OVERVIEW
Objective
¾
To describe the procedures for documenting the audit process.CONTENT Permanent
CONFIDENTALITY v
¾ Factors to consider ¾ Standardisation ¾ Techniques ¾ Technology FORM
DOCUMENTATION
Current
¾ Structure
¾ Significant matters ¾ Assembly
¾ Confidentality ¾ Retention ¾ Ownership
1
DOCUMENTATION
1.1
Definition and scope
¾
The material (working papers) prepared by and for (or obtained and retained by) the auditor relating to the conduct of the audit. May be in the form of data stored on paper, film, electronic or other media.¾
Includes ethical considerations, audit programmes, analysis, briefing documents, work schedules, reliance on experts, summaries of significant matters, confirmations,management letters, representation letters and other correspondence (including e-mails, text messages, notes of oral or electronic conversations) relating to all matters that may be considered significant.
1.2
Reasons for documentation
¾
The key reasons for documenting the audit process are: to provide support for the audit report and opinion; to demonstrate that the audit was performed in accordance with ethical requirements, ISAs and applicable legal and regulatory requirements; to enable an experienced auditor, having no connection with the audit, to
understand the audit process and its conclusions.
1.3
Purpose
¾
The purposes served by the documentation of the audit process include: Assisting the audit engagement partner (and team) in the planning andperformance of the audit (e.g. in analysing information to assess risks). Facilitating the supervision and review of audit work (e.g. in briefing and
instructing assistants; engagement partner can agree that the work has been fully carried out in accordance with the audit plan).
Recording the audit evidence generated by the audit procedures that are undertaken to justify and support the auditor’s opinion.
Retain a record of matters of continuing significance (e.g. to assist in the planning of future audits).
Ensures the audit team can be held accountable for its work.
2
FORM
¾
Working papers should be prepared to enable an experienced auditor, having no previous connection with the audit, to understand the procedures, processes, work undertaken and conclusions reached in order to understand: the nature, timing and extent of the audit procedures carried out to achieve the audit objectives;
the results of those procedures and the evidence obtained to support the conclusions reached; and
significant matters arising and the conclusions reached in dealing with them.
2.1
Factors to consider
¾
In determining the form, content and extent of audit documentation, the following factors (not inclusive) should be considered: Nature of the engagement (eg listed, private or public sector entity) and procedures to be performed to support the report given (eg , audit, assurance, review).
Nature and complexity of the entity, its environment and controls.
The identified risks of material misstatement within the financial statements. The reliance to be placed on control effectiveness.
The extent of judgement required in carrying out the work and evaluating the results.
The audit methodology and tools used (e.g. computer-assisted audit techniques). Standardisation (see below).
Extent of schedules, analyses and other documentation prepared by the entity. The significance of the evidence obtained.
The nature and extent of exceptions identified.
The need and extent for direction, supervision and review of tasks assigned to assistants.
2.1.1
Direction
¾
The means through which the engagement team are informed of: their responsibilities nature of the entity’s business risk related issues
the detailed approach to the performance of the engagement the objectives of the tasks they are to undertake
problems that may arise
¾
Communication tools include: engagement team briefing (which must be documented, eg planning memo) overall audit strategy and plan;
audit program;
staffing and time budgets.
2.1.2
Supervision
¾
Monitoring progress to ensure that: assistants have the skills and competence necessary;
assistants have understood and followed their instructions;
work is being done in accordance with the overall audit plan, audit program and time budget;
significant accounting and auditing issues are identified and acted upon (e.g. by modifying the audit program; noting for partner attention and action);
differences of professional judgment between members of the audit team are resolved, including use of (internal and/or external) consultation procedures.
2.1.3
Review (see also Session 29)
¾
A person of greater experience (e.g. senior reviewing junior, partner reviewing manager) should consider whether: work has been performed in accordance to standards and the audit plan; there is a need to revise the nature, timing and extent of work performed; the results of work performed are adequately documented;
audit objectives have been achieved;
the evidence obtained is sufficient and appropriate to support the audit report; significant audit matters have been raised and all resolved;
relevant consultations have taken place and the resulting conclusions documented; conclusions are consistent with the results of the work performed;
¾
In an ideal review hierarchy, the assignment manager would have responsibility to ensure that the audit documentation is complete, save for matters that require partner decision and action (often referred to in terms of partner review notes, completion memorandum, matters for partner attention, points for partner etc – basically, for example, summarising and confirming completion of key audit procedures inaccordance with the audit plan, detailing significant matters arising and action taken, significant matters requiring partner action, draft financial statements, management letter, representation letter and auditor’s report).
