Worked Solution
✓ Verified(b) Conditions for Using Negative Confirmation Requests as Sole Substantive Audit Procedure (SA 505)
As per SA 505 – External Confirmations, negative confirmation requests may be used as the sole substantive audit procedure to address an assessed risk of material misstatement at the assertion level only when ALL of the following conditions are met:
1. Low Risk Assessment: The auditor has assessed the risk of material misstatement as low, and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion being tested.
2. Large Population of Small Homogeneous Balances: The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous account balances, transactions, or conditions. This ensures that any individual misstatement is unlikely to be material.
3. Low Exception Rate Expected: A very low exception rate is expected — meaning the auditor does not anticipate that recipients will dispute the information or that there will be numerous errors in the records.
4. No Reason to Believe Respondents Will Disregard Requests: The auditor has no reason to believe that recipients of negative confirmation requests will disregard them. This is a critical condition because negative confirmations only require a response if the recipient disagrees with the information; if they ignore the request, no assurance is obtained.
If any of the above conditions is not satisfied, the auditor should use positive confirmation requests or combine negative confirmation with other substantive procedures, as negative confirmations alone provide less persuasive audit evidence than positive confirmations.
---
(c) Examples of Audit Procedures Involving Observation or Inspection (Risk Assessment Procedures)
As part of Risk Assessment Procedures under SA 315 – Identifying and Assessing the Risks of Material Misstatement, observation and inspection support inquiries of management. Few examples include:
1. Observation of Entity's Operations and Processes: The auditor may observe how business operations are conducted, such as watching the production process, inventory handling, or sales transactions to understand the entity's business and identify risks.
2. Inspection of Documents and Records: Inspecting business plans, budgets, board minutes, contracts, and internal policy manuals to gain an understanding of the entity's objectives, strategies, and related business risks.
3. Observation of Internal Controls in Operation: Watching how internal controls are applied by entity personnel — for example, observing how a supervisor reviews and approves journal entries or how access controls over IT systems are enforced.
4. Inspection of Premises and Plant: Physically visiting the entity's premises, warehouses, or manufacturing facilities to understand the nature of the operations and the environment in which financial reporting takes place.
5. Reading Reports prepared by Management: Inspection of management information reports, internal audit reports, regulatory correspondence, or exception reports to understand the risks the management is monitoring.
These procedures help the auditor develop a comprehensive understanding of the entity and its environment, forming the foundation for identifying material misstatement risks.
---
(d) Points of Consideration While Reporting Exceptions in IT Environment and IT Controls (System Audit)
When PQR & Co. concludes that there are exceptions in the IT environment and IT controls of Forceful Limited (post-migration to SAP), the following points must be considered while assessing and reporting such findings:
1. Nature and Significance of the Exception: The auditor should clearly describe what the exception is — whether it relates to General IT Controls (access controls, change management, backup) or Application Controls (input, processing, output controls) — and assess its materiality and financial impact.
2. Root Cause Analysis: The report should identify the underlying cause of each exception — whether it is a design deficiency (control was never in place) or an operating deficiency (control exists but failed to operate effectively).
3. Impact on Data Integrity and Reliability: The auditor must evaluate whether the exception compromises the integrity, accuracy, or completeness of data processed through SAP, particularly during the migration from the manual system.
4. Frequency and Pervasiveness: Consideration should be given to how often the exception occurred and whether it is an isolated incident or a pervasive systemic issue affecting multiple modules or processes.
5. Risk to Business Continuity: Exceptions related to backup and recovery procedures, disaster recovery planning, or data security should be flagged for their potential impact on business continuity.
6. Compensating Controls: The auditor should assess whether any compensating manual or automated controls exist that mitigate the impact of the identified exception, and whether those compensating controls are effective.
7. Management Response and Remediation Plan: The report should include management's response to each exception and a recommended corrective action plan with timelines to remediate the IT control weaknesses.
Write it like this
1The skeleton
- Open each part with the SA number + full name in one breath — write 'As per SA 505 – External Confirmations' before anything else, because examiners tick the standard citation first before reading your conditions.
- List conditions for part (b) as numbered points with bold headers — don't write them as flowing prose; the ICAI model answer uses '1. Low Risk Assessment', '2. Large Population...' style, and examiners pattern-match against that structure.
- For part (c), give the procedure name bold + one explanatory line — your example must be concrete (say 'board minutes, budgets' not just 'documents'), because vague examples get half marks even if the category is right.
- For part (d), split exceptions into General IT Controls vs Application Controls in your opening line — this one classification move signals to the examiner you understand system audit scope, and everything after that reads as informed rather than guessed.
- End each part with a one-line consequence or purpose sentence — 'these conditions ensure sufficient appropriate audit evidence is obtained' ties your answer back to the audit objective and picks up the presentation mark that most students leave on the table.
2Examiner-rewarded phrases
3Common trap
Heads up — for part (b), most students list only 3 conditions and miss the fourth one: 'no reason to believe recipients will disregard the request.' That's the sneaky condition ICAI loves to test, and dropping it costs you a full mark even if your other three are perfect. Also don't mix up negative confirmations (respond only if you disagree) with positive confirmations (respond in all cases) — if you flip the definition in your intro, the rest of the answer unravels.