CPA
Intermediate Leval
Auditing and Assurance April 2023
Suggested solutions

(ii) Encryption:

Encryption is the process of converting information or data into a code to prevent unauthorized access. In the context of computerized audit environments, encryption is essential for securing sensitive data and communication between systems. When data is encrypted, it is transformed into a format that can only be read or understood by someone with the correct decryption key. Encryption ensures that even if unauthorized individuals intercept the data, they cannot decipher it without the appropriate decryption key. Auditors use encryption to protect confidential audit files, communication with clients, and other sensitive information exchanged during the audit process, ensuring data integrity and confidentiality.

(iii) Embedded Audit Module:

An Embedded Audit Module (EAM) is a specialized program or code integrated into an organization's information system or software application. The purpose of an EAM is to collect specific audit-relevant data and perform predefined audit procedures automatically. EAMs are designed to capture transactional data, monitor system activities, and perform internal controls testing without requiring manual intervention from auditors. These modules are embedded within the organization's software applications, enabling auditors to obtain real-time audit evidence directly from the source system. By automating data collection and testing procedures, EAMs enhance audit efficiency, reduce the risk of errors, and allow auditors to focus on analyzing results and providing valuable insights to the organization.

Outsourcing involves contracting an external service provider or firm to conduct internal audit activities on behalf of the organization. In outsourcing, the entire internal audit function is delegated to the external provider, and they typically work off-site. The organization relies on the external provider for all internal audit services, and the provider is responsible for the planning, execution, and reporting of the audit activities. It is a more hands-off approach and is often used when the organization lacks the internal resources or expertise to conduct internal audits independently.

(ii) Matters to Include in the Engagement Letter with the Outsourced Service Provider:

Scope of Work: Define the specific scope of the internal audit engagement, including the objectives, areas to be covered, and any limitations. Ensure clarity on what the outsourced provider is expected to audit.

Audit Plan: Outline the audit plan, including the audit methodology, audit schedule, and key milestones. Specify reporting timelines and deliverables.

Access to Information: Ensure that the engagement letter clearly states the organization's commitment to providing the external service provider with access to all necessary information, documents, and personnel required for the audit.

Confidentiality and Data Security: Define the confidentiality and data security expectations, including how sensitive organizational information should be handled, stored, and protected.

(iii) Areas to Review for External Service Provider's Competency:

Experience and Qualifications: Review the external service provider's experience, qualifications, and credentials of the audit team members. Ensure they have relevant certifications and a track record of successful internal audit engagements.

Industry Knowledge: Evaluate the provider's knowledge of the industry in which the organization operates. Industry-specific knowledge is essential for understanding sector-specific risks and regulations.

Audit Methodology: Assess the provider's internal audit methodology, tools, and technology used. Ensure it aligns with industry best practices and the organization's audit standards.

Quality Assurance: Review the provider's quality assurance and review processes to confirm that their work meets high-quality audit standards and is subject to independent quality assessments.

References and Past Engagements: Seek references from previous clients and inquire about their experiences with the external provider. Evaluate the provider's reputation and client satisfaction.

Regulatory Compliance: Confirm that the external provider complies with all relevant auditing and regulatory standards. Ensure they are aware of any industry-specific regulations that may impact the audit.

External Auditors:

• Independence: External auditors are independent professionals hired by the organization's stakeholders (e.g., shareholders) to provide an impartial and objective assessment of the organization's financial statements. Their primary duty is to the organization's stakeholders, not the company itself.
• Financial Statement Audits: External auditors focus on the examination of the organization's financial statements, transactions, and related controls. They perform an annual financial statement audit to express an opinion on the fairness and accuracy of the financial statements, ensuring they are free from material misstatement, whether due to error or fraud.
• Detection of Material Misstatements: External auditors are responsible for identifying material misstatements in the financial statements that result from fraud or error. While their primary focus is not fraud detection, they are required to assess the risk of fraud and design audit procedures to detect material fraud.
• Legal Obligation: External auditors have a legal obligation to report any instances of fraud or material misstatements to the appropriate regulatory authorities when discovered during the audit. This obligation extends to fraud involving management or employees.

