Fundamental Principles of Assurance Engagements

An assurance engagement involves three essential parties: the practitioner (governed by professional competence), the responsible party (accountable for the subject matter), and the intended users (identified by agreement).

The subject matter is what's being evaluated—like financial statements—while the subject matter information is the outcome of this evaluation against specific criteria. For example, in a financial audit, the financial statements themselves are the subject matter information.

When gathering evidence, auditors must consider both sufficiency (quantity) and appropriateness (quality). Remember that more evidence may be needed when risk is higher, but simply getting more low-quality evidence doesn't compensate for poor quality. Evidence is more reliable when:

• Obtained from outside sources
• Generated internally under effective controls
• Directly obtained by the auditor
• In written/documentary form
• From original rather than copied sources

Pro Tip: Professional skepticism is crucial throughout an engagement. Maintaining a questioning mindset helps you avoid overlooking suspicious circumstances and strengthens your ability to gather appropriate evidence.

Assurance engagements vary by level and structure. Reasonable assurance engagements (like audits) provide high assurance with positive opinions, while limited assurance engagements (like reviews) offer moderate assurance with negative opinions. The procedures differ significantly—audits require more extensive procedures beyond inquiry and analytics.

The structure can be either attestation-based (practitioner evaluates assertions made by the responsible party) or direct (practitioner directly reports on the subject matter).

Non-assurance engagements include agreed-upon procedures (reporting findings without conclusions), compilations (organizing financial information without assurance), tax services, and management consulting. These services don't provide the same level of confidence as assurance engagements.

Professional standards are established by various boards under the International Federation of Accountants (IFAC), with corresponding Philippine Standards covering auditing (PSAs), review engagements (PSREs), assurance engagements (PSAEs), related services (PSRSs), and quality control (PSQCs).

Introduction to Financial Statement Audits

A financial statement audit is a systematic process where auditors obtain and evaluate evidence about management's assertions to determine if they match established criteria. This verification process forms the backbone of financial reporting credibility.

The theoretical framework for audits rests on several key principles. Auditors must maintain their independence to provide objective opinions, and the reliability of financial statements increases with effective internal controls and consistent application of accounting policies.

Businesses require audits due to several factors that create demand:

• Information and business risk make investors seek verification
• Conflicts of interest exist between management and financial statement users
• Expert knowledge is needed to interpret complex transactions
• Remote users cannot directly verify information themselves
• Financial consequences of decisions based on statements can be significant
• Regulatory requirements from SEC and BIR mandate audits for qualifying entities

Important: Companies with gross annual sales of ₱3 million or more (vatable businesses) must undergo BIR-required audits, while SEC requirements vary based on entity type and asset/liability thresholds.

When examining financial statements, auditors focus on specific assertions made by management. These are organized into three categories:

• Transactions and Events assertions (TOCCAC): Completeness, Occurrence, Classification, Accuracy, Cutoff
• Account Balances assertions (ACERV): Completeness, Existence, Rights & Obligations, Valuation
• Presentation and Disclosures assertions (PORCACUV): Occurrence, Rights & Obligations, Completeness, Accuracy, Classification, Understandability, Valuation

All audits face inherent limitations. These include sampling risk (testing only a portion of transactions), judgment limitations, internal control weaknesses, and evidence that is persuasive rather than conclusive.

The audit process follows a structured approach: preliminary engagement activities, planning, internal control evaluation, substantive testing, completion, report issuance, and post-audit responsibilities. Preliminary activities focus on client acceptance considerations, including the auditor's competence and independence, client integrity, and establishing audit preconditions through an engagement letter.

For recurring audits, new engagement letters aren't required unless significant changes have occurred in circumstances, terms, or management. If a client requests changing the engagement's nature, auditors must carefully evaluate whether there's reasonable justification before proceeding.

Planning an Audit

Planning is essential for an effective audit. According to PSA 300, proper planning helps coordinate work, assign responsibilities, facilitate supervision, and identify problems early. The nature and extent of planning varies based on the entity's size, complexity, prior experience with the entity, and circumstances.

The planning process produces three key outputs:

• Overall Audit Strategy (general scope, timing, and extent)
• Detailed Audit Plan (nature, timing, and extent of risk assessment and further audit procedures)
• Audit Program (detailed audit procedures for execution)

When identifying and assessing risks of material misstatements (RoMMs), auditors consider both:

• Financial Statement Level risks that affect the financial statements pervasively
• Assertion Level risks that affect specific assertions in account balances or transactions

Materiality directly impacts the extent of audit procedures. Lower materiality levels require more extensive procedures, while higher levels allow for less extensive testing. Remember this key relationship: materiality and audit risk have an inverse relationship, while audit risk and audit procedures have a direct relationship.

