Part A: Foundations and planning
Foundations of auditing
Key takeaways
- An audit is an independent examination of the financial statements that ends in an opinion on whether they give a true and fair view, and it gives reasonable, not absolute, assurance.
- Management prepares the financial statements and is responsible for internal control; the auditor examines them, and does not prepare them, guarantee the company's future or undertake to find every fraud.
- Under the Companies Act, 2015 the auditor has a right of access at all times to the accounting records and may require information and explanations from officers and employees, and a statement to the auditor that is misleading, false or deceptive in a material particular is an offence.
- Members can remove an auditor only by ordinary resolution at a meeting, with special notice, and the auditor may make written representations to the members.
- Independence faces five threats, self-interest, self-review, advocacy, familiarity and intimidation; where no safeguard reduces a threat to an acceptable level, the auditor declines or resigns.
Every financial statement this course has taught you to prepare (in ATD Financial Accounting) and analyse is, in practice, read by someone who was not there when it was prepared and has no independent way to verify it. Auditing exists to close that trust gap. This chapter sets out what an audit actually is, who performs one, and the framework of principles it operates under.
Standards for this chapter
ISA 200 for what an audit is and the auditor's objectives; the IESBA Code's fundamental principles (integrity, objectivity, professional competence and due care, confidentiality, professional behaviour) as adopted by ICPAK; ISA 230 for documentation; ISA 300 for planning; ISA 500 for evidence; ISA 315 (Revised 2019) for the accounting system and internal control; ISA 700 (Revised) for reporting; Part XXVII of the Companies Act, 2015 for the appointment, qualification, duties and removal of a company auditor; ISQM 1 and ISQM 2 for quality at firm and engagement level.
Key terms
Audit principles and process
International Standard on Auditing (ISA) 200 sets out the fundamental principles every audit is built on, echoed closely in the accountancy profession's own code of ethics.
An audit runs in a fixed sequence, and knowing the order is worth marks because each stage depends on the one before it:
- The auditor accepts or continues the engagement and agrees its terms in writing.
- They then obtain an understanding of the entity and its environment, including its internal control, and use that understanding to assess the risk of material misstatement.
- Procedures are designed to respond to the risks assessed, and are then performed, with the results evaluated and any misstatements accumulated.
- Finally the auditor forms an opinion and reports.
Two ideas run underneath the whole sequence and explain most of what an auditor does. The first is that the auditor gives reasonable rather than absolute assurance, because an audit tests samples rather than every transaction, because much accounting involves judgement and estimation, and because fraud may be concealed by collusion. The second is materiality: the auditor is concerned with misstatements large enough to influence the decisions of users, so effort is concentrated where an error would matter and not spread evenly over everything.
Auditing versus accounting
| Accounting | Auditing | |
|---|---|---|
| Purpose | Record, classify and summarise transactions into financial statements | Independently examine those statements and express an opinion on them |
| Performed by | The entity's own accountants/management | An independent auditor, separate from the entity's management |
| Timing | Continuous, throughout the financial period | Chiefly after the period end (though planning and interim work happen earlier, as the section on timing explains) |
| Output | The financial statements themselves | An audit report expressing an opinion on those statements |
| Governed by | Accounting standards (IFRS) | Auditing standards (ISAs) and a separate code of professional ethics |
Types and timing of audits
The types of audit are distinguished on three separate axes, and candidates who mix them produce muddled answers:
- By who requires it: an audit is statutory, where the law compels it, or private, where an owner or lender asks for it.
- By who performs it: it is external, by an independent firm reporting to the members, or internal, by a function reporting to management or the audit committee.
- By when and how the work is done: it is interim, performed during the year, or final, performed after the year end; and continuous, where the auditor attends throughout the period, or periodic, where the work is done in one visit.
Timing carries real consequences. Interim work:
- Spreads the effort
- Identifies problems while they can still be corrected
- Shortens the time between the year end and the report, which matters to a company with a filing deadline
It also risks work being duplicated if circumstances change, and requires the auditor to consider what has happened in the remaining period. A continuous audit gives closer supervision and earlier detection, but it can disrupt the client's staff and creates a risk that figures already checked are altered afterwards, which is why the auditor marks and controls the records examined.
Benefits and limitations of an audit
| Benefits | Limitations |
|---|---|
| Enhances the credibility of financial statements for external users | Provides reasonable, not absolute, assurance, an audit can still miss a material misstatement |
| Can detect errors and fraud, or deter them by its own existence | Based on testing samples of transactions, not a 100% check of every transaction |
| Gives management an independent perspective on internal controls | Relies partly on management's own representations (see written representations, in the chapter on the audit report), which could be inaccurate or dishonest |
| Supports access to finance, lenders and investors rely on audited figures | Inherent limitations of internal control mean some risk always remains (see the chapter on risks, errors and fraud) |
| Required by law for many entities, supporting regulatory compliance | Cost and management time required to support the audit |
The distinction between auditing and accounting above is worth pressing further, because the expectation gap grows out of misunderstanding it. Accounting produces the financial statements and is the responsibility of management, who select the policies, make the estimates and are responsible for the internal control that makes reliable reporting possible. Auditing examines those statements and expresses an opinion on them. The auditor:
- Does not prepare the statements
- Does not guarantee the company's future
- Does not certify that the figures are exactly correct
- Does not undertake to find every fraud
Users of the audit report
The same wide range of users this course has already met for financial statements generally (in ATD Financial Accounting) also read the auditor's report, since the opinion itself is part of what they rely on.
