Characteristics that make audit evidence persuasive

Audit evidence is persuasive when it is both sufficient and appropriate:

Persuasive means convincing enough to support a conclusion, even though it does not prove something with absolute certainty. In auditing, persuasive evidence gives the auditor a reasonable basis for their opinion.

• Sufficient: There is enough evidence. Higher assessed risk usually calls for more evidence.
• Relevant: The evidence directly supports the assertion being tested.
• Reliable: Evidence is generally stronger when it comes from an independent external source, is obtained directly by the auditor, or is supported by effective controls over its preparation.
• Consistent and corroborated: Evidence that agrees with other information from different sources strengthens the auditor’s conclusion. Conflicting evidence needs investigation.

No single characteristic guarantees that evidence is persuasive; the auditor considers the evidence as a whole. Audit evidence supports the auditor’s opinion but is usually persuasive rather than conclusive.

Physical examination and external confirmations

Physical examination and external confirmations can be expensive because they often require direct work beyond reviewing the client’s records.

• Physical examination: Auditors may need to travel to warehouses or other locations, attend an inventory count, inspect many items, and spend significant staff time. Specialist help or coordination across several sites may add cost.
• Confirmations: Auditors must prepare and send requests to banks, customers or suppliers, track replies, follow up on non-responses, and investigate differences. This can take time and may involve postage or secure confirmation platforms.

The actual cost depends on the audit. For example, examining one nearby asset may be inexpensive, while confirming many balances with overseas customers may be costly.

Persuasive rather than conclusive

Audit evidence is persuasive rather than conclusive because an audit provides reasonable assurance, not absolute certainty. This is due to:

• Sampling: Auditors usually test selected items rather than every transaction.
• Use of judgement: Auditors must judge which procedures to perform and how to interpret the results.
• Estimates and uncertainty: Some figures, such as impairment or provisions, depend on assumptions about uncertain future events.
• Limits of internal controls: Controls may be overridden or bypassed through collusion.
• Possibility of concealed fraud: Fraud may involve falsified documents or carefully organised schemes that are difficult to detect.
• Limits on available information: Management or others may unintentionally or intentionally fail to provide complete information.

Therefore, auditors gather sufficient, appropriate evidence from different sources to support their opinion, but that evidence cannot prove every matter with absolute certainty.

Complex transactions and estimated balances can increase inherent risk

Complex transactions and estimated balances can increase inherent risk because they are more susceptible to material misstatement before considering the client’s internal controls.

• Complex transactions may involve complicated contract terms, several parties, multiple accounting rules or unusual timing. This makes errors in recognition, measurement, classification or disclosure more likely. For example, revenue from a long-term construction contract may depend on estimates of costs and progress.
• Estimated balances cannot always be measured directly and rely on data, models, assumptions and management judgement about uncertain future events. This creates estimation uncertainty and subjectivity, as well as opportunities for unintentional or intentional management bias. Examples include expected credit losses, impairment and provisions for litigation.

The more complex or uncertain the transaction or estimate, the greater the likelihood or possible size of a misstatement and therefore the higher the auditor may assess inherent risk. The auditor may respond with more focused procedures, such as testing assumptions and data or involving an expert. 

Differences between audit risk and auditor’s business risk

Audit risk	Auditor’s business risk
The risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated.	The risk of loss or harm to the auditor or audit firm arising from the engagement, such as litigation, reputational damage or loss of fees.
Relates to the accuracy of the audit opinion.	Relates to the auditor’s practice and business interests.
Managed by assessing misstatement risks and designing audit procedures to reduce audit risk to an acceptably low level.	Managed through client acceptance decisions, engagement quality management, adequate documentation and professional risk management.

Example: If an auditor fails to detect a material misstatement and issues an inappropriate opinion, that is audit risk. If the client later sues the audit firm or the firm suffers reputational damage, that is auditor’s business risk.

The two may be connected, but they are not the same. ISA 200 specifically distinguishes audit risk from business risks such as litigation and adverse publicity.

Factors to consider when assessing materiality

Auditors use professional judgement and consider both quantitative and qualitative factors:

• Size of the misstatement: Its amount, relative to the financial statements, and whether it combines with other errors.
• Suitable benchmark: Such as profit before tax, revenue, total assets or equity. The benchmark depends on what users are likely to focus on and how stable the figure is.
• Nature of the item or error: A smaller amount may still be material if it involves fraud, a related party, legal or regulatory non-compliance, or affects a key disclosure.
• Effect on users’ decisions: For example, whether correcting an error changes a reported profit into a loss or causes a loan covenant to be breached.
• Entity circumstances: Its industry, size, stage of development, ownership structure, financing and current economic conditions.
• Importance of disclosures: Some information may matter to users because of its nature, even if it has no large monetary amount.

There is no single percentage that determines materiality in every audit; the auditor selects an appropriate benchmark and level based on the circumstances.

Why an engagement letter is important to the auditor

An engagement letter:

• Confirms the auditor’s appointment and records the agreed terms of the audit.
• Clarifies the audit’s objective and scope, helping prevent misunderstandings about what the auditor will do.
• Sets out each party’s responsibilities—the auditor’s and management’s.
• Identifies the financial reporting framework used to prepare the statements.
• Explains the expected auditor’s report and notes that its form may change depending on the audit findings.
• Confirms management’s duty to provide access to records, information and relevant staff.
• Provides a written reference if disagreements arise about the scope or conduct of the audit.

ISA 210 requires the agreed audit terms to be recorded in an engagement letter or another suitable written agreement.

Risks if preliminary procedures are inadequate

If auditors do not perform proper acceptance procedures, they may:

• Accept a client with poor integrity, increasing the risk of fraud, misleading information or management interference.
• Breach independence or ethical requirements because conflicts of interest or other threats were not identified and addressed.
• Accept work they cannot perform properly, due to insufficient expertise, staff, time or other resources.
• Begin the audit without agreed terms or preconditions, leading to disputes about management’s responsibilities, access to records or the scope of the audit.
• Overlook issues raised by the previous auditor or fail to consider why the client changed auditors.
• Misunderstand the applicable reporting framework or the client’s reporting responsibilities.
• Face financial, legal and reputational consequences if the audit is poorly performed or the auditor becomes associated with an unreliable client.

These failures may also lead to an inappropriate audit opinion. ISA 220 requires appropriate acceptance procedures; ISA 210 requires agreement on the audit preconditions and terms.

