Audit Procedures for Obtaining Audit EviAudit Procedures for Obtaining Audit Evidence

Audit Procedures for Obtaining Audit Evidence

24 In accordance with paragraph 5 of this standard, the auditor is required to obtain sufficient appropriate audit evidence to be able to draw reasonable conclusions on which to base the auditor’s opinion. Under ASA 315 and ASA 330, the auditor needs to perform audit procedures to:

(a) obtain an understanding of the entity and its environment, including its internal control, to assess the risks of material misstatement at the financial report and assertion levels (audit procedures performed for this purpose are referred to in the Auditing Standards as “risk assessment procedures”);

(b) when necessary or when the auditor has determined to do so, test the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level (audit procedures performed for this purpose are referred to in the Auditing Standards as “tests of controls”); and

(c) detect material misstatements at the assertion level (audit procedures performed for this purpose are referred to in the Auditing Standards as “substantive procedures” and include tests of details of classes of transactions, account balances and disclosures, and substantive analytical procedures).

25 Under ASA 315, the auditor needs to perform risk assessment procedures to provide a satisfactory basis for the assessment of risks at the financial report and assertion levels. Risk assessment procedures by themselves do not provide sufficient appropriate audit evidence on which to base the auditor’s opinion, however, and are supplemented by further audit procedures in the form of tests of controls, when necessary, and substantive procedures.

26 Tests of controls are necessary in two circumstances. When the auditor’s risk assessment includes an expectation of the operating effectiveness of controls, under ASA 330, the auditor needs to test those controls to support the risk assessment. In addition, when substantive audit procedures alone do not provide sufficient appropriate audit evidence, under ASA 330, the auditor needs to perform tests of controls to obtain audit evidence about their operating effectiveness.

27 Under ASA 330, the auditor needs to plan and perform substantive audit procedures to be responsive to the related assessment of the risks of material misstatement, which includes the results of tests of controls, if any. The auditor’s risk assessment is judgemental, however, and may not be sufficiently precise to identify all risks of material misstatement. Further, there are inherent limitations to internal control, including the risk of management override, the possibility of human error and the effect of systems changes. Therefore, under ASA 330, the auditor needs to design and perform substantive audit procedures for material classes of transactions, account balances and disclosures to obtain sufficient appropriate audit evidence.

28 Under paragraph 5 of this Auditing Standard, the auditor needs to use one or more types of audit procedures described in paragraphs 31 to 43 below. These audit procedures, or combinations thereof, may be used as risk assessment procedures, tests of controls or substantive audit procedures, depending on the context in which they are applied by the auditor. In certain circumstances, audit evidence obtained from previous audits may provide audit evidence where the auditor, under ASA 330, has performed audit procedures to establish its continuing relevance.

29 The nature and timing of the audit procedures to be used may be affected by the fact that some of the accounting data and other information may be available only in electronic form or only at certain points or periods in time. Source documents, such as purchase orders, bills of lading, invoices, and cheques, may be replaced with electronic messages. For example, entities may use electronic commerce or image processing systems. In electronic commerce, the entity and its customers or suppliers use connected computers over a public network, such as the Internet, to transact business electronically. Purchase, shipping, billing, cash receipt, and cash disbursement transactions are often consummated entirely by the exchange of electronic messages between the parties. In image processing systems, documents are scanned and converted into electronic images to facilitate storage and reference, and the source documents may not be retained after conversion. Certain electronic information may exist at a certain point in time. However, such information may not be retrievable after a specified period of time if files are changed and if backup files do not exist. An entity’s data retention policies may require the auditor to request retention of some information for the auditor’s review or to perform audit procedures at a time when the information is available.

30 When the information is in electronic form, the auditor may carry out certain of the audit procedures described below through CAATs.

Inspection of Records or Documents

31 Inspection consists of examining records or documents, whether internal or external, in paper form, electronic form, or other media. Inspection of records and documents provides audit evidence of varying degrees of reliability, depending on their nature and source and, in the case of internal records and documents, on the effectiveness of the controls over their production. An example of inspection used as a test of controls is inspection of records or documents for evidence of authorisation.

