Quality Control and General Auditing Principles — Practice

Question 1

Explain the relationship between SQC 1 and SA 220, using the analogy of a firm-wide policy and its application to a specific engagement, and state one specific responsibility SA 220 places on the engagement partner that flows directly from an SQC 1 element.

Accepted Answer

SQC 1 establishes the firm's overall system of quality control, the policies and procedures the firm as a whole adopts across all the engagements it performs, addressing six elements including leadership responsibility for quality, ethical requirements, client acceptance and continuance, human resources, engagement performance, and monitoring; SA 220 then requires this firm-wide system to be genuinely and specifically implemented on each individual audit engagement, making the engagement partner personally responsible for ensuring the firm's general policies are actually applied to this specific engagement, rather than assuming the firm's policies somehow apply themselves automatically. One specific example flowing directly from an SQC 1 element: SQC 1's client acceptance and continuance element establishes the firm's general policy for assessing whether to accept or continue a client relationship; SA 220 then requires the engagement partner to be satisfied that appropriate acceptance and continuance procedures have actually been followed for this specific client and this specific engagement, and to determine that conclusions reached in this regard are appropriate, translating the firm's general policy into a specific, personally accountable responsibility on this particular audit.

Question 2

Explain why SQC 1 requires the engagement quality control reviewer to be a person not otherwise involved in the engagement, connecting this requirement to a specific threat from the ethics framework.

Accepted Answer

SQC 1 requires the engagement quality control reviewer to be someone not otherwise involved in the engagement specifically to avoid the self-review threat, one of the fundamental categories of threat to objectivity identified in the ethics conceptual framework, which arises when a person is called upon to re-evaluate a judgement or piece of work they themselves previously made or performed, creating a risk that they will not appropriately or objectively identify flaws in their own prior work, whether from a genuine, if unconscious, reluctance to criticise their own judgement or from a bias toward confirming that judgement was sound. If the engagement quality control reviewer had been involved in the engagement itself, and were then asked to objectively evaluate the significant judgements made and conclusions reached on that same engagement, this would create precisely this self-review threat, undermining the entire purpose of the review, which is to provide a genuinely independent, objective check on the engagement team's own judgements before the audit opinion is issued; requiring the reviewer's independence from the engagement itself is what preserves the genuine value of this additional quality control layer.

Question 3

A company's management is found to have deliberately overstated revenue through a series of fictitious sales transactions, a fraud the auditor did not detect despite performing an audit that, in every other respect, complied fully with the Standards on Auditing. Explain whether the auditor has necessarily failed in their professional responsibility under SA 240, and what specifically an auditor must demonstrate to defend having exercised appropriate care in this situation.

Accepted Answer

The auditor has not necessarily failed in their professional responsibility under SA 240 purely because a fraud went undetected, since SA 240 establishes the auditor's responsibility as obtaining reasonable assurance, not absolute assurance, that the financial statements are free from material misstatement due to fraud, and reasonable assurance is a high but not absolute level of assurance, reflecting the inherent limitations of an audit, including the fact that fraud, by its nature, involves deliberate concealment, collusion, and falsification of documents specifically designed to evade detection, making some frauds genuinely undetectable through even a properly performed audit. To defend having exercised appropriate care, the auditor must demonstrate that professional scepticism was genuinely maintained throughout the audit, that the specific, mandatory procedures SA 240 requires for management override of controls (a risk present in every audit regardless of the auditor's own specific risk assessment) were actually performed, that the auditor's risk assessment appropriately considered the possibility of fraud based on the information available at the time, and that audit procedures were designed and performed in a manner responsive to the assessed risks of material misstatement due to fraud identified during the audit; if all of this genuinely occurred and is properly documented, the auditor has discharged the SA 240 responsibility even though the specific, well-concealed fraud in question was ultimately not detected, since the standard's requirement is a professional process obligation, reasonable assurance genuinely and diligently pursued, not a strict-liability guarantee that every fraud will always be found.

Question 4

Classify each of the following as a law or regulation with a direct effect on the financial statements or one whose non-compliance may have only an indirect material effect, and state the auditor's corresponding level of responsibility for each: (a) income tax law governing the computation of the company's tax expense and tax liability; (b) an industry-specific environmental licensing requirement whose breach could result in the suspension of the company's operating licence.