Key preliminary procedures before accepting an audit engagement

1. Assess the client’s integrity — consider the reputation of management, owners and those charged with governance, and why the client is changing auditors.
2. Check independence and ethical requirements — identify conflicts of interest or other threats and determine whether they can be resolved appropriately.
3. Assess the firm’s capability and resources — confirm the team has the necessary expertise, time and resources, including access to specialists if needed.
4. Consider relevant background information — review available information about the client, the nature of the engagement and any significant issues from a previous audit.
5. Communicate with the predecessor auditor, where applicable, subject to relevant ethical requirements and the client’s permission.
6. Confirm the audit preconditions — ensure the financial reporting framework is acceptable and management acknowledges its responsibilities for preparing the financial statements, internal control and providing access to information and staff.
7. Agree and document the engagement terms — set out the scope, responsibilities, reporting framework and expected form of the auditor’s report, usually in an engagement letter.

If the auditor cannot meet ethical requirements, lacks appropriate resources, or the audit preconditions are absent, the firm should not accept the engagement. ISA 220 covers acceptance and resources; ISA 210 covers preconditions and terms; ISA 300 addresses predecessor communication for an initial audit.

International Standards on Auditing (ISA) for preliminary audit procedures

Relevant ISAs for preliminary audit procedures

• ISA 220 (Revised) — Quality Management for an Audit of Financial Statements: covers acceptance and continuance of client relationships and audit engagements, including whether the firm can meet ethical requirements and has appropriate resources. mia.org.my
• ISA 210 — Agreeing the Terms of Audit Engagements: requires the auditor to establish that the audit preconditions are present and agree the engagement terms with management. mia.org.my
• ISA 300 — Planning an Audit of Financial Statements: for an initial audit, requires the auditor to complete acceptance procedures under ISA 220 and communicate with the predecessor auditor, where applicable. mia.org.my
• ISA 315 (Revised 2019) — Identifying and Assessing the Risks of Material Misstatement: guides the auditor in understanding the client, its industry and internal controls, then identifying and assessing risks. It informs audit planning, but is not specifically an engagement-acceptance standard. mia.org.my

In summary: ISA 220 and ISA 210 are central to acceptance and agreeing terms; ISA 300 addresses initial audit procedures; ISA 315 guides the related understanding and risk assessment.

Sources of information available

Auditors obtain an understanding of the client’s business from internal and external sources, using more than one source to check that the information is consistent. ISA 315 requires auditors to understand the entity, its industry, regulatory environment, business model and financial performance. mia.org.my

Source	Examples of information
Management and employees	Discussions with directors, finance staff, sales staff, internal auditors and those responsible for governance.
Internal documents and records	Business plans, budgets, management accounts, financial statements, minutes of meetings, organisation charts, policies, procedures and internal control documents.
Contracts and legal documents	Major customer and supplier contracts, loan agreements, leases, licences and legal correspondence.
Previous audit information	Prior-year financial statements, audit reports, working papers and previously identified control weaknesses, where relevant and available.
External sources	Industry publications, regulator and government information, economic data, trade journals, competitor information and relevant legal or tax guidance.
Direct observation and inspection	Visits to offices, factories, warehouses or retail locations; observing operations and inspecting assets or records.
Other professionals and business contacts	Information from lawyers, valuers, bankers or other experts, and—where appropriate—from customers or suppliers.

The auditor evaluates whether each source is relevant and reliable; information from one source may need to be corroborated with another.

Key elements of a letter of weakness

A letter of weakness, often called a management letter, communicates internal control deficiencies identified during the audit and suggests ways to address them.

1. Heading and recipient — date, client name, reporting period and the appropriate management or governance recipients.
2. Purpose and scope — explain that the audit aimed to form an opinion on the financial statements, and was not designed to express an opinion on the effectiveness of internal control.
3. Summary of findings — briefly identify the main weaknesses and their significance.
4. Details of each weakness, including:
   • Condition: what the auditor found.
   • Criteria: what should have happened or what control should exist.
   • Cause: why the weakness may have occurred, if known.
   • Potential effect or risk: how it could affect operations or the financial statements.
   • Recommendation: practical action to address the weakness.
5. Management’s response and action plan — proposed corrective action, responsible person and target date.
6. Limitations and conclusion — clarify that the matters reported are those identified during the audit and considered important; further weaknesses may exist.

ISA 265 requires written communication of significant deficiencies to those charged with governance, including a description of the deficiencies, their potential effects and enough context to understand the communication. Recommendations and management’s responses may also be included.

Factors affecting the auditor’s judgement on the sufficiency of audit evidence

Sufficiency means the quantity of evidence obtained. The auditor considers:

• Risk of material misstatement: Higher risk generally requires more evidence.
• Materiality: A lower materiality level may require more testing to detect smaller errors.
• Reliability and relevance of evidence: Strong, relevant evidence may reduce how much additional evidence is needed.
• Results of testing: Errors, exceptions or conflicting evidence may require further procedures.
• Size and characteristics of the population: A larger or more varied population may require a larger sample.
• Evidence from other sources: Consistent, independent evidence can strengthen the overall conclusion.

More evidence cannot make up for evidence that is unreliable or irrelevant.

How analytical procedures help auditors set materiality and plan substantive procedures

Analytical procedures compare financial information with prior periods, budgets, expectations or industry data, and examine relationships between financial and non-financial information. They help the auditor understand the business and identify unusual trends or relationships that may indicate a risk of misstatement. mia.org.my

1. Helping assess materiality

Analytical procedures help the auditor understand which financial measures are most relevant to users and how stable they are. For example, comparisons of profit, revenue and total assets over several years may show that profit is unusually volatile. The auditor may then judge that profit is not a suitable benchmark for setting overall materiality and consider another benchmark, such as revenue or assets.

Analytical results inform the auditor’s professional judgement; they do not calculate materiality on their own.

2. Helping plan substantive procedures

Analytical procedures can highlight unexpected changes or relationships and help the auditor decide:

• Which accounts or assertions need more testing.
• What type of substantive procedures to use, such as analytical procedures or tests of details.
• How extensive the testing should be, based on the assessed risk.

Example: If the gross profit margin falls sharply, the auditor may investigate whether revenue is incomplete, expenses are overstated, or inventory is incorrectly valued. The auditor could test sales and purchase records, check year-end cut-off, and examine inventory valuation.

At the planning stage, analytical procedures help assess risk. Later, substantive analytical procedures may also be used to obtain audit evidence, provided the auditor can form a sufficiently precise expectation and investigate significant differences.

Relationship between detection risk and materiality

Detection risk and materiality generally have an inverse relationship in audit planning:

• Lower materiality level: Smaller errors may affect users’ decisions. The auditor should aim for lower detection risk by performing more extensive or persuasive procedures, such as increasing sample sizes or obtaining stronger evidence.
• Higher materiality level: Smaller errors are less likely to be considered material. The auditor may be able to accept higher detection risk and perform less extensive testing, provided the assessed risks and other audit requirements allow it.

