Auditing is a chain: risk leads to evidence, and evidence leads to judgment. For every topic below, keep asking the same three questions: what could be materially wrong here, what evidence would actually address that risk, and how would the finding change the auditor’s conclusion or report? Memorizing a list of procedures without knowing what each one is meant to test is the single most common way this paper is prepared badly.
A. What an Audit Is, and What It Is Not
An external financial-statement audit is an independent examination that lets the auditor express an opinion on whether the financial statements are prepared and presented in accordance with the applicable reporting framework, in all material respects. Management prepares the statements; the auditor examines evidence and forms an opinion on them; these are two clearly separate roles, and confusing them is a conceptual error. An audit provides reasonable assurance, not absolute assurance: the auditor tests a sample of, say, sales invoices and related controls rather than re-performing every single transaction in the business, because absolute certainty would be both practically impossible and prohibitively expensive. This is why professional skepticism, treating management’s representations as needing corroboration rather than automatic acceptance, is central to the whole exercise.
B. Management Assertions and Audit Evidence
Assertions are management’s implicit or explicit claims embedded in the financial statements about transactions, balances, and disclosures, and they exist to tell the auditor exactly what needs to be proven. Common assertions include existence or occurrence (did the recorded asset or transaction actually happen or exist?), completeness (has everything that should have been recorded actually been recorded?), rights and obligations, accuracy or valuation, cut-off (is it recorded in the right period?), and classification and presentation. Example: for inventory, existence asks is the recorded inventory actually there, while completeness asks the opposite question, has all inventory that should be recorded been included. These two assertions pull in opposite directions and require different procedures.
Audit evidence is the information used to support the auditor’s conclusions, and its quality depends on relevance and reliability together; a large quantity of irrelevant evidence never compensates for evidence that does not actually address the assertion at risk. The standard evidence-gathering techniques are inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, and inquiry. Example: an external bank confirmation can provide reliable evidence about a bank balance because it comes from an independent third party, subject to how the confirmation procedure is actually carried out. The exam skill worth practising is not listing these techniques but, for any given procedure, identifying which specific assertion it is designed to test.
C. Planning the Audit: Programme, Risk and Materiality
An audit programme is a planned list of procedures for each area of the audit; it improves organization, delegation, and review, but a rigid, unchanging programme becomes a liability when circumstances on the ground turn out to be different from what was assumed at the planning stage. Example: a cash audit programme may include bank confirmations, bank reconciliation testing, and selected tests of cash receipts and payments.
Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are, in fact, materially misstated. Materiality concerns misstatements that could reasonably be expected to influence the economic decisions users make based on the statements; it is not simply any error above a fixed percentage, because qualitative factors matter too. Example: a small illegal payment may be material because of its nature, even though the amount involved is not large. Risk assessment is what actually drives the nature, timing, and extent of audit procedures: the higher the assessed risk in an area, the stronger the evidence response needs to be there.
D. Internal Control and the Two Kinds of Procedure
Internal control is the system of policies, processes, and activities an entity designs to help it achieve objectives such as reliable reporting, efficient operations, and legal compliance. Controls can either prevent errors and fraud from happening, or detect and correct them after the fact. Segregation of duties is a classic control principle: the person who physically receives cash should ideally not also be the only person recording and reconciling that same cash, because combining custody and recording in one person removes the natural cross-check that catches both error and deliberate misappropriation.
Once controls are understood, the auditor chooses between two broad kinds of procedure. Tests of controls evaluate whether a relevant control actually operates effectively in practice, not just on paper. Substantive procedures directly seek evidence about whether transactions, balances, or disclosures are materially misstated, regardless of how well the related control performed. Example: checking that purchase orders carry proper approval signatures is a test of a control; independently confirming outstanding receivable balances with customers is a substantive procedure providing direct evidence about receivables. The audit mix between the two depends on the risk assessment and on how much reliance the auditor plans to place on controls: strong, well-tested controls can justify less extensive substantive testing, and weak or unreliable controls require more.
