Audit Evidence and Procedures (Advanced)

The auditor must obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on which to base the audit opinion.

Sufficiency = the quantity of evidence. Affected by: the assessed risk of misstatement (higher risk → more evidence needed), the quality (appropriateness) of the evidence obtained, and the source and nature of the evidence.

Appropriateness = the quality of evidence — its relevance (does it relate to the assertion being tested?) and reliability (can the auditor depend on it?).

Factors affecting reliability:

• Evidence from external sources (bank confirmations, supplier statements) is more reliable than internal sources
• Evidence generated internally is more reliable when internal controls are effective
• Evidence obtained directly by the auditor (observation, inspection, recalculation) is more reliable than evidence obtained indirectly (inquiry)
• Documentary evidence (written, electronic) is more reliable than oral evidence
• Original documents are more reliable than photocopies or faxes

Seven types of audit procedure for obtaining evidence:

1. Inspection — examining records, documents, or tangible assets
2. Observation — watching a process or procedure (e.g., inventory count)
3. Inquiry — seeking information from knowledgeable persons (oral or written)
4. Confirmation — obtaining a direct response from a third party (external confirmation)
5. Recalculation — checking the mathematical accuracy of documents or records
6. Reperformance — independently re-executing a procedure or control
7. Analytical procedures — evaluating financial information through analysis of plausible relationships

Inventory (ISA 501.4-8):

• If inventory is material, the auditor must: attend the physical inventory count (inspect inventory, observe count procedures, perform test counts), OR if attendance at the count date is impracticable, perform alternative procedures to verify existence and condition
• If inventory is held by a third party: obtain confirmation from the third party, and consider whether inspection of the inventory or additional procedures are needed based on risk
• Procedures during attendance: Observe compliance with management's count instructions, inspect condition of inventory (obsolete, damaged, slow-moving), perform test counts and compare to count records, check cut-off (last goods inward/despatch notes before and after the count date)

Litigation and claims (ISA 501.9-12):

• The auditor must identify litigation and claims involving the entity that may give rise to a risk of material misstatement (provisions under IAS 37, contingent liabilities)
• Procedures: inquire of management, review board minutes, review legal invoices/correspondence, obtain a letter from the entity's lawyers (external legal confirmation) regarding litigation status, likely outcome, and estimated financial effect
• If management refuses to give the auditor permission to communicate with the entity's lawyers: this is a scope limitation — consider the implications for the auditor's report

Segment information (ISA 501.13):

• Evaluate whether segment information is presented in accordance with the applicable framework (IFRS 8)
• Consider the methods used to determine segment information and whether they are consistent with the framework
• Perform analytical procedures and other tests on segment data

External confirmations are direct written responses from third parties to the auditor. They provide high-quality evidence because they are from an independent external source.

Common confirmations:

• Bank confirmations: Confirming bank balances, loans, overdrafts, guarantees, security held
• Trade receivables confirmations: Confirming balances owed by customers (existence and accuracy)
• Trade payables confirmations: Confirming balances owed to suppliers (completeness)
• Legal confirmations: Confirming litigation status and outcomes
• Investment confirmations: Confirming holdings and values with custodians or registrars

Types of confirmation:

• Positive confirmation: The respondent is asked to reply in all cases — either confirming the information or stating any differences. More reliable because silence does not constitute confirmation.
• Negative confirmation: The respondent is asked to reply only if they disagree with the stated information. Less reliable — a non-response may mean the respondent agrees, or it may mean they did not receive/process the request. Used only for low-risk, high-volume items where controls are effective.

Dealing with non-responses:

• Send follow-up requests (a second or third request)
• If no response is received after follow-up: perform alternative audit procedures (e.g., for receivables: check subsequent cash receipts, inspect supporting documentation such as sales invoices and delivery notes)

Dealing with exceptions (disagreements):

• Investigate the nature and cause of the difference
• Common causes: timing differences (items in transit at the confirmation date), errors by the entity or the third party, disputed amounts
• Determine whether the exception indicates a misstatement in the financial statements

Management refusal to send confirmations: The auditor should assess whether the refusal is reasonable. If it is not reasonable, this may indicate a fraud risk. In any case, perform alternative procedures and consider the implications for the audit opinion.

Analytical procedures involve evaluating financial information through the analysis of plausible relationships among both financial and non-financial data. They are used at three stages:

1. Risk assessment (ISA 315 — mandatory): Preliminary analytical procedures at the planning stage to understand the entity, identify unusual trends, and assess risks.

