Part A: Foundations
Basic concepts and elements in auditing
Key takeaways
- An audit is a systematic, independent examination of evidence to form and express an opinion or conclusion on a defined subject matter, against agreed criteria.
- Monitoring is continuous and done by management; assessment is periodic and may be internal or external; an audit is periodic, independent of the activity examined, and ends in an opinion for someone other than the person responsible.
- Reasonable assurance is high but not absolute and is worded positively; limited assurance rests on less extensive work and is worded negatively: nothing has come to our attention.
- In an attestation engagement the practitioner reports on the responsible party's assertion; in a direct reporting engagement, the usual model for a governance audit, the practitioner measures the subject matter directly.
- A compilation is a non-assurance engagement: the practitioner expresses no opinion and no conclusion, and the report says so.
This closing paper is the specialist practice built on everything the CS course has covered so far: examining whether an organisation's governance (the ground of CS Corporate Governance and Ethics) and compliance (that of CS Meetings, Compliance and Administration) actually work as intended. This chapter sets out the vocabulary the rest of the paper relies on.
Standards for this chapter
The IAASB's International Framework for Assurance Engagements for the vocabulary of assurance, reasonable and limited assurance, attestation and direct reporting; ISAE 3000 (Revised) for assurance engagements other than financial statement audits; ISA 200 for statutory audit; the CMA Code of Corporate Governance Practices for Issuers of Securities to the Public, 2015 for the annual governance audit it requires of listed companies; ICS's Governance Audit Standards and Guidelines.
Auditing
A systematic, independent examination of evidence to form and express an opinion or conclusion on a defined subject matter, against agreed criteria.
Assessment
A broader evaluation of a subject matter, which may or may not follow the formal, evidence-based rigour a full audit requires.
Monitoring
The ongoing, continuous tracking of compliance or performance over time, distinct from an audit's periodic, point-in-time examination.
Assurance engagement
An engagement in which a practitioner expresses a conclusion designed to enhance the confidence of intended users about the outcome of evaluating a subject matter against criteria, the umbrella category this whole paper's audits fall under.
Non-assurance engagement
An engagement, such as a compilation (below) or agreed-upon-procedures engagement, that does not provide the intended users with a conclusion expressing assurance.
Reasonable assurance
A high, but not absolute, level of assurance, expressed as a positive conclusion (for example, 'in our opinion, the organisation complies...'), requiring more extensive evidence-gathering than limited assurance.
Limited assurance
A lower, though still meaningful, level of assurance, expressed as a negative conclusion (for example, 'nothing has come to our attention to suggest non-compliance'), based on less extensive procedures than reasonable assurance.
Direct reporting engagement
An assurance engagement where the practitioner directly measures or evaluates the subject matter against criteria and reports the outcome, without a responsible party first making its own assertion.
Attestation engagement
An assurance engagement where a responsible party measures the subject matter and provides an assertion, and the practitioner's conclusion is on that assertion, the more common model in financial statement auditing.
Compilation engagements
A non-assurance engagement where the practitioner applies accounting or subject-matter expertise to collect, classify and summarise information, without expressing any assurance conclusion on it.
Assurance reports
The formal written output of an assurance engagement, conveying the practitioner's conclusion to the intended users, structured per the reporting requirements covered in the chapter on reporting.
Direct reporting
The general reporting approach underlying a direct reporting engagement (above): the practitioner's own findings, not a management assertion, are what is reported on.
Authorities and criteria
Criteria are the benchmarks (a code, a standard, a law) a subject matter is measured against; authorities are the bodies that issue or enforce them, together defining what 'compliant' or 'well-governed' actually means for a given audit.
Monitoring is distinguished from both auditing and assessment by who does it and how often. Monitoring is continuous and is performed by management as part of running the entity. Assessment is periodic and may be internal or external. An audit is periodic, independent of the activity examined, and results in an opinion or conclusion expressed to someone other than the person responsible for the subject matter.
Assertions and audit
Assertions are claims, explicit or implicit, embedded in a subject matter (that a control exists and operates, that a policy is followed), which the audit's procedures (see the chapter on gathering evidence) are designed to test.
The whole vocabulary above resolves into three questions, and holding them in that order keeps the definitions straight. Who is reporting, and on what? In an attestation engagement the responsible party measures the subject matter against the criteria and the practitioner reports on that measurement. In a direct reporting engagement the practitioner measures it themselves and reports the outcome. A governance audit is usually direct reporting, which is why the auditor and not the board states whether the governance practices meet the standard.
