Auditing
Auditing
AUDIT - An Overview
Dependable financial information is essential to our society. We often rely upon information provided by
others in making economic decisions. The need of various users for more reliable financial information
has created a demand for an independent audit of financial statements.
The primary function of an independent audit is to lend credibility to the financial statements prepared by
an entity. The auditor's opinion enhances the value and usefulness of the financial statements. By
attaching a report to the financial statements, the auditor provides increased assurance to users that the
financial statements are reliable.
Auditing Defined
The Philippine Standards on Auditing (PSA) defines auditing by stating the objective of a financial
statement audit, that is, to enable the auditor to express an opinion whether the financial statements
are prepared, in all material respects, in accordance with an identified financial reporting framework.
This definition confines the audit to examination of the financial statements. Although the great
majority of audit work today deals with audit of financial statements, operational and compliance
auditing are becoming more and more important.
“An audit is a systematic process of objectively obtaining and evaluating evidence regarding
assertions about economic actions and events to ascertain the degree of correspondence
between these assertions and established criteria and communicating the results to interested
users."
2. An audit involves obtaining and evaluating evidence about assertions regarding economic
actions and events
Assertions are representations made by an audience about economic actions and events. The
auditor's objective is to determine whether these assertions are valid. To satisfy this objective, the
auditor performs audit procedures and gathers evidence that corroborates or refutes the assertions.
4. Auditors ascertain the degree of correspondence between assertions and established criteria
Established criteria are needed to judge the validity of the assertions. These criteria are important
because they establish and inform the users of the basis against which the assertions have been
evaluated and measured. In an audit, the auditor determines the degree by which the assertions
conform to the established criteria. For example, when auditing financial statements, the auditor
judges the fair presentation of the financial statements (assertions) by comparing the statements
with an identified financial reporting framework (criteria).
The communication of audit finding is the ultimate objective of any audit. For the audit to be
useful, the results must be communicated to interested users on a timely basis.
Independent Auditor
Established
Assertions
criteria
Types of Audits
Based on primary audit objectives, there are three major types of audit financial, compliance and
operational audits.
Compliance audit
Compliance audit involves a review of an organization’s procedures to determine whether the
organization has adhered to specific procedures, rules. or regulations. The performance of compliance
audit 1s dependent upon the existence of verifiable data and recognized criteria established by an
authoritative body. A common example of this type of audit is the examination conducted by BIR
examiners to determine whether entities comply with tax rules and regulations.
Operational audit
An operational audit is a study of a specific unit of an organization for the purpose of measuring its
performance. The main objective of this type of audit is to assess entity’s performance, identify areas
for improvements and make recommendations to improve performance. This type of audit is also
known as performance audit or management audit.
It should be noted that, although there are different types of audit, all audits possess the same general
characteristics. They all involve:
Unlike compliance and financial statement audits, where the criteria are usually defined, criteria used in
operational audit to evaluate the effectiveness and efficiency of operations are not clearly established.
Types of auditors
Auditors can be classified according to their affiliation with the entity being examined.
External auditors
These are independent CPAs who offer their professional services to different clients on a contractual
basis. External auditors are the ones who generally perform financial statement audits.
Internal auditors
Internal auditors are entity’s own employees who investigate and appraise the effectiveness and efficiency
of operations and internal controls. The main function of internal auditors is to assist the members of the
organization in the effective discharge of their responsibilities. Internal auditors usually perform
operational audits.
Government auditors
These are government employees whose main concern is to determine whether persons or entities comply
with government laws and regulations. Government auditors usually conduct compliance audits.
An opinion about
whether the financial Reports on the degree of
statements are fairly compliance with Recommendations or
Content of the
presented in conformity applicable laws, suggestions on how to
auditor’s report
with an identified regulations and improve operations.
financial reporting contracts.
framework.
Auditors who
External auditors Government auditors Internal auditors
generally perform
The auditor’s responsibility is to form and express an opinion on these financial statements based on
his audit. An audit of financial statements does not relieve management of its responsibilities. Hence,
it is management’s responsibility to adopt and implement adequate accounting and internal control
systems that will help ensure, among others, the preparation of reliable financial statements.
5. Nature of evidence
Evidence obtained by the auditor does not consist of “hard facts” which prove or disprove the
accuracy of the financial statements. Instead, it comprises pieces of information and impressions
which are gradually accumulated during the course of 'an audit and which, when taken together,
persuade the auditor about the fairness of the financial statements. Thus, audit evidence is
generally persuasive rather than conclusive in nature.
