Auditing

Define an audit

An audit is an independent examination of financial statements to check whether they are reasonable and comply with the relevant accounting standards.

What is the objective of an audit?

To provide reasonable assurance that the financial statements are free from material misstatements due to fraud or error, and to issue a report containing an opinion

Why do audits provide reasonable assurance rather than absolute assurance? (inherent limitations)

An audit provides reasonable assurance because there are inherent limitations. Auditors use sampling rather than examining every transaction. their work relies on professional judgment and the audit evidence available. Therefore, there is always a possibility that a material misstatement has not been identified.

Define materiality

Materiality is the size and nature of an error/misstatement in the financial statements that could influence the decisions of users

List the traditional materiality benchmarks and when each is used

1. 5-10% of pre tax profits (used when profit is stable)

2. 0.5-1% of revenue (used when profit is low or fluctuates)

3. 1-2% of total/net assets (used in asset heavy businesses where assets are important)

List four phases of the audit process

Phase 1: Client acceptance/continuance

Phase 2: Planning

Phase 3: Testing and evidence

Phase 4: Evaluation and judgment

Explain agency theory, why it happens and how external audits help to address it

Agency theory explains the relationship between shareholders (principles) and management (agents). Managers act on behalf of shareholders to maximise shareholder profits.

The agency problem arises because ownership and management are separate, managers goals may differ from shareholders, and managers have more information that shareholders (asymmetry of information). Managers may act in their own best interests rather than maximising shareholder value.

External audits address this problem by bringing credibility to the financial statements prepared by management.

Describe the regulatory framework governing statutory audits in Ireland, including the roles of IAASA, the competent authorities and ISAs

IAASA is the competent authority for audits in Ireland. It oversees audit regulation and helps to maintain public confidence in the accountancy profession. The competent authorities set auditing and ethical standards, regulate statutory audits and monitor and enforce audit requirements. ISAs provide the standards auditors follow when carrying out audits.

Explain the roles of the IFAC and IAASB in the development of auditing standards

IFAC is an international organisation for accountants. The IAASB is a board within the IFAC responsible for setting international auditing and assurance standards. These standards can then be adopted at national level by the relevant authorities.

Explain the purpose of the 2016 EU audit reforms

The 2016 EU audit reforms were introduced to restore confidence in audit quality and improve investor confidence. They aimed to improve auditor independence and professional scepticism, improve regulatory supervision of statutory auditors and to reduce excessive familiarity between auditors and clients. The reforms led to the creation of the IAASA in Ireland.

Define a public interest entity (PIE)

A PIE is generally a company that has a significant impact on the public, particularly because of its financial activities. For example, a company whose shares are traded on a regulated market, credit institutions (banks) and insurance companies

List any 4 additional audit requirements that apply to PIEs

Increased audit reporting requirements

Mandatory rotation of statutory auditors and audit firms.

Prohibition of certain non-audit services

Limits on fees for non-audit services

An enhanced role for the audit committee

Dialogue between the auditor and those charged with governance

Explain the difference between PABs and RABs including their main responsibilities

Prescribed accountancy bodies (PABs)

-train students, issue practising certificates, carry out investigations and disciplinary action and ensure compliance with continuing professional development (CPD)

Recognised accountancy bodies (RABs)

-Approve statutory auditors and audit firms and monitor statutory auditors through quality assurance.

Explain the requirements for individuals and firms wishing to practice as statutory auditors

Firms must be of good respute

Individuals must be approved as statutory auditors by a Recognised Accountancy Body

individuals must have sufficient audit experience

List the criteria for audit exemption for small private companies in Ireland and the circumstances in which exemption is not permitted

A small private company must meet at least 2 of these 3 criteria:

• Average of 50 or fewer employees

• Assets not exceeding €6 million

• Annual turnover not exceeding €12 million

A company cannot avail of exemption if:

• Its annual returns are filed late

• Its Articles of Association require an audit

• Shareholders request an audit under the 10% rule

• It is a PIE or another specifically excluded entity

Discuss the advantages and disadvantages of a small company availing of audit exemption

Advantages:

• Less work

• Saves time and money by avoiding audit costs

Disadvantages:

• Directors do not receive the additional assurance provided by an audit

• There may be less oversight of accounting records and transactions

• The company may miss out on improved credibility and potential access to alternative investment that an audit could support

List any 4 of the statutory responsibilities of company directors

• Prepare annual reports

• Act in the interest of shareholders and have regard for employees interests.

