Auditing 288/388 Year Summary

Auditing Summary – Semester 1
Introduction to Auditing
 What is an audit?
- A systematic process to gather and evaluate evidence & information to objectively, to
evaluate the assertions (made by management) in the FS, to determine the correlation
with predetermined criteria (qualitative and quantitative) and to communicate results to
stakeholders in writing.
 What is the purpose of an audit?
- To express an opinion on the FS that they are free of material misstatements and that
they fairly represent all material aspects in the financial position and performance of the
entity in accordance with IFRS and the Companies Act.
- What isn’t the purpose of an audit?
 Identifying every error
 Detecting fraud
 Guaranteeing future success of the company
 Inherent limitation of an Audit -> Reasonable Assurance:
- Nature of Financial Reporting
 Estimates and judgments are used.
- Nature of Audit Procedures
 Time and Cost Limitations
 Management may not provide all information.
 Management can hide fraud.
- Timeliness of Reporting
 Cost and benefit of taking longer to audit must be balanced.
- Reliability VS Cost
 Use of sampling because everything cannot be tested.
 Types of auditors?
- External – Independent Auditor
- Internal – Employed by company
- Attorney General (Public Auditors) – Auditor General, SARS
- Special-Purpose (Forensic Auditor) – For provisions like a contractual agreement
 5 Postulates (“assumptions”) auditors make about a company.
- Financial Statements is verifiable.
- Financial Statements are free from irregularities.
- What held in the past will hold in the future?
- Consistent application of principles leads to fair representation.
- No conflict of interest
 External VS Internal
- External Auditors
 Express and independent opinion on whether the financial statements fairly
represent the Financial Position and performance of a company.
 Not employed by company
- Internal Auditors
 Perform independent assignments for management.
 Enhances management’s confidence that internal controls are working properly.
 Employed by company.

, Internal Control (IC)
 Definition of Internal Control
- A process, designed and initiated by management, to provide reasonable assurance
about the achievement of the company’s objectives in terms of:
 Reliability of Financial Reporting
 Effectiveness and efficiency of Operations
 Compliance with Laws and Regulations
(Note: The auditor does not design, or Implement IC’s It is done by management throughout the year)
 Inherent Limitations of Internal Control
- Cost VS Benefit
 It is expensive to segregate all duties. Trade-off: only segregate some crucial
incompatible duties
- Internal Controls can become obsolete or inadequate as business changes.
- Collusion by Employees to circumvent internal controls and commit fraud.
- Collusion by Management to override internal controls and commit fraud.
- Human error
- Directed at routine, repetitive transactions rather than the exceptions.
 Auditors Duty
- How to gain adequate knowledge of business, including system of internal control:
 Prior experience or knowledge
 Discussions or enquiries with staff
 Reading the manuals
 Inspecting documents and previous records
 Observe (E.g. Cameras or operations)
 Walk through tests (E.g. From inventory to point of sale)
- How to document knowledge of internal control system utilizing following documents
 System Description
 Internal Control Questionnaire (You know what perfect system should look like)
 Yes: Sound Internal Controls
 No: Weakness in Internal Controls (Potential Risk)
 Consider Compensating Controls
 System Flow Charts
 Standardise Symbols
 Flow of Documents
 Sequence of Events
 Duties of Staff and Departments
 5 Components of internal control (COSO Model) (CRIMC)
- Control Environment
 Entity’s governance and management functions and attitudes, awareness, and
actions of those responsible for governance
- Risk Assessment Process
 Entity’s process for identifying risks relevant to the financial reporting objectives and
how they are addressed.
- Information System
 Procedures and records established by entity to initiate, execute, record, process,
and report transactions, events, and conditions and to maintain accountability (E.g.,
Pastel)

,  Initiate - Transactions (Decision and Approval)
 Execute - Implementation of the Decision
 Record - Reflect transaction on Source Documents.
 Process - Accounting Records (E.g. Cash book, ledgers, and journals)
 Reporting - Reflect on Financial Statements
- Control Activities
 Activities ensuring all transactions started and end up reflected correctly in Financial
Statements (E.g. Policies and Procedures)
- Monitoring of Controls
 Process to assess effectiveness of internal controls over time.