Evaluates Financial
Unaudited Financial Statements
Statements
1. The auditor should comply with the “ Code of Professional Ethics for Certified Public
Accountants” promulgated by the Board of Accountancy (BOA).
In order to retain public confidence in the credibility of the auditors’ work, auditors must adhere
to standards of ethical conduct that embody and demonstrate integrity, objectivity, and concern
for the public rather than self-interest.
2. The auditor should conduct an audit in accordance with Philippine Standards on Auditing.
These standards contain the basic principles and essential procedures which the auditor should
follow. The standards also include explanatory and other materials which, rather than being
prescriptive (that is mandatory), is designed to assist auditors in interpreting and applying the
auditing standards.
3. The auditor should plan and perform the audit with an attitude of professional skepticism
recognizing that circumstances may exist which may cause the financial statements to be
materially misstated.
An attitude of professional skepticism means the auditor makes a critical assessment, with a
questioning mind of the validity of audit evidence obtained and is alert to audit evidence that
contradicts or bring into questions the reliability of documents or management representations.
In planning and performing an audit, the auditor neither assumes that the management is honest
nor assumes unquestioned honesty. Thus, representations from management are not a substitute
2. Expertise
The complexity of accounting and auditing requires expertise in verifying the quality of the
financial information. Since most of the users of financial information are not equipped with the
'necessary skills and competence to determine whether the financial statements are reliable, a
qualified person is hired by users to verify the reliability of the financial statements on their
behalf.
3. Remoteness
Users of financial information are usually prevented from directly assessing the reliability of the
information. Most of the users do not have access to the entity’s records to personally verify the
quality of the financial information. Consequently, an independent auditor is needed to assist
them in verifying the reliability of the financial information.
4. Financial consequences
Misleading financial information could have substantial economic consequences for a decision
maker. It is therefore important that financial statements be audited first before they are used for
making important decisions.
1. Audit function operates on the assumption that all financial data are verifiable.
All balances reported in the financial statements must have supporting documents or evidence to
prove their validity. If no evidence exists in relation to the financial statements on which an
auditor is to express an opinion, then there can be no audit to perform.
2. The auditor should always maintain independence with respect to the financial statements under
audit
Independence is essential for ensuring the credibility of the auditor’s report. The report of the
auditor will be of little or no value to the readers of the financial statements if the readers are
aware that the auditor is not independent with respect to the client.
3. There should be no long-term conflict between the auditor and the client management.
4. Effective internal control system reduces the possibility of errors and fraud affecting the financial
statements.
The condition of the entity’s internal control system directly affects the reliability of the financial
statements. The stronger the internal control is, the more assurance it provides about the
reliability of the accounting data and financial statements.
6. What was held true in the past will continue to hold true in the future in the absence of known
conditions to the contrary.
Experience and knowledge accumulated from auditing a client in prior years can be used to
determine the appropriate audit procedures that need to be performed.
AUDITOR’S RESPONSIBILITY
The fair presentation of the financial statements in accordance with the applicable financial reporting
standards is the responsibility of ' the client’s management. The auditor’s responsibility is to design the
audit to provide reasonable assurance of detecting material misstatements in the financial statements.
These misstatements may emanate from;
1. Error,
2. Fraud, and
ERROR
The term “error” refers to unintentional misstatements in the financial statements, including the omission
of an amount or a disclosure, such as:
Fraud refers to intentional act by one or more individual among management, those charged with
governance, employees, or third parties, involving the use of deception to obtain an unjust or illegal
advantage. Although fraud is a broad, legal concept, the auditor is primarily concerned with fraudulent
acts that cause a material misstatement in the financial statements
Types of Fraud
There are two types of fraud that are relevant to financial statement audit. Misstatements resulting from
fraudulent financial reporting and misstatements resulting from misappropriation of assets.
involves theft of an entity’s assets committed by the entity’s employees. This may include:
Embezzling receipt
Fraud involves motivation to commit it and a perceived opportunity to do so. For example, an
employee might be motivated to steal company’s assets because 'this employee lives beyond his means.
Also, a member of management may be forced to manipulate the financial statements in order to meet an
overly optimistic projection. A perceived opportunity to commit fraud may exist when there is no proper
segregation of duties among employees or when management believes that internal control can be easily
circumvented.