Accepted Answer

(a) is a law with a direct effect on the financial statements, since income tax law directly determines the amounts recognised for current and deferred tax expense and tax liability, material figures that appear directly within the financial statements themselves; the auditor's responsibility here is to obtain sufficient appropriate audit evidence regarding the entity's compliance with the specific provisions of this law that determine these material amounts, applying essentially the same rigour to this compliance assessment as to any other material financial statement item. (b) is a law whose non-compliance may have only an indirect material effect, since the environmental licensing requirement itself does not directly determine any specific figure recognised in the financial statements, but a breach could trigger a suspension of the operating licence, which could indirectly have a material effect on the financial statements, for instance by threatening the entity's ability to continue operating (a going concern implication) or by giving rise to a contingent liability for penalties; the auditor's responsibility here is more limited, consisting of specific procedures such as inquiring of management and those charged with governance about compliance and inspecting correspondence with the relevant licensing authority, rather than the more extensive direct-verification procedures applied to the tax law example, reflecting that the auditor cannot reasonably be expected to have specialised environmental regulatory expertise to independently assess compliance with such requirements.

Question 5

Explain why SA 260 requires the auditor to communicate certain matters specifically to those charged with governance, distinct from management, using the example of significant difficulties encountered during the audit.

Accepted Answer

Those charged with governance, typically the board or audit committee, are distinct from management in having oversight responsibility for the entity's financial reporting process, including oversight of management's own conduct and the reliability of the information management provides, and SA 260 requires the auditor to communicate certain matters specifically to this governance body because information the auditor has gathered during the audit may be directly relevant to this oversight responsibility in a way management itself might have limited incentive to volunteer or emphasise, particularly where the difficulty encountered relates to management's own conduct or cooperation. A significant difficulty encountered during the audit, such as management being unwilling to provide requested information, unreasonable delays in providing needed evidence, or unnecessary restrictions imposed on the audit's scope, is precisely the kind of matter those charged with governance need to know about to properly exercise their oversight role, potentially indicating a deeper problem with management's own attitude toward transparency and cooperation with the audit process; communicating this directly to those charged with governance, rather than relying on management to relay it accurately (or at all), ensures the governance body genuinely receives information relevant to assessing whether management is discharging its own responsibilities appropriately, which is exactly the oversight function those charged with governance exist to perform.

Question 6

Two firms are jointly appointed as auditors of a large public sector bank, dividing the audit work by geographical branch coverage as agreed and documented at the outset. One firm later discovers a material misstatement in a set of branches allocated to the other firm, a misstatement that firm should have detected through properly performed procedures but did not. Explain the liability position of each firm under SA 299.

Accepted Answer

Under SA 299, each joint auditor is jointly and severally responsible for the audit as a whole, but individually responsible only for the specific work actually divided to and performed by that firm, based on the division of work agreed and documented at the outset; each joint auditor is entitled to rely on the other joint auditor's work on the divided portions allocated to them, absent any specific reason to believe that work is unreliable, and is not required to independently re-verify or re-perform the other firm's divided work as a matter of routine. Here, since the material misstatement occurred within the branches specifically allocated to, and the responsibility of, the other firm, and the firm discovering the issue had no specific reason to doubt the reliability of the other firm's work in those branches before this discovery, the firm discovering the misstatement is not individually liable for having failed to detect it, since that detection responsibility rested with the firm to whom those specific branches were allocated under the agreed division of work; the firm actually responsible for those branches bears individual responsibility for the failure to detect a misstatement it should have found through properly performed procedures, though both firms remain jointly and severally responsible for the audit opinion as a whole once issued, meaning both could potentially face consequences relating to the overall audit opinion even though individual fault for this specific failure rests with the one firm responsible for the affected branches.

Question 7

An entity outsources its payroll processing to a third-party service organisation. The user auditor needs assurance not only about the design of the service organisation's controls but also about whether those controls actually operated effectively throughout the year. Explain which type of report the user auditor should seek, and why a Type 1 report alone would be insufficient.

Accepted Answer

The user auditor should seek a Type 2 report, since a Type 2 report on the service organisation covers not only the description and design of the service organisation's controls, as a Type 1 report does, but also includes testing of the operating effectiveness of those controls over a specified period, providing evidence about whether the controls actually functioned as designed throughout the year, not merely whether they were suitably designed at a single point in time. A Type 1 report alone would be insufficient here because it addresses only the suitability of the design of the controls at a specific point in time, saying nothing about whether those controls were actually operated consistently and effectively throughout the period the payroll transactions relevant to the user entity's financial statements were processed; since the user auditor needs assurance about actual operating effectiveness across the year, not merely design adequacy at one point in time, only a Type 2 report, prepared by an independent auditor of the service organisation and covering the relevant period, provides the evidence genuinely needed to support the user auditor's own conclusions about the reliability of the payroll processing controls relevant to this audit.

Question 8

Explain why SQC 1's monitoring element requires an ongoing evaluation of the firm's quality control system, rather than treating a well-designed system, once established, as sufficient on its own.

