LIST OF INTERNATIONAL STANDARDS OF AUDITING

Respective responsibilities

• ISA 200 Objective and General Principles Governing an Audit of Financial Statements
• ISA 210 Terms of Audit Engagements
• ISA 220 Quality Control for Audits of Historical Financial Information
• ISA 230 Documentation
• ISA 240 The Auditor's Responsibility to Consider Fraud in an Audit of Financial statements
• ISA 250 Consideration of Laws and Regulations in an Audit of Financial Statements
• ISA 260 Communications of Audit Matters with Those Charged with Governance

Audit planning

• ISA 300 Planning and Audit of Financial Statements
• ISA 310 Knowledge of the Business
• ISA 315 Understanding the Entity and its Environment and Assessing the Risks of Material Misstatement
• ISA 320 Audit Materiality
• ISA 330 The Auditor's Procedures in Response to Assessed Risks

Internal Control

• ISA 400 Risk Assessments and Internal Control
• ISA 401 Auditing in a Computer Information Systems Environment
• ISA 402 Audit Considerations Relating to Entities Using Service Organisations

Audit evidence

• ISA 500 Audit Evidence
• ISA 501 Audit Evidence - Additional Considerations for Specific Items
• ISA 505 External Confirmations
• ISA 510 Initial Engagements - Opening Balances
• ISA 520 Analytical Procedures
• ISA 530 Audit Sampling and Other Means of Testing
• ISA 540 Audit of Accounting Estimates
• ISA 545 Auditing Fair Value Measurements and Disclosures
• ISA 550 Related Parties
• ISA 560 Subsequent Events
• ISA 570 Going Concern
• ISA 580 Management Representations

Using work of other experts

• ISA 600 Using the Work of Another Auditor
• ISA 610 Considering the Work of Internal Auditing
• ISA 620 Using the Work of an Expert

Audit conclusions and Audit report

• ISA 700 The Auditor's Report on Financial Statements
• ISA 710 Comparatives
• ISA 720 Other Information in Documents Containing Audited Financial Statements

Specialized areas

• ISA 800 The Auditor's Report on Special Purpose Audit Engagements
• ISA 810 The Examination of Prospective Financial Information