The primary factor that distinguishes fraud from error is whether the underlying cause of misstatement in
the financial statements is intentional or unintentional Although the auditor may be able to identify
opportunities for fraud to be perpetrated, it is often difficult, if not impossible, for the auditor to determine
intent, particularly in matters involving management judgment, such as accounting estimates and the
appropriate application of accounting principles. Consequently, the auditor’s responsibility for the
detection of hand and error is essentially the same.
Management to establish a control environment and to implement internal control policies and
procedures designed to ensure, among others, the detection and prevention of fraud and error.
Although the annual audit of financial statements may act as deterrent to fraud and error, the auditor is not
and cannot be held responsible for the prevention of fraud and error. The auditor’s responsibility is to
design the audit to obtain reasonable assurance that the financial statements are free from material
misstatements, whether caused by error or fraud.
PLANNING PHASE
1. When planning an audit, the auditor should make inquiries of management about the possibility of
misstatements due to fraud and error. Such inquiries may include
Any material error or fraud that has affected the entity or suspected fraud that the entity is
investigating
The auditor’s inquiries of management may provide useful information concerning the risk of material
misstatements in the financial statements resulting from employee fraud. However, such inquiries are
unlikely to provide useful information regarding the risk of material misstatements in the financial
statements resulting from management fraud. Accordingly, the auditor should also inquire of those
individuals in charge of governance to seek their views on the adequacy of accounting and internal
control systems in place, the risk of fraud and error, and the integrity of management.
2. The auditor should assess the risk that fraud or error may cause the financial statements to contain
material misstatements. In this regard, PSA 240 requires the auditor to specifically
“assess the risk of material misstatement due to fraud and consider that assessment in designing the audit
procedure to be performed. ”
The fact that fraud is usually concealed can make it very difficult to detect. Nevertheless, using the
auditor’s knowledge of the business , the auditor may identify events or conditions that provide an
opportunity, a motive or a means to commit fraud or, indicate that fraud may already have occurred. Such
events or conditions are referred to as “fraud risk factors”. Fraud risk factors do not necessarily indicate
the existence of fraud; however, they often have been present in circumstances where frauds have
occurred. Examples of fraud risk factors taken from PSA 240 are set out at the end of this chapter:
Judgments about the increased risk of material misstatements due to fraud may influence the auditor’s
professional judgments in the following ways:
The auditor may approach the audit with a heightened level of professional skepticism.
The auditor’s ability to assess control risk at less than high level may be reduced and the auditor
should be sensitive to the ability of the management to override controls.
The audit team may be selected in ways that ensure that the knowledge, skill, and ability of
personnel assigned significant responsibilities are commensurate with the auditor’s assessment of
risk.
The auditor may decide to consider management selection and application of significant
accounting policies, particularly those related to income determination and asset valuation.
TESTING PHASE
3. During the course of the audit, the auditor may encounter circumstances that may indicate the
possibility of fraud or error. For example, there are discrepancies found in the accounting records,
conflicting or missing documents or lack of cooperation from management. In these circumstances, the
auditor should perform procedures necessary to determine whether material misstatements exist.
If the auditor believes that the misstatement is, or may be the result of fraud, but the effect on the financial
statements is not material, the auditor should
Refer the matter to the appropriate level of management at least one level above those involved,
and
Be satisfied that, given the position of the likely perpetrator, the fraud has no other implications
for other aspects of the audit or that those implications have been adequately considered.
However, if the auditor detects a material fraud or has been unable to evaluate whether the effect on
financial statement is material or immaterial, the auditor should:
Consider implication for other aspects of the audit particularly the reliability of management
representations.
Discuss the matter-and the approach to further investigation with an appropriate level of that is at
least one level above those involved,
Attempt to obtain evidence to determine whether a material fraud in fact exists and, if so, their
effect, and
Suggest that the client consult with legal counsel about questions of law.
COMPLETION PHASE
5. The auditor ‘should obtain a written representation from the client’s management that
it acknowledges its responsibility for the implementation and operations of accounting and
internal control systems that are designed to prevent and detect fraud and error.
it believes the effects of those uncorrected financial statement misstatements aggregated by the
auditor during the audit are immaterial. both individually end in the aggregate, to the financial
statements taken as a whole. A summary of each items should be Included in or attached to the
written representation:
it has disclosed to the auditor all significant fact relating to any frauds or suspected frauds known
to management that may have affected the entity; and
it has disclosed to the auditor the results of its assessment of the risk that the financial statements
may be materially misstated as a result of fraud.
