Assurance cases I: engagement acceptance, planning and risk

Assurance appears in almost every Canadian case, and candidates who want a public accounting licence must show depth in the Assurance role. Assurance issues in cases range from whether a firm should accept a new client, through which kind of engagement a user needs, to planning, risk assessment, procedures, internal control and reporting. This lesson covers the first half: acceptance, the choice of engagement, materiality and risk assessment. Lesson 6 covers procedures, controls and reporting. The technical material was taught in ACCT-331 and ACCT-431; here the question is how to apply it to the facts of a case, using Tamarack Foods Group, the invented food company from ACCT-431, and its auditor Hollis Ward LLP.

Which engagement does the user need?

Many cases begin with a user who needs some kind of assurance and does not know which kind. A bank lending to a small private company may accept a review engagement under CSRE 2400, which provides limited assurance through inquiry and analytical procedures. A larger loan, a buyer, or a regulator may require an audit under the Canadian Auditing Standards, which provides reasonable assurance. A compilation under CSRS 4200 provides no assurance and is suitable when the user only wants financial information prepared by an accountant. Specific elements, such as a sales figure used in a rent calculation, may be audited under CAS 805, and compliance with a contract, such as a covenant, may be reported on under CSAE 3001 or with an agreed-upon procedures engagement under CSRS 4400. Sustainability information may be assured under the new Canadian standard based on ISSA 5000, adopted in 2026.

In a case, identify the user, what the user will do with the report and the level of confidence the user needs, then recommend the engagement and explain the trade-offs: cost, time, the level of assurance and what the report will say. If the client wants an audit but cannot afford one, or wants a review when the bank needs an audit, say so and recommend a path, such as asking the bank whether a review with specified procedures would be acceptable. Markers reward a clear recommendation tied to the user's needs.

Acceptance and independence

Before planning, a firm must decide whether to accept or continue an engagement. Under CSQM 1 the firm must have policies on client acceptance and continuance that consider the integrity of the client's management, whether the firm has the competence and resources, and whether it can comply with ethical requirements including independence. Cases plant acceptance issues: a prospective client whose previous auditor resigned after a disagreement, a partner who owns shares in the client, a fee that would make up a large share of the firm's revenue, a request to prepare the statements and also audit them for a listed entity. A competent response identifies the threat (self-interest, self-review, advocacy, familiarity or intimidation), evaluates its significance and recommends safeguards or declining the engagement.

Independence is assessed in the Assurance role but also matters in other roles. A candidate in the Finance role who is asked to value a company that the firm audits must notice the self-review threat. Write the principle, the threat and the response in a few sentences: 'Because Hollis Ward audits Tamarack, preparing the valuation that Tamarack will use in its financial statements would create a self-review threat; for a listed entity, this service is generally prohibited, so the firm should decline or refer it to another firm.'

Materiality in a case

Planning a case audit requires a materiality figure, and markers expect you to calculate one and justify it. Choose a benchmark that reflects what users focus on: profit before tax for a stable profitable company, revenue or total assets for a company near break-even or a not-for-profit, equity for some investment entities. Apply a percentage within the usual ranges, explain any adjustments for unusual items, and then set performance materiality, typically 50 to 75 per cent of overall materiality depending on the risk of misstatement and the history of errors, and a clearly trivial threshold, often about 5 per cent of overall materiality. The program below shows the Tamarack figures used in ACCT-431 and ranks the significant areas.

# Assurance planning for Tamarack Foods Group (from ACCT-431), in thousands.
benchmarks = {"pre-tax income x 5%": 28000 * 0.05, "revenue x 0.5%": 412000 * 0.005}
overall = 1400                       # chosen: pre-tax income basis, rounded
performance = round(overall * 0.75)  # 75% for a recurring audit with few past errors
trivial = round(overall * 0.05)
for k, v in benchmarks.items(): print(f"{k:22}{v:>10,.0f}")
print(f"Overall {overall:,}, performance {performance:,}, clearly trivial {trivial:,}")
# Rank account-level risks: inherent risk x control risk on a 1-3 scale
areas = {"Revenue cut-off": (3, 2), "Inventory provision": (3, 3), "Goodwill": (2, 2),
         "Payroll": (1, 1), "Mexico component": (3, 2), "Cash": (1, 1)}
print()
for a, (ir, cr) in sorted(areas.items(), key=lambda kv: -kv[1][0] * kv[1][1]):
    level = ir * cr
    resp = "significant risk: tailored substantive work" if level >= 6 else "standard procedures" if level >= 3 else "minimal"
    print(f"{a:20}{level:>3}  {resp}")

pre-tax income x 5%        1,400
revenue x 0.5%             2,060
Overall 1,400, performance 1,050, clearly trivial 70

