Chapter 7 - Planning

Question 1

Why is it important to plan an audit? (8)

Answer 1

Planning an audit is crucial because it ensures the audit process is efficient, effective, and meets its objectives. Here are key reasons why audit planning is important:

SERIF MEI

• S – Scope and Objectives: Planning helps auditors clearly understand the purpose, scope, and specific objectives of the audit.
• E – Ensures Compliance: Planning ensures the audit follows regulatory requirements, professional standards, and internal policies.
• R – Resources Efficiently: Proper planning ensures that the right personnel, time, and resources are allocated to the audit, reducing inefficiencies.
• I – Identifies Risks: It allows auditors to assess potential risks and areas of concern, focusing on critical aspects that might impact financial statements or operations.
• F – Facilitates Problem Resolution: Identifying potential issues early allows for better resolution strategies before they escalate.
• M – Minimizes Disruptions: Effective planning reduces disruptions to daily business operations by scheduling audit activities appropriately.
• E – Enhances Communication: It facilitates clear communication with management and key stakeholders about the audit process, expectations, and timelines.
• I – Improves Audit Quality: A well-planned audit ensures thorough testing, minimizes errors, and enhances the credibility of audit findings.

Question 2

What is an audit strategy? (6)

Answer 2

The audit strategy is a high-level approach that outlines the overall direction of the audit. It provides a framework for the audit plan and considers materiality, risk, audit approach, experts, timing, team, budgets and the deadlines of the audit and guides the development of the audit plan.

Key Elements of an Audit Strategy:

SORRTA

• S- Scope of the Audit – Defines the extent and boundaries of the audit.
• O - Objectives – Determines what the audit aims to achieve.
• R - Risk Assessment– Identifies significant risks and how they will be addressed.
• R - Resources & Team Allocation – Assigns responsibilities to auditors.
• T - Timing & Deadlines – Establishes key milestones for the audit process.
• A - Audit Approach – Decides between a substantive or control-based audit approach.

Question 3

What is an audit plan? (6)

Answer 3

The audit plan is a detailed roadmap that outlines the specific procedures and steps to be performed during the audit. It is derived from the audit strategy and provides practical guidance to the audit team.

Key Elements of an Audit Plan:

SCART

• S - Sampling Techniques – Describes the methods used to select audit samples.
• C - Communication Plan – Details how findings will be reported to stakeholders.
• A - Audit Procedures – Lists the specific tests and verification steps for transactions, controls, and balances.
• R - Resource Allocation – Specifies roles and responsibilities of audit team members.
• T - Timeline – Defines the schedule and deadlines for various audit phases.

Question 4

What is materiality?

Answer 4

According to ISA 320, materiality is:

“Misstatements, including omissions, are considered to be material if they, individually or in the aggregate, could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements.”

This means that an error or omission is material if it could impact the decision-making of financial statement users, such as investors, regulators, or management.

Question 5

What determines if a balance is material?

Answer 5

By definition, a material are misstatements, including omissions, that individually or in the aggregate, could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements

Therefore items might be material due to their:
* Amount/value/quantity
* Nature/quality

Question 6

What are the standard benchmark ranges used to determine the level of materiality based on value in an audit?

Answer 6

Question 7

What are the common matters considered material by nature in an audit?

Answer 7

• Misstatements which affect compliance with regulatory requirements
• Misstatements which impact on debt covenants
• Misstatements which obscure a change in earnings or affect ratios used to evaluate the entity
• Misstatements which affect management compensation

Question 8

When is materiality determined in an audit, can it be adjusted, and does it apply uniformly across all audit areas?

Answer 8

Materiality is set during the planning stage of the audit to help focus on significant misstatements. It can be adjusted if new information arises during the audit. However, a single materiality level may not be appropriate for all areas; auditors often use performance materiality for specific accounts or transactions to ensure undetected errors remain below overall materiality.

Question 9

What is performance materiality?

Answer 9

When the auditor plans an audit the overall risk of material misstatement based on the financial statements as a whole may be low leading to planning materiality being set as high. However this high level of materiality may not be appropriate for auditing all elements of the financial statements as certain elements may be high risk leading to their under auditing.

As a result the auditor should use a figure lower than planning materiality to audit these riskier assertions to ensure their appropriate auditing. This is performance materiality.

Question 10

What is sustainability materiality and how do auditors assess it?

Answer 10

Sustainability materiality considers whether omitting, misstating, or obscuring sustainability information could influence users’ decisions. Auditors assess it alongside traditional materiality when reviewing financial and sustainability-related disclosures.

Question 11

What is ‘double materiality’ in the context of sustainability reporting?

Answer 11

Double materiality is a key concept in sustainability reporting that recognises two dimensions of materiality:

• Financial materiality: When sustainability issues (e.g. climate risk, regulation, supply chain disruption) could impact the company’s financial performance or position—relevant to investors and creditors.
• Impact materiality: When the company’s operations have a material impact on people or the environment—relevant to wider stakeholders like regulators, communities, and NGOs.

This dual perspective ensures that both the risks to the business and the company’s impact on society are considered in sustainability disclosures.

