CA Inter Audit & Ethics

Answer: Analysis of eight statements (any seven to be answered)

(a) INCORRECT. Determination of business environment complexity is NOT solely dependent on automation levels. While automation may enhance efficiency, business complexity is multifaceted and depends on factors such as: operational scope, transaction diversity, geographic presence, regulatory environment, market volatility, and product/service range. Highly automated systems can introduce additional complexities in cybersecurity, system controls, and data integrity management. Therefore, increased automation does not necessarily correlate with reduced business complexity.

(b) INCORRECT. SA 200 on Overall Objectives of the Independent Auditor explicitly states that auditors provide reasonable assurance, not absolute assurance. Audit risk cannot be reduced to zero. Audit risk comprises inherent risk, control risk, and detection risk. The auditor's scope is to detect material misstatements, but there remains an acceptable risk level that material misstatements may not be identified. Thus, the auditor cannot wholly absorb assurance of freedom from material misstatement.

(c) CORRECT. SA 320 on Materiality to Financial Statements unambiguously requires that determining materiality involves exercise of professional judgment. The determination is not mechanical or purely quantitative but requires consideration of both quantitative benchmarks (revenue, profit, equity, etc.) and qualitative factors relevant to the specific entity and engagement. Each audit requires individualized assessment of materiality thresholds.

(d) INCORRECT. Internal audit functions have a broader scope than merely evaluating internal controls. Per SA 610 and established internal audit standards, internal audit's objectives encompass: risk management assessment, governance evaluation, operational effectiveness, compliance monitoring, IT audit, and process improvement recommendations. Internal controls evaluation is only one component of the internal audit function's wider mandate.

(e) CORRECT. SA 500 on Audit Evidence confirms that when the auditor has not obtained sufficient evidence regarding existence or valuation of accounts payable, testing recorded accounts payable becomes a relevant and necessary audit procedure. Testing recorded amounts helps gather additional evidence to address the deficiency. This is a standard procedure to obtain adequate audit evidence for liability assertions.

(f) INCORRECT. Section 139(8) of the Companies Act, 2013 addresses filling casual vacancies in the auditor's office. While the provision requires companies (other than those with CAG-appointed auditors) to fill vacancies within 30 days, the additional condition "where no cost audit is conducted" is not a statutory qualifier in this section. Cost audit provisions are addressed separately under Section 148, and Section 139(8) does not make the filling of casual auditor vacancies conditional upon absence of cost audit.

(g) CORRECT. SA 500 on Audit Evidence defines sufficiency as the measure of the quantity (amount) of audit evidence required, while relevance addresses the quality (applicability to specific assertions). Sufficiency ensures the auditor has obtained adequate volume of evidence, while relevance ensures the evidence addresses the relevant audit objectives and financial statement assertions being tested.

(h) INCORRECT. SA 701 on Communication of Key Audit Matters establishes that KAM communication is a requirement, not a discretionary matter. For audits of financial statements of listed entities, communicating Key Audit Matters in the audit report is mandatory. KAM communication is not limited to modified audit opinions—it is required regardless of the audit opinion expressed. Additionally, KAM communication applies as a standard practice for listed entities, not as a subjective choice in specific circumstances.

Auditor's Key Attributes to Verify for Depreciation and Amortisation:

Existence and Ownership – The auditor must verify that all assets for which depreciation/amortisation is being charged actually exist and are owned by the entity. This involves physical verification of assets and confirmation through supporting documents like purchase invoices, title deeds, and registration certificates.

Completeness – Ensure that depreciation has been charged on all depreciable and amortizable assets in the register. Verify that no assets have been omitted from the depreciation calculation. Cross-check the fixed asset register with the depreciation schedule to identify any gaps.

Valuation of Assets – Verify the cost of acquisition of assets as recorded, including all attributable costs of bringing the asset to its working condition. Confirm that historical cost records are accurate and properly supported by documentation. For revalued assets, ensure revaluation has been done by competent professionals.