CONSIDER THE EFFECT ON THE AUDITOR 'S REPORT
6. When the auditor believes that material error or fraud exists, he should request the management to
revise the financial statements. Otherwise, the auditor will expect a qualified or adverse opinion.
Because of the inherent limitations of an audit there in an unavoidable risk that material misstatements in
the financial statements resulting from fraud and error may not be detected. Therefore, the subsequent
discovery of material misstatement in the financial statements resulting from fraud or error does not, in
and of itself, indicate that the auditor has failed to adhere to the basic principles and essential procedures
of an audit.
The risk of not detecting a material misstatement resulting from fraud is higher than the risk 'of not
detecting misstatements resulting from error. This is due to the fact that fraud may involve sophisticated
and carefully organized schemes designed to conceal it, such as forgery, ' deliberate failure to record
transactions, or intentional misrepresentation being made to the auditor. Hence, audit procedures that are
effective for detecting material errors may be ineffective for detecting material fraud; especially those
concealed through collusion.
Furthermore, the risk of the auditor not detecting a material misstatement resulting from management
fraud is greater than for employee fraud, because those charged with governance and management are
often in a position that assumes their integrity and enables them to override the formally established
control procedures. Certain levels of management may be in a position to override control procedures
designed t6 prevent similar frauds by other employees, for example, by directing subordinates to record
transactions incorrectly or to conceal them. Given its position of authority within an entity, management
has the ability to either direct employees to do something or solicit their help to assist management in
carrying out a fraud, with or without the employee’s knowledge.
Noncompliance refers to acts of omission or commission by the entity being audited, either intentional
on: unintentional, which are contrary to the prevailing laws or regulations. Such acts include transactions
entered into by, or in the name cg the entity or on its behalf by its management or employees. Common
examples include:
Tax evasion
It is management’s responsibility to ensure that the entity’s operations are conducted in accordance with
laws and regulations. The responsibility for the prevention and detection of noncompliance rests with
management. (PSA 250)
The following policies and procedures, among others, may assist management in discharging its
responsibilities for the prevention and detection of noncompliance:
Ensuring employees are properly trained and understand the Code of Conduct.
Monitoring compliance with the Code of Conduct and acting appropriately to discipline
employees who fail to comply with it.
Maintaining a register of significant laws with which the entity has to comply within its particular
industry and a record of complaints.
In large entities, these policies and procedures may be supplemented by assigning appropriate
responsibilities to an internal audit function an audit committee.
Auditor’s Responsibility
An audit cannot be expected to detect noncompliance with all laws and regulations. Nevertheless, the
auditor should recognize that noncompliance by the entity with laws and regulations may materially affect
the financial statements.
PLANNING PHASE
1. In order to plan the audit, the auditor should obtain. General understanding of legal regulatory
framework applicable to the entity and the industry and how the entity is complying with that framework.
To obtain the general understanding of laws and regulations, the auditor would ordinarily.
Inquire of management concerning the entity’s policies and procedures regarding compliance
with laws and regulations.
Inquire of management as to the laws or regulations that may be expected to have a fundamental
effect on the operations of the entity.
Discuss with management the policies or procedures adopted for identifying, ' evaluating and
accounting for litigation claims and assessments.
Discuss the legal and regulatory framework with auditors of ' subsidiaries in other countries (for
example, if the subsidiary is required to adhere to the securities regulations of the parent
company).
After obtaining the general understanding, the auditor should design procedures to help identify
instances of noncompliance with those laws and regulations where noncompliance should be considered
when preparing financial statement such as:
TESTING PHASE
4. When the auditor becomes aware of information concerning a possible instance of noncompliance, the
auditor should obtain an understanding of the nature 6f the act and the circumstances in which it has
occurred, and sufficient other information to evaluate the possible effect on the financial statements.
When evaluating the possible effect on the financial statements, the auditor considered:
The potential financial consequences such as fines, penalties, damages, threat of expropriation of
users, enforced documentation of operations and litigation.
Whether the potential financial consequences are so serious to call into question the fair
presentation given by the financial statements.
