Part A: The audit and its framework
Nature and purpose of an audit
Key takeaways
- ISA 200 sets the objective of an audit: to enable the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework.
- The opinion adds credibility to the statements; it does not certify their accuracy, and management stays responsible for preparing them and for the internal control behind them.
- Auditing grew from detailed checking for fraud, through the balance sheet and systems-based audit, to today's risk-based audit, each stage adding a layer rather than replacing the last.
- Audits come in many types: statutory or private, internal or external, interim, continuous or final, and operational, compliance or special purpose, each suited to its own occasion.
- An audit gives reasonable, not absolute, assurance, because of judgement in financial reporting, limits on procedures, time and cost, sampling, and fraud that is deliberately concealed.
An audit is an independent examination of, and expression of opinion on, financial statements by an appointed auditor in pursuance of that appointment and in compliance with any relevant statutory obligation. This chapter sets out what an audit is for, how the profession reached its present form, who relies on an audited set of accounts, what distinguishes an audit from the accounting it examines, and the different kinds of audit a qualified accountant may be asked to perform, before the rest of the paper works through how an audit is actually planned, evidenced and reported.
Standards for this chapter
ISA 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with International Standards on Auditing, states the objectives this chapter describes and the inherent limitations set out at the end of this chapter; the Companies Act, 2015 sections on the statutory audit (see CPA Company Law, in its chapter on auditors, sections 709 to 716) fix which companies must have one.
The objective of an audit
The objective of an audit of financial statements is to enable the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework, and to report on the financial statements, and communicate as required by the ISAs, in accordance with the auditor's findings (ISA 200). The opinion adds credibility to the statements: it does not certify their accuracy, and it does not relieve management of its responsibility for preparing them.
Three separate roles sit behind every audit: the preparer (management, who prepares the financial statements and is responsible for the internal control that makes reliable preparation possible), the auditor (who gathers evidence and forms an independent opinion), and the user (who relies on that opinion rather than auditing the business personally).
How auditing developed
The development of audit approach
| Era | Focus | Method |
|---|---|---|
| Early audit (pre-1900s) | Detection of fraud and clerical error, on behalf of owners who no longer managed the business day to day | Detailed checking of every transaction; the auditor as a bookkeeper's watchdog |
| Balance sheet audit (early to mid-1900s) | Verifying the year-end balance sheet was fairly stated, since the growth of companies made full transaction checking impractical | Sampling of transactions supporting the closing balances, with reliance on internal controls beginning to appear |
| Systems-based audit (mid to late 1900s) | Evaluating and testing the client's internal control system, on the reasoning that reliable controls make reliable statements | Tests of control, followed by reduced substantive testing where controls proved reliable |
| Risk-based audit (present) | Directing audit effort at the areas most likely to contain material misstatement, whatever the source | Formal risk assessment (ISA 315) driving a tailored response of tests of control and substantive procedures (see the chapter on audit risk assessment) |
Each stage did not simply replace the last; it added a layer, because the underlying reason for audit, that ownership and management had separated, kept growing more acute as companies grew larger and their shareholders more numerous and more distant from day-to-day management. The modern risk-based approach still uses systems testing and substantive verification; it simply decides how much of each an efficient, effective audit needs by first identifying where the risk of material misstatement actually lies.
Users of audited financial statements
- Shareholders and other owners, who use the report to hold management to account and to decide whether to hold, buy or sell their investment
- Lenders and other creditors, who rely on audited statements to assess a borrower's ability to repay and to monitor loan covenants
- Employees and their representatives, interested in the stability and profitability of their employer
- Government and regulatory bodies, including the Kenya Revenue Authority, the Capital Markets Authority for a listed company and sector regulators, who use audited figures for tax, compliance and prudential purposes
- Suppliers and other trade creditors, assessing whether a customer will pay for goods or services supplied on credit
- Customers, particularly where a long-term relationship or a warranty depends on the supplier's continuing existence
- The public and financial analysts, who use published, audited results to inform investment and policy decisions generally
Every one of these users lacks the ability, the access and usually the technical skill to verify the financial statements personally; the audit exists to close that gap, which is why ISA 200 frames the objective around enabling users' reliance rather than around satisfying the auditor's own curiosity.
Features of an audit
Auditing and accounting compared
Accounting and auditing compared
| Point | Accounting | Auditing |
|---|---|---|
| Who does it | Management (preparer) | An independent auditor (examiner) |
| What it produces | The financial statements themselves | An opinion on whether those statements are fairly stated |
| Nature of the work | Recording, classifying and summarising transactions | Examining and evaluating that recording, on a sample and risk basis |
| Timing | Continuous, throughout the period | Principally after the period end, though planning starts earlier |
| Governing framework | A financial reporting framework (IFRS, IFRS for SMEs) | International Standards on Auditing |
| Responsibility | Management is responsible for the statements and the internal control that makes them reliable | The auditor is responsible only for the opinion, never for the statements themselves |
The distinction matters because it is the single most common misunderstanding a new candidate carries into this paper: an unqualified audit opinion does not mean the auditor prepared, corrected or guarantees the accounts, and a material error remaining despite an audit does not, by itself, prove the auditor was negligent. The auditor examines what management produced; management remains responsible for producing it.