Example: If the auditor sets a lower materiality level for an account, they need to test more items or obtain stronger evidence to reduce the chance of missing an error that could now be material.

The relationship is not automatic: the auditor also considers the risk of material misstatement. Overall, audit procedures must reduce audit risk to an acceptably low level. 

Importance of developing an overall audit strategy

An overall audit strategy sets the audit’s broad direction. It helps the auditor:

• Define the audit’s scope—which entities, locations, reporting areas and requirements are covered.
• Set the timing of key work, such as interim testing and year-end procedures.
• Focus the team on significant areas and assessed risks, so audit effort is directed where material misstatements are more likely.
• Determine the resources needed, including staff with suitable skills and any experts.
• Plan direction, supervision and review of the engagement team’s work.
• Coordinate the audit, including communications with management and those charged with governance.

The strategy provides the framework for the detailed audit plan, which specifies the nature, timing and extent of audit procedures. It should be updated if circumstances or audit evidence change.

Audit tests performed by the auditor to examine the true and fair view of financial statement prepared by the company.

Auditors perform audit tests to obtain sufficient appropriate evidence about whether the financial statements are fairly presented. These tests are commonly grouped into four categories:

Category	Purpose	Example
1. Tests of controls	Check whether the company’s controls operate effectively to prevent or detect and correct misstatements.	Check whether sales transactions were properly approved.
2. Substantive tests of transactions	Check whether individual transactions are recorded accurately and in the correct period and accounts.	Trace recorded sales to customer orders and delivery notes.
3. Analytical procedures	Assess whether financial information is reasonable by examining relationships, trends or ratios.	Compare gross profit margins across periods and investigate unusual changes.
4. Tests of details of balances	Verify the amounts and disclosures in year-end account balances.	Confirm accounts receivable with customers or inspect inventory.

Tests of transactions, analytical procedures and tests of balance details are substantive procedures. In some audit standards, the last three are grouped under substantive procedures, which comprise tests of details and substantive analytical procedures.

Sufficiency of audit evidence

Sufficiency of audit evidence refers to the quantity of audit evidence obtained. The auditor determines whether enough evidence has been gathered to support the audit opinion. The amount needed depends partly on the assessed risk: higher risk generally requires more evidence. However, a large quantity of unreliable evidence cannot make up for poor-quality evidence.

Sufficiency refers to the quantity of audit evidence the auditor obtains. The auditor gathers enough relevant evidence to support conclusions about the financial statements and form an audit opinion with reasonable assurance.

The amount of evidence required depends on several factors:

• Assessed risk: Higher risk of material misstatement generally means the auditor needs more evidence or more extensive testing.
• Reliability of the evidence: Strong, reliable evidence may allow the auditor to obtain a conclusion from a smaller quantity of evidence. Less reliable evidence may require additional corroboration.
• Results of testing: If a sample reveals errors or exceptions, the auditor may need to increase the sample, perform further procedures or reassess the risk.
• Importance of the account or assertion: Significant or sensitive areas may require more audit work.

For example, if the auditor assesses a high risk that accounts receivable is overstated, they may confirm more customer balances and investigate exceptions.

Remember: Sufficiency is about how much evidence; appropriateness is about its quality - including relevance and reliability. More evidence is not automatically better if it is unreliable. 

Factors affect the auditor’s assessment of risk of material misstatement

Audit risk is affected by the likelihood that the financial statements contain a material misstatement and the chance that the auditor’s procedures will not detect it. The factors below mainly affect the auditor’s assessment of risk of material misstatement.

i. Integrity of management

• High integrity: Management demonstrates honesty, ethical behaviour and a willingness to provide complete information. This may indicate a stronger control environment and a lower assessed risk of fraud or management bias.
• Low integrity: Dishonesty, misleading explanations, prior fraud or reluctance to provide information raises the risk of fraudulent reporting, management bias and override of controls. The auditor should assess risk as higher, maintain professional scepticism and obtain stronger evidence.

Management’s apparent integrity does not remove the need for audit procedures; auditors should not rely on trust alone. mia.org.my

ii. Approval and authorisation of transactions

• Effective approvals: Clear authority limits, independent approval and evidence of review can prevent or detect unauthorised transactions. If the controls are properly designed and operating effectively, the auditor may assess control risk as lower.
• Weak or missing approvals: Transactions may be unauthorised, fraudulent or incorrectly recorded. The auditor should assess control risk as higher and consider increasing substantive testing.

The auditor should test relevant approval controls before relying on them. If the controls fail, the auditor needs to revise the risk assessment and audit procedures. ISA 315 requires evaluation of the control environment, including management’s commitment to integrity and ethical values.

In addition to management integrity and approval and authorisation of transactions, auditors may consider these factors when assessing audit risk:

Factor	May indicate higher risk	May indicate lower risk
iii. Segregation of duties	One person controls several stages of a transaction, increasing the opportunity for error or fraud.	Duties are divided so that one person’s work is checked by another.
iv. Competence of accounting staff	Staff lack experience or training, increasing the chance of accounting errors.	Staff are qualified, experienced and receive appropriate supervision.
v. Effectiveness of internal controls	Controls are missing, poorly designed or not consistently followed.	Controls are suitably designed and operate effectively.
vi. Complexity of transactions and estimates	Complex transactions or estimates require significant judgement, creating greater scope for error or management bias.	Transactions and estimates are straightforward and supported by reliable information.
vii. Financial pressure on the entity	Financial distress, pressure to meet targets or loan covenant requirements may increase incentives to manipulate results.	The entity is financially stable and faces less pressure to misstate results.
viii. Previous audit findings	Prior-period errors, control deficiencies or frequent adjustments suggest problems may continue.	Few recurring errors and timely correction of past audit findings may indicate lower risk.
ix. Accounting and IT systems	Recent system changes, weak access controls or unreliable data increase the risk of errors or unauthorised changes.	Systems are stable, access is restricted and data is properly checked.
x. Unusual or related-party transactions	Unusual, non-routine or related-party transactions may be complex, improperly recorded or insufficiently disclosed.	Transactions are routine, well documented and properly reviewed.
xi. Industry and regulatory environment	Rapid changes, strict regulation or volatile industry conditions can increase reporting uncertainty and compliance risk.	A stable environment with clear requirements may reduce some risks.

These factors help assess the risk of material misstatement and determine the nature, timing and extent of audit procedures. They are considered together; one favourable factor does not by itself establish that audit risk is low.