Labels: ICAP, International Auditing Standards, ISAs

ACCA RULE BOOK

ISA 240 (REDRAFTED) AUDITORS AND FRAUD

MARCH 2009
RELEVANT TO ACCA QUALIFICATION PAPERs f8 an d p7
Fraud is a highly controversial area, and the extent
of auditor responsibility for the prevention and
detection of fraud has generated considerable
discussion in recent years. This article aims
to summarise the current extent of auditor
responsibilities for fraud, as per the requirements
of ISA 240 (Redrafted), The Auditor’s
Responsibilities Relating to Fraud in an Audit of
Financial Statements. ISA 240 (Redrafted) was
issued in December 2006 and is effective for
audits of financial statements for periods beginning
on or after 15 December 2008. The International
Auditing and Assurance Standards Board (IAASB)
Clarity Project was launched in 2004 in order
to encourage greater use of its standards and to
facilitate the process of translation of standards
into other languages. ISA 240 is described by
the IAASB Handbook (reference 1) as ‘redrafted’
because it has been revised in the past few years
and is not in need of further revision by the Clarity
Project. As a result, the ‘clarified’ version of ISA
240 is the same as the redrafted version. See the
IAASB Handbook, and the section ‘Background
Information on the Clarity Project of the IAASB’ for
further details (reference 2).
BACKGROUND
The traditional ‘passive philosophy’ towards
auditor responsibility for fraud detection is well
summarised by the Lord Justice Lopes’ ruling, in
the UK, given in the 1896 Kingston Cotton Mill
case (re Kingston Cotton Mill Company (No.2)):
‘An auditor is not bound to be a detective, or
… to approach his work with suspicion, or with
a foregone conclusion that there is something
wrong. He is a watchdog, not a bloodhound.’
(Reference 3). Watchdogs and Bloodhounds
(below) gives formal definitions of a ‘watchdog’
and a ‘bloodhound’.
Clearly, auditing has changed considerably
since 1896, although auditor responsibility for
fraud detection has remained a low priority. We
now consider the requirements of the recently
revised audit standard regarding the role of the
auditor and fraud detection, and then form a
conclusion about the current extent of auditor
responsibility for fraud detection.
THE DIFFERENCE BETWEEN FRAUD
AND ERROR
The key distinguishing factor between fraud
and error is whether the underlying action
that results in a misstatement of the financial
statements is intentional or unintentional. The
term ‘fraud’ is a broad legal concept, but the
auditor is concerned with fraud that causes
a material misstatement in the financial
statements. ISA 240 (Redrafted) defines
fraud as: ‘An intentional act by one or more
individuals among management, those charged
with governance, employees, or third parties,
involving the use of deception to obtain an
unjust or illegal advantage.’ ISA 240 (Redrafted),
paragraph 11.
This article examines the definitions given by International Standard on Auditing (ISA) 240 (Redrafted)
of fraud and error, and the historical expectations of the audit role. It also defines the extent of auditor
responsibilities for the prevention and detection of fraud, including the need for professional skepticism
and discussion among the engagement team. The article then summarises the key risk assessment
procedures required of auditors by ISA 240 (Redrafted), and concludes that the traditional ‘watchdog
not bloodhound’ philosophy regarding the extent of auditor responsibilities for fraud detection is no
longer valid in the context of the requirements of the redrafted ISA.
The two types of fraud most relevant to the
auditor, according to ISA 240 (Redrafted), are
misstatements arising from fraudulent financial
reporting, and misstatements arising from the
misappropriation of assets. By way of contrast to
fraud, the term ‘error’ refers to an unintentional
misstatement in financial statements, including
the omission of an amount or a disclosure.
ISA 240 (Redrafted) says: ‘The distinguishing
factor between fraud and error is whether the
underlying action that results in the misstatement
of the financial statements is intentional or
unintentional.’ ISA 240 (Redrafted), paragraph 2.
The emphasis of this article is on fraud,
because fraud responsibilities are more
controversial than error. Fraud may involve
sophisticated and carefully organised schemes,
designed to conceal fraudulent activity, such
isa 240 (re drafte d),
au ditor s an d frau d –
AND THE END OF WATCHDOGS AND BLOODHOUNDS
WATCHDOGS AND BLOODHOUNDS
The Oxford English Dictionary gives the
following definitions (Reference 4).
A watchdog is defined as ‘A dog kept to guard
private property’, and ‘a person or group that
monitors the practices of companies providing
a particular service or utility’.
A bloodhound is defined as ‘A large hound with
a very keen sense of smell, used in tracking’.
technical
page 51
as forgery,
deliberate failure
to record transactions, or
intentional misrepresentations being
made to the auditor. However, in order to better
understand error, more consideration of internal
control effectiveness is required.
ISA 240 (REDRAFTED) AND RESPONSIBILITIES
FOR FRAUD
ISA 240 (Redrafted) makes it clear who has
the main responsibility for the prevention and
detection of fraud: ‘The primary responsibility
for the prevention and detection of fraud rests
with both those charged with governance of the
entity and management.’ ISA 240 (Redrafted)
paragraph 4.
ISA 240 (Redrafted) also goes on to state,
however, that: ‘An auditor conducting an audit
in accordance with ISAs is responsible for
obtaining reasonable assurance that the financial
statements as a whole are free from material
misstatement, whether caused by fraud or error.’
ISA 240 (Redrafted), paragraph 5.
Hence, both the entity itself and the auditors
have responsibilities for fraud and error. It could
be said that management, and those charged
with governance, have the primary responsibility
for fraud and error, whereas the auditor has a
secondary responsibility. It is important, however,
to ensure that the extent of these secondary
responsibilities are clearly understood, which is the
THIN KIN G PER?
PERFORMANCE OBJECTIVEs 17 AND 18 ARE lin ked TO PAPER f8
area discussed in the rest of
this article.
PROFESSIONAL Skepticism
ISA 200 (Revised and Redrafted), Overall
Objective of the Independent Auditor and the
Conduct of an Audit in Accordance with ISAs,
requires the auditor to maintain an attitude
of professional skepticism: ‘The auditor shall
plan and perform an audit with professional
skepticism, recognising that circumstances