• Keep proper books of accounts

• Safeguard company assets

• Take reasonable steps to prevent and detect fraud and other irregularities

List any 5 of the fiduciary duties of company directors

• Act in good faith

• Act honestly and responsibly

• Act within their powers

• Use company property appropriately

• Exercise independent judgment

• Avoid conflicts of interest

• Exercise due care, skill and diligence

• Have regard for shareholders interests

Why should companies maintain proper books of accounts?

Companies must maintain proper books of accounts to:

• correctly record and explain transactions

• determine the company’s financial position with reasonable accuracy

• ensure the accounts comply with company legislation

• allow the accounts to be properly audited

List information proper books of accounts should contain

• daily records of money received and spent

• records of assets and liabilities

• records of goods purchased and sold

• stock records and stocktaking information

• records of services purchased and provided, where applicable

What is the auditors responsibility when adequate accounting records have not been maintained?

The auditor must:

• notify the company as soon as possible

• notify the Companies Registration Office (CRO) within seven days of notifying the company

List 4 of the main statutory duties of an auditor

• Provide an audit report

• Report failures to maintain adequate accounting records

• Exercise professional integrity, skill, care and caution

• Provide evidence of approval and eligibility to act as an auditor

• Explain the reasons for resigning or not wishing to be appointed

• Report category 1 and category 2 offences to the relevant authorities

Explain the auditors duty to report Category 1 and 2 offences, with at least 3 examples. State the consequence of failing to report them.

Auditors must report category 1 and 2 offences to the Registrar of Companies and the Director of Corporate Enforcement

Examples include:

• Failure to maintain proper books of accounts

• Falsification of records or documents

• Fraudulent trading

• Illegal transactions involving directors

• Making false statements to an auditor

• Failure to file an annual return

• Acting when disqualified

Consequences of failing to report: the auditor is guilty of a category 3 offence and may face up to 5 years imprisonment and/or a fine not exceeding €5,000

Explain the procedure for appointment of a statutory auditor

• Auditors are appointed by shareholders by voting on it at a general meeting (ordinary resolution)

• Directors can temporarily appoint an auditor if there’s an unexpected vacancy, subject to approval at the AGM

• For a PIE the audit committee makes a recommendation

Explain the procedure for removal of a statutory auditor

• An auditor can be removed by a majority vote of shareholders at the AGM

• The removal must be in the best interest of the company, not simply because of difference of opinion

• The auditor has the right to make representations and attend the next AGM

Describe the procedures, duties and rights associated with an auditor’s resignation, including the Statement of Circumstances.

When an auditor resigns

• they must provide a Statement of Circumstances, explaining any circumstances connected to their resignation that should be brought to the attention of shareholders or creditors.

• They must notify the appropriate authority

• If there are circumstances that must be stated, the relevant information must be provided to the Registrar of Companies within 10 days

• The company must send copies to all shareholders

Explain the auditor rotation requirements for PIEs and non-PIEs

Auditor rotation limits how long an auditor can remain in the same audit relationship

• PIEs: rotation after 5 years

• Non-PIEs: rotation after 10 years

Purpose: rotation helps reduce excessive familiarity between auditors and clients and supports auditor independence.

Explain the importance of audit planning

Audit planning helps ensure the audit is carried out effectively and efficiently

List 4 of the main benefits of audit planning

• Gives the appropriate attention to important areas of the audit

• Helps identify and resolve potential problems early

• Helps organise and manage the audit effectively

• Helps select suitable audit team members and allocate work

• Facilitates the direction, supervision and review of work

• Helps coordinate work carried out by other auditors and experts

Distinguish between an overall audit strategy and an audit plan

Overall audit strategy: sets the overall scope, timing and direction of the audit

Audit plan: provides more detail about the audit procedures to be carried out

The audit plan includes:

• Timetable

• Allocation of work to audit team members

• Audit procedures for major accounts, such as inventory, receivables and cash

• Materiality for the financial statements as a whole and performance materiality.

The audit strategy is translated into a detailed audit plan and both are updated when necessary

Explain how materiality affects audit planning and the nature, timing and extent of audit procedures

Materiality helps the auditors decide which misstatements are significant enough to affect users decisions.