2. Substantive analytical procedures (ISA 520 — optional):

• Used as a substantive procedure to detect material misstatements at the assertion level
• The auditor develops an expectation of what a recorded amount should be, based on a reliable relationship (e.g., revenue × expected margin = expected gross profit; prior year depreciation adjusted for asset additions/disposals = expected depreciation)
• The expectation is compared to the recorded amount — any significant difference is investigated
• The reliability depends on: the predictability of the relationship, the precision of the expectation, the disaggregation of the data (more disaggregated = more precise), and the independence/reliability of the source data
• If the difference exceeds the threshold (often set at performance materiality or a fraction of it), the auditor must investigate by: inquiring of management, corroborating management's explanations, and performing additional procedures if needed

3. Overall review (ISA 520.6 — mandatory):

• Performed near the end of the audit — the auditor performs analytical procedures to assess whether the financial statements as a whole are consistent with the auditor's understanding of the entity
• If material inconsistencies or unexpected relationships are identified at this stage, the auditor must consider whether additional procedures or a revision of the risk assessment is needed
• This is a "stand back" review — does the overall picture make sense?

Audit sampling involves applying audit procedures to less than 100% of items within a population, in such a way that all items have a chance of selection, enabling the auditor to draw conclusions about the entire population.

Statistical vs non-statistical sampling:

• Statistical: Uses random selection and probability theory to evaluate results. Allows quantification of sampling risk. More objective and defensible.
• Non-statistical: Uses the auditor's judgement for selection and evaluation. Selection methods include: haphazard (without conscious bias, not truly random), block selection (all items in a period), judgemental. Does not allow quantification of sampling risk but is widely used in practice.

Sample design:

• Define the population: The entire set of data from which the sample is drawn. Must be appropriate for the audit objective (e.g., testing completeness of payables — sample from subsequent payments or GRNs, not from the payables ledger).
• Stratification: Dividing the population into sub-groups (strata) with similar characteristics. Allows the auditor to direct effort to higher-risk items and improve efficiency (e.g., separating large and small transactions).

Sample size — determined by:

• Acceptable sampling risk: Lower acceptable risk → larger sample (the auditor accepts less risk of drawing the wrong conclusion)
• Tolerable misstatement / tolerable rate of deviation: Lower tolerable level → larger sample
• Expected misstatement / deviation rate: Higher expected rate → larger sample (to determine whether the actual rate exceeds the tolerable rate)
• Assurance from other sources: More assurance from other procedures (e.g., controls testing) → smaller sample

Selection methods: Random (every item has a known probability of selection — using random number tables or generators), systematic (selecting every nth item from the population with a random start), monetary unit sampling (MUS — probability of selection is proportional to the item's value — larger items are more likely to be selected — useful for testing for overstatement).

Evaluating results:

• Analyse misstatements found in the sample — nature, cause, and whether they indicate systemic errors or fraud
• Project the misstatements to the population — if 3 errors totalling £5,000 are found in a sample representing 20% of the population, the projected misstatement is approximately £25,000
• Compare the projected misstatement to the tolerable misstatement — if projected > tolerable, the conclusion is that the population contains a material misstatement (perform additional procedures, request management correction, or modify the opinion)

ISA 540 (Revised) addresses the auditor's responsibilities regarding accounting estimates and related disclosures. Estimates are inherently uncertain and are a common source of material misstatement.

Spectrum of inherent risk: ISA 540 aligns with the ISA 315 (Revised 2019) concept of assessing inherent risk on a spectrum. Estimates at the higher end of the spectrum (those with greater estimation uncertainty, complexity, and subjectivity) require more rigorous audit procedures.

The auditor's approach:

1. Understand how management makes the estimate: the method/model used, the data inputs, the assumptions, and the degree of estimation uncertainty
2. Identify and assess the risks of material misstatement related to the estimate
3. Respond to assessed risks — using one or a combination of:
   • Obtaining evidence from events up to the date of the audit report (e.g., a provision for litigation may be resolved after year-end)
   • Testing how management made the estimate — evaluate the method/model, test the data for completeness/accuracy, evaluate the reasonableness of assumptions (are they internally consistent? consistent with market/industry data? biased?)
   • Developing an auditor's point estimate or range — independently estimating the amount and comparing it to management's figure
4. Evaluate the overall reasonableness — consider whether the estimate and related disclosures are reasonable, or whether indicators of management bias exist

Management bias: The auditor must evaluate whether management's judgements and assumptions indicate potential bias. Indicators include: consistently optimistic estimates, selective use of data, changes in assumptions that move the estimate toward a desired outcome, and failure to revise estimates when circumstances change.