¾
It is critical to document and demonstrate that the review process has taken place. This includes notes of partner meetings with the client clearly documenting how contentious issues were resolved (an area that is often noted within RSB reviews as a weak area).¾
In one celebrated case, the auditor admitted during a fraud trial (they were acting aswitnesses and were not defendants) that notes of key meetings with client management were written up only after they realised that one of the directors was being sued and that their working papers would be scrutinised by the court.
2.2
Standardisation
¾
It is common practice for audit firms to use standard pre-printed documentation on audit engagements. For example: Audit completion disclosure and other checklists. Internal Control Questionnaires (see Appendix 1). Audit programs.
Specimen letters – e.g. management representation letters (see Session 20). Indices for standard organisation of working papers (see later).
Example 1
Suggest advantages and disadvantages of standardising audit working papers.
Solution
Advantages
Disadvantages
9
9
9
9
8
8
8
¾
Wherever standard documentation is used it is essential that the documentation is: tailored for each individual client (e.g. work programmes to address assessed risks;engagement letters to reflect different requirements, representation letters to reflect different circumstances); and
kept up to date for changes in ISA, IFRS, laws and regulations (e.g. GAAP checklist, engagement letters).
2.3
Documentation techniques
Narrative +/- +/- Questionnaires +/- Checklists Electronic
Diagrammatic
¾
Narrative notes and detail – by far the most common way of recording information, eg business history, processes, controls, interviews, work done, results, reviews.¾
Diagrammatic – covers a wide range of charting facilities to record information, eg flowcharting of systems, organisation charts, graphing trends, bar charts, pie charts etc.¾
Questionnaires – varied, with the most common being internal control questionnaires(ICQs) and internal control evaluation questionnaires (ICEQs) to assist the auditor to understand the design of appropriate controls and how they have been implemented. Other examples include, for example, independence and fit & proper questionnaires.
¾
Checklists – extensively used as a means of recording set procedures (eg pre-printedwork programmes, analytical review, going concern checklist, IFRS/GAAP checklist) and to demonstrate that key procedures have been carried out (new client acceptance checklist, ethical checklists, planning checklist, review checklists, partner completion checklist).
¾
Electronic media are now used extensively to produce audit documentation. Examples include general word processing, spreadsheets, databases, documenting, diagrammatic, flowcharting, charting and analysis. Not only are these in narrative and diagrammatic form, but may also contain image and video formats within a knowledge base format.2.3.1
Factors to consider
¾
The form and extent of documentation is influenced by many factors, eg: Size and complexity of entity. Nature of control systems (e.g. simple, complex, manual or electronic). Auditors’ intended reliance on effectiveness of controls.
2.4
Use of information systems
¾
There are two main areas within which information systems play an important role within audit and assurance: to assist in practice (partnership) management and administration; and to automate the audit process (administration and work processes).
¾
Generally, the reasons for using information systems include: Reduction in costs (eg staff, time, storage and materials) and greater effective use of time (eg access, analysis and reporting; freeing staff time to carry out other critical functions; 24/7 ability).
Being able to use functions which would not be practicable or cost effective (eg time and difficulty) within a wholly manually based approach (eg use of CAATs – see Session 21).
Improve audit quality by using more effective methods (e.g. analytical procedures, systems understanding, implementation & interrogation, analysis of data, CAATs). Increase standardisation of approach and working papers (see above).
Ease of updating, formatting, correcting, storing, accessing, analysing and distributing data.
Provision of consistent and up to date technical support to partners, staff and clients (e.g. electronic procedure materials, IFRS, ISAs, technical bulletins, online technical support).