may exist that cause the financial statements to
be materially misstated.’ ISA 200 (Revised and
Redrafted), paragraph 15.
ISA 200 (Revised and Redrafted) describes
professional skepticism as: ‘An attitude that
includes a questioning mind, being alert
to conditions which may indicate possible
misstatement due to error or fraud, and a critical
assessment of audit evidence.’ ISA 200 (Revised
and Redrafted), paragraph 13 (l).
ISA 240 (Redrafted) further requires that: ‘The
auditor is responsible for maintaining an attitude
of professional skepticism throughout the audit.’
ISA 240 (Redrafted), paragraph 8.
Professional skepticism is of key importance
to the audit, for example requiring auditors to be
alert to:
audit evidence contradicting other
evidence
information questioning evidence reliability
conditions that may indicate possible fraud
circumstances that suggest the need for audit
procedures in addition to those required by
the ISAs.
DISCUSSION AMONG THE ENGAGEMENT TEAM
ISA 240 (Redrafted) refers to the requirement in
ISA 315 (Redrafted), Identifying and Assessing
the Risks of Material Misstatement Through
Understanding the Entity and its Environment,
that members of the engagement team discuss the
susceptibility of the entity’s financial statements
to material misstatement due to fraud. ISA 240
(Redrafted) requires that: ‘This discussion shall
place particular emphasis on how and where the
entity’s financial statements may be susceptible
to material misstatement due to fraud, including
how fraud might occur.’ ISA 240 (Redrafted),
paragraph 15.
Ordinarily, the key members of the engagement
team should be involved in the discussion, and the
engagement partner should then consider which
matters are to be communicated to those in the
team not involved in the discussion. Discussion is
expected to occur with a questioning mind, setting
aside any beliefs held by the engagement team
members that the management and those charged
with governance are honest and have integrity.
Interestingly, this discussion is also expected
to include a consideration of how an element
of unpredictability will be incorporated into the
nature, timing, and extent of the audit procedures
to be performed.
technical
page 52
student accountANT
MARCH 2009
ISA 240 (REDRAFTED) RISK
ASSESSMENT PROCEDURES
ISA 240 (Redrafted) requires that the auditor
performs risk assessment procedures to
obtain information for use in identifying the
risks of material misstatement due to fraud.
Paragraphs 17 to 24 of ISA 240 (Redrafted)
outline the required risk assessment
procedures, which are summarised in the
Risk Assessment Procedures box (left).
CONCLUSION
The redrafting of ISA 240 has allowed for
a timely review of audit responsibilities
relating to fraud. It should be noted, however,
that there are minor differences of emphasis
between the requirements of ISA 240 (Redrafted)
and the current requirements of ISA (UK and
Ireland) 240 The Auditor’s Responsibility
to Consider Fraud in an Audit of Financial
Statements, which became effective for periods
commencing on or after 15 December 2004.
According to ISA 240 (Redrafted) the difference
between fraud and error depends upon whether
deception has been used, and the distinction
between the responsibilities of those charged
with governance and auditors for fraud prevention
can be described respectively as primary and
secondary responsibilities. Auditors are required,
however, to maintain an attitude of professional
skepticism throughout the audit, and members
of the audit engagement team are required to
discuss the susceptibility of the entity’s financial
statements to material misstatement due to fraud.
ISA 240 (Redrafted) requires auditors to
perform risk assessment procedures to obtain
information for use in identifying the risks of
material misstatement due to fraud.
Finally, it can be concluded that to describe
the audit role as that of a ‘watchdog, not a
bloodhound‘ is no longer valid in the context of
the requirements of the redrafted and revised
ISAs; these negate the traditional ‘passive
philosophy’ towards auditor responsibility
for fraud detection, marking a significant shift
away from a ‘monitoring’ role and towards the
requirement for a very keen ‘sense of smell’.
REFERENCES
1 Handbook of International Auditing, Assurance,
and Ethics Pronouncements, Part II, IAASB,
2008 Edition.
2 Background Information on the Clarity Project of
the International Auditing and Assurance Standard
Board, 2008 Edition, pages 1 to 4, in Part II of
Handbook of International Auditing, Assurance,
and Ethics Pronouncements, IAASB, 2008 Edition.
3 Lord Justice Lopes, The Law Times, Volume LXXIV,
Court of Appeal, 11 July 1896, quoted in Sarup
D, Watchdog or Bloodhound? The Push and Pull
Towards a New Audit Model, Information Systems
Control Journal, Volume 1, 2004.
4 Oxford English Dictionary, www.askoxford.com
Martyn Jones is assessor for Paper F8
RISK ASSESSMENT PROCEDURES
Paragraphs 17 to 24 of ISA 240
(Redrafted) detail the required
audit risk assessment procedures
and related activities, summarised
as follows:
1 Enquiries
(i) The auditor should inquire
about management’s own
assessments of the risks of fraud,
the process used for identifying
and responding to the risks
of fraud, and management’s
communication to those charged
with governance regarding its
processes for identifying and
responding to the risks of fraud.
(ii) The auditor should also make
inquiries of management to
determine whether they have any
knowledge of fraud.
(iii) The auditor should also make
inquiries of internal audit (where
there exists an internal function)
to determine whether it has any
knowledge of fraud.
2 Oversight role of those charged
with governance
The auditor should obtain an
understanding of how those charged
with governance exercise oversight
of the management process for
identifying and responding to the
risks of fraud, and whether those
charged with governance have
any knowledge of fraud affecting
the entity.
3 Evaluate unusual or
unexpected relationships
The auditor should evaluate whether
unusual or unexpected relationships
identified when performing analytical
procedures may indicate risks of
material misstatement due to fraud.
4 Consider other information
The auditor should consider whether
other information obtained potentially
indicates risks of fraud.
5 Evaluation of other risk
assessment procedures
The auditor should evaluate whether
the information obtained from the
other risk assessment procedures and
related activities performed indicates
that one or more fraud risk factors
are present.