Remember: When control risk and inherent risk are both high, detection risk must be at its lowest level to maintain an acceptable overall audit risk. This means you'll need to perform more extensive substantive testing.

Internal control is a process established by management to provide reasonable assurance about operations, reporting, and compliance. Effective internal controls can significantly improve audit efficiency by allowing for reduced substantive testing.

Internal controls face inherent limitations (COCCHA):

• Cost-benefit considerations
• Management override
• Collusion among employees
• Changing conditions
• Human error
• Only addressing anticipated transactions

The five components of internal control (CRIME) include:

• Control environment (foundation for all other components)
• Risk assessment (identifying and managing business risks)
• Information and communication systems
• Monitoring activities
• Control activities (policies and procedures)

After evaluating the design and implementation of controls, auditors make a preliminary assessment of control risk. If control risk is assessed at less than maximum, auditors perform tests of controls to confirm operating effectiveness. If controls aren't effective or it's inefficient to test them, the control risk is set at maximum, requiring more extensive substantive testing.

Tests of Controls and Substantive Testing

Tests of Controls evaluate whether internal controls operate effectively in preventing, detecting, or correcting material misstatements. These tests go beyond just understanding the design—they confirm that controls actually work in practice.

For high-volume transactions, tests of controls combined with substantive analytics provide more persuasive evidence than substantive testing alone. Key procedures include inquiry, observation, inspection, and reperformance, with inquiry alone never being sufficient.

When controls aren't operating effectively, auditors must rely more heavily on substantive procedures, testing closer to year-end with larger sample sizes.

Substantive testing focuses on gathering evidence about the accuracy of account balances and transactions. Without sufficient evidence, an auditor cannot express an opinion. This evidence must be both persuasive and relevant to the assertions being tested.

Audit Insight: Evidence quality matters more than quantity. Evidence obtained from independent external sources is generally more reliable than information generated internally, and original documents are more reliable than copies.

Substantive testing can be performed as:

• Tests of Details of Transactions (examining the movement in accounts)
• Tests of Balances (focusing on ending balances)
• Substantive Analytics (evaluating financial information through analysis)

The nature, timing, and extent of substantive procedures depend on the assessed risk levels. Lower detection risk requires more effective procedures, testing closer to year-end, and larger sample sizes.

Specific substantive procedures include the "trifecta" (inquiry, observation, inspection) plus recalculation, analytical procedures, and confirmations. External confirmations are particularly valuable as they provide evidence directly from third parties.

For positive confirmations:

• Recipients must respond to indicate agreement or disagreement
• More effective for larger account balances
• Non-responses require alternative procedures

For negative confirmations:

• Recipients respond only if they disagree with the information
• Appropriate for many small balances with low risk
• More efficient but provide less assurance

Completing the Audit

As the audit nears completion, auditors perform crucial wrap-up procedures to ensure all material matters are properly addressed before issuing their opinion.

Searching for unrecorded liabilities is a critical step since companies tend to understate liabilities. Auditors review subsequent cash disbursements, examine unapproved invoices, and perform analytical procedures to detect missing obligations.

When evaluating litigation and claims, auditors:

• Inquire with in-house legal counsel
• Review board meeting minutes
• Examine legal expense accounts
• Obtain direct confirmation from external legal counsel

Warning: If management refuses to allow communication with the entity's external legal counsel, this may result in a qualified opinion or disclaimer of opinion.

Related party disclosures require special attention. Auditors must identify relationships, evaluate unusual transactions, and assess whether disclosures comply with accounting standards. Failure to obtain sufficient evidence about related parties may lead to a qualified or adverse opinion.

Assessing going concern is another critical element. Management must evaluate the entity's ability to continue operating for at least 12 months from the financial statement date. If significant doubt exists, auditors must:

1. Evaluate management's plans to mitigate these issues
2. Gather evidence to confirm or dispel material uncertainties
3. Determine appropriate reporting based on their findings

If going concern is appropriate but material uncertainty exists, an unqualified opinion with an Emphasis of Matter paragraph is required. If going concern is not appropriate and financial statements are prepared on a going concern basis, an adverse opinion is warranted.

For subsequent events, auditors must distinguish between:

• Adjusting events (those providing evidence of conditions existing at the balance sheet date)
• Non-adjusting events (those concerning conditions arising after the balance sheet date)

If management amends financial statements to reflect subsequent events, the auditor must extend procedures to cover these changes and issue a new report. If management refuses to make necessary amendments, the auditor may need to modify their opinion or seek legal advice.