2.4.1
Management and administration
¾
Activities include: resource allocation (e.g. staff planning)
time and cost/expense records – on-line input, real time reporting and WIP/fees management accounting, partnership accounting, analysis and reporting
project management and risk analysis
groupware working (e.g. through the use of Lotus Notes) computer-based interactive training
2.4.2
Automating the audit process
¾
The use of laptops by audit and assurance staff is now standard practice. Packaged (off the shelf) “audit automation” tools can easily be purchased and many firms have developed their own in-house (bespoke) systems. These include tools for: automated work programmes, lead schedules, standard questionnaires and checklists, trial balances and financial statements;
data extraction and analysis;
interrogation of client data (audit software, see CAATs in Session 21); statistical sampling and analysis (see Session 19);
expert systems (e.g. to design audit programs, assess business risks, review laws and regulations);
evaluation of clients’ risk management procedures;
corporate and financial modelling programs for use as predictive audit tests (see analytical procedures in Session 16;
¾
The expectation is to automate as much of the working papers as possible with most of the information gathered during an audit being electronically stored. A typicaloverview of the process re the work programme and working papers could be: After carrying out a thorough business risk assessment using specific (electronic)
business risk templates and models (expert system), the auditor will have obtained an understanding of the inherent risks facing the client plus an understanding of the design and operation of the control functions.
The work programme for each area is developed through the use of the expert system using information from the risk assessment and detail input from the client’s general ledger (eg asset/liability balances, revenues and costs).
The base audit work programmes established by the expert system will then be reviewed and tailored as necessary by the auditor.
Lead schedules, test schedules and other supporting documentation (eg circularisation letters) can also be produced from the client data input into the expert system.
3
CONTENT
3.1
Permanent
v
current audit files
¾
For recurring audits, the working papers are usually split between two main files – the permanent audit file (PAF) and the current audit file (CAF). Each file may be sub-divided into smaller files dealing with specific matters, eg on the PAF a separate file covering systems and controls and on the CAF, a separate file covering the receivables circularisation, just because of the sheer volume of paper. Correspondence is often filed separately and for group audits (not within the syllabus) there will be a separateconsolidation file. There will also (usually) be a separate CAF for the interim audit, inventory observation and the final audit.
¾
The PAF contains documents that are of a permanent nature related to the audit and the client’s business, are of continuing importance to the audit process and provide ahistory of significant audit related matters. The CAF contains information that is of direct relevance to the current audit (at whatever stage).
Example 2
Suggest the audit working papers which you would expect to be filed as “permanent” and “current”.
Permanent audit file
Updated with new information of continuing importance
Current audit file
Contains information relating primarily to the audit of a single period
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
¾
Standard indices may be used for both permanent and current audit files. These are usually tailored (e.g. by circling the references used).Current Audit File Index A Audit control papers
A1 Financial statements A2 Audit completion checklist A3 Review schedules
A4 Points forward to next year A5 Time record and budget B Overall audit plan C Intangible assets
D Tangible non-current (fixed) assets E Investments
F Inventories (Stock) G Receivables (Debtors)
H Cash
J Payables (Creditors)
K Provisions and contingencies L Taxation
M Capital and reserves
N Statement of comprehensive income
P Revenue
Q Purchases
R Wages and salaries
S Extended trial balance and adjustments to profit
¾
Alternative referencing systems might include separate sections for interim audit working papers, systems work, or analytical procedures.3.2
Audit section structure
¾
On each working paper it is standard procedure to record the client name, year end, subject, schedule reference, date of preparation, preparer’s identification (e.g. initials), date of review and identification of reviewer (eg initials). An audit section (egreceivables, revenue, non-current assets) may be constructed as follows (as an example):
3.2.1 Section lead schedule
¾
In each section the first schedule would usually be the lead schedule showing the make up of the audited balance together with the comparatives for the prior year. Forexample, receivables would show (on separate lines with comparatives): Gross trade receivables
Less: Bad debt allowance
Dr balances within trade payables Other receivables
Prepayments and accrued income
¾
Each element that is shown separately within the financial statements (including notes) would be sub-totalled and cross referenced to the financial statements.¾
Each element would also be crossed referenced to the supporting work schedules.¾
The comparatives would be shown as agreeing to the prior year financial statements.3.2.2 Section summary and conclusion
¾
A typical summary and conclusion on each section would show: Audit objectives for the section (each objective may be cross referenced to particular tests within the work programme)
Significant matters arising, if any (cross referenced as necessary) Conclusion on section, eg:
−
The work performed has been carried out in accordance with the audit strategy and audit plan (as adjusted)−
The work performed and the results obtained have been adequately documented−
Any revision to the audit plan, risk assessments and materiality have been detailed on Schedule XX and approved by the partner−
Any matters outstanding have been detailed on schedule XX for action by the partner−
In my (audit assistant) opinion, audit section are fairly stated subject to the matters noted on Schedule XX (or give an alternative conclusion)¾
The contents of this schedule may be shown as a separate schedule or incorporated into the lead schedule or work programme. It is important however, that an overallconclusion is reached linking the objectives of the section with the work carried out and the results obtained.