AUDIT RISK FOR ACCA PAPER F8 . BPP

ACCOUNTANCY AGE JOBS

THE RISING COST OF AUDIT

The Rising Cost of Audit

The introduction of International Auditing Standards in 2005 has had a major impact on the profession and the way in which firms – typically those at the smaller end of the scale – deal with auditing issues.

There is a dividing line between commercial reality/cost v benefit and adherence to ‘the book’ as well as a sense of uncertainty as to what various International Auditing Standards actually (a) require the auditor to do and (b) the documentation required to be placed on the audit file to support the audit evidence.

This article by Steven Collings looks at how audit firms acting for smaller companies can try to reduce their costs and at the same time produce an audit file which would stand up to scrutiny.

It goes without saying that the international regime has certainly put the cost of audit up and in most cases, the extent of these costs are sometimes irrecoverable – meaning that audit is becoming more of a hindrance to professional firms than a benefit.  Invariably, clients will express their dissatisfaction at their fees going up by anymore than the annual rate of inflation and even that can sometimes ‘ruffle feathers’.

So why did the standards change so dramatically, and how can firms at the smaller end of the scale manage the increased costs inherent with the audit process?

Well-publicised corporate disasters (Enron, WorldCom and such like) contributed hugely to the overhaul of the auditing standards, as well as the convergence of the UK to the international regime in both audit and accounting standards.  It is true to say that the now defunct Statements of Auditing Standards (SASs) in the UK were not as arduous as the International Standards on Auditing (ISAs).  In particular, with reference to the well-publicised corporate disasters, ISA 240 (“The Auditor’s Responsibility to Consider Fraud in an Audit of Financial Statements”) places much more emphasis on the auditor to consider fraud at the planning stage than the old SAS 110 did.

However, as an auditor myself, what I found to be the biggest surprise was the sheer size of an audit file prepared under ISAs after completion, when compared with another file prepared under SASs.  Why? The reason is the sheer amount of audit documentation which the ISAs now require.

Invariably, when following an audit programme under SASs, most auditors would tick a box to say that they had completed an audit task.  The ISAs now require, not only for auditors to complete a task (and show they have completed a task), but ISAs expect a schedule documenting exactly what the auditor has done, rather than just write ‘completed’ without any detail as to the procedures undertaken. This has contributed to the sheer increase in paperwork placed on an audit file and in turn has also contributed to the additional costs faced by professional firms because the amount of ‘corner cutting’ a firm can do has now been significantly wiped out.

When attending CPD seminars, it is obvious from comments made by delegates and speakers alike, that the administrative burdens associated with audit and the increases in cost that these extra burdens brings, frustrates accountants – because ultimately the reason they are in business is to make a profit.  So how can smaller firms deal with the increase in the costs and still produce a good standard audit file which would face up to scrutiny?

In September 2007, the Auditing Practices Board (APB) issued Practice Note 26 (“Guidance on Smaller Entity Audit Documentation”) which replaced Practice Note 13 (“The Audit of Smaller Businesses”).  The key aspect of the practice note is that it is directed at those companies that are either audit exempt, but choose to have an audit and for those smaller entities where the ownership is smaller and the operations, processes and internal controls within the entity are relatively straightforward.  Needless to say, the consultation draft was widely supported throughout the profession.

ISA 315 (“Obtaining an Understanding of the Entity and its Environment”) is a very comprehensive and long-winded standard which details the various requirements auditors have to undertake to obtain an understanding of their audit client.  Invariably, this results in masses of paperwork being stored on the planning section of the current and permanent audit files.

The key feature of practice note 26, which auditors will no doubt welcome, is the fact that under the practice note, it is not necessary to document every single aspect of the auditor’s understanding of its client.  The practice note allows auditor’s of smaller companies to merely document the key points relevant to the audit, which should save time and reduce costs.  The practice note goes on to say that audit documentation may be in simple form and relatively brief.

Another feature of the practice note is that at the back of practice note, there are examples of what smaller audit documentation may look like and how they can be put to good use in a smaller audit.  These examples were welcomed by the profession as ISA 315 appeared to be the main area where costs had increased.  There was also the issue that professional firms were uncertain as to the extent of documentation required to be put on their files to support the audit evidence obtained in understanding the entity especially when documenting the entity’s internal control environment.

