account balance or class of transactions. It means evaluating
effectiveness of accounting and internal control systems in preventing or
detecting and correcting material misstatements.
The auditor should also evaluate the control environment, control procedures,
and assessment of control risk and test controls. He must make adopt suitable
nature, timing and extent of substantive procedures.
There is an inverse relationship between detection risk and the combined level
of inherent and control risks. Regardless of risks assessed the auditor must
adopt suitable nature, timing and extent of substantive procedures for material
account balances and classes of transactions.
For each of the above assessment/evaluations of risks and other items the
auditor must document his conclusions and evidence for reaching them.
High
Lowest
Lower
Medium
Medium
Lower
Medium
Higher
Low
Medium
Higher
Highest
Plans should be made to cover at least (a) acquiring knowledge of the client’s
accounting systems, policies and internal control procedures; (b) establishing
the expected degree of reliance to be placed on internal control; (c) determining
and programming the nature, timing, and extent of the audit procedures to be
performed; and (d) co-ordinating the work to be performed.
Materiality depends on the size and nature of the item, judged in the
circumstances of its misstatement. The assessment of what is material is a
matter of professional judgment. Materiality can be considered at individual
account balances, classes of transaction, legal and regulatory requirements,
cumulative impact of small misstatements.
Auditor must critically evaluate financial, operating and other indicators that
question the going concern assumption. (refer AAS para 6)
When going concern assumption is in question, the auditor should gather audit
evidence to attempt to resolve, the question regarding the entity’s ability to
continue in operation for the foreseeable future and document that same.
Where the going concern question is not satisfactorily resolved, the financial
statements should disclose adequately:
the principal conditions that raise substantial doubt about the entity’s ability to
continue in operation for the foreseeable future;
state that there is significant uncertainty that the entity will be able to continue
as a going concern and, therefore, may be unable to realise its assets and
discharge its liabilities in the normal course of business; and
state that the financial statements do not include any adjustments relating to
the recoverability and classification of recorded asset amounts, or to amounts
and classification of liabilities that may be necessary if the entity is unable to
continue as a going concern.
Auditor should ensure that his staff also is communicated with this knowledge.
Refer the AAS appendix for matters for a illustrative list of matters to consider.
The Standard deals with Auditor’s consideration of compliance with laws and
regulations and the audit procedures where non-compliance is observed.
Management is responsible for ensuring that entity’s operations are as per the
relevant laws and regulations; i.e., Responsibility for prevention and detection
rests with management.
Appropriate planning and performing of such audit tests are required to identify
non-compliance with applicable laws and regulations. Sufficient evidences
should be obtained of such non-compliances and they be considered while
preparing financial statements.
The Standard deals with agreeing to terms of engagement and the auditor’s
response to changes in the terms of an engagement to one that gives a lower
level of assurance.
Auditor and Client must agree on the terms of engagement that is recorded in a
contract or any other suitable form of contract. To avoid misunderstandings the
engagement letter must be sent to client before the commencement of the
engagement.
Audit engagement letter must be clear and precise and must include the scope
of assignment, declaration that the audit process are subjected to peer review,
the objectives of financial statements, communicating matters of conflicts of
interest, and the responsibilities of the management.
Management responsibilities are the selection and implementation of accounting
standards and their departures, records maintenance, efficient internal controls
for safeguarding assets and prevention of frauds and other irregularities
The changes in terms of engagement letter must be agreed between the client
and auditor. If in a situation the auditor is not in agreement with suggested
changes than he should withdraw from the engagement. Subsequently on
withdrawal, the auditor will need to consider whether there is any contractual
obligation or otherwise to report the circumstances necessitating his withdrawal
to parties like the board of directors or shareholders.
"Governance" refers to the role of persons who are entrusted with the
supervision, control and direction of an entity. Auditors to determine the
relevant persons who are charged with Governance and with whom audit
matters of Governance are required to be communicated.
The structure of Governance may be different for very entity. Example in case
of companies the board, audit committee, corporate governance committee; in
case of trusts the trustees or the management etc.
When the CIS are significant, the auditor should also obtain an understanding of
the CIS environment and how it may influence the assessment of inherent and
control risks.
He must evaluate risks and controls in the light of the following – Lack of
transaction trails, Uniform processing of transactions, Lack of segregation of
functions, Potential for errors and irregularities, Initiation or execution of
transactions, Dependence of other controls over computer processing, Potential
for increased management supervision, Potential for the use of computer-
assisted audit techniques.
ensure that authorised, correct and complete data is made available for
processing;
ensure that in case of interruption in the working of the CIS environment due to
power, mechanical or processing failures, the system restarts without distorting
the completion of the entries and records;
ensure the accuracy and completeness of output;
provide adequate data security against fire and other calamities, wrong
processing, frauds etc.;
provide for safe custody of source code of application software and data files.
Auditor should document his audit plan and also assessment of risks as per AAS
6 and design audit procedures to reduce the audit risk.
Notes:
Only selected AAS are covered here considering their pervasive importance and
applicability.
All AAS should be read with reference to the "Preface to the Statements on
Standard Auditing Practices". AAS are mandatory with respect to all attest
engagements carried out by the members. Any audit not done in accordance
with the AAS, the auditor draw attention to material departures therefrom in his
report.
Points covered in one AAS but are otherwise covered in detail in another AAS
are ignored in the first one.
The auditor must plan the work for an effective review by way of obtaining or
updating knowledge of the client businesses, accounting and operating systems
etc. Important matters of review should be documented including making
inquiries on matters subsequent the balance sheet dates that may require
adjustment or disclosures in the financial statements.
Review reports wherever possible to quantify the matters that impair the true
and fair view with either express a negative assurances or adverse statements
on the financial statements. Limitation of scope must be specified by way of
qualification or negative assurances when such limitations are significant in
nature.
The date of review report must not be a date when the financial statements are
signed or approved by the management. Review reports must include
performing procedures relating to events occurring up to date of signing of the
report.
_________________