3.2.3 Basis of accounting and Accounting policy
¾
This schedule would show the basis of accounting (a broad overview of the accounting and recording process for the section) and the accounting policy used (this would be audited as being consistent with prior years and in accordance with IFRS).3.2.4 Work programme
¾
All elements of the work programme should be signed off and cross referenced to supporting documentation (eg the test lead schedule). Any changes made to the work programme must be approved by the engagement partner.¾
It is not unusual to see each test, or a group of tests, aligned with a particular assertion (see Session 15).3.2.5 Test lead schedule
¾
Each test within the work programme will be supported by a test lead schedule and supporting schedules.¾
The test lead schedule should state (for example): the objective of the test (usually based on an assertion);
the testing and sampling approach (including sample size, method of selection); the work done;
matters arising;
action taken relating to such matters;
conclusion (which should relate to the objective of the test).
3.2.6 Test supporting schedule
¾
These schedules will show the work done – how it was done, on what it was done and the matters arising.¾
So that the work carried out may be re-performed, it is essential that the matters, actions, processes and documents tested are recorded and identified through, for example: a document code (e.g. GRN number);
attributes (e.g. for a sales invoice – customer details, description of inventory items sold, unit price, total value, discounts, VAT, invoice value);
cost, dates, stratification levels (e.g. all items greater than $10,000); details of sampling (e.g. starting point, every nth item);
details of discussions (e.g. with who, when, what, where);
observations of processes (e.g. the process, who was involved, date, time, where).
¾
Work carried out should be recorded on the schedules and identified through, for example, use of ‘audit ticks’, a key to what such ticks mean (e.g. ‘ф = agreed to sales invoice’) and appropriately cross referenced to other supporting schedules.3.3
Significant matters
¾
Examples of significant matters include: matters that result in significant risks (revenue is always considered a significant risk, so detailed notes on the sales system and the risks involved must always be made);
details indicating that the financial statements may be materially misstated; the need to revise previous assessments of risks and material misstatements; factors that cause difficulty in applying ISA;
findings that could result in a modification to the auditor’s report, and the reasons why, or why not, it was modified.
¾
Note that the above is not an exhaustive list. Other examples are given throughout this study system of what must be documented eg, ethics, laws & regulations, oralcommunications, planning, engagement team discussions on potential for fraud.
¾
Where the auditor is aware of information that contradicts or is inconsistent withconclusions reached on a significant matter, details of how that contradiction or inconsistency was dealt with must be recorded.
¾
Any necessary departure from applying ISAs must be recorded including the reasons why and how the audit objective was achieved under the circumstances.¾
It is usual for details of significant matters and how they were addressed to be recorded in a summary document (e.g. completion memorandum, partner review notes – see Session 29).3.4
Assembly of working papers file
¾
All matters that support the audit opinion must be on file; the file reviewed and signed off before the auditor signs the audit report. Any matters of an administrative nature should normally be concluded within (as suggested by ISA 230 Audit documentation) 60 days of the auditor’s report being signed. Such matters include: deleting or discarding unnecessary documentation; sorting, collating and cross-referencing documentation; signing off completion for assembly of file;
¾
After final assembly, the auditor should not delete audit documentation until the completion of the retention period (see next section). If modification is required (after final assembly) the following must be documented: the specific reasons for modification; when and by whom;
¾
If it is necessary after the date of the auditor’s report for the auditor to perform further procedures or revise their original conclusion (e.g. facts impacting the audit report became known after the report was signed), record on the file: the reasons why the changes were necessary;
the additional audit procedures performed, evidence obtained and conclusions reached;
when and by whom the updating was made and a review carried out.