E. Internal Audit versus External Audit
Internal audit is a function within the organization providing assurance and advisory services focused on governance, risk management, and controls, typically reporting to those charged with governance (such as an audit committee). External audit is independent of management altogether and is commonly focused on the financial-statement opinion required by the applicable reporting framework or law. Their objectives, reporting lines, and independence requirements differ significantly, even though their work can sometimes overlap or inform each other. Example: internal audit may review procurement controls continuously throughout the year as part of ongoing governance oversight, while external audit draws on whatever evidence is relevant to support its single annual opinion. A clean comparison across purpose, scope, independence, reporting line, timing, and legal basis is a reliable way to answer any exam question asking for the distinction.
F. The Audit Process, Computerized Environments, and Fraud
The audit as a whole is a process, not a single event: accept or continue the client relationship, understand the entity and its environment, assess risk and set materiality, plan the response, perform control and substantive work, complete the audit (including subsequent events and misstatement evaluation), and finally form the opinion and issue the report. Planning is iterative, not a one-time step frozen at the start: unexpected evidence, such as unexplained inventory discrepancies discovered mid-audit, can and should cause more testing than was originally planned.
When an entity’s records and controls are computerized, the auditor needs to understand IT-specific risks: access controls (who can get into the system), change controls (how modifications to programs are authorized and tracked), data integrity, backups and system interfaces, and audit trails. Auditors may use computer-assisted audit techniques (CAATs) to analyze an entire sales file for duplicate invoice numbers or unusual entries, rather than testing only a small manual sample. “Computerized” should never be read as meaning “error-free” — automation can just as easily automate and multiply an error at scale.
Fraud involves intentional deception; error is unintentional. Management bears the primary responsibility for fraud prevention and detection through governance and controls, while the auditor’s role is to assess fraud risk and perform procedures responsive to that risk within the audit’s own objective — an audit is not a guarantee that every fraud will be uncovered. Fraud risk tends to be highest where three factors combine: pressure or incentive to commit the fraud, an opportunity created by weak controls, and a rationalization that lets the person justify the act to themselves. Example: cash theft is easier to conceal through falsified records when one person alone controls both custody of the cash and the recording of it — exactly the segregation-of-duties failure described in Section D.
G. Going Concern, Auditor Responsibility, and the Audit Opinion
Auditors must consider whether events or conditions create material uncertainty about an entity’s ability to continue as a going concern, and whether related disclosures and reporting are appropriate under the applicable financial-reporting framework and auditing standards. Going-concern problems can affect how assets and liabilities are measured, what must be disclosed, and ultimately the audit report itself. Warning signs include severe recurring losses, inability to pay debts as they fall due, and loss of major financing — but no single sign automatically decides the conclusion; it is always a matter of overall judgment based on the combination of evidence available.
Company law and professional auditing standards together define the auditor’s appointment, right of access to information, reporting duties, and possible civil, criminal, or professional consequences for failing to meet those duties. Because this area of law changes over time, current statutory wording (the current Companies Act rather than any superseded ordinance) must always be checked before relying on it, and statutory duties should be kept conceptually distinct from separate ethical or professional duties.
Finally, the audit report communicates the auditor’s opinion, built around one central question: are the statements materially misstated, and was sufficient appropriate evidence obtained to reach a conclusion on that? An unmodified (“clean”) opinion is issued when the auditor concludes the statements are fairly presented in all material respects. Modified opinions exist on a spectrum depending on how material and how pervasive an identified issue is: a qualified opinion for a matter that is material but not pervasive, an adverse opinion where misstatements are both material and pervasive, and a disclaimer of opinion where the auditor simply could not obtain sufficient appropriate evidence at all. Example: a material but not pervasive misstatement typically leads to a qualified opinion, though the exact wording and form of any report must follow the current auditing standards in force, not a memorized template. The reasoning behind each opinion type is worth understanding properly; the exact phrasing used in a real report is a secondary, updatable detail.
Paper II (Auditing) key takeaways: an audit gives reasonable assurance, never absolute assurance, because evidence is sampled and judged, not exhaustively verified. Every assertion tells you what specifically needs to be proven, and every procedure should be traceable back to the assertion it tests. Risk assessment drives how much and what kind of evidence is needed. Tests of controls ask whether a control works; substantive procedures ask directly whether a balance or transaction is right. Fraud requires pressure, opportunity, and rationalization together, and auditors respond to fraud risk without ever guaranteeing fraud will be found. The audit opinion’s type depends on how material and how pervasive an issue is, not on a fixed formula.