Whilst audit documentation is still crucial under ISA 230 (“Audit documentation”), practice note 26 may help firms at the smaller end of the scale reduce the time spent on various aspects of the audit, and in turn reduce the associated costs.  It is worth noting that practice note 26 is designed to be persuasive rather than prescriptive and is designed to assist audit firms in applying the ISAs to particular circumstances and industries for companies at the smaller end of the scale.

The APB is currently undergoing a further overhaul of its auditing standards aimed at clarifying and improving the standards.  The APB recently announced that its complete set of clarified ISAs will be effective for audits of financial statements for periods beginning on or after 15 December 2009 and we can only wait until then to see how effective the APB’s clarity project has actually been.

Practice Note 26 can be downloaded free of charge fromhttp://www.frc.co.uk/apb/press/pub1404.html

Steven Collings FMAAT ACCA is Audit Manager at Leavitt Walmsley Associates Limited and a regular contributor to AccountancyStudents.

THE AUDITOR AND FRAUD

The Auditor and Fraud

Fraud has become a major issue within the accountancy profession over recent years and the accounting and audit profession has suffered a significant amount of embarrassment because of the failings whereby audit firms have either overlooked or ‘turned a blind eye’ to fraud.

This article considers the technical aspects of ISA 240 ‘The Auditor’s Responsibility to Consider Fraud in an Audit of Financial Statements’.  The article is written from the perspective of a smaller audit client and aims to outline what smaller audit firms need to consider when looking at fraud issues and what they have to do if they discover a fraud.  Further on in the article there is an illustration of a fraud committed at an audit client and considers other ISAs which may need to be considered in the area of fraud.

Prior to international standards, fraud was dealt with in SAS 110 ‘Fraud and Error’. The international regime has dropped ‘error’ in the title of the standard and ‘fraud’ is dealt with in ISA 240.  At the outset it is important to understand what determines ‘fraud’ and what gives rise to ‘error’.

ISA 240 defines fraud as:

“an intentional act by one or more individuals among management, those charged with governance, employees, or third parties, involving the use of deception to obtain an unjust or illegal advantage”.

Error, on the other hand is defined as:

“an unintentional misstatement in the financial statements including the omission of an amount or disclosure”.

Misstatements within the financial statements can therefore be derived from either ‘fraud’ or ‘error’ and the auditor needs to be extremely careful to ensure that the misstatement is correctly classified.

In terms of audit, fraud is sub-divided into two further categories.  There is ‘management fraud’ which refers to fraud involving one or more members of management, or those charged with governance and there is ‘employee fraud’ where the level of fraud is committed by non-management.  In addition, there is also what is termed ‘manipulation of the financial statements’.  This is where the financial statements are deliberately amended to achieve a higher or lower earnings level than has actually occurred or maybe to reduce gearing levels in order to comply with loan covenants imposed by financiers.

In terms of management fraud, this involves (primarily) overriding internal controls.  The actual amounts involved could be substantial and auditors need to consider this carefully.  Conversely, employee fraud (primarily) involves the misappropriation of company assets whether it is stock or cash.  In contrast to management fraud, whereby managementoverride the internal controls, employees will exploit weaknesses in the internal control environment.  The amounts involved in employee fraud can be anything from small to substantial.

ISA 240 states that auditors need to suspect fraud at the planning stage and essentially confirm that fraud has not been committed by virtue of their audit work.  From a smaller audit perspective, how can this be achieved?  In essence, ISA 240 states that auditors must:

• discuss fraud risk and incidence with management and those charged with governance (auditors need to document this discussion on the file as part of the planning);
• discuss with the engagement team how the financial statements may be susceptible to material misstatement whether caused by fraud or error;
• consider whether one or more fraud risk factors are present;
• perform audit procedures to test the appropriateness of journal entries, test the risk of management override of internal controls, review accounting estimates and their appropriateness (see also ISA 540 ‘Auditing Accounting Estimates’) and understand the business rationale for significant transactions outside the normal course of business;
• obtain specific representations from management including its assessment of the risk of fraud; and
• consider the implications under the Money Laundering Regulations.

Prior to the international regime of auditing, under SAS 110 ‘Fraud and Error’ if our audit work revealed discrepancies then we would increase our substantive testing accordingly.  ISA 240 works on the basis that we have to suspect fraud at the outset of the audit and reduce that expectation, by virtue of our audit work, to an acceptable level.  The term ‘guilty until proven innocent’ is what the ISA is suggesting.  It is important to point out that the auditor’s responsibility is not to detect fraud – the responsibility of preventing and detecting a fraud rests with the client.