Question 12

What are analytical procedures? Why are they used at the planning stage?

Answer 12

Analytical procedures involve evaluating financial information by studying relationships between data, trends, and expected patterns to identify anomalies or inconsistencies.

Auditors will use these in the planning to understand the business and identify potential risks.

Question 13

Outline the key benefits and limitations of analystical procedures at the planning stage of an audit (5-5)

Answer 13

Benefits:
* Identifies Risk Areas – Helps the auditor pinpoint material areas that need further work.
* Detects Unusual Items – Highlights inconsistencies or oddities in relation to the overall accounts.
* Finds Hidden Errors – May uncover errors not identified through detailed testing.
* Uses External Information – Leverages data (e.g., budgets, industry trends) outside of the accounting records, reducing reliance on the preparer.
* Enhances Business Understanding – Assists auditors in gaining insights into the client’s business operations and performance.

Limitations:
* Requires Knowledge of the Business – A deep understanding of the client is needed to interpret results accurately.
* Risk of Concealed Errors – Consistency in results might mask significant errors.
* Potential for Mechanical Execution – There’s a risk of performing procedures without adequate professional skepticism.
* Requires Experienced Staff – Needs skilled auditors to apply procedures effectively.
* Availability of Reliable Data – Reliable external data may not always be accessible for comparison.

Question 14

What are the key ratio types we look at in this course? State what aspect of financial statements they help the auditor assess

Answer 14

• Perfomance ratios - helps the auditor assess the company’s ability to generate profit.
• Liquidity ratios - help the auditor assess how easily a company can meet its obligations, and how the company manages its working capital
• Long term solvency ratios - Help the auditor assess the company’s ability to meet its long-term debt obligations
• Efficiency ratios - Help the auditor assess how effectively the company uses its assets and resources to generate revenue

Question 15

Outline the perfomance ratios

Answer 15

• Gross profit margin
• Operating profit margin
• Operating cost percentage
• Return on capital employed

Question 16

Define gross profit margin, including the equation

Answer 16

It measures the efficiency of a company in producing goods or services relative to its revenue.

Question 17

Define operating profit margin, including the equation

Answer 17

It measures a company’s ability to generate profit from its core business operations, excluding the impact of financing and tax expenses.

Question 18

Define operating cost percentage, including the equation

Answer 18

It measures the proportion of revenue that is consumed by operating costs, indicating how efficiently a business controls its operating expenses.

Question 19

Define return on capital employed, including the equation

Answer 19

It measures how efficiently a company is generating profit from the capital it has invested in the business. It’s a key indicator of profitability and capital efficiency.

Question 20

Outline the liquidity ratios

Answer 20

• Current ratio
• Quick ratio (acid test)

Question 21

Define current ratio, including the equation

Answer 21

It measures a company’s ability to meet its short-term obligations using its short-term assets. It indicates liquidity and short-term financial health.

Question 22

Define quick ratio, including the equation

Answer 22

It measures a company’s ability to meet its short-term liabilities using its most liquid assets, excluding inventory. It’s a stricter test of liquidity than the current ratio.

Question 23

Outline the long term solvency ratios

Answer 23

• Gearing ratio
• Interest cover ratio

Question 24

Define gearing ratio, including the equation

Answer 24

It measures the proportion of a company’s capital that is financed through debt compared to equity. It indicates the financial risk and long-term solvency of the business.

Question 25

Define interest cover ratio, including the equation

Answer 25

It measures how easily a company can pay its interest expenses from its operating profit. It indicates the company’s ability to service its debt obligations.

Question 26

Outline the efficiency ratios

Answer 26

* Net asset turnover ratio * Inventory period * Inventory days * Trade receivable period * Trade payable period

Question 27

Define net asset turnover ratio, including the equation

Answer 27

It measures how efficiently a company uses its net assets to generate revenue. It indicates asset utilisation and operational efficiency.

Question 28

Define inventory period, including the equation

Answer 28

It measures the average number of days it takes a company to sell its inventory. It reflects inventory management efficiency and how quickly stock is converted into sales.

Question 29

Define inventory turnover, including the equation

Answer 29

It measures how many times a company sells and replaces its inventory during a given period. It reflects inventory efficiency and how well stock is being managed relative to sales activity.

Question 30

Define trade payable period, including the equation

Answer 30

It measures the average number of days a company takes to pay its suppliers. It reflects how the business manages its cash flow and relationships with creditors.

Question 31

Define trade receivable period, including the equation

Answer 31

It measures the average number of days it takes a company to collect payment from its customers after a sale. It indicates the effectiveness of credit control and cash collection processes.

Question 32

How is Audit Data Analytics used in the planning of an audit?

Answer 32

Audit Data Analytics (ADA) is used during audit planning to analyse large volumes of both structured data (e.g. accounting records) and unstructured data (e.g. emails, social media posts, images). It helps auditors to: * Identify patterns, anomalies, and correlations * Detect red flags or deviations from expected outcomes * Gain early insight into areas of risk or potential misstatement By doing so, auditors can better tailor their audit approach, focusing on high-risk areas and increasing audit efficiency and effectiveness.