Accepted Answer

SQC 1's monitoring element exists because a quality control system that is well-designed on paper does not guarantee that it is actually being followed, or is genuinely effective, in practice across the firm's many engagements and personnel; policies and procedures can be well-conceived yet poorly implemented, inconsistently applied, or gradually eroded over time as engagement teams face commercial pressure, time constraints, or simply human error, none of which a system's design alone can detect or correct. Monitoring requires the firm to periodically and systematically evaluate whether its policies and procedures are relevant, adequate, and operating effectively, typically through mechanisms such as periodic inspection of completed engagements, feedback from engagement teams, and root-cause analysis of any identified deficiencies, ensuring the firm learns from actual practice and continuously improves its system rather than assuming that a policy manual, once written, is self-executing; this connects directly to the broader principle, familiar from professional competence and due care, that a system's genuine reliability depends on ongoing verification of its actual operation, not merely its initial, well-intentioned design.

Question 9

A firm is approached by a prospective new audit client whose previous auditor resigned mid-engagement, citing unspecified 'professional reasons.' Explain the specific SQC 1 element engaged here, and the steps the prospective firm should take before deciding whether to accept this engagement.

Accepted Answer

This engages SQC 1's acceptance and continuance of client relationships and specific engagements element, which requires a firm, before accepting a new client, to assess whether the firm has the competence, capabilities, and resources to perform the engagement, and, critically here, to consider the integrity of the client, including matters that might call the client's integrity into question, such as the identity and business reputation of the client's principal owners and management. A resignation by the previous auditor mid-engagement, citing unspecified professional reasons, is precisely the kind of red flag this element requires the prospective firm to investigate before accepting the engagement, since a mid-engagement resignation is unusual and often indicates a serious disagreement, an unresolved integrity concern, or a scope limitation the client itself may have imposed, any of which would be directly relevant to the prospective firm's own decision. Professional standards (and, in India, Companies Act provisions on outgoing auditor communication) require the prospective auditor to communicate with the outgoing auditor before accepting the engagement, specifically to understand the reasons behind the resignation, and the prospective firm should not proceed to accept the engagement until it has made reasonable efforts to obtain this information and has satisfied itself that the reasons behind the resignation do not raise integrity or other concerns that would make accepting the engagement inappropriate.

Question 10

Classify each of the following as fraudulent financial reporting or misappropriation of assets, and explain the classification: (a) a company's finance team records fictitious sales at year end to inflate reported revenue and meet an analyst's earnings target; (b) a warehouse manager repeatedly records inventory as damaged and disposed of, when in fact the inventory is being stolen and sold personally.

Accepted Answer

(a) is fraudulent financial reporting, since the finance team's action, recording fictitious sales, is an intentional misstatement within the financial statements themselves, specifically designed to deceive users of those statements (here, to meet an analyst's earnings target) rather than to steal any physical or monetary asset for personal gain; the deception is aimed at the financial statements' users, not at extracting an asset from the entity. (b) is misappropriation of assets, since the warehouse manager is actually stealing physical inventory for personal benefit, and the false 'damaged and disposed of' records are created specifically to conceal this theft from detection, rather than to deceive users of the financial statements about the entity's genuine financial performance or position in the way fraudulent financial reporting does; the false records here are a means of concealing an asset theft, not an end in themselves designed to mislead statement users about overall performance.

Question 11

An auditor has audited the same client for eight consecutive years and has never previously identified any indication of fraud or dishonesty in management's dealings. Explain why SA 240 requires the auditor to maintain professional scepticism regardless of this positive past experience with the client.

Accepted Answer

SA 240 explicitly requires the auditor to maintain professional scepticism throughout the audit, recognising the possibility that a material misstatement due to fraud could exist, notwithstanding the auditor's past experience of the honesty and integrity of the entity's management and those charged with governance, precisely because past experience, however positive and however many years it spans, is not a reliable guarantee against fraud occurring in the current period; circumstances, incentives, and pressures on management can change over time, a previously honest individual can face new personal or business pressures creating a genuine incentive to commit fraud for the first time, and an auditor who allows years of positive past experience to substitute for genuine, current-period scepticism risks precisely the complacency SA 240 is designed to prevent. This is directly connected to the familiarity threat concept from the ethics framework: an extended relationship with the same client can create a risk that the auditor becomes too accepting of management's representations and too comfortable with the client's explanations, and SA 240's explicit instruction to maintain scepticism despite positive past experience is a direct, standard-mandated counterweight to exactly this familiarity-driven complacency risk.

Question 12

Explain what specific matters relating to independence SA 260 requires the auditor to communicate to those charged with governance, and why this communication matters even though the auditor has already internally assessed and concluded that independence is not compromised.