Inventory provision   9  significant risk: tailored substantive work
Revenue cut-off       6  significant risk: tailored substantive work
Mexico component      6  significant risk: tailored substantive work
Goodwill              4  standard procedures
Payroll               1  minimal
Cash                  1  minimal

Tamarack's pre-tax income of 28 million gives 1,400 thousand at 5 per cent, which Hollis Ward chose over the revenue benchmark because Tamarack is a stable, profitable listed company and investors focus on earnings. Performance materiality of 1,050 thousand, 75 per cent of overall materiality, is appropriate for a recurring audit with few past misstatements; a first-year audit or one with known control weaknesses would use a lower percentage. Clearly trivial is 70 thousand. In a case, also mention when a lower materiality applies to particular items, such as related-party transactions or executive pay.

Assessing the risks of material misstatement

Risk assessment is where cases test judgment most directly. CAS 315 (Revised) requires the auditor to understand the entity, its environment, the applicable financial reporting framework and its system of internal control, and to identify and assess risks of material misstatement at the financial statement and assertion levels, considering inherent risk factors such as complexity, subjectivity, change, uncertainty and susceptibility to misstatement due to management bias or fraud. Risks at the high end of the spectrum are significant risks that require a specific response. Revenue recognition is presumed to be a fraud risk unless rebutted, and management override of controls is always a significant risk.

In a case, link each risk to the facts and to an assertion. 'There is a risk that revenue is overstated (occurrence and cut-off) because the sales team's bonuses depend on December shipments and shipments to one distributor doubled in the last week of the year' is a competent risk statement. 'Revenue is risky' is not. Then explain the response: what kind of procedures, at what timing and extent, focused on which assertion. The ranking in the program is a simplification of that process. It scores inherent and control risk and labels the high scores as significant; in practice the assessment is a judgment informed by such scores, not the product of them.

Group and component considerations

Group audits appear in cases with subsidiaries, especially foreign ones. Under CAS 600 (Revised), effective for periods beginning on or after December 15, 2023, the group engagement team determines which components need work, the nature and extent of that work, and how to direct and review the work of component auditors. Tamarack's Mexican subsidiary is audited by another firm, so Hollis Ward must evaluate that firm's competence and independence, communicate its requirements and component performance materiality, and review the work. In a case, note that the group engagement partner remains responsible for the group opinion; in Canada the report does not divide responsibility with the component auditor.

Professional scepticism in the response

Markers look for evidence that you approached management's explanations with a questioning mind. When a case gives management's reason for an unusual result, such as 'the provision fell because we cleared old stock', a sceptical response asks what evidence would confirm it: sales records for the cleared stock, the prices obtained, whether the stock was sold to a related party. Scepticism does not mean assuming dishonesty; it means not accepting a convenient explanation without corroboration, especially when it supports a result management wants. Write it into the response explicitly: 'Management attributes the decrease to clearance sales; we should obtain the sales records and confirm that the items were sold at or above their carrying amount before accepting the lower provision.' One such sentence per significant risk shows the marker that you are thinking as an auditor, not repeating the client's view.

Integrating assurance with other areas

Assurance analysis builds on the financial reporting analysis. If you have concluded in the reporting section that revenue on bundled contracts is recognized too early, that conclusion becomes an assurance risk and probably a proposed adjustment. If a covenant is close to its limit, management has an incentive to bias estimates, which raises fraud risk. If a tax planning scheme is aggressive, the tax provision becomes a significant estimate. The best responses make these links and avoid analysing assurance in isolation. They also stay in role: as auditor you recommend procedures and evaluate management's accounting; you do not make management's decisions.