Ways to reduce detection risk

Detection risk is the risk that the auditor’s procedures fail to detect a material misstatement. The auditor can reduce it by:

• Designing procedures to address the assessed risks and relevant financial statement assertions.
• Increasing the extent of testing, such as testing a larger sample or examining more transactions.
• Obtaining more reliable evidence, such as direct confirmations from banks or customers.
• Performing procedures closer to year-end when balances or transactions may change significantly.
• Using a mix of audit procedures, such as inspection, confirmation, recalculation and analytical procedures.
• Assigning experienced staff to complex or high-risk areas, with proper supervision and review.
• Using unpredictable procedures where fraud risk is a concern, such as selecting unexpected items for testing.

The higher the assessed risk of material misstatement, the more persuasive the evidence the auditor should obtain. These actions reduce detection risk, but cannot eliminate it completely.

Distinguish between control risk and detection risk

Control risk	Detection risk
The risk that the client’s internal controls fail to prevent, detect or correct a material misstatement on time.	The risk that the auditor’s procedures fail to detect a material misstatement that exists.
Relates to the client’s internal control system.	Relates to the auditor’s audit procedures.
The auditor assesses it by understanding and, where relevant, testing the client’s controls.	The auditor manages it by designing appropriate procedures and gathering sufficient evidence.

Example: If purchase approvals are weak, an unauthorised payment may not be stopped—this is control risk. If the auditor’s testing then fails to find that payment, this is detection risk.

Both contribute to audit risk: audit risk = risk of material misstatement × detection risk.

Assertion tested by an audit procedure

To identify the assertion tested by an audit procedure, focus on what the procedure is trying to prove. The same procedure can support different assertions depending on its purpose.

If the procedure checks whether…	Assertion	Example
Recorded items actually exist	Existence	Attend the inventory count and inspect selected items on the inventory listing.
The entity owns or is responsible for the item	Rights and obligations	Inspect title documents for property recorded as an asset.
All items that should be recorded are included	Completeness	Select items from the warehouse floor and trace them to the inventory listing.
The amount is correct and properly valued	Accuracy, valuation and allocation	Check inventory cost calculations and whether obsolete items are written down.
The balance is recorded in the correct category	Classification	Check that short-term borrowings are not recorded as long-term liabilities.
The balance is properly grouped and disclosed	Presentation	Check that inventory is clearly presented and required disclosures are included.

Useful direction rule: Checking from the accounting records to supporting evidence often tests existence. Checking from source evidence to the accounting records often tests completeness. The assertion ultimately depends on the objective of the procedure.

Assertions about account balances

Assertions are claims management makes about account balances in the financial statements. The auditor uses them to identify what could be misstated and plan audit procedures. Under ISA 315, the main assertions for account balances at period end are: mia.org.my

Assertion	Meaning	Example: inventory
Existence	The recorded assets, liabilities and equity balances exist.	Inventory recorded in the accounts is physically present.
Rights and obligations	The entity owns or controls the recorded assets, and recorded liabilities are its obligations.	Goods held on consignment for another business are not recorded as the entity’s inventory.
Completeness	All balances that should be recorded have been included.	Inventory held at another location is included in the records.
Accuracy, valuation and allocation	Balances are recorded at appropriate amounts, and related adjustments are properly recorded.	Damaged or obsolete inventory is valued appropriately.
Classification	Balances are recorded in the correct accounts or categories.	Inventory is not incorrectly recorded as equipment.
Presentation	Balances are appropriately grouped, described and disclosed in the financial statements.	Inventory is separately and clearly presented, with required disclosures.

Existence checks whether recorded items are real; completeness checks whether all items that should be recorded are included. ISA 315 groups some assertions differently across transactions, balances and disclosures, so use the account-balance wording when answering a question specifically about balances.

Risk assessment

• Risk assessment is an essential part of audit planning. 
• The auditor needs to understand the entity and identify where material misstatements may occur before deciding which audit procedures to perform. 
• ISA 315 requires auditors to identify and assess risks of material misstatement; ISA 300 requires the audit plan to reflect the planned risk assessment and further procedures. mia.org.my

• Risk assessment does not waste time. 
• It helps the auditor focus effort on high-risk areas, choose appropriate procedures, and allocate staff and time effectively. 
• If auditors skip this step and begin detailed testing immediately, they may test low-risk areas unnecessarily while overlooking significant risks, including fraud. 
• This can make the audit less effective and may lead to insufficient evidence or an inappropriate opinion.

• Risk assessment is also ongoing. 
• Substantive testing may uncover new information, but if that happens, the auditor should update the risk assessment and modify the audit plan as needed. mia.org.my

Conclusion: Auditors should not bypass or minimise risk assessment. A well-planned risk assessment helps make detailed audit procedures more focused, efficient and responsive to the risks.

Important planning procedures for a new audit client

For a new client, the auditor should complete preliminary acceptance work and then plan the audit based on the client’s circumstances and risks.

1. Assess whether to accept the engagement. Consider the client’s integrity, the firm’s independence, relevant expertise and whether enough suitable resources are available.

2. Agree the terms of the engagement. Confirm the audit’s scope, applicable financial reporting framework, management’s responsibilities and the form of the auditor’s report.

3. Communicate with the predecessor auditor, if another firm audited the previous period, in line with ethical requirements. Where permitted, arrange to review relevant working papers.

4. Understand the client and its environment. Learn about its business, industry, operations, ownership, accounting policies, legal and regulatory requirements, and financial reporting process.

5. Understand internal controls and assess risks. Identify areas where material misstatement due to error or fraud may occur, including significant account balances, transactions and disclosures.

6. Set materiality to help plan audit procedures and evaluate identified misstatements.

7. Plan the audit strategy and procedures. Decide the audit scope, timing and approach, including which controls to test and what substantive procedures to perform.

8. Assign appropriate staff and supervision. Consider the skills and experience needed for higher-risk areas, and plan how the team’s work will be directed and reviewed.

9. Consider opening balances. In an initial audit engagement, obtain evidence that opening balances do not materially affect the current period’s financial statements, and that accounting policies have been applied consistently or changes have been properly accounted for. mia.org.my

The auditor should document the overall strategy and audit plan, then update them if new information changes the assessed risks or planned work.

Consequences of inadequate audit planning

Inadequate audit planning can lead to:

• Failure to identify or detect material misstatements, including fraud.
• Insufficient or inappropriate audit evidence, making it difficult to support the auditor’s opinion.
• Audit procedures that do not address key risks, resulting in important accounts or assertions being inadequately tested.
• Inefficient use of time and resources, which can increase audit costs or delay completion.
• Poor coordination and supervision, leading to duplicated work, gaps or errors in the team’s work.
• An inappropriate audit opinion if significant issues are missed or evidence is inadequate.
• Damage to the auditor’s reputation and possible professional or legal consequences.

