Assurance cases II: procedures, controls and reporting

Once risks are assessed, a case usually asks what the auditor should do about them, what the client should do about weaknesses in its controls, or what the report should say. These are the parts of assurance analysis where candidates most often lose marks for being generic. A list of procedures copied from memory, 'vouch, confirm, recalculate', earns little; a procedure designed for the specific risk and the specific facts earns a lot. This lesson shows how to write procedures, how to analyse internal control weaknesses and how to reach reporting conclusions, continuing with Tamarack Foods Group and its auditor Hollis Ward LLP, and drawing on ACCT-331 and ACCT-431.

Writing procedures that earn marks

A well-written procedure has four parts: what the auditor will do, to what population or source, for which assertion, and why it addresses the risk. 'Obtain the distributor's confirmation of the December shipments, including any side agreements on returns, to test the occurrence and cut-off of revenue, because the volume spike and the sales bonuses create a risk of overstatement' contains all four. Compare it with 'confirm receivables'. The difference is not length but specificity: the first procedure could only have been written for this case.

Choose procedures by the assertion and the evidence they produce. External confirmations provide strong evidence of existence and rights. Inspecting documents provides evidence of occurrence and, for documents created outside the entity, of accuracy. Observation, such as attending an inventory count, provides evidence of existence at a point in time. Recalculation and reperformance test accuracy. Analytical procedures can be substantive if the expectation is precise enough, but in a case they work best as a supporting procedure unless you can build a precise expectation from the data. Inquiry alone is never sufficient. For estimates, CAS 540 asks the auditor to test how management made the estimate, test subsequent events, or develop an independent point estimate or range; say which approach you would use and why.

Sampling in a case

Cases occasionally ask how many items to test or how to evaluate the results of a test. You will not be expected to use statistical tables from memory, but you should know how sample size responds to the inputs: higher confidence, lower tolerable deviation and more expected deviations all increase sample size. The program below calculates attribute sample sizes for a test of a control at 95 per cent confidence with a tolerable deviation rate of 5 per cent, and evaluates the upper deviation limit for different numbers of deviations found.

# Attribute sampling for a test of controls, and evaluating the result.
import math
def sample_size(tolerable, expected_errors=0, confidence=0.95):
    # smallest n such that P(at most e deviations | rate = tolerable) <= 1 - confidence
    n = 1
    while True:
        p = sum(math.comb(n, k) * tolerable**k * (1 - tolerable)**(n - k) for k in range(expected_errors + 1))
        if p <= 1 - confidence: return n
        n += 1
def upper_limit(n, found, confidence=0.95):
    lo, hi = 0.0, 1.0
    for _ in range(60):
        mid = (lo + hi) / 2
        p = sum(math.comb(n, k) * mid**k * (1 - mid)**(n - k) for k in range(found + 1))
        lo, hi = (mid, hi) if p > 1 - confidence else (lo, mid)
    return hi
for e in (0, 1, 2):
    print(f"Tolerable 5%, expecting {e} deviations: n = {sample_size(0.05, e)}")
n = sample_size(0.05, 1)
for found in (0, 1, 2):
    ul = upper_limit(n, found)
    print(f"n={n}, found {found}: upper deviation limit {ul:.1%} -> {'rely' if ul <= 0.05 else 'do not rely'}")

Tolerable 5%, expecting 0 deviations: n = 59
Tolerable 5%, expecting 1 deviations: n = 93
Tolerable 5%, expecting 2 deviations: n = 124
n=93, found 0: upper deviation limit 3.2% -> rely
n=93, found 1: upper deviation limit 5.0% -> rely
n=93, found 2: upper deviation limit 6.6% -> do not rely

Expecting no deviations requires 59 items; expecting one requires 93; expecting two, 124. With a sample of 93, finding no deviations gives an upper limit of 3.2 per cent and finding one gives exactly the tolerable 5.0 per cent, so the auditor can just rely on the control; finding two pushes the upper limit to 6.6 per cent, above tolerable, and the auditor cannot rely on it as planned. In a case response the useful point is the consequence: if the control cannot be relied on, the auditor must increase substantive testing of the related balances and should communicate the deficiency to management.

Internal control weaknesses

Many cases include a description of a process, such as purchasing, payroll or revenue, with weaknesses planted in it. A strong response presents each weakness in a structured way: the weakness, its implication, and a recommendation. The implication should say what could go wrong and why it matters: 'Because the same clerk sets up new suppliers and approves payments, a fictitious supplier could be created and paid without detection, which is a risk of fraud and misstatement of expenses.' The recommendation should be practical for the client's size: in a small company that cannot separate duties, a monthly review of new suppliers and payments by the owner may be the best compensating control.

Ranking matters here too. A case may describe eight weaknesses; the marker expects you to identify the most important ones, usually those that could lead to material misstatement or fraud, and to address them well. Weaknesses that are inefficient but low-risk, such as a manual process that takes too long, deserve a brief mention unless the client asked about efficiency. If the client is a reporting issuer, remember that management must certify the design and operating effectiveness of disclosure controls and internal control over financial reporting under NI 52-109, and that a material weakness must be disclosed in MD&A, so control findings have reporting implications too.

Reaching reporting conclusions

Reporting questions ask what kind of report the auditor should issue. Start with the evaluation of misstatements: compare uncorrected misstatements, individually and in total, with materiality, and consider qualitative factors. If management refuses to correct a material misstatement, the opinion is qualified if the effect is material but not pervasive, and adverse if it is material and pervasive. If the auditor cannot obtain sufficient appropriate evidence, the opinion is qualified or, if the possible effects are pervasive, a disclaimer of opinion. If there is a material uncertainty related to going concern that is adequately disclosed, the report includes a separate section on it under CAS 570; if the disclosure is inadequate, the opinion is modified. For listed entities, key audit matters are communicated under CAS 701.

In a case, show the reasoning: the misstatement, its size relative to materiality, whether it is pervasive, management's response and the resulting report. 'The inventory provision is understated by an estimated 492 thousand to 1,516 thousand. The lower end is below overall materiality of 1,400 thousand, but the upper end exceeds it. If management does not adjust toward our point estimate and the misstatement is material, a qualified opinion would be required, because the effect is confined to inventory and cost of sales.' This kind of paragraph shows the marker that you understand both the standards and their application.

Reviews and compilations in a case

When the engagement is a review, the procedures are mainly inquiry and analytical procedures, and the practitioner must design them to address areas where material misstatements are likely. If the practitioner becomes aware of a matter suggesting a material misstatement, additional procedures are required. A review report expresses a conclusion that nothing has come to the practitioner's attention that causes them to believe the statements are not prepared, in all material respects, in accordance with the framework. A compilation under CSRS 4200 provides no assurance; the practitioner must still not be associated with information they know is false or misleading. In a case, the most common error is recommending audit procedures, such as confirmations, for a review engagement. They are not required, and recommending them suggests the candidate does not understand the engagement.

Integrating assurance with the rest of the case

Procedures and reporting conclusions should flow from the earlier analysis. If your reporting section concluded that revenue should be deferred, your assurance section should include procedures to test the deferral and should evaluate the misstatement if management disagrees. If the finance section shows that a covenant is breached after adjustments, the assurance section should address going concern. If the tax section identifies an uncertain position, the assurance section should consider the related provision. Tie these together with a sentence or two, and the marker will see an integrated response rather than separate essays.