Audits are not designed to confirm to the user of the financial statements that the accounts are 100% accurate – this is simply not possible.  Fraud, by its very nature, can be extremely difficult to detect and it could be the case that the audit may not reveal a fraud.  Clients can sometimes be under the illusion that if an unqualified opinion is issued on the financial statements, then this means they are 100% accurate and their systems are totally robust – this is not necessarily the case.  Firms should therefore ensure that their letters of engagement emphasises that the nature of the audit is such that a material misstatement may not be revealed during the audit.  However, this is not designed as a ‘get out of jail’ card for not doing appropriate audit testing in terms of fraud.  Audit firms must ensure that their audit work supports the opinion they give on the financial statements and an efficient audit would normally detect a material misstatement whether caused by fraud or error.

The following illustration will help illustrate what the auditor has to do in terms of ISA 240 and the instance of fraud.

Illustration

We are undertaking the audit of Company A Limited for the year ended 31 March 2008. Company A operates a highly successful retail clothing business in a very busy town centre location and is largely cash-based. The audit firm have audited the client for the last five years and the client has relatively simple internal controls which have always operated effectively.  The integrity of the management has never been brought into question.  Cash is reconciled on a daily basis and passed to the accounts office cashier for subsequent recording in the bookkeeping system and banking.  One person is employed in the accounts department whereas in previous years two have always been employed.

The audit senior is undertaking the audit of the cash takings for the year which contribute significantly to the company’s turnover for the year.  During the course of reperforming the cash reconciliation in the sample, it transpired that there was a significant difference between the cash that has been taken from till sales against the cash that has been banked in the same sample. The senior has therefore increased the sample accordingly and has confirmed that in the increased sample, discrepancies in the region of £25,000 have been discovered.  The senior has also discovered that the cash sheets have been amended by the cashier and the explanations she has given are “they are ‘over rings’ on the till”.  The planning section of the audit file (which is up to date) suggests that any ‘over rings’ on the till are corrected and reviewed by a Director.  There is no evidence that this authorisation/review has been sought and this suggests that the apparent ‘over rings’ have not, in fact, occurred.

The audit senior also noticed that the cashier drives a brand new Porsche.  Having undertaken the wages audit, the cashier’s annual salary is £20,000 per annum and she has been telling the audit senior about her forthcoming three-week cruise around the Caribbean and how much she is looking forward to it as she has recently redecorated her (recently purchased) three-bedroom detached house.  The audit senior has questioned the marital status of the cashier and it turns out that she is single and not in a relationship.

Further investigation by the senior and the audit manager strongly suggests that a fraud has been committed.  It appears the cashier has been stealing cash from the takings on a daily basis and amending the cash sheets to read what has been banked, as opposed to the actual takings in an attempt to cover up the fraud.  It would appear she has committed this fraud to finance her lavish lifestyle.  The fact that she is single and is not in a relationship immediately eradicates the question of whether her husband/partner has a high income level, which would support that sort of lifestyle.

Under ISA 260 ‘Communication of Audit Matters to those Charged with Governance’ the auditor must go to the directors/those charged with governance and inform them of the situation as soon as is reasonably practical.  The auditor must also consider the appropriate means of communicating the fraud to the directors – either orally or in writing.  Firms at the smaller end of the scale may find it more appropriate to confirm both orally and in writing.  If the firm communicates orally, then they should document this discussion in the audit file.

The auditor must be absolutely certain that a fraud has been committed.  If it was a genuine error or multiple errors throughout the year, then this may not be a fraud – it could just be weaknesses in internal controls which should be notified to those charged with governance in the form of a management letter.  Therefore, the correct classification of ‘fraud’ or ‘error’ is crucial.

In the example above there is a mix of issues.  The first is clearly the fraud.  The audit senior had noticed that the lifestyle of the cashier is far too extravagant and that her annual salary would not normally allow for such a lifestyle.  The senior was right to question her lifestyle and her marital status because this has made the senior ask the question “how can she afford a brand new Porsche, a new house and an expensive holiday?”  This is a clear indication that fraud may be being committed.  The difficulty arises because we are not auditing the employee, we are auditing the company and employee’s financial circumstances are not normally questioned – in this example, however, the audit senior was right to question the employee’s personal financial circumstances.  It could be that in the illustration above, the employee may have received a windfall of cash, or inherited a rich Aunt’ fortune which would have allowed for such a lifestyle – however for the purposes of this article, we shall assume that the only income the cashier has is her annual salary.

Secondly there has been a failing in the internal controls.  The cashier has identified and exploited a weakness in the internal controls – the weakness being a lack of segregation of duties in terms of the banking arrangements of the company.  Ideally, one person should be reconciling the cash taken on a daily basis, another person should have been recording the cash in the company’s books and another individual should have been banking the cash.  The fact that one individual records and banks the cash is thus a failing in the company’s internal controls and the audit firm needs to raise this issue by way of management letter.

