CS Advanced Level

Governance and Compliance Audit flashcards

Read the question, say the answer to yourself, then turn the card to check. The first 10 of 72 cards are free; the rest come with the subject.

Card 1 of 72

Jump to a card

Complete Flashcard Reference

Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 62 come with the subject.

How do reasonable assurance and limited assurance differ?

Reasonable assurance: high but not absolute, needs more extensive evidence, and is worded positively: 'in our opinion, the entity complied'. Limited assurance: lower, rests on less extensive procedures, and is worded negatively: 'nothing has come to our attention to suggest non-compliance'. The negative form accurately describes the lesser work performed.

What are the three categories of impact of non-compliance?

Legal: fines, sanctions or personal liability for officers. Business: disruption to operations, lost contracts or withdrawn licences. Reputational: damage to stakeholder trust, often the most durable and hardest to reverse.

What are the four types of governance and compliance audit by legal basis and timing?

Statutory: required by law at set intervals. Voluntary: commissioned by the organisation for its own assurance. Periodic: on a regular cycle, such as annually or biennially. Ad hoc or special: triggered by a specific event or concern. The two axes combine, so an audit can be voluntary and ad hoc.

Distinguish professional objectivity, professional scepticism and professional judgement.

Objectivity: not allowing bias or conflict of interest to compromise professional judgement. Scepticism: a questioning mind, alert to signs of misstatement or non-compliance, rather than assuming good faith by default. Judgement: applying training, knowledge and experience to decisions, especially where standards give no single mechanical answer.

What does an inception report record, and why does it protect the auditor?

It records the auditor's understanding of the scope, the criteria, the methodology, the timetable, the information required from the entity and by when, and the reporting arrangements. A client who later disputes the scope or supplies information late is answered from a document both parties accepted at the outset.

How is materiality judged in a governance audit?

Mostly qualitatively, because most governance failings have no monetary amount. A matter is material if a reasonable user of the report would change their view of the entity's governance on knowing it. A single failure can be material by its nature, such as a board that has not met for a year or a missing conflict of interest register.

What does Re Fireproof Doors Ltd [1916] 2 Ch 142 say about signed minutes?

Minutes signed by the chairman are prima facie, but not conclusive, evidence of the proceedings they record; other evidence may be led to show what happened. So the auditor corroborates a minute with attendance registers, papers circulated in advance and the decisions that followed.

How is audit evidence ranked for reliability?

Obtained directly by the auditor beats obtained indirectly. From outside the entity beats generated inside it. Documentary beats oral, and an original beats a copy. A management written representation is evidence, but never sufficient on its own for a material matter.

Which opinion follows from a departure from criteria or a limitation of scope?

Departure, material but confined: qualified. Departure, pervasive: adverse. Scope limitation, material but confined: qualified. Scope limitation, pervasive: disclaimer. No significant exceptions: unqualified (clean).

What are the stages of the peer review mechanism, in order?

1. Selection of the practitioner or engagement for review. 2. Review of documentation and working papers. 3. Discussion of findings with the reviewed practitioner. 4. Reporting the outcome and any required remedial action.

How does an attestation engagement differ from a direct reporting engagement?