Audit planning must be updated when new information changes the auditor’s understanding of risks or the work required.

Common weaknesses in audit planning

Weak audit planning can cause the audit team to miss important risks or use its time and resources poorly. Common weaknesses include:

• Insufficient understanding of the client - not learning enough about its business, industry, operations or reporting requirements.
• Poor risk assessment - failing to identify areas where material misstatement or fraud is more likely.
• Inappropriate materiality levels - setting materiality without considering the needs of financial statement users.
• Audit procedures that do not address the risks - for example, using procedures that do not properly test the relevant account or assertion.
• Poor timing and resource allocation - scheduling work too late or not assigning enough time, staff or expertise to high-risk areas.
• Inadequate direction, supervision and review - team members may misunderstand their tasks, or errors in their work may go unnoticed.
• Failure to update the plan - continuing with the original plan even when new information or audit evidence changes the risk assessment.
• Insufficient documentation - not recording the audit strategy, plan or reasons for significant changes.

ISA 300 requires the auditor to plan the audit, including its procedures, timing and resources, and to update the plan when necessary.

What is the auditor trying to test?

ISA 330 distinguishes tests of controls from substantive procedures; substantive procedures include tests of details and substantive analytical procedures. mia.org.my

Procedure	What the auditor tests	Example
Test of control	Whether a control operated effectively.	Inspecting sales invoices for evidence of required approval.
Substantive test of transactions	Whether individual transactions were recorded correctly.	Checking a sample of recorded sales to customer orders and delivery notes.
Test of details of balances	Whether an ending account balance is correct.	Sending confirmations to customers to verify accounts receivable at year-end.
Analytical procedure	Whether relationships or trends in financial and non-financial data are reasonable.	Comparing monthly gross profit margins and investigating an unexpected change.

Quick guide

• Checks approval, authorisation or another control? → Test of control
• Checks individual transactions? → Substantive test of transactions
• Checks the year-end balance? → Test of details of balances
• Compares figures, ratios or trends? → Analytical procedure

The classification depends on the purpose of the audit step. For example, inspecting an invoice for an approval signature tests a control; inspecting it to verify the amount recorded in the sales account tests a transaction. Analytical procedures involve evaluating plausible relationships and investigating significant differences.

Factors that affect the reliability of audit evidence

Under ISA 500, reliability depends on the evidence’s source, nature and the circumstances in which it is obtained. mia.org.my

• Source: Evidence from an independent external party is generally more reliable than evidence produced internally.
• Internal controls: Internally generated records are more reliable when the controls over their preparation and maintenance are effective.
• How the auditor obtains it: Evidence obtained directly by the auditor—such as observing a control—is generally more reliable than evidence obtained indirectly through enquiry.
• Form of evidence: Original documents are generally more reliable than copies or electronic versions, unless the controls over creating and maintaining those versions are reliable.
• Authenticity and competence: The auditor considers whether the evidence is genuine and whether its source is knowledgeable and impartial.
• Consistency: Evidence that agrees with information from other independent sources is generally more convincing. Conflicting evidence needs investigation.
• Timing and relevance: Evidence should relate to the period and assertion being audited.

Note: An external document is not automatically reliable, and inquiry alone usually does not provide sufficient evidence. Auditors consider the quality of evidence, not just how much they collect.

PODCIAR

PODCIAR is a mnemonic for common audit procedures used to obtain evidence:

Procedure	What it means	Example
P – Physical examination	Inspecting a tangible asset to check that it exists and assess its condition.	Inspecting inventory or equipment.
O – Observation	Watching a process or procedure being performed.	Observing the client’s year-end inventory count.
D – Documentation	Examining documents or records that support transactions or balances.	Checking supplier invoices or delivery orders.
C – Confirmation	Obtaining a direct response from an independent third party.	Asking a bank to confirm the company’s account balance.
I – Inquiry	Asking knowledgeable people for information, verbally or in writing.	Asking management about an unusual expense.
A – Analytical procedures	Evaluating financial information by comparing relationships and investigating unexpected differences.	Comparing this year’s gross profit margin with last year’s.
R – Recalculation and re-performance	Recalculation: checking mathematical accuracy. Re-performance: independently repeating a procedure or control.	Recalculating depreciation or re-performing a bank reconciliation.

These procedures may be combined. Inquiry alone is usually not enough to support a conclusion; auditors generally corroborate responses with other evidence.

audit risk = risk of material misstatement × detection risk

Conceptually, audit risk = risk of material misstatement × detection risk. When RMM is high, the auditor needs to reduce detection risk to keep overall audit risk at an acceptably low level. This can involve more extensive substantive procedures and less reliance on weak controls.

Materiality and its relationship with risk of material misstatement

Materiality is the level at which an error or omission in the financial statements could reasonably influence users’ decisions. Auditors set materiality using professional judgement, considering both the amount and nature of a misstatement. They use it when planning the audit and evaluating identified errors. mia.org.my

Risk of material misstatement (RMM) is the risk that the financial statements are materially misstated before the audit. At the assertion level, it comprises inherent risk and control risk. mia.org.my

How they relate

• Materiality sets the benchmark; RMM assesses the chance of a misstatement reaching that benchmark.
• A misstatement may be material on its own or when combined with other misstatements.
• If the auditor sets a lower materiality level, smaller errors may affect users’ decisions, so the auditor may need more extensive procedures.
• If the auditor assesses RMM as high, the auditor responds by obtaining more persuasive evidence and adjusting the nature, timing and extent of audit procedures.

Example: If materiality is RM100,000, an error of RM5,000 may not be material by itself. But many similar errors could add up to a material amount. If the account also has weak controls, the auditor may assess a higher RMM and increase testing.

In summary: Materiality concerns the importance or size of a possible misstatement; RMM concerns its likelihood and potential magnitude. Materiality is not itself a component of RMM, but it helps the auditor assess and respond to that risk.

Ways an auditor can reduce the risk of failing to detect a material misstatement

1. Apply professional scepticism — question unusual explanations and consider evidence that contradicts management’s claims.
2. Assess risks carefully — understand the entity, its business and internal controls to identify where material errors or fraud could occur.
3. Design audit procedures to match the risks — the higher the assessed risk, the more persuasive the evidence the auditor should obtain. mia.org.my
4. Gather sufficient and appropriate evidence — use suitable procedures such as inspection, observation, confirmation, recalculation and analytical procedures.
5. Test controls if relying on them — check that relevant controls are operating effectively; otherwise, increase substantive testing.
6. Focus on areas requiring judgement — for example, accounting estimates, unusual transactions and journal entries, where management bias or fraud may occur.
7. Use appropriate sampling and follow up exceptions — investigate errors found and consider whether they indicate wider problems.
8. Review the audit evidence overall — reconsider the risk assessment if evidence conflicts or suggests another misstatement may exist.