4
CONFIDENTIALITY, SAFE CUSTODY, RETENTION AND
OWNERSHIP
4.1
Confidentiality and safe custody
¾
As part of the requirements on quality control, auditors should maintain theconfidentiality and safe custody of working papers. Practical procedures include locked cabinets or rooms at the clients for hardcopy data (although second keys may be held by the client) and the use of physical keys and logical passwords to prevent access to computers for electronic data (the risk then is that the laptop may be stolen).
¾
Electronic documentation may be particularly susceptible to corruption or loss andshould be backed up (e.g. to a CD/USB/HD drive) on a regular basis, eg at lunchtime and/or the end of every working day. The backup medium must then be made secure.
¾
Where secure access to a file server at the auditor’s office is available, the backup couldbe made direct to that office. If secure access cannot be guaranteed, then the data should be encrypted. This would then also facilitate early/continuous review of the file by the manager/partner.
¾
IT systems at the auditor’s office must also be secure. General IT controls should therefore apply re access to data, security of data etc.¾
The need for the confidentiality and security of working papers (and client data) should be part of the terms and conditions of employment of audit staff and considered a serious offence if breached.¾
Common sense must be applied when considering the security of data (electronic or hard copy) eg: do leave working papers unattended at the client;
do not leave working papers in the boot of a car whilst the car is unattended; do not put working papers in checked-in luggage at airports (such luggage does
4.2
Retention
4.2.1
General principle
¾
For a period sufficient to meet the needs of the audit practice and in accordance with legal and professional requirements – IAASB requires at least 5 years.4.2.2
Considerations — not in the ISA
¾
Legal requirements e.g. accounting records must be maintained for 3 years for private companies and 6 years for other companies in the UK.¾
General position in law governing the period of time in which actions may be brought in a court of law e.g. 6 years for actions based on contract in the UK.¾
Requirements for compiling tax returns e.g. assessments may be made 6 years after the period to which they relate.¾
Likelihood of seeking quotation on a recognised stock exchange – previous 6 years are required to be reported on in UK.4.2.3
Minimum period — recommended by ACCA
¾
Audit working papers – 7 years¾
Tax files – 7 years and then returned to client (or former client).4.3
Ownership
4.3.1
General principles
¾
Working papers are the property of the auditor and clients have no rights to demand access.¾
Portions of or extracts from working papers may be made available to the entity at the discretion of the auditor.¾
All documents relating to clients are confidential.¾
A client may require auditor to disclose documents which belong to the client (only) to a third party.4.3.2
Determining ownership
¾
Primary consideration is the contract with client – agreed and evidenced in the engagement letter.¾
If no specific agreement consider: capacity in which members act i.e. as principals (auditing services) or agents (tax compliance);
FOCUS
You should now be able to:
¾
explain the need for and the importance of audit documentation;EXAMPLE SOLUTION
Solution 1 — Standardisation
Advantages
v
Disadvantages
9
Preparation and review is moreefficient when audit files, sections and documents within them, are presented in a systematic manner.
8
A “mechanical” approach may lead to a lack of appreciation of test objectives and the implications of errors and deviations found.9
Helps to familiarise junior staff with standard procedures (e.g. attending physical inventory counting and requesting direct confirmations from customers).8
Adopting a “standard approach” may stifle initiative and discourage the exercise of professionaljudgement.
9
Similarly, it facilitates direction (&delegation), supervision and review.
