Substantive procedures, including tests of details and substantive
A11. The audit procedures described in paragraphs A14-A25 below may be used as risk assessment procedures, tests of controls or substantive procedures, depending on the context in which they are applied by the auditor. As explained in SA 330, audit evidence obtained from previous audits may, in certain circumstances, provide appropriate audit evidence where the auditor performs audit procedures to establish its continuing relevance8.
A12. The nature and timing of the audit procedures to be used may be affected by the fact that some of the accounting data and other information may be available only in electronic form or only at certain points or periods in time. For example, source documents, such as purchase orders and invoices, may exist only in electronic form when an entity uses electronic commerce, or may be discarded after scanning when an entity uses image processing systems to facilitate storage and reference. 8 SA 330, paragraph A35.
A13. Certain electronic information may not be retrievable after a specified period of time, for example, if files are changed and if backup files do not exist. Accordingly, the auditor may find it necessary as a result of an entity’s data retention policies to request retention of some information for the auditor’s review or to perform audit procedures at a time when the information is available.
A14. Inspection involves examining records or documents, whether internal or external, in paper form, electronic form, or other media, or a physical examination of an asset. Inspection of records and documents provides audit evidence of varying degrees of reliability, depending on their nature and source and, in the case of internal records and documents, on the effectiveness of the controls over their production. An example of inspection used as a test of controls is inspection of records for evidence of authorisation.
A15. Some documents represent direct audit evidence of the existence of an asset, for example, a document constituting a financial instrument such as a stock or bond. Inspection of such documents may not necessarily provide audit evidence about ownership or value. In addition, inspecting an executed contract may provide audit evidence relevant to the entity’s application of accounting policies, such as revenue recognition.
A16. Inspection of tangible assets may provide reliable audit evidence with respect to their existence, but not necessarily about the entity’s rights and obligations or the valuation of the assets. Inspection of individual inventory items may accompany the observation of inventory counting.
A17. Observation consists of looking at a process or procedure being performed by others, for example, the auditor’s observation of inventory counting by the entity’s personnel, or of the performance of control activities. Observation provides audit evidence about the performance of a process or procedure, but is limited to the point in time at which the observation takes place, and by the fact that the act of being observed may affect how the process or procedure is performed. See SA 501 for further guidance on observation of the counting of inventory.9
A18. An external confirmation represents audit evidence obtained by the auditor as a direct written response to the auditor from a third party (the confirming party), in paper form, or by electronic or other medium. External 9 SA 501, “Audit Evidence—Specific Considerations for Selected Items”. confirmation procedures frequently are relevant when addressing assertions associated with certain account balances and their elements. However, external confirmations need not be restricted to account balances only. For example, the auditor may request confirmation of the terms of agreements or transactions an entity has with third parties; the confirmation request may be designed to ask if any modifications have been made to the agreement and, if so, what the relevant details are. External confirmation procedures also are used to obtain audit evidence about the absence of certain conditions, for example, the absence of a “side agreement” that may influence revenue recognition. See SA 505 for further guidance.10
A19. Recalculation consists of checking the mathematical accuracy of documents or records. Recalculation may be performed manually or electronically.
A20. Reperformance involves the auditor’s independent execution of procedures or controls that were originally performed as part of the entity’s internal control.
A21. Analytical procedures consist of evaluations of financial information made by a study of plausible relationships among both financial and non-financial data. Analytical procedures also encompass the investigation of identified fluctuations and relationships that are inconsistent with other relevant information or deviate significantly from predicted amounts. See SA 520 for further guidance.
A22. Inquiry consists of seeking information of knowledgeable persons, both financial and non- financial, within the entity or outside the entity. Inquiry is used extensively throughout the audit in addition to other audit procedures. Inquiries may range from formal written inquiries to informal oral inquiries. Evaluating responses to inquiries is an integral part of the inquiry process.
A23. Responses to inquiries may provide the auditor with information not previously possessed or with corroborative audit evidence. Alternatively, responses might provide information that differs significantly from other information that the auditor has obtained, for example, information regarding the possibility of management override of controls. In some cases, responses to 10 SA 505, “External Confirmations”. inquiries provide a basis for the auditor to modify or perform additional audit procedures.
