Assurance and the role of the auditor: Canadian standards and CPAB

Every day, investors, lenders, suppliers, employees and governments rely on financial statements prepared by people they will never meet. Management prepares those statements, and management also benefits when the numbers look good. An independent audit exists to close that gap. The auditor gathers evidence, forms an opinion on whether the statements are presented fairly in all material respects, and reports that opinion to the people who rely on them. This course follows a full audit from the first client meeting to the signed report. ACCT-211 and ACCT-212 taught you what the financial reporting standards require; ACCT-240 taught you how accounting systems and internal controls work. This course asks a different question: how does an outsider obtain enough evidence to say, with reasonable assurance, that someone else's statements are right? The answer draws on judgment, statistics, scepticism, ethics and law, and it is the core of the CPA profession's public-interest role.

Why audits are demanded

Three ideas explain why audits exist even where no law requires them. The first is agency theory. Shareholders and lenders (principals) hire managers (agents) to run the business, but the agents know more than the principals and may act in their own interest. Financial statements are the main way managers report on their stewardship, and an independent check on those statements reduces the agency cost of monitoring them. The second is information risk: the risk that the information used to make a decision is wrong. Users protect themselves against information risk by demanding a higher return, so a credible audit lowers the cost of capital. The third is the insurance view: auditors can be sued and carry professional liability insurance, so an audit also shifts some risk of loss from users to the auditor. Lesson 3 returns to that idea when it covers legal liability.

The information-risk argument can be made concrete. A lender that cannot rely on a borrower's statements will add a margin to the interest rate to cover the chance that the borrower is weaker than it looks. If an audit narrows that margin, the borrower may save more in interest than it pays in audit fees, before counting the benefit to shareholders, suppliers and anyone else who relies on the statements.

# Information risk: how an audit changes the interest rate a lender charges (illustrative)
loan = 46_000_000                 # Fairhaven's bank debt
spread_unaudited = 0.0325         # extra spread a lender might demand on unaudited statements
spread_audited = 0.0225           # spread on audited statements
audit_fee = 385_000               # proposed annual audit fee
saving = loan * (spread_unaudited - spread_audited)
print(f"Annual interest saved by audited statements: {saving:,.0f}")
print(f"Audit fee: {audit_fee:,.0f}")
print(f"Net benefit before other users are counted: {saving - audit_fee:,.0f}")

Annual interest saved by audited statements: 460,000
Audit fee: 385,000
Net benefit before other users are counted: 75,000

The numbers are illustrative, but the logic holds for real companies: the audit is valuable because other people can rely on it. That is why the auditor's duty runs to users of the statements as a group, not just to the management team that negotiates the fee.

The running example: Fairhaven

Throughout this course we audit one invented company. Fairhaven Outdoor Gear Ltd. designs and sells outdoor clothing, tents and camping equipment through its own stores, an online shop and wholesale accounts with sporting goods chains. It is headquartered in Kelowna, British Columbia and its shares trade on the Toronto Stock Exchange. Its year end is December 31, 2026, and the audit firm, Bramble Shaw LLP, is planning that audit in the autumn of 2026. All amounts are in thousands of dollars unless stated otherwise, and all of them are invented for teaching.

Even this short table raises questions an auditor would ask. Income before tax rose 37 per cent on a 9.5 per cent increase in revenue. Receivables grew more than three times as fast as revenue, and inventory more than twice as fast. These patterns may have perfectly good explanations, such as a large wholesale order shipped in December, but they are exactly the kind of signal that directs the auditor's attention. Lesson 4 turns them into a formal preliminary analysis.

Assurance and other engagements

An audit is one kind of assurance engagement. In an assurance engagement, a practitioner obtains evidence about a subject matter that is the responsibility of another party, and expresses a conclusion designed to increase the confidence of intended users. Every assurance engagement has three parties: the practitioner, the responsible party (usually management) and the intended users. It also needs suitable criteria, such as IFRS or US GAAP for financial statements, against which the subject matter is measured.

Assurance comes in degrees. An audit provides reasonable assurance, a high but not absolute level, and the auditor expresses a positive opinion: the statements present fairly, in all material respects. A review provides limited assurance through mainly inquiry and analytical procedures, and the practitioner expresses a negative conclusion: nothing has come to our attention that causes us to believe the statements are not presented fairly. A compilation provides no assurance at all; the accountant helps management prepare the statements and says so.

In Canada, reviews of private-company statements follow CSRE 2400 and compilations follow CSRS 4200, which replaced the old notice-to-reader compilation framework for periods ending on or after December 14, 2021. ACCT-431 covers both in depth.

Reasonable assurance and its limits

Reasonable assurance is a high level of assurance, but it is not a guarantee. Several inherent limitations mean an audit can never reduce the risk of a material misstatement to zero. Financial reporting involves estimates and judgment, such as the allowance for doubtful accounts or the write-down of slow-moving inventory, so even a perfect audit cannot make an estimate certain. The auditor tests samples rather than every transaction. Evidence is usually persuasive rather than conclusive. Management may collude with third parties to hide fraud, or override controls in ways that leave few traces. And the audit must be completed within a reasonable time and at a reasonable cost; users are not willing to pay for an audit that takes years.

