1. ISSAI 400 Compliance Auditing
Elements (27 to 41)
Principles (42 to 60)
Framework (12 to 26)
Purpose and Authority (4-11)

2. Elements
ISSAI 100 mentioned 4 elements *three parties, *subject matter-criteria-subject matter information * types of engagement –attest engagement or direct reporting engagement ISSAI 200 talks about additional aspects of elements mentioned in ISSAI 100 Subject matter may be (a) activities, (b) financial transactions or (c) information

3. ISSAI 400 says ‘criteria’ for compliance audit …
ISSAI 400 says ‘criteria’ for compliance audit …. come from the structure & content of Authorities It says ‘Authorities’ include laws, rules, regulations, budgetary laws, budgetary resolutions, policy, codes, agreements … …… (regularity)-para 28,29 Compliance audits can also focus on propriety where formal criteria are absent (?) or shortcoming in legislation concerning their application (?). Criteria would be general principles governing sound financial management and conduct of public officials.

4. General Principles (8)
(1) Adherence to ethical requirements & independence prescribed by the organisation (2) Auditor to comply with quality control requirements prescribed by the organisation (3) Auditor to possess the required knowledge, skills & capabilities (4) Auditor to plan and perform audit with professional scepticism and professional judgement

5. General Principles
(5) use professional judgement to reduce the audit risk to reduce inherent risk (where controls do not exist) and reduce control risk (controls fail to detect and prevent mistakes)
(6) use professional judgement to determine the materiality of the misstatement (whether significant to influence the decision of users)
(7) Auditor needs to keep an effective system of communication with management
(8) Auditor needs to document the entire process particularly the extent of audit procedures used so that others (other auditor) can understand the process

6. Principles related to Audit Process
Auditors should determine the audit scope Auditor should identify the subject matter and suitable criteria (for attest engagements Auditors should develop audit strategy & audit plan Auditors should gather sufficient and appropriate evidence Auditor should reach conclusions by evaluating the audit evidence Auditors should prepare a report (long/short form)

7. Framework for compliance auditing
CA may cover wide range of subject matter Can provide reasonable or limited assurance Compliance audits may be attestation or direct reporting engagement or both at once May cover all levels of government Compliance audits of private entities are also possible focusing for revenue on tax payers, for expenditure; on those involved in management of public services or public property through partnerships, as recipients of grants or subsidies

8. Auditing standard for (ii) is ISSAI 4100
Para 20 to 26
Compliance Auditing is generally conducted either (i) in relation with audit of financial statement or (ii) separately from audit of financial statement or (iii) in combination with performance auditing
Auditing standard for (i) is ISSAI 4200 and this audit is along with FA using ISSAI
Auditing standard for (ii) is ISSAI 4100
Under (iii), compliance is seen as one of aspects of 3Es
Why do we need a separate CA? Compliance aspect can be additional element in FA,PA.

10. Framework for compliance auditing
Para 12: Compliance audits are carried out by assessing whether activities, financial transactions and information comply with authorities governing the entity (see para 28,29 what is authority). Compliance auditing is independent assessment of whether the given subject matter is in compliance with applicable authorities (identified as criteria). What is the purpose of compliance audit? How is it distinguished from FA and PA?

11. What would compliance auditing in private entity involve ?
Governments regulate various aspects of private business through promulgating laws and regulations Private sector entities are required to ‘comply’ with those laws and regulations. It is mandatory. Non compliance would involve penal action often impact the figures in balance sheet.

12. AICPA, has 4 sets of standards.
SAS: Statements of Auditing Standards
SSAE: Statements on Standards for Attestation Engagements
SSARS: S...on Standards for Accounting & Review Services
SSCS: Statements on Standards for Consultancy Services
SSAE 10 Compliance Attestation engagements related to an entity's compliance with requirements of specified laws, regulations, rules, contracts, or grants etc

13. USA – Federal Grants to entities Audited by CPAs Single Audit Act of 1984 OMB Circular A-133 Compliance Audit in addition to certification of the accounts of the entity SAS 117 of AICPA: Obtain sufficient appropriate audit evidence to form opinion and report at the level required in the governmental audit requirement on whether the entity complied with applicable compliance requirements.

14. IAASB of IFAC International Standards on Auditing ISA 250 “considerations of laws & regulations in audit of financial statements” - Source of ISSAI 4200 which talks about CA in combination of FA IFAC Study Note 3 issued in October 1994 titled “Auditing for Compliance with Authorities A public sector perspective” - Source of ISSAI 4100 which talks about CA separately from audit of financial statement