It influences:

• Nature: which audit procedures are performed

• Timing: when the procedures are performed

• Extent: how much testing is carried out

Materiality helps the auditor focus on important areas of financial statements

Define corporate governance and explain its purpose

Corporate governance is the system by which a company is directed, controlled and held accountable

Its purpose is to ensure proper oversight, accountability, risk management, ethical behaviour and transparency

Identify the main sources of Irish corporate governance law and regulation

• Companies Act 2014: Covers directors duties, company records, financial statements, AGMs and auditing

• Companies Act 2024: Updated company law in areas including governance, enforcement and company administration

• Irish Corporate Governance Code 2024: sets out governance principles for companies with an equity listing on Euronext Dublin, using a “comply and explain” approach

• Listing rules / Euronext requirements: set requirements for listed companies

• Central bank requirements: apply to regulated financial institutions

• Governance codes and sector-specific regulation: Provide additional requirements for particular organisations

Explain the main governance responsibilities of directors under the Companies Act 2014

Directors are responsible for:

• Fulfilling their duties and responsibilities

• maintaining proper company and accounting records

• Ensuring financial statements and directors reports are prepared

• Overseeing the company and its administration

• Ensuring governance responsibilities are not simply left to the external auditor

Describe the main areas covered by the Irish Corporate Governance Code 2024 and explain the meaning of “comply and explain”

The code covered:

• Board leadership and company purpose

• Division of responsibilities

• Board composition, succession and evaluation

• Audit, risk and internal control

• Remuneration

• Corporate reporting

• Engagement with shareholders

Comply and explain means a company should follow the Codes provisions or explain why it has not followed them

Explain the respective roles of the board, audit committee, management and internal audit in corporate governance

• Board: sets the company’s direction and oversees management, risks and internal controls

• Audit committee” oversees financial reporting, external audit, internal controls, risk and internal audit where applicable

• Management: manages risk, designs and operates controls and prepares reports

• Internal audit: Provides independent, objective assurance and advice to improve the organisation

Explain how external auditors consider corporate governance during an audit in Ireland, referring to relevant ISAs

External auditors consider corporate governance as part of understanding the company’s audit environment and risks.

Relevant standards include:

• ISA 260: communication with those charged with governance

• ISA 265: communicating deficiencies in internal controls

• ISA 315: Identifying and assessing risks

• ISA 240: Responsibilities relating to fraud

• ISA 720: responsibilities relating to other information

Important: the external auditor does not take responsibility for the company’s corporate governance

Define an internal audit

Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations.

List 5 of the main activities of an internal audit

• Risk assessment

• Internal control reviews

• Compliance reviews

• Fraud risk work

• IT and cybersecurity reviews

• Operational and governance audits

• Following up on recommendations

Distinguish between internal and external audit

Main objective

• Internal: Primarily serves the organisation and board

• External: Provides opinion on financial statements

Focus

• Internal: Focuses broadly on operation and risk

• External: Focuses on financial statements

Provides

• Internal: Provides assurance and advisory services

• External: Conduct a statutory or contractual audit

Reports to

• Internal: Senior management or audit committee

• External: Shareholders or appropriate users

Both can cooperate but their objectives and responsibilities differ

Explain why independence is important for internal audits and how it can be maintained

Independence allows internal audits to assess the organisation objectively and challenge management

It can be maintained by:

• reporting functionally to the audit committee

• having direct access to the audit committee chair

• Being free to determine audit work within the approved plan

• Not being responsible for operating the controls being audited

• Being protected from management interference

Describe the 9 stages of the internal audit cycle

1. Understanding the organisation and its strategy

2. Identify and assess risks

3. Develop a risk-based audit plan

4. Agree the scope and objectives

5. Test controls and obtain evidence

6. Evaluate findings

7. Report recommendations

8. Management prepares action plan

9. Follow up on implementation

Explain the conflict of interest that arises when internal audit designs a control and later audits that same control

A conflict arises because internal audit would be auditing its own work.

This threatens the independence and objectivity, as it may be less willing to identify problems with a control it designed

Internal audit should assess controls independently rather than be responsible for operating or designing the controls it audits

How is AI changing corporate governance and internal audit

AI is being used for:

• Board reporting and data analysis.

• Risk monitoring and forecasting.