A24. Although corroboration of evidence obtained through inquiry is often of particular importance, in the case of inquiries about management intent, the information available to support management’s intent may be limited. In these cases, understanding management’s past history of carrying out its stated intentions, management’s stated reasons for choosing a particular course of action, and management’s ability to pursue a specific course of action may provide relevant information to corroborate the evidence obtained through inquiry.
A25. In respect of some matters, the auditor may consider it necessary to obtain written representations from management and, where appropriate, those charged with governance to confirm responses to oral inquiries. See SA 580 for further guidance.11
Information to be Used as Audit Evidence
Relevance and Reliability (Ref: Para. 7)
A26. As noted in paragraph A1, while audit evidence is primarily obtained from audit procedures performed during the course of the audit, it may also include information obtained from other sources such as, for example, previous audits, in certain circumstances, and a firm’s quality control procedures for client acceptance and continuance. The quality of all audit evidence is affected by the relevance and reliability of the information upon which it is based.
A27. Relevance deals with the logical connection with, or bearing upon, the purpose of the audit procedure and, where appropriate, the assertion under consideration. The relevance of information to be used as audit evidence may be affected by the direction of testing. For example, if the purpose of an audit procedure is to test for overstatement in the existence or valuation of accounts payable, testing the recorded accounts payable may be a relevant audit procedure. On the other hand, when testing for understatement in the existence or valuation of accounts payable, testing the recorded accounts payable would not be relevant, but testing such information as subsequent disbursements, unpaid invoices, suppliers’ statements, and unmatched receiving reports may be relevant.
A28. A given set of audit procedures may provide audit evidence that is relevant to certain assertions, but not others. For example, inspection of 11 SA 580, “Written Representations”. documents related to the collection of receivables after the period end may provide audit evidence regarding existence and valuation, but not necessarily cut-off. Similarly, obtaining audit evidence regarding a particular assertion, for example, the existence of inventory, is not a substitute for obtaining audit evidence regarding another assertion, for example, the valuation of that inventory. On the other hand, audit evidence from different sources or of a different nature may often be relevant to the same assertion.
A29. Tests of controls are designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level. Designing tests of controls to obtain relevant audit evidence includes identifying conditions (characteristics or attributes) that indicate performance of a control, and deviation conditions which indicate departures from adequate performance. The presence or absence of those conditions can then be tested by the auditor.
A30. Substantive procedures are designed to detect material misstatements at the assertion level. They comprise tests of details and substantive analytical procedures. Designing substantive procedures includes identifying conditions relevant to the purpose of the test that constitute a misstatement in the relevant assertion.
A31. The reliability of information to be used as audit evidence, and therefore of the audit evidence itself, is influenced by its source and its nature, and the circumstances under which it is obtained, including the controls over its preparation and maintenance where relevant. Therefore, generalisations about the reliability of various kinds of audit evidence are subject to important exceptions. Even when information to be used as audit evidence is obtained from sources external to the entity, circumstances may exist that could affect its reliability. For example, information obtained from an independent external source may not be reliable if the source is not knowledgeable, or a management’s expert may lack objectivity. While recognising that exceptions may exist, the following generalisations about the reliability of audit evidence may be useful: • The reliability of audit evidence is increased when it is obtained from independent sources outside the entity. • The reliability of audit evidence that is generated internally is increased when the related controls, including those over its preparation and maintenance, imposed by the entity are effective. • Audit evidence obtained directly by the auditor (for example, observation of the application of a control) is more reliable than audit evidence obtained indirectly or by inference (for example, inquiry about the application of a control). • Audit evidence in documentary form, whether paper, electronic, or other medium, is more reliable than evidence obtained orally (for example, a contemporaneously written record of a meeting is more reliable than a subsequent oral representation of the matters discussed). • Audit evidence provided by original documents is more reliable than audit evidence provided by photocopies or facsimiles, or documents that have been filmed, digitised or otherwise transformed into electronic form, the reliability of which may depend on the controls over their preparation and maintenance.
A32. SA 520 provides further guidance regarding the reliability of data used for purposes of designing analytical procedures as substantive procedures.12
A33. SA 240 deals with circumstances where the auditor has reason to believe that a document may not be authentic, or may have been modified without that modification having been disclosed to the auditor.13 Reliability of Information Produced by a Management’s Expert (Ref: Para. 8)
A34. The preparation of an entity’s financial statements may require expertise in a field other than accounting or auditing, such as actuarial calculations, valuations, or engineering data. The entity may employ or engage experts in these fields to obtain the needed expertise to prepare the financial statements. Failure to do so when such expertise is necessary increases the risks of material misstatement.