Types of audit
When each type is used
Worked scenario: matching the audit to the occasion (not a decided case)
Kilifi Cement PLC, a listed company with a December year end, engages Rono & Associates to visit in September to test controls and substantive balances for the nine months to date: this is interim audit work, performed before the year end to spread the workload ahead of the final audit.
In January, Rono & Associates return to complete testing on the remaining three months and the year-end balances, and to form the opinion on the full year's financial statements: this is the final (balance sheet) audit, and the interim work informs how much further testing the final audit still needs.
Separately, Kilifi Cement's board commissions an operational audit of its logistics function to assess whether trucking costs could be reduced without an opinion on the financial statements being sought at all, and, ahead of acquiring a smaller competitor, commissions a special purpose due-diligence audit of the target's accounts: neither is part of the statutory cycle, and each has its own scope, addressee and report.
Each of the remaining types suits a particular occasion:
- Continuous audit: suits an entity with very high transaction volumes or weak controls needing frequent attention, such as a bank or a government payroll system.
- Compliance audits: are performed wherever a funder, regulator or lender requires evidence that specific conditions were met, a donor-funded project's grant conditions being a common Kenyan example.
- A special purpose audit: is commissioned whenever a specific decision, a merger, a fraud allegation, a dispute, needs assurance that the annual cycle was never designed to provide.
Strengths and weaknesses of each type
Advantages and disadvantages of audit types
| Type | Advantage | Disadvantage |
|---|---|---|
| Statutory audit | Legally required, so credibility is assured to every user without negotiation | Cost and management time are fixed regardless of the entity's own appetite for assurance |
| Interim audit | Spreads workload, identifies problems early enough to fix before the year end | Duplicated administrative cost of two visits; interim conclusions can be overtaken by later events |
| Continuous audit | Errors and control weaknesses are caught close to when they occur | Can disrupt client staff repeatedly, and the auditor's presence throughout can affect independence perception |
| Internal audit | Ongoing coverage across the whole entity, tailored to management's own risk priorities | Not independent of management in the way a statutory external audit is, and carries no opinion for external users |
| Operational audit | Improves efficiency and value for money directly, beyond what a financial opinion addresses | No standardised opinion or public credibility comparable to a financial statement audit |
| Special purpose audit | Tailored exactly to the decision at hand, often faster than waiting for the annual cycle | Narrow scope: it says nothing about matters outside its specific terms of reference |
The work each audit involves
A statutory or external final audit follows the full risk-based sequence: engagement acceptance, planning and risk assessment, evidence gathering through tests of control and substantive procedures, and reporting, each covered in its own chapter. An interim audit performs a slice of that same sequence early, concentrating on risk assessment, systems documentation and testing of controls, with substantive testing of transactions to date, leaving final substantive procedures on the closing balances for the final visit.
Internal audit work is driven by a risk-based internal audit plan rather than by an external reporting deadline, and can range across financial, operational and compliance matters in the same cycle. An operational or compliance audit substitutes the specific criteria, cost-efficiency, or a named regulation, for the financial reporting framework that a statutory audit tests against, so evidence gathering is directed at those criteria rather than at financial statement assertions.
Inherent limitations of an audit
ISA 200 requires the auditor's report to make clear that an audit provides reasonable, not absolute, assurance, because of inherent limitations that no amount of additional work removes entirely.
These limitations are why an unqualified opinion is not, and never claims to be, a guarantee that no misstatement exists; they explain the phrase 'reasonable assurance' in every auditor's report, and they are the standard answer whenever an examiner asks why an audit failed to detect a fraud that later came to light despite the auditor having followed the standards properly.
State the objective, then the limitation, before applying either
Almost every question in this chapter is really testing whether a candidate can state ISA 200's objective (reasonable assurance that the statements are free from material misstatement, enabling an opinion) and then explain why that objective can never become certainty, before applying either to a scenario. Candidates who jump straight to 'the auditor should have found it' without first establishing what the audit was actually trying to achieve lose the analytical marks.
Self-check
(a) State the overall objective of an audit of financial statements as ISA 200 defines it. (4 marks)
(b) Explain four features that distinguish an audit from the accounting function it examines. (8 marks)
(c) Kilifi Cement PLC's shareholders ask why, despite an unqualified audit opinion for the year, a fraud by a senior manager involving forged supplier invoices was only discovered eighteen months later. Explain, with reference to the inherent limitations of an audit, why this does not necessarily mean the audit was deficient. (8 marks)
Show worked answer
(a) To enable the auditor to express an opinion on whether the financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework, and to report in accordance with the auditor's findings as the ISAs require (4 marks).
(b) Any four of: independence from the preparer; a systematic, structured process rather than ad hoc inspection; an opinion supported by sufficient appropriate evidence rather than impression; professional scepticism and judgement throughout; a report to a defined addressee; compliance with a recognised standards framework (2 marks each, 8 marks).
(c) An audit provides reasonable, not absolute, assurance (ISA 200), and fraud involving forgery, collusion or management override is inherently harder to detect than error, since the auditor cannot assume every document presented is genuine and testing is performed on a sample rather than every transaction; provided the auditor exercised appropriate professional scepticism, followed ISA 240's requirements and had no reason on the evidence available to suspect the forged invoices, the later discovery of a well-concealed fraud is consistent with a properly conducted audit rather than proof of negligence, though the facts would need to be examined against the standard actually applied at the time (8 marks).