Useful Life and Residual Value – Examine the useful life estimates assigned to different categories of assets and assess their reasonableness based on industry norms, past experience, and technical obsolescence factors. Verify that residual values have been properly estimated and are not excessively high compared to the asset's nature.

Depreciation Method – Confirm that the depreciation method chosen (straight-line method, written-down value method, units of production method, etc.) is appropriate for the type of asset and is being consistently applied. Verify calculations are mathematically accurate and in accordance with the stated policy.

Consistency of Application – Check that depreciation policies have been consistently applied across the current and prior years. Any changes in depreciation method, useful life, or residual value should be identified, properly accounted for as per Ind AS 8, and adequately disclosed.

Cut-off – Verify that depreciation on assets acquired during the year has been calculated from the date of acquisition (or when the asset became available for use), and depreciation on disposed assets has been calculated only up to the date of disposal. Ensure proper treatment in transition periods.

Allocation and Classification – Ensure depreciation is properly allocated to appropriate cost centers, departments, or profit centers as per the entity's accounting system. Verify correct classification in the income statement (e.g., cost of goods sold, administrative expenses, selling expenses).

Accounting Standards Compliance – Confirm that depreciation is calculated and presented in accordance with Ind AS 16 (Property, Plant and Equipment) and Ind AS 38 (Intangible Assets). Verify compliance with the entity's stated accounting policies.

Disclosure – Review the financial statements for adequate disclosure of depreciation policies, useful lives assigned to different asset categories, depreciation methods, accumulated depreciation, and any changes in estimates. Ensure disclosures comply with relevant accounting standards.

Internal Financial Control (IFC) and Internal Controls over Financial Reporting (ICFR) are two distinct but related concepts within an organization's control environment.

Internal Financial Control is a broader system of controls designed to ensure the effectiveness and efficiency of all financial operations and processes within an organization. It encompasses controls over the entire financial management cycle, including planning, execution, monitoring, and safeguarding of assets. IFC aims to provide reasonable assurance regarding the achievement of objectives related to operational efficiency, safeguarding of resources, accuracy of financial data, and compliance with laws and regulations. It includes controls over cash management, payroll, inventory, procurement, expenditure authorization, asset protection, and all other financial processes.

Internal Controls over Financial Reporting (ICFR) is a narrower and more specific subset of controls that are designed to ensure the reliability and accuracy of financial statements and disclosures. ICFR focuses specifically on those controls that prevent or detect errors in financial data at the transaction level and ensure that financial statements are prepared in accordance with applicable accounting standards. These controls address the completeness and accuracy of financial information used in the preparation of published financial statements.

Key Differences:

Scope: IFC has a wider scope covering all financial operations and processes, while ICFR is restricted specifically to those controls that impact the financial reporting process and financial statement assertions.

Objective: IFC aims to achieve multiple objectives including operational effectiveness, asset safeguarding, regulatory compliance, and data accuracy. ICFR has a single primary objective—to ensure the reliability of financial reporting and the accuracy of financial statements.

Coverage: IFC includes controls over operational decisions, risk management, resource allocation, and efficiency improvements. ICFR is limited to controls that directly affect the financial statements or the underlying accounting records and transactions.

Regulatory Emphasis: Under the Companies Act 2013, Section 143(3)(i) (as amended), auditors are required to report on the adequacy of internal controls over financial reporting specifically. CARO 2020 requires auditors to comment on the internal control environment over financial statements. However, the broader concept of IFC is relevant to overall governance and risk management.

Examples to Illustrate: A control ensuring that purchase invoices are matched with goods receipts is both an IFC control (for operational efficiency) and an ICFR control (as it prevents overstatement of expenses). Conversely, a control over inventory management systems that tracks stock efficiently may be an IFC control but not necessarily an ICFR control unless it directly impacts financial statement values.

Conclusion: While all ICFR controls are part of IFC, not all IFC controls are part of ICFR. ICFR represents the essential controls that directly contribute to reliable financial reporting, whereas IFC represents the complete internal control architecture of an organization.