How much assurance is being given? Reasonable assurance is high but not absolute, and is expressed positively: in our opinion the entity complied. Limited assurance is lower, gathers less evidence, and is expressed negatively: nothing has come to our attention that causes us to believe the entity did not comply. The negative form is not modesty, it is an accurate description of the lesser work performed, and an answer that treats the two as interchangeable has missed the examinable point.
Against what criteria? An assurance engagement is impossible without criteria that are suitable and available to the intended users, because an opinion is always an opinion that something conforms to something else. Suitable criteria are relevant, complete, reliable, neutral and understandable. In a governance audit the criteria come from the Constitution and statute, the sector regulator's code, the entity's own charter and constitution, and the applicable governance code, and identifying them precisely is the first substantive act of the engagement.
Internal audit
An independent, objective assurance and consulting function operating within the organisation itself, reporting to the audit committee (CS Corporate Governance and Ethics, in the chapter on the governance of risk), distinct from statutory audit's external, shareholder-facing role.
Re Kingston Cotton Mill Co (No 2) [1896] 2 Ch 279 (Court of Appeal, persuasive)
The standard of care expected of any auditor: the skill, care and caution of a reasonably competent, careful and cautious auditor, judged by the circumstances. The auditor is a watchdog and not a bloodhound, and may rely on the representations of trusted officers provided reasonable care is taken and nothing has arisen to arouse suspicion. It sets the floor for a governance auditor as much as for a financial one: reliance on what the secretary says is legitimate until something on the file contradicts it.
Re City Equitable Fire Insurance Co Ltd [1925] Ch 407 (Chancery Division, persuasive)
The corresponding standard for directors, and the reason a governance audit exists. A director need show only the skill reasonably expected of a person of their knowledge and experience, need not give continuous attention, and may trust officials absent grounds for suspicion. That indulgent standard proved inadequate, and the codes a governance audit measures against were written to replace it with something testable.
Persuasive/binding authority as stated in each citation; a Kenyan court applies an English decision as persuasive authority under section 3(1)(c) of the Judicature Act (Cap 8).
Statutory audit
An audit required by law, most familiarly the external audit of financial statements required under the Companies Act, 2015.
Compilation engagements sit outside assurance altogether and are a favourite trap. The practitioner assembles information supplied by management into a form, applies accounting expertise rather than assurance expertise, and expresses no opinion and no conclusion. The report says explicitly that no assurance is given. A candidate who describes a compilation as giving limited assurance has conceded the mark.
Legal audits
An audit focused specifically on legal compliance, verifying an organisation meets its statutory and regulatory obligations across the areas it operates in.
A legal audit and a governance audit overlap but answer different questions. A legal audit asks whether the entity complies with the law that binds it: its licences, its filings, its contracts and its statutory obligations. A governance audit asks whether the entity is directed and controlled in the way the applicable code and its own constitution require, which reaches conduct that is entirely lawful and still poor governance, such as a board that never challenges the chief executive.
Governance audit
An audit specifically examining whether an organisation's governance structures and practices (the subject of CS Corporate Governance and Ethics) actually function as intended, the paper's own core subject, paired throughout with compliance audit.
Exam tip
The reasonable-versus-limited assurance distinction is one of the most precisely tested definitions in this chapter, know both the difference in evidence rigour and the difference in how the conclusion is worded (positive vs negative form).
Self-check
(a) An engagement's conclusion is worded 'nothing has come to our attention to suggest non-compliance'. Identify the level of assurance this represents, and explain why it is worded this way. (3 marks)
(b) Distinguish an attestation engagement from a direct reporting engagement. (3 marks)
(c) Distinguish internal audit from statutory audit. (3 marks)
(d) Explain the difference between auditing and monitoring. (2 marks)
Show worked answer
(a) Limited assurance; it is expressed as a negative conclusion because limited assurance is based on less extensive procedures than reasonable assurance, so the practitioner can only state that nothing came to their attention suggesting a problem, not positively affirm compliance the way a reasonable-assurance (positive-form) conclusion does (3 marks).
(b) In an attestation engagement, a responsible party first measures the subject matter and provides an assertion, and the practitioner's conclusion is on that assertion; in a direct reporting engagement, the practitioner directly measures or evaluates the subject matter and reports the outcome, without a responsible party's prior assertion (3 marks).
(c) Internal audit is an independent, objective assurance and consulting function operating within the organisation itself, reporting to the audit committee; statutory audit is an audit required by law, most familiarly the external audit of financial statements, internal audit serves the organisation's own oversight needs, statutory audit serves external, shareholder-facing legal requirements (3 marks).
(d) Auditing is a periodic, point-in-time examination against agreed criteria; monitoring is the ongoing, continuous tracking of compliance or performance over time, an audit is a snapshot, monitoring is a continuous process (2 marks).