An audit provides reasonable assurance, not a guarantee that every material misstatement will be detected. These steps help reduce detection risk. 

Relationship between internal control and risk of material misstatement

Risk of material misstatement (RMM) is the risk that the financial statements contain a material error or fraud before the auditor’s work. At the assertion level, it consists of inherent risk and control risk. Control risk is the possibility that the entity’s internal controls fail to prevent, detect or correct a misstatement on time. mia.org.my

• Effective internal controls can lower control risk by reducing the chance that errors or fraud go undetected.
• Weak or missing controls increase control risk, which can increase the auditor’s assessed RMM.
• If controls are weak, RMM is higher, so the auditor may do more substantive testing. If the auditor plans to rely on controls, they must test whether those controls operated effectively.

Example: If one employee can create suppliers, approve purchases and arrange payments, a fictitious supplier payment may go undetected. Separating these duties helps reduce that risk. Internal controls reduce risk, but cannot eliminate it completely.

Types of misstatements

Misstatements can be described in two ways: by their cause and by how the auditor classifies them during the audit.

1. By cause

• Error: An unintentional mistake or omission in the financial statements.
• Fraud: An intentional act to deceive, such as deliberately misstating or omitting information. Fraud may involve:
  • Fraudulent financial reporting — deliberately manipulating the financial statements.
  • Misappropriation of assets — stealing or improperly using the organisation’s assets. www.iaasb.org

2. By audit classification (ISA 450)

• Factual: A definite error with no reasonable disagreement, such as omitting a supplier invoice.
• Judgemental: Management’s accounting judgement or policy is unreasonable or inappropriate, such as an unjustifiably low bad-debt allowance.
• Projected: The auditor estimates the likely error in the full population from errors found in a sample. mia.org.my

Key point: Fraud is not a fourth ISA 450 classification. It describes the intentional cause of a misstatement; a fraud-related misstatement may also be classified as factual, judgemental or projected.

Roles of those charged with governance in relation to fraud

Those charged with governance (TCWG)—usually the board of directors or audit committee—provide oversight. Management remains primarily responsible for preparing the financial statements and establishing controls to prevent and detect fraud.

TCWG should:

• Oversee management’s assessment of fraud risks and its plans to address them.
• Monitor the controls and processes management uses to prevent, detect and respond to fraud.
• Promote integrity and ethical conduct through the organisation’s culture and leadership.
• Challenge management’s explanations and seek further information when something appears unusual.
• Oversee the handling of fraud allegations, including ensuring that concerns are investigated and addressed appropriately.
• Communicate with the external auditor about known, suspected or alleged fraud, and consider the auditor’s concerns and findings.

In short, TCWG oversee and challenge; management is responsible for operating the controls and preparing the financial statements.

Actions auditors should take when they detect or suspect fraud

1. Maintain professional scepticism. Do not accept explanations at face value. Gather and assess reliable evidence, including evidence that may contradict management’s explanation.

2. Understand and investigate the matter. Make appropriate enquiries, establish what happened and who may be involved, and consider whether the issue points to a wider fraud risk or a weakness in internal controls.

3. Inform the appropriate people. Report the matter promptly to an appropriate level of management. If senior management may be involved, communicate directly with those charged with governance, such as the audit committee or board.

4. Reassess and adjust the audit. Reconsider the assessed risks, the reliability of information and management representations, and whether more or different audit procedures are needed.

5. Consider reporting obligations. Determine whether law, regulation or professional requirements require reporting to an external authority. The auditor should follow applicable confidentiality requirements and obtain legal advice where appropriate.

6. Assess the effect on the audit opinion. If the financial statements remain materially misstated and management does not correct them, consider a modified opinion. Consider whether the auditor can continue the engagement.

7. Document the work. Record the evidence, enquiries, communications, conclusions and decisions made.

The auditor’s role is to respond to fraud risks and assess their effect on the financial statements; deciding whether a crime has legally occurred is for the relevant authorities. IAASB

Standards note: Revised ISA 240 is effective for audits of financial statements for periods beginning on or after 15 December 2026

Management’s responsibilities in relation to financial statements

Management is responsible for:

1. Preparing and fairly presenting the financial statements in accordance with the applicable financial reporting framework, such as MFRS.
2. Maintaining appropriate internal controls so the statements are free from material misstatement caused by fraud or error.
3. Keeping proper accounting records and providing the auditor with relevant information and access to staff.
4. Making reasonable accounting estimates and judgements, and providing adequate disclosures.
5. Assessing whether the going concern basis is appropriate and disclosing any significant uncertainties.
6. Taking responsibility for the financial statements, including confirming this responsibility in writing when requested by the auditor.

The auditor’s role is to examine the statements and express an independent opinion. 

The audit does not transfer responsibility for preparing the financial statements from management to the auditor.

Aktiviti AT2403A HGD344 20264

Grouping

group 1 - Paku Payung

1. Anwar

2. Sherizam

3. Nazeri

4. Amre

5. Atiqah

6. Hamizan

7. Hafiz

Pilihan Tugasan: Option 3 (Video)

Tajuk :DUIT MINYAK DAN DUIT KOPI: IKHLAS ATAU RASUAH?

Hasil Perbincangan:

Kumpulan kami bersetuju memilih tajuk berkaitan pemberian duit minyak dan duit kopi oleh kontraktor selepas kerja disiapkan. Video ini akan mengetengahkan isu integriti, pemberian hadiah dan unsur rasuah dalam urusan pekerjaan.

Storyboard dan skrip akan dibincangkan serta disediakan untuk Seminar 3.

group 2 - Kompas Lurus

1. Fattah

2. Ammar

3. Zaidi

4. Hakim

5. Zulhakimi

6. Jabbar

7. ⁠Iqbal

Kajian Kes 1

Tajuk: Skandal Rasuah Tuna Bonds: Penglibatan Bekas Menteri Kewangan Manuel Chang dalam Krisis Hutang Negara Mozambique.

Kumpulan kami bersetuju memilih tajuk berkaitan skandal rasuah Tuna Bonds di Mozambique yang melibatkan bekas Menteri Kewangan, Manuel Chang. Kes ini melibatkan rasuah dalam urusan pinjaman kerajaan melalui projek maritim, iaitu pembayaran rasuah dan komisen kepada pegawai kerajaan sebagai balasan mendapatkan kelulusan jaminan pinjaman bernilai berbilion dolar Amerika. Skandal ini turut melibatkan penyelewengan dana, penyalahgunaan kuasa dan urus niaga kewangan secara tidak telus sehingga menyebabkan krisis hutang negara Mozambique.