Disclosures: The auditor evaluates whether the disclosures about estimation uncertainty are adequate — particularly for estimates with high estimation uncertainty (where the range of possible outcomes is very wide), the financial statements should disclose the assumptions, sensitivities, and range of possible outcomes.

ISA 550 — Related parties:

• Obtain an understanding of the entity's related party relationships and transactions
• Risks: undisclosed related parties, non-arm's-length transactions, related party transactions used to manipulate results
• Procedures: inquire of management, inspect registers and board minutes, review contracts for related party terms, review unusual or large transactions (especially near period-end), confirm terms with the related parties, evaluate whether disclosures comply with IAS 24
• Maintain professional scepticism — related party transactions may indicate fraud risk (e.g., channelling revenue through a director's company)

ISA 560 — Subsequent events:

• Period 1 (between year-end and the date of the audit report): The auditor must perform procedures to identify events that require adjustment or disclosure — active duty to search for events. Procedures include: reviewing post-balance sheet transactions, reading board minutes, inquiring of management about developments.
• Period 2 (between the date of the audit report and the date the FS are issued): No obligation to search, but if the auditor becomes aware of a material event, they must discuss with management and consider whether the FS need amendment and the audit report needs revision.
• Period 3 (after the FS are issued): No obligation. But if a material fact is discovered that existed at the audit report date, the auditor considers whether to take action (e.g., advise management to reissue).

ISA 570 (Revised) — Going concern:

• The auditor must evaluate management's assessment of the entity's ability to continue as a going concern for at least 12 months from the date of the financial statements
• Going concern indicators — financial: Net liability/current liability position, adverse key ratios, inability to pay creditors on time, inability to comply with loan covenants, changing from credit to cash-only trading, inability to obtain finance
• Going concern indicators — operating/other: Loss of key management, loss of major customer/supplier/market, labour difficulties, shortage of key supplies, legal/regulatory proceedings, loss of a major license/franchise
• Auditor's procedures: Evaluate management's assessment (period covered, assumptions, cash flow forecasts), consider events and conditions beyond management's assessment period, evaluate the adequacy of disclosures, obtain written representations about management's plans
• Reporting implications:
  • Going concern basis appropriate and no material uncertainty → unmodified opinion
  • Going concern basis appropriate but material uncertainty exists and adequately disclosed → unmodified opinion with a separate "Material Uncertainty Related to Going Concern" section in the audit report
  • Going concern basis appropriate but material uncertainty exists and NOT adequately disclosed → qualified or adverse opinion (inadequate disclosure)
  • Going concern basis NOT appropriate (entity cannot continue) → adverse opinion

ISA 580 — Written representations:

• The auditor must obtain written representations from management (and TCWG where appropriate) confirming key matters:
  • Management has fulfilled its responsibilities for the preparation of the FS (true and fair view, compliance with framework)
  • All information and access has been provided to the auditor
  • All transactions have been recorded and reflected in the FS
  • Specific representations on matters where other evidence cannot be expected (e.g., management's intentions regarding assets, completeness of contingent liabilities, related party disclosures)
• Written representations are necessary but NOT sufficient on their own — they must be corroborated by other evidence
• If management refuses to provide written representations: this is a scope limitation → qualified opinion or disclaimer of opinion
• The representation letter is dated the same date as the audit report

For a first-year audit (the auditor was not the auditor in the prior period), ISA 510 requires the auditor to obtain sufficient appropriate evidence about opening balances.

Procedures:

• Read the predecessor auditor's working papers (with permission of the entity and the predecessor)
• Evaluate whether the prior year's audit opinion was modified (if so, consider the implications for the current year)
• Evaluate whether the prior year's accounting policies are consistent with the current year and the applicable framework
• Perform specific procedures on opening balances: for current assets/liabilities, much of the evidence comes from the current year's procedures (e.g., receivables collected, payables paid). For non-current assets, review prior year records, inspect title documents, recalculate depreciation.

If unable to obtain sufficient evidence on opening balances: The auditor may need to qualify the opinion (or disclaim an opinion) on the current year's financial statements — particularly on the income statement (as the opening balance affects profit through cost of sales, depreciation, etc.).