Accepted Answer

SA 260 requires the auditor to communicate, where applicable, matters relating to auditor independence, including a statement that the engagement team and others in the firm, as appropriate, have complied with relevant ethical requirements regarding independence, all relationships and other matters between the firm and the entity that, in the auditor's professional judgement, may reasonably be thought to bear on independence, and the related safeguards applied to eliminate or reduce identified threats to an acceptable level. This communication matters even where the auditor has already internally concluded that independence is not compromised because those charged with governance have their own oversight responsibility for the reliability of the audit itself, and genuine transparency about relationships and safeguards allows this governance body to form its own independent view about whether the auditor's independence conclusion is well-founded, rather than simply having to trust the auditor's own internal, self-assessed conclusion without visibility into the underlying facts and safeguards that conclusion rests on; this external check by those charged with governance is itself a further safeguard reinforcing genuine auditor independence, since an auditor aware that its independence assessment will be scrutinised by an informed governance body has an additional incentive to conduct that assessment rigorously and transparently in the first place.

Question 13

A payroll service organisation itself outsources part of its data processing to a further, separate subservice organisation. Explain the two approaches SA 402 permits for addressing the subservice organisation's controls within the report on the primary service organisation, and why this layered outsourcing structure adds complexity to the user auditor's evidence-gathering.

Accepted Answer

SA 402 permits two approaches for addressing a subservice organisation within a report on the primary service organisation: the 'inclusive method,' where the description of the service organisation's system and the scope of the engagement include the relevant controls at the subservice organisation as well, meaning the subservice organisation's controls are directly tested and reported on within the same report; and the 'carve-out method,' where the description of the service organisation's system identifies the nature of the services performed by the subservice organisation but excludes the subservice organisation's own controls from the scope of the report and from the opinion expressed, requiring the user auditor to separately obtain assurance about the subservice organisation's own controls if those controls are relevant to the user entity's audit. This layered outsourcing structure adds complexity to the user auditor's evidence-gathering because, under the carve-out method specifically, the user auditor cannot rely on a single report to address the entire outsourced processing chain; the auditor must separately identify whether the subservice organisation's own controls are relevant to the audit, and if so, obtain a separate report or other evidence specifically addressing those controls, effectively requiring the user auditor to trace and evaluate controls across multiple, separately reported layers of outsourcing rather than relying on one comprehensive report covering the entire chain, a materially more involved evidence-gathering exercise than a single-layer service organisation arrangement would require.

Question 14

During the course of an audit, the auditor becomes aware of information suggesting the entity may have violated an environmental regulation, a matter with only an indirect potential effect on the financial statements. Explain what SA 250 requires the auditor to do upon becoming aware of this possible non-compliance.

Accepted Answer

Upon becoming aware of information indicating possible non-compliance with a law or regulation, even one with only an indirect potential effect on the financial statements, SA 250 requires the auditor to obtain an understanding of the nature of the act and the circumstances in which it occurred, and further information to evaluate the possible effect on the financial statements, discussing the matter with management and, where appropriate, those charged with governance; the auditor is not required to actively search for non-compliance beyond the specific, limited procedures SA 250 otherwise prescribes for indirect-effect laws, but once information suggesting possible non-compliance has come to the auditor's attention through the ordinary course of the audit, the auditor cannot simply ignore it and must follow up appropriately. If the auditor suspects the non-compliance may be material, the auditor should also consider the implications for other aspects of the audit, including the risk assessment, and evaluate the adequacy of disclosure of the matter's financial consequences (such as a contingent liability for potential penalties), and, if management or those charged with governance do not provide sufficient information about the actual or suspected non-compliance, the auditor should consider obtaining legal advice about the appropriate course of action and the possible effect on the auditor's own report, including a potential modification if the matter's financial statement implications cannot be adequately resolved.

Question 15

State what the human resources element of SQC 1 requires a firm's policies to address, and one specific way this element supports the engagement performance element.

Accepted Answer

The human resources element requires the firm to have policies and procedures designed to provide reasonable assurance that it has sufficient personnel with the capabilities, competence, and commitment to ethical principles necessary to perform its engagements in accordance with professional standards and applicable regulatory requirements. This element directly supports the engagement performance element because an engagement can only be performed to the required professional standard if the specific personnel assigned to it genuinely possess the necessary technical competence and commitment to ethical behaviour in the first place; a firm's engagement performance policies, however well designed, cannot compensate for assigning personnel who lack the requisite competence or ethical commitment, making the human resources element a necessary precondition for the engagement performance element to be capable of being satisfied at all on any given engagement.

Practice — Quality Control and General Auditing Principles

Sign in to save attempts to your dashboard and track your accuracy over time

Find a verified tutor

Join a live course

Browse coaching centres

About

Categories

Support

Documentation

Get Study Tips & Updates

Download Our App

Download for iOS

Download for Android

Popular Cities