8
Standard programs may result in a “bare minimum” attitude.9
It provides a means of quality control by requiring a consistent approach to all audits and ensuring that essential procedures are not overlooked.8
It may be inappropriate to follow set procedures for a particular client (e.g. one with subscription income rather than sales revenue).9
Consistent approach to specific audit functions, e.g. IFRS checklistSolution 2 — Working papers
Permanent audit file
Usually sectionalised, e.g.:
¾
General business information¾
Systems and control documentation¾
Accounts and financial statements information¾
Statutory and legal documentation¾
Job administration¾
Planning documentation Content includes:¾
Information concerning the legal structure of the entity (e.g. Memorandum and Articles of Association).¾
Detail of the business environment, the operating industry, nature and history of client’s business, locations, products, key suppliers, key customers, subcontractors, employees.¾
Organisational and management structure. Governance structure including auditcommittee. Main contacts within management and other key staff re audit.
¾
Group structure, group auditors, other auditors (a separate file would normally be kept detailing group audit procedures and detail)¾
Structure of key departments, eg finance, treasury, internal audit.¾
Major suppliers, customers – turnover, terms of trade, imports, exports¾
Detail, evaluation and analysis of: control environment, risk assessment procedures information systems control activities and control monitoring
¾
Rolling analysis of business risks, key performance indicators and risk management.¾
Main accounting and other key records, showing where kept and of what type (e.g.hand-written, computerised).
¾
Major assets and liabilities.¾
Previous financial statements, auditor’s reports and supporting details if modified.¾
Principal accounting policies and any IFRS not applicable.¾
New client checklist and other legal/regulatory documents relating to accepting a new client.¾
Major laws and regulations under which the entity operates including regulatory reporting requirements (e.g. charities, banks, environmental, health and safety).¾
Known related parties and history of transactions.¾
Previous partner review notes, matters for the attention of the partner.¾
Previous reports to management (detailing weaknesses found in the accounting system).¾
Previous reports and minutes of discussions with governance (e.g. audit committee).¾
Management representations.¾
Insurance cover details, including claims history.¾
Significant ratios, trends and performance indicators over the last (say) 10 years.¾
Rotational control schedule (e.g. location visits, inventory observation, document¾
Other documents of continuing importance: terms of engagement letters of authority (e.g. bank mandate) minutes of important meetings
key legal resolutions annual filing returns debenture deeds mortgages and charges
title deeds and lease agreements trade agreements and labour contracts
profit share, bonus and share option agreements royalty agreements.
¾
Other professional advisors (bankers, lawyers, brokers).¾
Past administration, e.g. budgets, costing.Current Audit File
¾
Financial statements audited (evidenced as having been agreed to accounting records, cross-referenced to supporting schedules, comparatives, accounting policies, notes and disclosures all evidenced as audited).¾
Completion checklists: Compliance with statutory and IFRS disclosure provisions.
Partner sign off completion, including confirmation of audit report. Second partner review (as necessary)
Audit completion checklists (partner, manager, senior)
¾
Closedown: Representation letter
Management letter (final and interim) plus response from client Matters for attention of partner (final and interim)
Minutes of meetings with directors, audit committee Minutes of board meeting approving financial statements Schedule of adjusted and unadjusted errors
Queries raised during the audit and subsequent clearance Review notes (partner, manager, senior) and how cleared Analytical review and performance indicators
Going concern and subsequent events
Ethical matters, e.g. proposed acceptance to continue as auditor Confirmation of continued independence
¾
Job administration: Engagement team and applicable experience Budget and fee estimates
Actual time/cost summaries and variance analysis Fee notes
¾
Planning: Ethical matters, e.g. client acceptance, independence, competence Minutes of meetings with client, audit committee and audit team Initial audit strategy, audit plan and tailored work programmes Updated plans with explanations
Understanding of entity and its environment Deign of internal control and its implementation
Risk assessments, analytical review, materiality, sampling approach Direction, supervision and review of the audit team
¾
Audit sections Final audit lead schedule showing makeup of key figures in the financial statements (cross referenced to financial statements and supporting schedules). Work programmes (interim and final).
Supporting schedules detailing (for example) objective of test, testing approach, sampling, work done, matters arising, action taken and conclusion.
Supporting work schedules detailing the actual work carried out including balances, transactions and evaluation of control effectiveness.
Supporting internal and external documentation, e.g. bank letters, receivable confirmations, expert valuations.