Before finalizing the audit, auditors perform analytical procedures to help form an overall conclusion about whether the financial statements are consistent with their understanding of the entity.

Communication and Documentation

Effective communication and thorough documentation are essential components of a quality audit. A key communication tool is the Management Representation Letter, which:

• Confirms specific matters discussed during the audit
• Supports other audit evidence
• Should be provided near the report date
• Must be signed by senior management (typically CEO and CFO)

However, remember that written representations aren't substitutes for other audit procedures—they're like inquiries and should be supported by additional evidence.

Important Distinction: Don't confuse a Management Representation Letter (from the client to the auditor) with a Management Letter (from the auditor to the client). The latter contains recommendations for improving internal controls and operations.

Audit documentation (working papers) provides a record of procedures performed and conclusions reached. It should be sufficient for an experienced auditor with no previous connection to understand the work performed, significant findings, and conclusions reached.

Documentation typically includes:

• Current working papers (financial statements, audit strategy, programs, trial balance)
• Permanent working papers (articles of incorporation, legal documents, prior communications)

Working papers should be properly indexed, cross-referenced, and marked with tick marks to show procedures performed. They remain the property of the auditor and must be completed within 60 days after the audit report date.

Audit reporting communicates the results to users. The standard auditor's report follows a structured format (TAOB MA SAD):

• Title (identifying it as an independent auditor's report)
• Adressee (shareholders, board, or intended users)
• Opinion (referencing the financial statements and expressing a conclusion)
• Basis for Opinion (explaining the audit was conducted in accordance with standards)
• Management & TCWG Responsibilities
• Auditor's Responsibilities
• Signature and Name
• Address
• Date

The type of opinion depends on the circumstances:

• Unqualified ("presented fairly in all material respects")
• Qualified ("except for...")
• Adverse ("does not present fairly")
• Disclaimer ("we do not express an opinion")

Additional paragraphs may include Key Audit Matters (most significant matters for listed entities), Emphasis of Matter (drawing attention to disclosed issues), and Other Matter paragraphs (addressing matters not presented in the financial statements).

Other Information and Special Engagements

When auditors encounter other information $financial or non-financial information included in annual reports$, they must consider whether it's consistent with the audited financial statements. If material inconsistencies or misstatements exist, auditors must request management to make corrections or, if management refuses, modify their report accordingly.

Comparative information presents special considerations. Two approaches exist:

1. Corresponding Figures - Current year is primary focus, with prior year for comparison
2. Comparative Financial Statements - Equal prominence to both years

The approach determines how the auditor addresses prior period matters and whether separate opinions are expressed on each period.

Special purpose engagements address the specific needs of certain users:

• Tax-basis financial statements for tax authorities
• Cash receipts and disbursements for creditors
• Regulatory-basis statements for regulators
• Contract-compliance statements for contracting parties

For single financial statements or specific elements, auditors may express separate opinions, but generally can't issue an unmodified opinion on a component if they've issued an adverse or disclaimer on the complete set.

Summary financial statements provide condensed information derived from audited financial statements. The auditor's report on summaries must:

• Indicate whether they're consistent with the audited statements
• Warn that they don't contain all disclosures from full statements
• Reference the audit report on the complete financial statements

Prospective financial information engagements examine future-oriented financial data:

• Forecasts are management's best estimate of expected future results
• Projections are based on hypothetical assumptions about future conditions

When examining prospective information, auditors assess the reasonableness of assumptions but don't provide assurance on whether results will be achieved. Their report should clearly indicate the purpose and any limitations.

The Accountancy Profession and Ethics

The Philippine Accountancy Act of 2004 (RA 9298) established the framework for regulating the accounting profession in the Philippines. This law standardizes accounting education, governs CPA examinations, and regulates professional practice.

Accountancy encompasses several major areas:

• Auditing
• Management consultancy
• Taxation
• General accounting

The scope of practice can include:

• Public practice (providing independent professional services on a fee basis)
• Commerce and industry (working within businesses)
• Government accounting (working in government agencies)
• Education/academic $teaching accounting-related subjects$

The Professional Regulatory Board of Accountancy consists of a chairman and six members appointed by the President. Members must be natural-born citizens with 10 years of experience in any scope of practice and good moral character.

Career Insight: To maintain your CPA license, you must complete at least 120 CPD units every three years, with a minimum of 20 units annually. After age 65, this requirement becomes optional.

Fraud and error represent significant concerns in financial reporting. While both can lead to misstatements, fraud involves intentional deception while errors are unintentional mistakes. Fraud typically requires more extensive audit procedures performed closer to year-end with larger sample sizes.

The fraud triangle identifies three factors present in fraud cases:

• Incentive/pressure to commit fraud
• Opportunity due to weak controls or position
• Rationalization/attitude that justifies the behavior

Management is primarily responsible for preventing and detecting fraud, while auditors must identify risks, obtain evidence, and respond appropriately to identified fraud. If significant fraud is discovered, auditors must report it to the appropriate level of management and those charged with governance.

Non-compliance with laws and regulations (NOCLAR) presents another important area. Laws with direct effect on financial statements (like tax laws) require specific audit procedures, while those with indirect effect (like environmental regulations) may require different approaches. When auditors discover NOCLAR, they must determine appropriate reporting based on the severity and circumstances.

Transaction Cycles and Business Processes

Understanding business transaction cycles helps auditors identify risks and design effective procedures. These cycles represent how accounting systems process related activities.

The Revenue and Receipt Process (Order to Cash) includes:

1. Sales process - accepting customer orders, preparing sales documentation
2. Credit approval - evaluating customer creditworthiness
3. Inventory control - monitoring availability and authorizing releases
4. Shipping - preparing goods for delivery and documenting shipment
5. Billing - preparing invoices and sending to customers
6. Accounting - recording transactions and updating records
7. Collection - receiving and processing customer payments

The Expenditure and Disbursement Process (Purchase to Pay) includes:

1. Requisition - departments identify needs
2. Purchasing - selecting vendors and placing orders
3. Receiving - accepting deliveries and verifying quantities
4. Inventory management - storing and controlling goods
5. Accounts payable - processing invoices for payment
6. Treasury - issuing payments
7. General accounting - recording transactions

Control Insight: The three-way match (purchase order, receiving report, and vendor invoice) is a critical control in the expenditure cycle that helps prevent payment for goods not ordered or received.

The Payroll Cycle (Hire to Retire) encompasses:

1. Time recording - tracking hours worked
2. HR functions - managing personnel information
3. Payroll calculation - computing wages and deductions
4. Disbursement - issuing payments to employees
5. Accounting - recording payroll expenses and liabilities

Other important cycles include:

• Fixed Asset Cycle (Acquire to Retire) - managing property, plant, and equipment
• Conversion Cycle (Plan to Inventory) - transforming materials into finished goods
• Finance and Investment Process - managing financing and investments

Audit sampling allows auditors to draw conclusions about a population by testing only a portion of items. The two main types are:

1. Attribute sampling (used for tests of controls)
2. Variable sampling (used for substantive testing)

Sample size is affected by factors like risk assessment, expected deviation/misstatement rates, and tolerable rates. Higher risk generally requires larger samples, while more effective alternative procedures may allow smaller samples.

Audit Sampling and IT Auditing

Attribute sampling helps auditors evaluate the rate of deviations in control procedures. Sample size is inversely related to acceptable risk and the tolerable deviation rate—as these decrease, sample size increases. After testing, auditors compare the sample deviation rate to their expectations and determine whether controls can be relied upon.

Variable sampling techniques for substantive testing include:

• Ratio estimation (when differences are proportional to book values)
• Difference estimation (when little relationship exists between differences and book values)
• Mean-per-unit estimation (based on average audited values)

When missing or voided documents are encountered, auditors must determine if they were properly handled according to internal control procedures. If not, they're considered deviations or misstatements.

Sampling Insight: While sampling introduces risk, it's often the only practical way to gather audit evidence. The key is managing sampling risk through appropriate sample selection methods and evaluation techniques.

Auditing in a computerized information system (CIS) environment requires understanding three key IT elements:

• IT applications (programs that process data)
• IT infrastructure (hardware, operating systems, networks)
• IT processes (procedures for managing IT)

IT controls operate at different levels:

1. Entity-level IT controls define strategic direction and organizational framework
2. General IT controls (GITCs) support ongoing operations across all applications:
   • Change management controls
   • Operation controls
   • Access controls
3. Application controls are embedded in software to prevent or detect unauthorized transactions:
   • Input controls
   • Processing controls
   • Output controls

Automated controls are generally more reliable than manual controls since they're less prone to human error and cannot be easily bypassed. However, auditors must ensure these controls are properly designed and operating effectively.

Auditors can use two main approaches:

• Auditing around the computer (black box approach) - focusing on inputs and outputs
• Auditing through the computer (white box approach) - examining internal processing using Computer-Assisted Audit Techniques (CAATs)

CAATs can include program analysis, test data, integrated test facility, parallel simulation, and many other techniques that help auditors test controls and verify data processing accuracy in complex IT environments.