Question 33

What types of data can auditors use for data analytics in audit planning, and why?

Answer 33

Auditors can now analyse a wider range of data sources, including: * Email – May reveal customer complaints or internal control concerns. * Social media – Can highlight reputational risks, customer dissatisfaction, or trends that impact financial reporting. * Electronic records – Provide access to large volumes of transaction data, often in real time. * Mobile technology & location tracking – Offers insights into asset usage, employee activity, or supply chain issues. These sources help auditors develop a richer, more dynamic understanding of business risks and operations before audit testing begins.

Question 34

What is cyber security and why is it important in audit planning?

Answer 34

Cyber security protects IT systems from unauthorised access, fraud, viruses, and other threats. It’s important in audit planning because breaches can lead to data loss, legal penalties, operational disruption, and reputational damage—auditors must consider cyber risks when assessing internal controls.

Question 35

What are four key cyber security challenges identified by the ICAEW, and what recommendations are made to address them?

Answer 35

* **Communication is a key barrier** – Cyber security language can be overly technical and hard to understand. **Recommendation**: Appoint a Chief Information Security Officer (CISO) to translate complex language and make it more accessible. * **Responsibility and accountability** – Without clear ownership, cyber security can be overlooked. **Recommendation**: Employ dedicated cyber security professionals (in-house or outsourced) to take responsibility for managing cyber risk. * **Board-level accountability** – Cyber risk is often not integrated into overall risk governance. **Recommendation**: Boards should regularly consider cyber risk and ensure it is embedded in day-to-day risk management. * **Lack of knowledge** – Non-executive directors and audit committees may not have the expertise to oversee cyber security. **Recommendation**: Provide training and expert support to help board members understand and fulfil their oversight role.

Question 36

Name and explain key approaches business can take to combat IT risk and improve IT security (8)

Answer 36

* **Business Continuity Planning** – Involves preparing for major IT failures (e.g. cyberattacks, system crashes) to ensure the business can continue operating. This includes backup systems, recovery plans, and crisis response procedures. * **System Access Controls** – Focuses on controlling who can access systems and data. This includes passwords, multi-factor authentication, and user permissions to prevent unauthorised use or data breaches. * **Systems Development and Maintenance** – Ensures all systems are regularly updated and patched to fix vulnerabilities and maintain protection against evolving threats. * **Physical Security** – Protects hardware and devices from theft or tampering. This may include locked server rooms, CCTV, security staff, and access control systems. * **Compliance** – Ensures the organisation complies with legal and regulatory requirements, especially those related to data protection laws like the UK GDPR. * **Security Policy** – A formal, written policy that outlines the organisation’s approach to IT and data security. It sets expectations for staff behaviour and outlines procedures for dealing with security threats. * **Asset Classification and Control** –Recognises information as a valuable asset. Each piece of data should have an assigned owner responsible for its protection, access, and classification based on sensitivity. * **Personnel Security** – Ensures only trusted and properly trained staff have access to systems. Includes background checks, staff training, and clearly defined responsibilities to reduce internal threats.

Question 37

What is cloud computing and how is it relevant to audit planning?

Answer 37

Cloud computing delivers services (e.g. storage, software, processing power) over the internet without the need for physical infrastructure. In audit planning, it’s relevant because client data may be stored remotely, which impacts how auditors access and obtain sufficient, appropriate audit evidence.

Question 38

What are the key challenges when auditing cloud-based systems, and why do they matter?

Answer 38

* **Third-party access dependencies** – Many companies outsource their accounting systems to third-party providers using cloud platforms. This means auditors may not have direct control over where or how data is stored. Auditors must plan for remote access and may face delays or complications obtaining sufficient and appropriate audit evidence. They need to coordinate with third parties to ensure access is granted and reliable data is available. * **Security and certification concerns** – Cloud systems often hold external certifications like SOC2, which can be helpful for assessing data security and integrity. However, cloud environments involve strict security protocols and permission controls. Auditors may need to go through complex procedures to access data securely. They must also evaluate whether the client's cloud provider meets necessary security standards, especially regarding confidentiality, integrity, and availability of data.

Question 39

What should auditors consider when auditing clients using cloud systems, and why?

Answer 39

* **Understanding the cloud system’s structure** – Auditors need to grasp how the cloud platform operates, where data is stored, and how it flows through the system. This ensures the auditor applies the right audit procedures and understands any system limitations that could affect evidence gathering. * **Timing of data access** – Cloud systems may have restricted access windows or require special arrangements for pulling data. Auditors need to factor this into their planning and scheduling to avoid delays or missing critical data for testing. * **Staff expertise** – Audit teams must have the technical knowledge to understand and assess cloud systems. Lack of understanding may lead to inadequate testing or failure to recognise security risks and data integrity issues. * **Storage and security of audit evidence** –Auditors should know where and how evidence collected from the cloud will be stored and protected so as to maintain audit trail integrity, confidentiality, and compliance with audit standards. * **Security and access risks** – Auditors must ensure any data access and usage complies with client security policies and does not compromise sensitive information. This is to protect against data breaches, unauthorised access, and to uphold professional and legal responsibilities.