A35. When information to be used as audit evidence has been prepared using the work of a management’s expert, the requirement in paragraph 8 of this SA applies. For example, an individual or organisation may possess expertise in the application of models to estimate the fair value of securities for which there is no observable market. If the individual or organisation applies that expertise in making an estimate which the entity uses in preparing its financial statements, the individual or organisation is a management’s expert and paragraph 8 applies. If, on the other hand, that individual or organization merely provides price data regarding private transactions not otherwise available to the entity which the entity uses in its own estimation methods, such information, if used as audit evidence, is subject to paragraph 7 of this SA, but is not the use of a management’s expert by the entity. 12 SA 520, paragraph 5(a). 13 SA 240, “The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements”, paragraph 13.
A36. The nature, timing and extent of audit procedures in relation to the requirement in paragraph 8 of this SA, may be affected by such matters as: • The nature and complexity of the matter to which the management’s expert relates. • The risks of material misstatement in the matter. • The availability of alternative sources of audit evidence. • The nature, scope and objectives of the management’s expert’s work. • Whether the management’s expert is employed by the entity, or is a party engaged by it to provide relevant services. • The extent to which management can exercise control or influence over the work of the management’s expert. •
Whether the management’s expert is subject to technical performance
standards or other professional or industry requirements. • The nature and extent of any controls within the entity over the management’s expert’s work. •
The auditor’s knowledge and experience of the management’s expert’s
field of expertise. • The auditor’s previous experience of the work of that expert. The Competence, Capabilities and Objectivity of a Management’s Expert (Ref:
A37. Competence relates to the nature and level of expertise of the management’s expert. Capability relates the ability of the management’s expert to exercise that competence in the circumstances. Factors that influence capability may include, for example, geographic location, and the availability of time and resources. Objectivity relates to the possible effects that bias, conflict of interest or the influence of others may have on the professional or business judgment of the management’s expert. The competence, capabilities and objectivity of a management’s expert, and any controls within the entity over that expert’s work, are important factors in relation to the reliability of any information produced by a management’s expert.
A38. Information regarding the competence, capabilities and objectivity of a management’s expert may come from a variety of sources, such as: • Personal experience with previous work of that expert. • Discussions with that expert. • Discussions with others who are familiar with that expert’s work. • Knowledge of that expert’s qualifications, membership of a professional body or industry association, license to practice, or other forms of external recognition. • Published papers or books written by that expert. • An auditor’s expert, if any, who assists the auditor in obtaining sufficient appropriate audit evidence with respect to information produced by the management’s expert.
A39. Matters relevant to evaluating the competence, capabilities and objectivity of a management’s expert include whether that expert’s work is subject to technical performance standards or other professional or industry requirements, for example, ethical standards and other membership requirements of a professional body or industry association, accreditation standards of a licensing body, or requirements imposed by law or regulation.
A40. Other matters that may be relevant include: • The relevance of the management’s expert’s competence to the matter for which that expert’s work will be used, including any areas of specialty within that expert’s field. For example, a particular actuary may specialise in property and casualty insurance, but have limited expertise regarding pension calculations. •
The management’s expert’s competence with respect to relevant
accounting requirements, for example, knowledge of assumptions and methods, including models where applicable, that are consistent with the applicable financial reporting framework. • Whether unexpected events, changes in conditions, or the audit evidence obtained from the results of audit procedures indicate that it may be necessary to reconsider the initial evaluation of the competence, capabilities and objectivity of the management’s expert as the audit progresses.
A41. A broad range of circumstances may threaten objectivity, for example, self-interest threats, advocacy threats, familiarity threats, self-review threats and intimidation threats. Safeguards may reduce such threats, and may be created either by external structures (for example, the management’s expert’s profession, legislation or regulation), or by the management’s expert’s work environment (for example, quality control policies and procedures).
A42. Although safeguards cannot eliminate all threats to a management’s expert’s objectivity, threats such as intimidation threats may be of less significance to an expert engaged by the entity than to an expert employed by the entity, and the effectiveness of safeguards such as quality control policies and procedures may be greater. Because the threat to objectivity created by being an employee of the entity will always be present, an expert employed by the entity cannot ordinarily be regarded as being more likely to be objective than other employees of the entity.