• Fraud detection.

• Regulatory monitoring.

• Document and contract analysis.

• Cybersecurity monitoring.

Identify the main governance risks associated with AI

• Unclear responsibility for AI decisions.

• Poor-quality data.

• Decisions that cannot be explained.

• Bias in AI models.

• Inadequate human oversight.

• Breaches of confidential or personal data.

List 5 of the controls an organisation should implement to ensure AI is governed appropriately

• Maintain an AI inventory and classify risks.

• Assign clear ownership and responsibility.

• Ensure human oversight.

• Establish approved-use policies.

• Test and validate AI models.

• Use access controls and audit trails.

• Check data quality.

• Monitor AI systems continuously.

• Establish incident reporting procedures.

• Provide staff training.

Explain how internal governance can assess an organisation’s AI governance and controls

Internal audit can:

• Review AI policies and governance structures.

• Identify high-risk AI applications.

• Test access and change controls.

• Review data quality.

• Examine model testing and validation.

• Check monitoring and exception reporting.

• Assess human oversight.

• Review compliance with relevant laws.

Important: Internal audit should not assume AI outputs are correct simply because they are generated automatically.

Explain what ESG means and describe environment, social and governance matters that a board should oversee

ESG stands for Environmental, Social and Governance

Environmental:

• Climate risk

• Emissions

• Energy and resource use

Social:

• Employees

• Human rights

• Customers

• Supply chains

Governance

• Ethics

• anti-corruption

• Board oversight

• risk

• internal controls

Explain the main requirements of the CSRD and Irish sustainability reporting framework

• The Corporate Sustainability Reporting Directive (CSRD) concerns sustainability reporting by companies within its scope.

• Irish regulations introduced sustainability reporting requirements and amended the Companies Act 2014.

• In-scope companies report under European Sustainability Reporting Standards (ESRS).

• Reporting covers environmental, social and governance matters.

• Sustainability information is subject to assurance, with the Irish framework providing for limited assurance.

• The applicable reporting year must be checked because some requirements have been postponed

Explain the board's responsibilities for sustainability governance and the prevention of greenwashing

The board should:

• Decide who is responsible for sustainability strategy.

• Identify sustainability risks affecting the business.

• Ensure ESG targets are measurable.

• Ensure sustainability information is reliable.

• Maintain internal controls over ESG data.

• Monitor greenwashing risk.

Greenwashing means making environmental or sustainability claims that are misleading or not supported by evidence.

Describe how internal audit can assess ESG data, sustainability reporting and related internal controls

Internal audit can:

• Check ESG data is complete and accurate.

• Review reporting boundaries and definitions.

• Check evidence supporting emissions data.

• Test controls over sustainability metrics.

• Review supplier and human-rights information.

• Examine climate-risk processes.

• Compare ESG claims with underlying records.

Explain the meaning of double materiality, distinguishing between impact materiality and financial materiality

Double materiality considers sustainability from two perspectives:

• Impact materiality: How the organisation affects people and the environment.

• Financial materiality: How sustainability issues affect the organisation's financial position, performance, cash flows or access to finance.

What is ISA 610

ISA (Ireland) 610 deals with the external auditor's responsibilities when considering the work of internal auditors.

What does an external auditor consider when deciding whether to use internal audit work (ISA 610)

The external auditor considers:

• Objectivity: Is internal audit independent and unbiased?

• Competence: Do internal auditors have the necessary skills and knowledge?

• Systematic and disciplined approach: Do they follow an organised audit process?

• Nature and scope of work: What work has internal audit carried out?

• Relevance: Is the work relevant to the external audit?

Explain why internal audit work does not automatically become external audit evidence

Internal audit work does not automatically become external audit evidence because the external auditor must assess its quality and relevance first.

The external auditor must consider internal audit's objectivity, competence and approach before deciding whether the work can be used

Explain how an external auditor may encounter ESG information during an audit, referring to ISA 720

ISA (Ireland) 720 deals with the external auditor's responsibilities relating to other information.

An external auditor may encounter ESG information in:

• Directors' reports and other information.

• Risk assessments.

• Going concern assessments and estimates.

• Provisions and impairment.

• Climate-related assumptions.

• Sustainability reporting, where assurance is required.

The auditor considers relevant information and reporting responsibilities as part of the audit.