The expectation gap is the difference between what users believe an auditor does and what the auditor is actually required to do. It has three components worth naming:
- Users expecting work the standards never required, such as detecting every fraud
- Users expecting a standard of performance beyond reasonable assurance
- Genuine underperformance, where the auditor fell short of what was required
Only the third is the auditor's fault, and closing the first two is a matter of explanation rather than of more audit work.
Legal and professional requirements
Appointment under the Companies Act
Company law requires most companies to appoint a qualified external auditor, typically appointed by the shareholders in general meeting (or, for a first auditor, by the directors, subject to shareholder confirmation), to hold office until the next meeting at which accounts are considered.
Appointment by tender
Larger entities, and public sector bodies especially, often appoint their auditor through a competitive tendering process, inviting proposals from eligible audit firms and evaluating them on independence, technical capability, resourcing and fee, rather than simply reappointing the incumbent by default.
Qualifications of an auditor
A company auditor must be a member of a recognised professional accountancy body (in Kenya, ICPAK) holding a valid practising certificate, and must not be:
- Disqualified by law
- An officer or employee of the company
- A partner or employee of an officer
- Someone with certain other conflicting relationships with the entity being audited
The Act separates appointment by company type. A private company appoints auditors under section 717, and a public company under section 721, and in each case the Cabinet Secretary holds a default power to appoint where the company fails to do so, under sections 718 and 722 respectively. The point behind the default power is worth stating in an answer: the audit is not simply a service the company buys, it is a protection the law gives the members and creditors, so the state will supply an auditor if the company will not.
The auditor's duties and rights
- To carry out the audit with due care and skill
- To form and express an opinion on the financial statements
- To report to shareholders whether, in the auditor's opinion, the statements give a true and fair view
- Rights of access at all times to the company's books, accounts and vouchers
- The right to require officers of the company to provide information and explanations
- The right to attend and be heard at general meetings on matters concerning the auditor
Section 731 gives the auditor a right of access at all times to the company's accounting records and financial statements, in whatever form they are held. It also entitles the auditor to require information and explanations:
- From officers and employees
- From anyone holding or accountable for the records
- From Kenyan subsidiary undertakings
- From the officers, employees and auditors of those subsidiaries
The right reaches people who held those positions in the past as well as those who hold them now.
That right is backed by criminal sanction rather than by good manners. Under section 733 a person who makes a statement to an auditor that is misleading, false or deceptive in a material particular commits an offence. Section 734 gives the auditor rights in relation to resolutions and meetings, and section 735 requires the auditor to sign and date the report. Together these provisions are the answer to an examination question asking why the auditor's right of access matters: without enforceable access to the records and to the people who keep them, an opinion on the financial statements would be worthless.
Removing an auditor
An auditor may be removed from office before the end of their term by an ordinary resolution of the shareholders, subject to special notice requirements, and the outgoing auditor generally has a statutory right to make representations to shareholders on the circumstances of their removal, a safeguard against an entity dismissing an auditor simply for raising uncomfortable findings.
Removal is deliberately made public and deliberately gives the auditor a voice, because an auditor removed quietly is an auditor who can be removed for asking awkward questions. Section 739 provides that the members may remove an auditor from office at any time, but only by ordinary resolution at a meeting and only in accordance with section 740. Section 740 requires special notice of that resolution, and obliges the company to send a copy of the notice to the auditor immediately.
The auditor may then make written representations of up to two thousand words and require the company to notify the members of them. Within fourteen days of the resolution being passed the company must lodge a copy with the Registrar, and failure to do so is an offence carrying a fine of up to two hundred thousand shillings for the company and every officer in default. Section 742 preserves the rights of an auditor who has been removed, and section 747 does the same for one who resigns.
Read the machinery as a whole and the design is obvious: an auditor cannot be dismissed by the board, cannot be dismissed without notice, cannot be dismissed without an opportunity to tell the members why, and cannot be dismissed without the Registrar being told. Removing an auditor is meant to be difficult and visible. Section 739(3) adds that removal does not affect any claim the auditor may have for compensation or damages for termination of the appointment.
Professional ethics
Beyond the fundamental audit principles set out above, the auditor is bound by the wider professional code of ethics (IFAC's International Code of Ethics, adopted by ICPAK), covering threats to independence (self-interest, self-review, advocacy, familiarity and intimidation threats) and the safeguards used to address them.
Independence is examined more than any other ethical requirement, and the examinable content is the five threats and the safeguards against them.
Naming the threat is what earns the mark, because the safeguard follows from it.
The safeguards follow the threat rather than being applied generically:
- Rotation of the engagement partner addresses familiarity.
- An engagement quality review by a partner outside the team addresses self-review and self-interest.