A43. When evaluating the objectivity of an expert engaged by the entity, it may be relevant to discuss with management and that expert any interests and relationships that may create threats to the expert’s objectivity, and any applicable safeguards, including any professional requirements that apply to the expert; and to evaluate whether the safeguards are adequate. Interests and relationships creating threats may include: • Financial interests. • Business and personal relationships. • Provision of other services. Obtaining an Understanding of the Work of the Management’s Expert (Ref: Para. 8(b))
A44. An understanding of the work of the management’s expert includes an understanding of the relevant field of expertise. An understanding of the relevant field of expertise may be obtained in conjunction with the auditor’s determination of whether the auditor has the expertise to evaluate the work of the management’s expert, or whether the auditor needs an auditor’s expert for this purpose.14
A45. Aspects of the management’s expert’s field relevant to the auditor’s understanding may include: • Whether that expert’s field has areas of specialty within it that are relevant to the audit. •
Whether any professional or other standards, and regulatory or legal
requirements apply. • What assumptions and methods are used by the management’s expert, and whether they are generally accepted within that expert’s field and appropriate for financial reporting purposes. • The nature of internal and external data or information the management’s expert uses.
A46. In the case of a management’s expert engaged by the entity, there will ordinarily be an engagement letter or other written form of agreement between 14 SA 620, “Using the Work of an Auditor’s Expert”, paragraph 7. the entity and that expert. Evaluating that agreement when obtaining an understanding of the work of the management’s expert may assist the auditor in determining the appropriateness of the following for the auditor’s purposes: • The nature, scope and objectives of that expert’s work; • The respective roles and responsibilities of management and that expert; and •
The nature, timing and extent of communication between management
and that expert, including the form of any report to be provided by that expert.
A47. In the case of a management’s expert employed by the entity, it is less likely there will be a written agreement of this kind. Inquiry of the expert and other members of management may be the most appropriate way for the auditor to obtain the necessary understanding. Evaluating the Appropriateness of the Management’s Expert’s Work (Ref: Para. 8(c))
A48. Considerations when evaluating the appropriateness of the management’s expert’s work as audit evidence for the relevant assertion may include: • The relevance and reasonableness of that expert’s findings or conclusions, their consistency with other audit evidence, and whether they have been appropriately reflected in the financial statements; • If that expert’s work involves use of significant assumptions and methods, the relevance and reasonableness of those assumptions and methods; and • If that expert’s work involves significant use of source data, the relevance, completeness, and accuracy of that source data. Information Produced by the Entity and Used for the Auditor’s Purposes (Ref: Para. 9(a)-(b))
A49. In order for the auditor to obtain reliable audit evidence, information produced by the entity that is used for performing audit procedures needs to be sufficiently complete and accurate. For example, the effectiveness of auditing revenue by applying standard prices to records of sales volume is affected by the accuracy of the price information and the completeness and accuracy of the sales volume data. Similarly, if the auditor intends to test a population (for example, payments) for a certain characteristic (for example, authorisation), the results of the test will be less reliable if the population from which items are selected for testing is not complete.
A50. Obtaining audit evidence about the accuracy and completeness of such information may be performed concurrently with the actual audit procedure applied to the information when obtaining such audit evidence is an integral part of the audit procedure itself. In other situations, the auditor may have obtained audit evidence of the accuracy and completeness of such information by testing controls over the preparation and maintenance of the information. In some situations, however, the auditor may determine that additional audit procedures are needed.
A51. In some cases, the auditor may intend to use information produced by the entity for other audit purposes. For example, the auditor may intend to make use of the entity’s performance measures for the purpose of analytical procedures, or to make use of the entity’s information produced for monitoring activities, such as internal auditor’s reports. In such cases, the appropriateness of the audit evidence obtained is affected by whether the information is sufficiently precise or detailed for the auditor’s purposes. For example, performance measures used by management may not be precise enough to detect material misstatements. Selecting Items for Testing to Obtain Audit Evidence (Ref: Para. 10)
A52. An effective test provides appropriate audit evidence to an extent that, taken with other audit evidence obtained or to be obtained, will be sufficient for the auditor’s purposes. In selecting items for testing, the auditor is required by paragraph 7 to determine the relevance and reliability of information to be used as audit evidence; the other aspect of effectiveness (sufficiency) is an important consideration in selecting items to test. The means available to the auditor for selecting items for testing are:
