1. AUDIT STAFF TRAINING WORKSHOP 13 TH – 14 TH NOVEMBER 2014, HILTON HOTEL NAIROBI GENERAL ISSUES IN PERFORMING AN AUDIT 1

2. CONTENT 1. Introduction 2. Professionalism and maintaining Independence & objectivity. 3. Audit Evidence 4. Tests of controls 5. Using the work of others 6. Documentation 2

3. 1. Introduction As we have already looked at audit planning, the purpose of this session is just to remind us of various issues that need to be addressed in order to perform an audit well. 3

4. 1. Introduction There are many issues but the key ones are addressed here. For additional matters please refer to International Standards on Audit (ISAs). 4

5. 2. Professionalism and independence Members should behave like professionals. Have: 1. Integrity 2. Objectivity 3. Professional competence and due care 4. Confidentiality 5. Good behavior (Obey laws and rules) 5

6. 2. Professionalism and independence Maintain Independence. Avoid threats to independence: 1. Self-Interest(Financial, close business relationships, employment, partner on client board, gifts and hospitality, % fees, overdue fees, family and personal relationships, low balling and contingent fees). 6

7. 2. Professionalism and independence 2. Self –Review (Other services, maintaining accounting records and preparing financial and statements, valuation services, Internal audit, corporate finance) 7

8. 2. Professionalism and independence 3. Advocacy(Promoting positions for client to the point of being compromised) 4.Familiarity (Long time) 5.Intimidation (Possible litigation) 8

9. 3. Audit Evidence Audit evidence is information obtained by the auditor in arriving at the conclusion on which the audit opinion is based. 9

10. 3. Audit Evidence The auditor should obtain sufficient and appropriate audit evidence to be able to draw reasonable conclusions on which to base the audit opinion. (ISA 500) 10

11. 3. Audit Evidence 11

12. 3. Audit Evidence Categories of procedures 12 CategoryExplanation Risk assessment procedures Procedures to obtain an understanding of the entity and its environment, including its internal control, to assess risks of material misstatement at the financial statement and assertion levels. Tests of controls Procedures to test the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level (when necessary or when the auditor has determined to do so). Substantive procedures Procedures to detect material misstatements at the assertion level and include tests of details of classes of transactions, account balances and disclosures and substantive analytical procedures

13. 3. Audit Evidence Procedures for obtaining evidence 13 ProcedureExplanation Analytical procedures Check plausibility of financial statement figures e.g. use of ratios Enquiry and confirmation Seeking information from parties within and outside the organization InspectionExamining records, documents and assets ObservationLooking at a process or transaction RecalculationChecking the arithmetical accuracy of documents or records and the auditor's independent execution of procedures and re- performance of controls.

14. 4. Tests of Control ISA 315: The auditor must understand the accounting system and control environment in order to determine the audit approach: 14

15. 4. Tests of Control Elements of Internal Control; 15 ElementKey Issues Control Environment (Governance and Management functions) 1.Communication and Enforcement 2.Commitment to competence 3.Participation of those charged with govern. 4.Management Philosophy 5.Organizational Structure 6.Assignment of authority and responsibility 7.Human resource policies and practices Risk Assessment process1.Identify business risks 2.Estimate significance of the risks 3.Assess likelihood of their occurrence 4.Decisions on management

16. 4. Tests of Control Elements of Internal Control; 16 ElementKey Issues Information System 1.Classes of transactions in entity’s operations 2.Procedures of these transactions 3.Related accounting records 4.How the Information System captures all these transactions 5.Financial Reporting processes used to prepare the entity’s financial statements Control Activities1.Approval and control of documents 2.Controls over computerized applications 3.Checking arithmetical accuracy of records 4.Maintaining and reviewing control accounts 5.Segregation of duties 6.Physical controls

17. 4. Tests of Control Elements of Internal Control; So what are tests of control? 17 ElementKey Issues Monitoring of Controls 1.These can be done by internal audit 2.Other mechanisms put in place to ensure that controls are working such as specific reports by heads of sections

18. 4. Tests of Control 1. Inspection of documents 2. Inquiries about internal control 3. Re-performance of control procedures 18

19. 4. Tests of Control 4. Examination of evidence of management views 5. Testing internal controls on computerized systems. 6. Observation of controls by checking how they were applied, consistency of application and who is applying them? 19

20. 4. Tests of Control During testing, the auditor can record internal controls as part of audit documentation: 1. Narrative notes 2. Flowcharts 3. Questionnaire 4. Checklists 20

21. 4. Tests of Control In addition the auditor is required to communicate to the management deficiencies in internal controls, the risk the deficiencies cause, the corrective action required. This is done via a Management Letter. 21

22. 5. Using the work of others Whilst auditors are highly trained individuals, it is possible that when conducting an audit they encounter issues which are outside the scope of their expertise, for example, valuation of buildings. Additionally, it is increasingly common for companies to outsource specific functions, for example payroll, to service organizations who have more expertise than the entity. 22

23. 5. Using the work of others As such, the auditor must consider the availability and reliability of the evidence provided by such experts and by the work of service organizations. Also, in some cases, external auditors may want to rely on work done by internal audit. 23

24. 5. Using the work of others ISA 620 – Using the work of an expert Expert means a person or firm possessing special skill, knowledge and experience in a particular field other than accounting and auditing. 24

25. 5. Using the work of others When planning to use the work of an expert the auditor should evaluate the objectivity and professional competence of the expert by considering the expert's: (a) Professional certification or licensing by, or membership in, an appropriate professional body. (b) Experience and reputation in the field in which the auditor is seeking evidence. 25

