CA Inter Audit & Ethics

Reporting objectives are the specific outcomes and communications that the auditor intends to achieve through the audit engagement. The auditor considers these objectives when establishing audit strategy to determine the appropriate timing, nature, and extent of audit procedures. Here are four key instances of reporting objectives:

1. Identification and Reporting of Material Misstatements: The primary reporting objective is to identify all material misstatements in the financial statements, whether intentional or unintentional. This objective directly influences the timing of procedures (requiring substantive procedures at or near the period end, particularly for significant account balances) and the nature of audit procedures (detailed testing of transactions and balances near year-end to capture cutoff issues).

2. Fraud Detection and Reporting: Identifying fraud and determining whether it has resulted in material misstatement is a critical reporting objective. This affects audit procedures significantly—the auditor must approach the engagement with heightened professional skepticism and may employ surprise procedures (such as unannounced cash counts or inventory observations) to detect potential management or employee fraud. The nature of inquiries of management must be carefully crafted to assess fraud risk.

3. Assessment and Reporting of Going Concern Issues: Evaluating whether the entity can continue as a going concern is a mandatory reporting objective. This objective requires the auditor to perform procedures specifically timed to identify recent events (hence procedures must be performed close to the audit report date), such as subsequent losses, breach of loan covenants, or inability to secure financing. The auditor must communicate going concern issues to those charged with governance.

4. Compliance with Laws and Regulations: Identifying and reporting instances of non-compliance with applicable laws and regulations is an important reporting objective. This affects the nature of audit procedures (targeted inquiries of management regarding litigation, regulatory matters, and compliance with industry-specific regulations) and the timing of communications to ensure proper disclosure or adjustment of financial statements for the impact of non-compliance.

As an auditor of Star Ltd., the following four matters should be verified to ensure proper CSR disclosures in the notes to accounts:

1. Applicability of Section 135 - The auditor should verify whether the company meets the threshold criteria under Section 135(1) of the Companies Act, 2013. A company is covered under Section 135 if it has a net worth of ₹500 crores or more, or turnover of ₹1000 crores or more, or net profit of ₹5 crores or more during the immediately preceding financial year. Only companies meeting these criteria are required to make CSR disclosures.

2. Calculation of Prescribed CSR Expenditure - The auditor should verify that the company has correctly computed the amount required to be spent on CSR activities, which is 2% of the average net profit for the immediately preceding 3 financial years, as per Section 135(5) of the Act. The auditor should ensure this calculation is correctly disclosed in the notes to accounts.

3. Actual CSR Expenditure and Compliance - The auditor should verify the actual amount spent on CSR activities during the financial year against the prescribed amount. This includes verifying that CSR activities undertaken fall within the scope of Schedule VII of the Companies Act, 2013, and that proper records and documentation support the disclosed expenditure.

4. Unspent CSR Amount and Disclosure of Reasons - If the company has not spent the full required amount, the auditor should verify the unspent balance and ensure that proper disclosure has been made regarding reasons for non-spending. The auditor should also verify whether unspent amounts have been transferred to the prescribed funds (CSR Fund or specified bank account) as required under the Companies (Corporate Social Responsibility Policy) Rules, 2014.

Sub-part (a)(i): Is CA Y's decision correct?

CA Y's decision is not correct. Under SA 500 (Audit Evidence), the mere "availability" of audit evidence does not determine its appropriateness. Appropriateness is the measure of the quality of audit evidence — encompassing both its relevance and reliability in relation to the assertion being tested.

In this case, the documents — ledger invoices, debit notes, and credit notes — are all internally generated documents created by First Health Private Limited itself. SA 500 explicitly states that audit evidence obtained from independent external sources is more reliable than evidence generated internally by the entity. Internal documents are susceptible to management manipulation and, unless corroborated, provide a lower level of assurance.

For the assertion on book debts (primarily existence, valuation, and rights), mere availability of internal records does not constitute sufficient appropriate evidence. The auditor should have supplemented or replaced these with external confirmations from debtors (as per SA 505 – External Confirmations), or other corroborative evidence. Accepting internally generated documents simply because they are "available" is a flawed approach and may lead to insufficient audit evidence.

Sub-part (a)(ii): How should an auditor select the most appropriate evidence?

When testing the accuracy of any assertion, the auditor must exercise professional judgment to select evidence that is both sufficient (quantity) and appropriate (quality). SA 500 provides the following guidance:

1. Relevance: The evidence must logically relate to the assertion being tested. For example, to test the valuation of book debts, an aged debtors' report and provision workings are relevant; a purchase invoice is not.

2. Reliability — key factors to consider:
- Evidence from independent external sources (e.g., bank confirmations, debtor responses) is more reliable than internally generated evidence.
- Evidence obtained directly by the auditor (e.g., physical inspection, direct observation) is more reliable than evidence obtained from the entity.
- Documentary evidence is more reliable than oral evidence.
- Original documents are more reliable than photocopies or scanned reproductions.
- Evidence is more reliable when the entity's internal controls over its generation are strong.

3. Use of Multiple Sources: When evidence from one source is inconsistent with evidence from another, the auditor must perform additional procedures to resolve the inconsistency (SA 500).

4. Cost-Benefit Consideration: While reliability drives selection, the auditor also considers practical constraints, but this cannot justify accepting evidence of poor quality.

In summary, the auditor should move from a pyramid of evidence — prioritising external, independently obtained, original documentary evidence over internal, entity-prepared records — to form a well-grounded opinion on each assertion.

---

Sub-part (b): Types of Controls in an Automated Environment and Classification

Under SA 315 (Identifying and Assessing the Risks of Material Misstatement), controls in an automated IT environment are classified into two broad types:

1. General IT Controls (GITCs): These are policies and procedures that relate to the overall IT environment and support the effective functioning of application controls. They include access security, data centre operations, program change management, and IT operations.

2. Application Controls: These are automated controls embedded within specific business process applications. They govern input, processing, and output of transactions and data — ensuring completeness, accuracy, and validity.

Mapping of Column A to Column B:

Rationale:
- Access security governs who can access the IT systems at an infrastructure level — a GITC.
- Sequence number checks ensure completeness of transaction processing (e.g., no invoice numbers missing) — an Application Control embedded in the transaction cycle.
- Data centre and network operations deal with physical and operational security of IT infrastructure — a GITC.
- Mandatory data fields enforce that certain fields must be filled before a transaction can be saved, ensuring data completeness at input — an Application Control.