The difference between what the public thinks an audit does and what auditing standards require is called the expectation gap. Many users believe an unmodified opinion means the company is financially healthy, that there is no fraud, or that every transaction was checked. None of these is true. The auditor's report itself, which lesson 12 examines line by line, tries to narrow the gap by describing the auditor's responsibilities in plain words, and both countries now require auditors of listed companies to describe the most significant matters in each audit.

Who sets the rules in Canada

In Canada, auditing standards are issued by the Auditing and Assurance Standards Board (AASB), an independent body overseen by the Auditing and Assurance Standards Oversight Council. The AASB adopts the International Standards on Auditing (ISAs) of the International Auditing and Assurance Standards Board (IAASB) as the Canadian Auditing Standards (CAS), with very few Canadian amendments. CAS 200, for example, corresponds to ISA 200. The standards are published in the CPA Canada Handbook – Assurance. Because Canada uses the international standards, a student who learns CAS has also learned the auditing framework used in more than 130 countries.

Licensing and oversight are separate from standard setting. Provincial CPA bodies license public accountants, set rules of professional conduct and run practice inspection programs for all firms. In addition, the Canadian Public Accountability Board (CPAB), created in 2003, regulates the firms that audit reporting issuers. National Instrument 52-108 Auditor Oversight requires a reporting issuer's auditor to be a participant in CPAB's oversight program and in good standing. CPAB inspects selected audit files each year, can impose requirements and restrictions on firms, and publishes its findings.

What the regulators find

Audit regulators publish the results of their inspections, and the numbers show both progress and persistent problems. A finding means the inspectors concluded that the firm had not obtained sufficient appropriate evidence for an important part of its opinion, not necessarily that the financial statements were wrong.

# Inspection results reported by the two regulators (share of inspected audits with significant findings or Part I.A deficiencies)
cpab = {2023: 34, 2024: 24, 2025: 23}          # CPAB, all inspected files, per cent
pcaob_all = {2023: 46, 2024: 39}               # PCAOB, all inspected firms, per cent
pcaob_big4 = {2023: 26, 2024: 20}              # PCAOB, Big Four firms, per cent
print(f"{'Year':<6}{'CPAB':>8}{'PCAOB all':>12}{'PCAOB Big Four':>17}")
for y in (2023, 2024, 2025):
    a = cpab.get(y); b = pcaob_all.get(y); c = pcaob_big4.get(y)
    show = lambda v: f"{v}%" if v is not None else "n/a"
    print(f"{y:<6}{show(a):>8}{show(b):>12}{show(c):>17}")
drop = (cpab[2023] - cpab[2025]) / cpab[2023]
print(f"CPAB rate fell by {drop:.0%} of its 2023 level over two years")

Year      CPAB   PCAOB all   PCAOB Big Four
2023       34%         46%              26%
2024       24%         39%              20%
2025       23%         n/a              n/a
CPAB rate fell by 32% of its 2023 level over two years

CPAB's 2025 annual report, published in March 2026, covered 120 inspected audit files: 23 per cent had significant findings, compared with 24 per cent in 2024 and 34 per cent in 2023. CPAB attributed the improvement partly to firms' new systems of quality management. From March 2026, CPAB also began publishing individual inspection reports for firms inspected after March 24, 2025, a significant step toward transparency (as of October 2026). Recurring themes include the audit of accounting estimates, revenue, and the work of component auditors on group audits.

Kinds of auditors

External auditors are independent public accountants engaged to report on financial statements; they are the focus of this course. Internal auditors are employees or contractors of the organization who evaluate risk management, control and governance for management and the audit committee. Their work follows the Institute of Internal Auditors' Global Internal Audit Standards, which took effect in January 2025. External auditors may use internal auditors' work in some circumstances, but they cannot hand over responsibility for the opinion. Government auditors examine public-sector organizations and programs, including value-for-money or performance audits that go well beyond financial statements.

At the federal level in Canada, the Office of the Auditor General of Canada audits the Government of Canada's financial statements and reports to Parliament on the performance of federal programs; each province has its own auditor general.

The audit process at a glance

Every audit, whatever its size, follows the same broad sequence. The auditor first decides whether to accept or continue with the client and agrees the terms of the engagement (lesson 4). Next comes planning and risk assessment: understanding the entity and its environment, setting materiality and identifying the risks of material misstatement (lessons 4 to 6). The auditor then designs and performs further audit procedures that respond to those risks: tests of controls and substantive procedures (lessons 6 to 10). Finally, the auditor completes the audit, evaluates the misstatements found and the overall presentation, and issues the report (lessons 11 and 12). Throughout, the auditor applies professional scepticism, documents the work and complies with ethical requirements (lesson 2).