26. 5. Using the work of others ISA 420: Audit considerations relating to entities using service organization's Service organizations provide a wide variety of services to businesses. Examples include; maintenance of accounting records, payroll, credit control and data entry/ information processing. 26

27. 5. Using the work of others The auditor should assess the significance of the service organization's activities to the entity and audit, assess the risk of material misstatement relating to the transactions, assets and liabilities dealt with by the service organization assess the extent of control risk associated with the service organi. 27

28. 5. Using the work of others During the course of their planning, the external auditors should perform an assessment of the internal audit function if they consider that it may be possible, and desirable, to rely on some of internal audit's work. 28

29. 5. Using the work of others If the external auditor can rely on the work conducted by the internal auditor, the volume of detailed work undertaken by the external auditor may be reduced. ISA 610 Considering the Work of Internal Auditing sets out the criteria that auditors should use when assessing the internal audit function. 29

30. 5. Using the work of others General assessment includes: (a) Organizational status i.e. degree of independence (b) Scope of function (c) Technical competence (d) Due professional care. 30

31. 5. Using the work of others Specific procedures will require (a) adequacy of technical training and proficiency (b) whether work of assistants is properly supervised, reviewed and documented (c) sufficiency and appropriateness of audit evidence to be able to draw reasonable conclusions (d) whether conclusions are appropriate and reports are consistent with work performed (e) whether any exceptions or unusual matters disclosed are properly resolved 31

32. 5. Documentation The objective of the auditor is to prepare documentation that provides: (a) A sufficient and appropriate record of the basis for the auditor’s report; and (b) Evidence that the audit was planned and performed in accordance with ISAs and applicable legal and regulatory requirements. 32

33. 5. Documentation - Definitions 1. Audit documentation – The record of audit procedures performed, relevant audit evidence obtained, and conclusions the auditor reached (terms such as “working papers” or “work papers” are also sometimes used). 33

34. 5. Documentation - Definitions 2. Audit file – One or more folders or other storage media, in physical or electronic form, containing the records that comprise the audit documentation for a specific engagement. 34

35. 5. Documentation-Requirements 1.The auditor should prepare audit documentation on a timely basis. Preparing sufficient and appropriate audit documentation on a timely basis helps to enhance the quality of the audit and facilitates the effective review and evaluation of the audit evidence obtained and conclusions reached before the auditor’s report is finalized. 35

36. 3. Requirements 2. Documentation of the Audit Procedures performed and audit evidence. 2.1 Form, content and extent of documentation 36

37. 3. Requirements The form content and extent of documentation depends on factors such as: 37

38. 3. Requirements The size and complexity of the entity. The nature of the audit procedures to be performed. The identified risks of material misstatement. The significance of the audit evidence obtained. The nature and extent of exceptions identified. Basis of conclusion Audit methodology used and tools used. 38

39. 3. Requirements Audit documentation may be recorded on paper or on electronic or other media. Examples of audit documentation include: 39

40. 3. Requirements 1. Audit programs. 2. Analyses. 3.Issues memoranda. 4. Summaries of significant matters. 5.Letters of confirmation and representation. 6. Checklists. 7. Correspondence (including e-mail) concerning significant matters 40

41. 3. Requirements The auditor may include abstracts or copies of the entity’s records (for example, significant and specific contracts and agreements) as part of audit documentation. Audit documentation, however, is not a substitute for the entity’s accounting records. 41

42. 3. Requirements The auditor shall document discussions of significant matters with management, those charged with governance, and others, including the nature of the significant matters discussed and when and with whom the discussions took place. This may include other appropriate records such as minutes of meetings prepared by the entity’s personnel and agreed by the auditor. 42

43. 3. Requirements The auditor shall assemble the audit documentation in an audit file and complete the administrative process of assembling the final audit file on a timely basis after the date of the auditor’s report. 43

44. 3. Requirements After the assembly of the final audit file has been completed, the auditor shall not delete or discard audit documentation of any nature before the end of its retention period. 44

45. 3. Requirements In circumstances where the auditor finds it necessary to modify existing audit documentation or add new audit documentation after the assembly of the final audit file has been completed, the auditor shall, regardless of the nature of the modifications or additions, document: (a) The specific reasons for making them; and (b) When and by whom they were made and reviewed. 45

46. 4. Other standards ISA 210, Agreeing the Terms of Audit Engagements – paragraphs 10–12 ISA 220, Quality Control for an Audit of Financial Statements – paragraphs 24–25 ISA 240, The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements – paragraphs 44–47 ISA 250, Consideration of Laws and Regulations in an Audit of Financial Statements – paragraph 29 46

47. 4. Other standards ISA 260, Communication with Those Charged with Governance – paragraph 23 ISA 300, Planning an Audit of Financial Statements – paragraph 12 ISA 315 (Revised), Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment – paragraph 32 ISA 320, Materiality in Planning and Performing an Audit – paragraph 14 47

48. 4. Other standards ISA 330, The Auditor’s Responses to Assessed Risks – paragraphs 28–30 ISA 450, Evaluation of Misstatements Identified during the Audit – paragraph 15 ISA 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates, and Related Disclosures – paragraph 23 ISA 550, Related Parties – paragraph 28 ISA 600, Special Considerations—Audits of Group Financial Statements (Including the Work of Component Auditors) – paragraph 50 ISA610 (Revised), Using the Work of Internal Auditors – paragraph 24 48