If the fraud in the example above had been committed by a Director – this would have given rise to (a) management override of internal controls and, maybe, (b) a weakness within the internal controls.  If the integrity of an audit client’s management is brought into question (i.e. a management fraud has been committed), then auditors need to tread very carefully.

Firstly, the auditor must seek legal advice to determine the most appropriate course of action.  If, as a result of exceptional circumstances, the auditor is forced to consider their ability to continue performing the audit, ISA 240 states that the auditor must:

• consider the professional and legal responsibilities applicable in the circumstances, including whether there is a requirement for the auditor to report the person(s) who made the audit appointment to regulatory authorities;
• consider the possibility of withdrawing from the engagement; and
• if the auditor withdraws from the engagement they must discuss their reasons with management and those charged with governance and consider whether there is a professional obligation to report the person(s) who made the engagement to regulatory authorities.

In terms of actual audit work to address the risk of fraud, then the auditor should look at ISA 330 ‘The Auditor’s Procedures in Response to Assessed Risks’.  This ISA states that the auditor should:

• consider the assignment and supervision of personnel;
• consider the accounting policies used by the entity; and
• incorporate an element of unpredictability in the nature, timing and extent of audit procedures.

There are lots of ways in which fraud can be committed at both management level and employee level and auditors sometimes need to think like a fraudster!  Some common indicators of fraud are as follows:

• employees not taking holidays;
• external pressures from outside entities, for example, the bank may have loan covenants and the audit client is struggling to prevent breaches of the covenants;
• threatening or intimidating management;
• a history of dishonesty with those charged with governance;
• management override of internal controls.  Examples of these are fictitious journals (especially towards the year end), inappropriately adjusting assumptions and judgements and omitting or delaying events that have occurred during the accounting period;
• a high standard of living (as in the example above) where a salary or package would not normally allow such a high standard of living;
• unusual characteristics within the financial statements (the use of analytical review may identify such characteristics); and
• a lack of segregation of duties (as in the example above).

Those are just some of the most common indicators of fraud.  There are others and auditors should use their judgements accordingly.

Applicable Auditing Standards that link to Fraud

• ISA 240 The Auditor’s Responsibility to Consider Fraud in an Audit of Financial Statements.
• ISA 260 Communication of Audit Matters to those Charged with Governance.
• ISA 315 Obtaining an Understanding of the Entity and the Environment in which it Operates.
• ISA 330 The Auditor’s Procedures in Response to Assessed Risk.
• ISA 520 Analytical Procedures.
• ISA 540 Auditing Accounting Estimates.

Conclusion

Fraud is a subject that is often ‘brushed under the carpet’ because auditors do not like discussing such issues with their client.  It can be very awkward discussing fraudulent activity with clients and, in some circumstances, clients can take offence!  However, ISA 240 does stipulate that professional scepticism must be adopted in all audits, whether the firm has acted for the client for ten years or has just been appointed.

In the event that auditors discover a fraud, then they should (in all circumstances) consult the provisions of ISA 240 and ISA 260.  Where the integrity of those charged with governance is brought into doubt the auditor should seek legal advice.

Steve Collings is Audit Manager at Leavitt Walmsley Associates

http://www.lwaltd.com

ARTICLE ON THE IMPORTANCE OF AUDIT PLANNING

The Importance of Audit Planning

This article takes a look at a vitally important aspect of an auditor’s work which is that of the planning of the audit.  Students studying ACCA F8 and P7 will benefit from the contents of this article.

An efficient and effective audit can only be performed if the audit has been thoroughly and properly planned.  The importance of audit planning cannot be over emphasised and ISA 300 (redrafted) ‘Planning an Audit of Financial Statements’ contains the provisions which the auditor is required to comply with in planning an audit.

In summary, ISA 300 says that the planning stage of the audit should be used to establish an overall strategy for the audit, develop an audit plan and reduce audit risk to an acceptably low level.  In other words, the auditor should plan the audit engagement so that it will be performed in an effective manner and in accordance with auditing standards.

Adequate audit planning will ensure that appropriate attention is given to crucial areas of the audit and that potential problems are identified on a timely basis.  At the planning stage the audit engagement partner should assign the necessary staff who possess the skills and ability required in order to ensure the audit is carried out efficiently and in accordance with the International Standards on Auditing.

Preliminary Engagement Activities

When the auditor engages a new audit client, then ISA 300 stipulates certain procedures the auditor is required to carry out as follows:

• Perform procedures regarding the continuance of the client relationship and the specific audit engagement;
• Evaluate compliance with ethical requirements, including independence; and
• Establish an understanding of the terms of the engagement.

Performing these preliminary activities ensures that the auditor:

• Maintains the necessary independence and ability to perform the engagement;
• Ensures that there are no issues with management integrity that may affect the auditor’s willingness to continue with the engagement; and
• Ensures that there is no misunderstanding with the client as to the terms of the engagement.