32 Some documents represent direct audit evidence of the existence of an asset, for example, a document constituting a financial instrument such as a stock or bond. Inspection of such documents may not necessarily provide audit evidence about ownership or value. In addition, inspecting an executed contract may provide audit evidence relevant to the entity’s application of accounting policies, such as revenue recognition.

Inspection of Tangible Assets

33 Inspection of tangible assets consists of physical examination of the assets. Inspection of tangible assets may provide reliable audit evidence with respect to their existence, but not necessarily about the entity’s rights and obligations or the valuation of the assets. Inspection of individual inventory items ordinarily accompanies the observation of inventory counting.

Observation

34 Observation consists of looking at a process or procedure being performed by others. Examples include observation of the counting of inventories by the entity’s personnel and observation of the performance of control activities. Observation provides audit evidence about the performance of a process or procedure, but is limited to the point in time at which the observation takes place and by the fact that the act of being observed may affect how the process or procedure is performed. See ASA 501, for further mandatory requirements and explanatory guidance on observation of the counting of inventory.

Enquiry

35 Enquiry consists of seeking information of knowledgeable persons, both financial and non-financial, throughout the entity or outside the entity. Enquiry is an audit procedure that is used extensively throughout the audit and often is complementary to performing other audit procedures. Enquiries may range from formal written enquiries to informal oral enquiries. Evaluating responses to enquiries is an integral part of the enquiry process.

36 Responses to enquiries may provide the auditor with information not previously possessed or with corroborative audit evidence. Alternatively, responses might provide information that differs significantly from other information that the auditor has obtained, for example, information regarding the possibility of management override of controls. In some cases, responses to enquiries provide a basis for the auditor to modify or perform additional audit procedures.

37 Ordinarily, the auditor performs audit procedures in addition to the use of enquiry to obtain sufficient appropriate audit evidence. Enquiry alone ordinarily does not provide sufficient audit evidence to detect a material misstatement at the assertion level. Moreover, enquiry alone is not ordinarily sufficient to test the operating effectiveness of controls.

38 Although corroboration of evidence obtained through enquiry is often of particular importance, in the case of enquiries about management intent, the information available to support management’s intent may be limited. In these cases, understanding management’s past history of carrying out its stated intentions with respect to assets or liabilities, management’s stated reasons for choosing a particular course of action, and management’s ability to pursue a specific course of action may provide relevant information about management’s intent.

39 In respect of some matters, the auditor obtains written representations from those charged with governance and management to confirm responses to oral enquiries. For example, the auditor obtains written representations from those charged with governance and/or management on material matters when other sufficient appropriate audit evidence cannot reasonably be expected to exist or when the other audit evidence obtained is of a lower quality. See ASA 580 Management Representations, for further mandatory requirements and explanatory guidance on written representations.

Confirmation

40 Confirmation, which is a specific type of enquiry, is the process of obtaining a representation of information or of an existing condition directly from a third party. For example, the auditor may seek direct confirmation of receivables by communication with debtors. Confirmations are frequently used in relation to account balances and their components, but need not be restricted to these items. For example, the auditor may request confirmation of the terms of agreements or transactions an entity has with third parties, the confirmation request is designed to ask if any modifications have been made to the agreement and, if so, what the relevant details are. Confirmations also are used to obtain audit evidence about the absence of certain conditions, for example, the absence of a “side agreement” that may influence revenue recognition. See ASA 505, for further mandatory requirements and explanatory guidance on confirmations.

Recalculation

41 Recalculation consists of checking the mathematical accuracy of documents or records. Recalculation can be performed through the use of information technology, for example, by obtaining an electronic file from the entity and using CAATs to check the accuracy of the summarisation of the file.

Reperformance

42 Reperformance is the auditor’s independent execution of procedures or controls that were originally performed as part of the entity’s internal control, either manually or through the use of CAATs, for example, reperforming the ageing of accounts receivable.

Analytical Procedures

43 Analytical procedures consist of evaluations of financial information made by a study of plausible relationships among both financial and non-financial data. Analytical procedures also encompass the investigation of identified fluctuations and relationships that are inconsistent with other relevant information or deviate significantly from predicted amounts. See ASA 520 Analytical Procedures, for further mandatory requirements and explanatory guidance on analytical procedures.