Internal Auditors:

• Employed by the Organization: Internal auditors are employees of the organization itself, and their primary responsibility is to assist management in achieving the organization's objectives, which includes the detection and prevention of fraud.
• Operational Focus: Internal auditors have a broader scope and focus on the organization's internal operations, controls, and processes. They assess the effectiveness and efficiency of these processes, including internal controls, to identify weaknesses that could lead to fraud.
• Fraud Prevention and Detection: While their primary focus is on preventing and detecting operational and compliance-related issues, internal auditors also play a crucial role in fraud prevention and detection. They are often involved in proactive fraud risk assessments and may conduct investigations into suspected fraud incidents.
• Continuous Monitoring: Internal auditors typically engage in continuous monitoring and provide ongoing recommendations to strengthen internal controls, which can help deter and detect fraudulent activities.
• Communication with Management: Internal auditors regularly communicate their findings and recommendations to management, allowing for timely remediation of control weaknesses and improved fraud prevention measures.

Matters that Kezzia should consider including:

Reporting Lines and Accountability:

Clearly define the reporting lines of the internal audit function. The audit charter should specify that the Head of Internal Audit reports directly to the Audit Committee or its equivalent governing body. This ensures that the internal audit function is independent of management and can operate without undue influence or interference.

Authority and Access to Information:

Establish the authority of the internal audit function to access all relevant records, personnel, and information necessary to perform its duties. The audit charter should explicitly state that management is required to provide unrestricted access to audit areas and information. This authority helps ensure that internal auditors can carry out their work independently and thoroughly.

Conflict of Interest Policies:

Include provisions in the audit charter that address conflicts of interest among internal audit staff. Internal auditors should be free from any personal or financial interests that could compromise their independence and objectivity. The charter should outline procedures for identifying and managing potential conflicts and require auditors to disclose any conflicts promptly.

Whistleblower Protection:

Specify that the internal audit function has a responsibility to receive and investigate reports of alleged improprieties, irregularities, or unethical conduct within the organization. The audit charter should also include provisions for protecting the confidentiality and anonymity of whistleblowers to encourage them to come forward with concerns without fear of retaliation.

(ii) Purpose of undertaking risk assessment procedures.

The purpose of undertaking risk assessment procedures, as required by ISA 315, is to help the auditor identify and assess the risks of material misstatement in the financial statements. These procedures are crucial because they lay the foundation for the entire audit process. The key objectives are as follows:

a. Understanding the Entity and its Environment: By gaining an understanding of the entity, its industry, operations, and the environment in which it operates, auditors can identify factors that may influence the financial statements. This knowledge helps in assessing the inherent risks associated with the entity.

b. Understanding Internal Controls: The auditor must assess the effectiveness of the entity's internal controls, particularly those that are relevant to financial reporting. This helps in determining whether the controls can prevent or detect material misstatements.

c. Identifying Risks: By understanding the entity and its internal controls, auditors can identify specific risks that could result in material misstatements in the financial statements. These risks could be related to fraud, errors, or other issues.

d. Tailoring the Audit Approach: Once risks are identified and assessed, the auditor can develop an audit plan that is tailored to address these specific risks. This involves deciding on the nature, timing, and extent of audit procedures.

(iii) Sources of audit evidence that the auditor can use as part of risk assessment procedures include:

a. Management's Discussion and Analysis (MD&A): This is a section of the annual report where management provides insights into the entity's financial performance, challenges, and strategies. It can help auditors understand the entity's operations and environment.

b. Internal Documents: Internal documents like organizational charts, policies and procedures manuals, and strategic plans can provide insights into the entity's structure and operations.

c. Meetings and Interviews: Auditors may interview key personnel, including management, to gather information about the entity's operations, objectives, and risks.

d. Industry and Economic Reports: Information from industry reports, economic forecasts, and market analyses can help auditors understand the external factors that may affect the entity's financial statements.

e. Previous Audit Documentation: If the entity has been audited in prior years, the auditor may review the previous audit files for insights into the entity's historical performance and issues.

f. Observation: The auditor may physically observe the entity's operations, premises, or inventory to gain a firsthand understanding of the business.

g. Analytical Procedures: Analyzing financial data and ratios can reveal trends, anomalies, or potential risks that may require further investigation.

h. Inquiries with Third Parties: Auditors may inquire with third parties such as customers, suppliers, legal counsel, or regulatory authorities to gather information about the entity's business and potential risks.