Segregation of Duties Records and Documents
 A Transaction should not be handled by only one  Document Design
employee from beginning to end. - Easy identification of different types of forms (Colour
 Reduces probability that an employee can commit or Size)
error/fraud and hide it. - Pre-printed and Pre-numbered (enables sequence
 Incompatible Functions are: checking)
- Initiation of transaction - Logical design & layout
- Authorisation of transaction - Space for signatures and initials
- Executions of transaction - Multi-copied source documents (Different Divisions)
- Recording of transaction  Stationary Control
- Control/Safeguarding of asset involved (if applicable) - Safeguarded
- Register
- Cancelation after use
Control Access (Security) Independent Review (Double Review)
 Logical (Not NB) & Physical Security  2nd Independent person checking the other person’s
 Access Control to Assets (E.g. Locks, Safes, Guards, work.
Etc.)  Sign or Initial (Evidence that a check was performed
 Access Control to Documents/Records (E.g. Stationary and pinpoint the responsibility)
Register)
Authorisation Monitoring (Reconciliation)
 In terms of Company Policy (NB these words)  Reconciliation between Actual VS Recorded Assets
- Specific authorisation levels given the types of - Comparing (E.g. Physical stock counts with inventory)
transactions or value thereof.  Reconciliation between two sets of recorded
- After reviewing supporting documents information
 Evidence of Authorisation Required - Comparing (E.g. Bank Account to Bank Statements)
- Sign (as evidence that authorisation was given and to - Comparing (E.g. Sub-ledger to General Ledger)
pinpoint responsibility)
Control Activities (SCRRAM)


Control Activities (SCRRAM) Control Objectives (VAC)
Segregation of Duties <- Do this. Validity
Control Access / Security Accuracy
Independent Review Completeness
Records and Documents To ensure that this
Authorisation is achieved - >
Monitoring

, Control Objectives (VAC)
Validity Completeness Accuracy
 Transactions are authorised in  Keyword = “ALL RECORDED”  Right account
terms of company policy.  No Omissions  Right amount
 Events occurred.  Pre-Numbered documents are  Right document
 Documents exist. in order, and all are present.  Right product
 Transaction is legitimate (in  Timely recorded
other words were not made
to fictitious people)
 Possible Exam Questions
- Give:
 Weaknesses (State what is not there)
 Consequences (Usually fraud or error, resulting in material misstatement)
 Recommendations (Give the correct controls that you identified as missing. If a
document is missing, give all the controls around that document, namely the perfect
cycle. Quite a lot of marks!)
- Give a perfect cycle. Leave out the controls that the company is already doing right.
- Identify the control activities relating to some given controls (SCRRAM)
 E.g., “The manager locks the petty cash box in a safe” = Access Control
- Formulate control objectives (Start with ‘to ensure that…’)
 E.g., “Formulate the control objectives for the validity of credit sales.”
Answer: To ensure that
 All debtors are approved and authorised in terms of company policy.
 Credit sales actually occurred.
 Invoices are generated for credit sales.
 Credit sales are legitimate (specifically only sales to approved debtors)
 Perfect Cycles of Internal Control
- Exam technique: Generic Template that applies to almost every document.
 [Document Name] should be pre-numbered and pre-printed.
 Prepared by [Clerk/Storeman] and signed to assign responsibility.
 [Number of copies]
 For client, as evidence off occurrence
 For accounting department, for recording If in doubt, there is usually
 For same department, for evidence of occurrence 4 copies. Say Why each
 For next department, to agree documents. copy is needed.
 Reviewed by [Sales/Purchases/Warehouse] Manager for details:
 Reperform Calculations
 Check date.
 Check quantity and price.
 Agree to previous documents.
 Reviewer signs to authorise in terms of company policy (e.g., approving a debtor)
 Reviewer checks number sequence and follows up outstanding items (Say this for every
single document)
 Blank documents must be safe guarded.
 + The Additional Controls Specific to each cycle
 Perfect Cycles:
- Sales and Receipts
- Purchases and Payments