5. When the audits believe there may be noncompliance, the auditor should document the findings,
discuss them with management and consider the implication on other aspect of the audit
COMPLETION PHASE
6. The auditor should obtain written representations that management has disclosed to the auditor all
known actual or possible noncompliance with laws and regulations that could materially affect the
financial statements
7. When the auditor believes that there is noncompliance with laws and regulations that materially affects
the financial statements, he should request the management to revise the financial statements. Otherwise,
a qualified or adverse opinion will be issued.
8. If a scope limitation has precluded the auditor from obtaining sufficient appropriate evidence to
evaluate the effect of noncompliance with laws and regulations, the auditor should express a qualified
opinion or a disclaimer of opinion.
An audit is subject to the unavoidable risk that some material misstatements in the financial statements
will not be detected, even though the audit is properly planned and performed in accordance with PSAs.
This risk is higher with regard to material misstatements resulting from noncompliance with laws and
regulations because:
There are many laws and regulations relating principally to the operating aspects of the entity that
typically do not have a material effect on the financial statements and are not captured by the
Noncompliance may involve conduct designed to conceal it, such as collusion, forgery, deliberate
failure to record transactions, senior management override of controls or intentional
misrepresentations being made to the auditor.
Examples of Risk Factors Relating to Misstatements Resulting from Fraud
The fraud risk factors identified below are examples of such factors typically faced by auditors in a broad
range of situations. However, the fraud risk factors listed below are only examples; not all of these factors
are likely to be present in all audits, nor is the list necessarily complete. Furthermore, the auditor exercises
professional judgment when considering fraud risk factors _ individually or in combination and whether
there are specific controls that mitigate the risk.
Fraud Risk Factors Relating to Misstatement Resulting from fraudulent financial Reporting
Fraud risk factors that relate to misstatements resulting from fraudulent financial reporting may be
grouped in the following three categories:
2. Industry Conditions
For each of these three categories, examples of fraud risk factors relating to misstatements arising from
fraudulent financial reporting are set out below.
1. Fraud Risk Factor Relating to Management’s Characteristics and influence over their control
environment
These fraud risk factors pertain to management’s abilities Pressures, style, and attitude relating to internal
control and the financial reporting process.
Management does not effectively communicate and support the entity’s values or ethics,
or management communicates inappropriate values or ethics.
Management sets unduly aggressive financial targets and expectations for operating
personnel.
There is a strained relationship between management and the current or predecessor auditor.
Specific indicators might include the following:
Formal or informal restrictions on the auditor that inappropriately limit the auditor’s
access to people or information, or limit the auditor’s ability to communicate effectively
with those charged with governance.
Dominating management behavior in dealing with ' the auditor, especially involving
attempts to influence the scope of the auditor’s work.
There is a history of securities law violations, or claims against the entity or its management
alleging fraud or violations of securities laws.
Little attention being paid to financial reporting matters and to the accounting and
internal control systems by those charged with governance
2. Fraud Risk Factors Relating to Industry Conditions
These fraud risk factors involve the economic and regulatory environment in which the entity operates.
New accounting, statutory or regulatory requirements that could impair the financial stability or
profitability of the entity.
A declining industry with increasing business failures and significant declines in customer
demand.
Rapid changes in the industry, such as high vulnerability to rapidly changing technology or rapid
product obsolescence.
3. Fraud Risk Factors Relating to Operating Characteristics and Financial Stability.
These fraud risk factors pertain to the nature and complexity of th e entity and 1ts transactions, the entity’s
financial condition, and its profitability.
Inability to generate cash flows from operations while reporting earnings and earnings growth.
Significant pressure to obtain additional capital necessary to stay competitive, considering the
financial position of the entity (including a need for funds to finance major research and
development or capital expenditures).
Assets, liabilities, revenues or expenses based on significant estimates that involve unusually
subjective judgments or uncertainties, or that are subject to potential significant change in the
near term in a manner that have a financially disruptive effect on the entity (for example, the
ultimate collectability of receivables, the timing of revenue recognition, the realizability of
financial instruments based on highly-subjective valuation of Collateral or difficult to assess
repayment sources, or a significant deferral of costs).
Significant related party transactions which are not in the ordinary course of business.
Significant related party transactions which are not audited or are audited by another firm.
Significant, unusual or highly complex transactions (especially those close to year-end) that pose
difficult questions concerning substance over form.
Significant bank accounts or subsidiary 01.1i branch operations in tax-heaven jurisdictions for
which there appears to be no clear business justification.