The auditor should also communicate with the entity’s previous auditors where there has been a change of auditors in accordance with the relevant Ethical Standards.

Planning activities for initial engagements will often be more in depth than for a recurring engagement simply because the auditor will not have previous experience of the audit engagement and therefore the auditor needs to ensure they gain a thorough understanding of the entity and the environment in which it operates in accordance with ISA 315 (redrafted) ‘Understanding the Entity and its Environment and Assessing the Risk of Material Misstatement’.

Initial engagements will also include additional audit procedures required to be adopted to gather audit evidence concerning the opening balances.  ISA 510 (redrafted) ‘Initial Engagements – Opening Balances’ deals with issues where the audit firm was not the previous year’s auditors and the procedures required to deal with the opening balances.

Planning Activities

At the planning stage the auditor will develop the overall audit strategy.  The audit strategy sets the scope, timing and direction of the audit.  At this stage the auditor will develop the detailed audit plan which will help identify problem areas and important audit areas.

At the planning stage the materiality level is set and areas where material misstatement might occur are identified.  Materiality must always be assessed where an audit opinion is given.

Once the audit strategy has been established, then the auditor is able to develop the more detailed audit plan to address the matters identified in the overall audit strategy.  The auditor should then reduce the audit risk to an acceptably low level.  Audit risk is the risk that the auditor will arrive at the wrong opinion.

Contents of the Audit Plan

The audit plan is more detailed than the overall audit strategy and ISA 300 defines the contents which the detailed audit plan should take.

The audit plan should document the nature, timing and extent of the audit procedures to be adopted which should be sufficient and effective enough to be able to assess the risks of material misstatement within the financial statements.

The detailed audit plan should also contain a description of the nature, timing and extent of planned further audit procedures at the assertion level for each material class of transactions, account balances and disclosures.  This section of the audit plan interlinks with the provisions of ISA 330 ‘The Auditor’s Procedures in Response to Assessed Risks’.

Finally, the audit plan should also contain details of other audit procedures to be adopted so that the audit can be carried out in accordance with the ISA’s (for example, ISA 620 (revised and redrafted) ‘Using the Work of an Auditor’s Expert’).

It is important to understand that planning for the audit procedures takes place over the course of the audit engagement.  Risk assessment procedures are carried out early on in the audit, whereas the nature, timing and extent of audit procedures will be carried out in response to the risk assessment.

Typical contents of the detailed audit plan are:

• Nature of the business and what it does
• Risk and problematic areas (both business risk and financial statement risk)
• Details of any complexities associated with the audit assignment
• Specific accounting and auditing standards relevant to the assignment
• Budgets
• Planned audit procedures
• Details of sampling techniques
• Key personnel employed at the clients
• Points brought forward from previous audits

Planning During the Audit

It is important to understand that once the planning of the audit is completed, it is not simply forgotten about.  There could be occasions when the audit plan might need to be changed, for example due to unforeseen circumstances and in these respects the auditor will need to change the overall audit plan.

Supervision

During the planning stage the auditor plans the nature, timing and extent of the audit procedures to be carried out.  This is not the only issue which the auditor needs to address during the course of the planning.  The auditor should also ensure that they plan the nature, timing and extent of the review of the work of the engagement team members.

The review of the engagement team members work will vary depending on various factors such as the complexity of the audit engagement, the risk of material misstatement and the competencies involved.  These factors are not exhaustive and specific factors attached to the audit engagement should be considered when planning the nature, timing and extent of the engagement team members work review.

Documentation

The provisions of ISA 300 state that the auditor must document the overall audit strategy and the audit plan.  In addition, any significant changes to the overall audit strategy and audit plan must also be documented.  Standard audit programmes can be used to deal with this issue, however it is important that the auditor tailors the audit programme appropriately so it is specific to the engagement.  Remember, the audit is not simply a ‘tick box’ exercise. ISA 230 (revised) ‘Audit Documentation’ governs the documentation required during the course of an audit.

Conclusion

The planning stage of the audit is an extremely vital area.  Going in to an audit ‘blind’ is wreckless and does not conform to the ISAs relating to planning – namely ISA 300 and ISA 315.  The core principle involved in the audit planning is to ensure the audit is carried out efficiently and that sufficient attention is devoted to important audit areas.

Steve Collings FMAAT ACCA DipIFRS is audit manager at Leavitt Walmsley Associates (http://www.lwaltd.com) and is partner in AccountancyStudents.co.uk.  Steve is also the author of ‘A Summary of IFRS and IAS’ which can be purchased direct from AccountancyStudents.co.uk