Considerations for selecting creditors to be included in the sample:

• Significant Balances: Start by identifying creditors with significant balances. Creditors with larger amounts owed to them are more important to the financial statements, and confirmation from them provides more substantial evidence.
• Aged Balances: Review the aging of accounts payable. Focus on older balances, as they may have a higher risk of disputes or errors. Also, consider selecting creditors with balances that have been outstanding for a long time.
• Unusual Transactions: Identify creditors with transactions or balances that appear unusual or inconsistent with the company's typical business operations. This can include unexpected increases in balances or unusual terms.
• High Transaction Volume: Consider creditors with a high volume of transactions. These creditors may be more prone to errors or irregularities, making their confirmation important.
• Suppliers with Complex Terms: Select creditors with complex or non-standard terms of payment, as these may be more prone to disputes or errors. This could include creditors with extended payment terms or non-standard payment arrangements.
• Previous Issues: If the company has experienced issues with specific creditors in the past, it may be prudent to include them in the sample for confirmation.
• Supplier Relationships: Consider the importance of the supplier relationships to the company's operations. Suppliers critical to the production process or those that provide essential materials/components should be included.
• Creditors Subject to Risk Assessment: Creditors that have been identified as posing a higher risk of material misstatement during the risk assessment phase of the audit should be included in the sample.
• Materiality Threshold: Consider the materiality threshold set for the audit. Creditors with balances near or above the materiality threshold should be included, as misstatements in these accounts can have a significant impact on the financial statements.
• Judgment and Professional Skepticism: Use auditor judgment and apply professional skepticism when selecting creditors for confirmation. If there are doubts or concerns about specific creditors, include them in the sample.

• Acknowledgment of Responsibility: The letter of representation requires the management to acknowledge their responsibility for the financial statements and the accuracy of the information provided to the auditor. This is crucial for maintaining transparency and accountability.
• Confirmation of Representations: The letter serves as a formal way for management to confirm the accuracy of the representations made to the auditor during the audit. It helps in reducing the risk of misunderstandings or disputes later on.
• Evidence of Management's Cooperation: It demonstrates management's willingness to cooperate with the audit process and indicates their understanding of the audit's purpose and scope.
• Compliance with Professional Standards: Many auditing standards and guidelines require auditors to obtain a letter of representation as part of their audit procedures. It is a standard practice to ensure compliance with professional standards.

(ii) Matters to Include in the Letter of Representation:

• Confirmation of Responsibility: An acknowledgment of management's responsibility for the preparation and fair presentation of the financial statements in accordance with applicable accounting standards.
• Full Disclosure: Assurance that all relevant information and disclosures have been provided to the auditor, including any significant accounting policies and estimation uncertainties.
• Completeness and Accuracy: A statement confirming that all records and documents related to the financial statements have been made available to the auditor and that the information is complete and accurate.
• Compliance with Laws and Regulations: Confirmation that the company is in compliance with all relevant laws and regulations, particularly those related to financial reporting and taxation.
• Internal Control Representations: Confirmation of the effectiveness of internal control over financial reporting, as well as the absence of any fraud, irregularities, or illegal acts.
• Subsequent Events: Disclosure of any significant events or transactions that occurred between the balance sheet date and the date of the auditor's report.
• Cooperation with the Audit: Assurance of full cooperation with the auditor, including providing access to all necessary information and personnel during the audit process.

(iii) Reasons for Management's Unwillingness to Sign a Letter of Representation:

• Legal Concerns: Management might have legal concerns about the implications of signing such a letter, fearing potential liabilities or admissions of wrongdoing.
• Audit Findings: If the audit has uncovered irregularities or issues that management is not willing to acknowledge or address, they may be reluctant to sign the letter.
• Disputes: There may be disputes or disagreements between the auditor and management regarding the financial statements, disclosures, or accounting treatments.
• Communication Breakdown: A breakdown in communication between the auditor and management could lead to a lack of trust or cooperation.
• Confidential Information: Management may have concerns about disclosing sensitive or confidential information in the letter of representation.
• Reputation Concerns: Signing the letter might have adverse implications for the company's reputation, especially if it implies that management was aware of significant issues or deficiencies.