- Declining or ceasing the non-audit service addresses self-review directly.
- Monitoring fee dependency and disclosing it to those charged with governance addresses self-interest.
Where no safeguard reduces the threat to an acceptable level, the only course is to decline or resign, and an answer that offers a safeguard for every situation has missed that point.
Auditing standards
International Standards on Auditing (ISAs), issued by the International Auditing and Assurance Standards Board (IAASB) and adopted for use in Kenya by ICPAK, set the required procedures and reporting requirements for every audit; specific ISAs are cited throughout this guide (ISA 240 on fraud, ISA 500 on evidence and ISA 700 on the audit report, among them).
Two companion sets matter: the IESBA Code of Ethics, which supplies the fundamental principles set out under professional ethics above, and the quality management standards, ISQM 1 for the firm's system of quality management and ISQM 2 for engagement quality reviews, both in force since 15 December 2022 in place of ISQC 1, with ISA 220 (Revised) placing responsibility for each audit's quality on its engagement partner.
Confidentiality is the principle candidates state too broadly. The auditor must not disclose client information to a third party without proper authority, and must not use it for personal advantage. But the duty is not absolute, and the recognised exceptions are worth listing:
- Where disclosure is permitted by law and authorised by the client
- Where disclosure is required by law, for example in response to a court order or under anti-money laundering legislation
- Where there is a professional duty or right to disclose, such as complying with a quality review by the Institute or defending oneself in disciplinary proceedings
Outsourced public sector audits
Kenya's Auditor-General, constitutionally responsible for auditing public entities, can and does outsource specific public sector audits to private audit firms, appointed and supervised under the Auditor-General's own authority, extending audit capacity across the very large number of public entities that fall within their mandate.
Re Kingston Cotton Mill Co (No 2) [1896] 2 Ch 279 (Court of Appeal)
An auditor's duty is to exercise the skill, care and caution a reasonably competent, careful and cautious auditor would exercise in the circumstances, not to act as a detective or approach the work with suspicion, an auditor is 'a watchdog, but not a bloodhound.' The auditor is entitled to believe the representations of trusted officers of the company and to rely on them, provided reasonable care is taken, absent circumstances that would arouse suspicion, directly grounding the skills-and-competence and audit-evidence principles above and the professional scepticism ISA 240 requires (see the chapter on risks, errors and fraud).
Self-check
(a) State the fundamental principles ISA 200 sets an audit on, and explain which one is described as the single most safeguarded principle in auditing. (5 marks)
(b) Distinguish between an internal audit and an external audit in terms of who it reports to and what it evaluates. (5 marks)
(c) Using Re Kingston Cotton Mill Co (No 2) above, explain what an auditor is and is not required to do when relying on management's representations, and the circumstance in which that reliance is no longer justified. (5 marks)
(d) State three limitations of an audit, and explain why 'reasonable, not absolute, assurance' is a limitation rather than a failure of the audit process. (5 marks)
(e) State two rights a company auditor holds under the Companies Act, and explain why the right of access to books and records is essential to the auditor discharging their duties. (4 marks)
Show worked answer
(a) Integrity, objectivity and independence; confidentiality; skills and competence; work performed by others; documentation; planning; audit evidence; understanding of the accounting system and internal control; and audit conclusions and reporting. Integrity, objectivity and independence is described as the single most safeguarded principle, since an auditor who is not genuinely independent and objective cannot be trusted to reach an honest conclusion regardless of how competently every other principle is otherwise satisfied. (5 marks)
(b) Internal audit is an appraisal function established within the entity itself, reporting to management or the audit committee, evaluating the effectiveness of risk management, control and governance processes broadly. External audit is an independent examination carried out by an auditor from outside the entity, typically required by law for the benefit of shareholders and other external users, culminating in a statutory audit opinion specifically on the financial statements. (5 marks)
(c) An auditor is entitled to believe the representations of trusted officers of the company and to rely on them, provided reasonable care is taken, the auditor is not required to act as a detective or approach the work with suspicion or a foregone conclusion that something is wrong, a 'watchdog, but not a bloodhound.' That reliance is no longer justified once circumstances arise that would arouse suspicion, at that point the auditor must investigate further rather than continuing to accept management's representations at face value. (5 marks)
(d) An audit provides reasonable, not absolute, assurance; is based on testing samples of transactions, not a 100% check; and relies partly on management's own representations, which could be inaccurate or dishonest. 'Reasonable, not absolute, assurance' is a limitation rather than a failure because absolute assurance is genuinely unattainable given the inherent limitations of audit testing (sampling, the persuasive rather than conclusive nature of most evidence, and the risk that fraud is deliberately concealed), a properly conducted audit that still misses a well-concealed misstatement has not failed in its professional duty, it has operated within the inherent limits the profession itself recognises. (5 marks)
(e) Rights of access at all times to the company's books, accounts and vouchers; and the right to require officers of the company to provide information and explanations. The right of access to books and records is essential because the auditor's entire opinion rests on evidence gathered from the entity's own records, without guaranteed, unrestricted access, an uncooperative management could selectively withhold records to conceal a problem, defeating the audit's whole purpose. (4 marks)