Perbincangan kumpulan akan memberi tumpuan kepada perkara berikut:

1. Apa yang berlaku

2. Individu yang terlibat

3. Modus operandi

4. Tindakan pihak berkuasa

5. Kesan terhadap negara Mozambique

6. Pengajaran untuk negara Malaysia

7. Kesimpulan

group 3 Pantang Mundur

1. Sofri

2. Frankie 

3. Hisham

4. Azraf

5. Hakim

6. Alif

7. Fairus

Kajian Kes 2

Tajuk: SKANDAL RASUAH JABATAN AIR NEGERI SABAH (JANS) / “SABAH WATERGATE” (2016–2026)

Kumpulan kami bersetuju memilih tajuk berkaitan skandal rasuah Jabatan Air Negeri Sabah (JANS) yang dikenali sebagai “Sabah Watergate”, iaitu antara kes rasuah dan pengubahan wang haram berprofil tinggi yang pernah berlaku di Sabah pada tahun 2016.

Kajian kes ini akan mengetengahkan isu integriti, penyalahgunaan kuasa, penyelewengan dana projek kerajaan, pengubahan wang haram serta kesan rasuah terhadap organisasi dan masyarakat.

Perbincangan kumpulan akan memberi tumpuan kepada perkara berikut:

1. Latar belakang kes – Kronologi kejadian dan bagaimana skandal JANS terbongkar pada tahun 2016.

2. Individu yang terlibat – Pegawai kanan jabatan dan pihak berkaitan yang didakwa dalam kes tersebut.

3. Modus operandi – Bagaimana penyelewengan dan pengumpulan wang yang disyaki hasil kegiatan haram berlaku.

4. Tindakan SPRM – Siasatan, tangkapan, rampasan wang tunai dan tindakan undang-undang.

5. Kesudahan kes – Perkembangan perbicaraan dan keputusan mahkamah sehingga tahun 2026.

6. Pengajaran dan nilai integriti – Kepentingan amanah, ketelusan dan tanggungjawab dalam pengurusan kewangan serta projek kerajaan.

Objektif Kajian

Kumpulan kami berharap kajian kes ini dapat memberikan kesedaran tentang kepentingan integriti dalam sektor awam serta membuktikan bahawa penyalahgunaan kuasa dan pengurusan kewangan yang tidak telus boleh menjejaskan kepercayaan rakyat terhadap institusi kerajaan.

Aktiviti HGD344 - KP3A4 DEG

Types of audit programme: Standard and tailored

Types of audit programme: Standard and tailored

Basis	Standard audit programme	Tailored audit programme
Meaning	A prepared set of procedures commonly used for the same audit area across different clients.	A programme designed or adapted for a particular client’s operations, systems and risks.
When useful	As a starting point for routine areas with similar transactions and controls.	When the client has unusual transactions, significant changes or risks requiring specific attention.
Main advantage	Saves preparation time, promotes consistency and reminds staff to cover common audit objectives.	Directs staff towards the particular ways the client’s financial statements could be misstated.
Main limitation	Staff may follow it mechanically and overlook a risk specific to the client.	Requires more planning time and judgement. A programme developed from scratch may overlook routine work.
Example	An inventory programme instructs staff to select items from the year-end inventory listing and locate them in the warehouse to test existence.	After learning of a warehouse flood, the auditor adds procedures to identify damaged stock and assess whether its carrying amount should be reduced.

A firm can start with a standard programme and tailor it. The decision depends on what could go wrong at the particular client and whether the planned procedures would detect it.

Worked example | Jengka Furniture Sdn. Bhd.

During a warehouse tour, the auditor finds 40 water-damaged tables included in year-end inventory. Each table is recorded at RM500.

Programme step	Audit procedure	Assertion
Standard procedure	Select tables from the year-end inventory listing and physically locate them in the warehouse. Record the quantities found and any signs of damage.	Existence
Tailored procedure	Identify the 40 damaged tables on the inventory listing. Examine subsequent selling prices and estimated repair and selling costs to determine their net realisable value.	Valuation

Suppose the evidence supports a net realisable value of RM350 per damaged table. The required write-down is 40 × (RM500 − RM350) = RM6,000. The auditor then checks whether management recorded the adjustment.

The count answers “Are the tables there?” The additional procedure answers “Is RM500 per table still recoverable?” That second question explains why the programme needed tailoring.

Audit Programme

An audit programme is a written set of instructions describing the audit procedures the team plans to perform for a particular area, such as sales, inventory or trade receivables. It turns an audit objective into specific work that an auditor can carry out and a supervisor can review.

For example, “Test the completeness of sales” states an objective. An audit programme gives the instruction: “Select signed delivery notes for goods delivered before 31 December and trace them to the sales journal to check that all sales that should have been recognised were recorded.” The instruction identifies the documents, the direction of testing and the purpose.

What does an audit programme contain?

Element	What it tells the audit team
Objective and assertion	What the auditor wants to establish, such as whether recorded inventory exists.
Nature of the procedure	What the auditor will do and what evidence to examine, such as inspecting goods or obtaining a customer confirmation.
Timing and extent	When to perform the work and how many or which items to test, taking account of the assessed risk.
Responsibility and documentation	Who performs and reviews the work, when it was completed and where the results and conclusions are recorded.

An audit programme helps the team allocate work, cover identified risks and monitor completion. As the audit progresses, the team updates the programme if new information changes the risks or the evidence needed.

What is audit quality, and how is it measured?

Audit quality means the audit team performs its work competently and independently, obtains sufficient appropriate evidence and issues a report that fits the findings. The IAASB’s framework considers the inputs to the audit, the process followed and the outputs produced, alongside stakeholder interactions and the circumstances of the engagement. Audit quality therefore calls for several indicators interpreted together. IAASB

Area	Example of a measurable indicator	What the indicator helps assess
People and resources	Partner and manager hours spent on areas assessed as high risk.	Whether experienced staff devoted attention to difficult judgements. Hours alone say little about the quality of that attention.
Supervision and review	Proportion of significant audit areas reviewed before the report was signed.	Whether the team had time to challenge conclusions and obtain additional evidence where needed.
Evidence and judgement	File inspection findings on unsupported conclusions, including how often the same finding recurs.	Whether the work actually supports the opinion and whether the firm has addressed earlier weaknesses.
Communication	Time taken to communicate significant findings to the audit committee, together with a review of what was communicated.	Whether those responsible for oversight received clear information in time to act.
Reporting outcome	Whether an independent file review finds that the opinion issued was appropriate in the circumstances.	Whether the final report reflects the evidence and the significance of unresolved matters.

Classroom example. Two audit teams encounter the same RM3,000 interest difference. One writes “amount immaterial” without recording its cause. The other establishes that December interest was omitted, checks whether similar year-end expenses were missed and verifies management’s adjustment. Both teams might ultimately issue an unmodified opinion. The second file provides a stronger basis for assessing audit quality because a reviewer can follow the evidence, the judgement and the conclusion. 

Ownership and confidentiality

Ownership concerns who owns the records. Confidentiality concerns who may see or use the information. The audit firm generally owns its working papers, subject to applicable law or regulation. The client retains ownership of its original accounting records. For example, the company owns its sales ledger, while the firm owns the audit schedule documenting which sales it tested and what it found. micpa.com.my

The auditor must protect confidential information during and after the engagement. Disclosure requires proper authority, such as valid client authorisation where legally permitted, or an applicable legal or professional right or duty. mia.org.my

Situation	Appropriate treatment
A bank officer asks the auditor to email the client’s loan working papers.	The bank’s interest in the client does not itself authorise disclosure. The auditor checks whether a valid basis exists before releasing information.
An audit regulator lawfully requests specified working papers for an inspection.	The firm verifies the request and provides the required records through an authorised, secure channel.
An audit assistant wants to use a client’s payroll schedule in a class presentation.	The assistant can create a fictional example. Removing the company name alone may still leave employees identifiable from salaries or job titles.

Preparation of working papers

Under ISA 230, the auditor prepares documentation promptly and in enough detail for an experienced auditor with no previous connection to the engagement to understand the work. The reviewer should be able to identify what was tested, the results, significant judgements, who performed the work and who reviewed it. mia.org.my

What to record	Worked example for Jengka Furniture’s bank loan
Heading and reference	Jengka Furniture Sdn. Bhd. — Loan interest expense — Year ended 31 December 2026 — L2.
Objective and assertion	Determine whether the company recorded the correct interest expense for the year. The main assertion is accuracy.
Evidence and procedure	Inspect the signed agreement for the fixed rate of 6%. Check the loan statement to establish that RM600,000 was outstanding for the full year. Recalculate the interest and compare it with the ledger.
Result	Expected interest is RM600,000 × 6% = RM36,000. The ledger shows RM33,000, giving a difference of RM3,000.
Investigation and conclusion	The loan statement shows RM3,000 of December interest accrued and payable in January. Management records the adjustment. The auditor checks the revised ledger and concludes that it now agrees with the recalculation.
Preparation and review	Record the preparer’s name and completion date, the reviewer’s name, the date and extent of review, and references to the agreement, loan statement and adjustment.

A note saying “interest checked” leaves the reviewer unable to tell whether the auditor checked the rate, the principal, the period or only the arithmetic. Recording those details makes the conclusion reviewable.

Current audit file

The current file contains the planning, testing, evidence and conclusions for one financial year. It shows how the audit team reached its opinion for that year.

Stage	Examples of current-file contents
Planning	Current-year audit strategy, risk assessment, materiality calculation and audit programme.
Fieldwork	Trial balance, inventory test counts, bank confirmations, sales cut-off tests and schedules of audit differences.
Completion	Evaluation of uncorrected misstatements, management representation letter, final financial statements and signed auditor’s report.

One loan, two files. For the audit at 31 December 2026, the five-year agreement belongs in the permanent file. The bank confirmation at 31 December 2026, the 2026 interest calculation and the auditor’s conclusion on the closing balance belong in the current file. The interest working paper can cross-reference the agreement so the reviewer can find the rate used.

Permanent files

Audit working papers are the records of what the auditor tested, the evidence obtained and the conclusions reached. For example, a bank confirmation provides evidence of a loan balance. The auditor’s working paper shows how that balance was compared with the ledger, how any difference was investigated and what the auditor concluded. mia.org.my

The permanent file contains information that remains useful across several annual audits. The auditor reviews it each year and updates documents when circumstances change.

Typical contents	Why the auditor keeps them
Incorporation documents and the company constitution, if adopted	To understand the company’s legal structure and relevant shareholder rights.
Group structure and ownership information	To identify subsidiaries, controlling parties and relationships relevant to the audit.
Long-term loan and lease agreements	To refer to repayment terms, interest rates, security and other obligations across financial years.
Descriptions of the accounting system and major business processes	To understand how the company processes transactions and identify changes since the previous audit.

Example. Jengka Furniture Sdn. Bhd. signs a five-year bank loan. The auditor keeps a copy of the signed agreement in the permanent file because its terms affect several audits. If the bank changes the interest rate, the auditor adds the signed amendment and records its effective date.

Tests of details of account balances and disclosures

A balance test examines an amount at a particular date. A disclosure test examines whether the notes contain the required information and describe it accurately. The same document can support both purposes. standards.xrb.govt.nz

Item tested	Assertion	Example of a substantive test
Trade receivables balance	Existence	Obtain direct confirmation from selected customers of the balances they owed at 31 December. Investigate differences between replies and the ledger.
Inventory balance	Valuation	For damaged tables, compare recorded cost with the expected selling price less repair and selling costs. Determine whether a write-down is required.
Trade payables balance	Completeness	Select payments made after year-end and inspect the supplier invoices and goods received notes. Where the company received the goods before year-end, check that it recorded the liability at 31 December.
Loan disclosure	Completeness and accuracy of disclosure	Inspect the signed loan agreement for assets pledged as security. Compare those terms with the loan note in the financial statements.

Exam application: Suppose an auditor inspects a supplier invoice. If the auditor checks whether the purchasing manager performed the required approval, the purpose is to test a control. If the auditor checks whether the company recorded the correct amount in the correct period, the purpose is to test the transaction directly. A strong exam answer identifies the action, the evidence examined and the purpose.

Tests of details of classes of transactions

These tests examine individual transactions during the year, such as sales, purchases and wages. The auditor selects the starting document according to the assertion being tested. mia.org.my

Assertion	Example of a substantive test
Occurrence of sales	Select entries from the sales journal and vouch them to customer orders and signed delivery notes to establish that the recorded sales occurred.
Completeness of purchases	Select goods received notes for timber deliveries and trace them to supplier invoices, the purchases journal or year-end accruals to determine whether the purchases were recorded.
Accuracy of wages	For selected employees, agree hours worked to approved timesheets and hourly rates to employment records. Recalculate gross pay and compare it with payroll.
Cut-off of sales	Inspect delivery records immediately before and after 31 December, check when control passed under the sales terms and compare that date with the accounting period used.