Foundations of Audit and Assurance

Introduction and context

Modern organisations depend on information. Investors decide whether to provide capital, lenders assess credit risk, regulators monitor compliance, boards evaluate management, and citizens judge the stewardship of public resources. Much of this decision-making relies on information prepared by one party and used by another. Because information providers may possess better knowledge, have incentives to present results favourably, or make unintentional errors, users seek independent confidence in its reliability.

Audit and assurance engagements respond to this need. They do not eliminate business risk, guarantee future success, or replace management responsibility. Rather, they improve the credibility of information by applying professional judgement, evidence-gathering procedures, ethical requirements and reporting standards.

For a post-graduate accountant, audit must therefore be understood both technically and institutionally. It is a professional service, a governance mechanism, an element of capital-market infrastructure and a social process shaped by regulation, technology and public expectations.

Learning objectives

By the end of this chapter, you should be able to:

• explain the purpose, historical development and social value of audit;
• distinguish audit, review and other assurance and related services;
• apply agency theory, accountability theory and expectation-gap theory;
• explain reasonable and limited assurance and the effect of assurance level on procedures and conclusions;
• evaluate the responsibilities of management, those charged with governance and the practitioner;
• identify ethical, regulatory, technological and practical limitations of assurance engagements.

1. The nature and purpose of audit

An audit is a systematic process of obtaining and evaluating evidence about information, particularly financial statements, to determine whether that information has been prepared in accordance with an applicable financial reporting framework and to report a conclusion that enhances users’ confidence.

A financial statement audit generally involves:

1. identifying the intended users and the applicable reporting framework;
2. assessing risks of material misstatement;
3. designing and performing procedures responsive to those risks;
4. evaluating whether sufficient appropriate evidence has been obtained;
5. considering materiality, misstatements, going concern and relevant disclosures; and
6. expressing an independent opinion in a formal report.

The audit opinion provides reasonable assurance—not absolute assurance—that the financial statements as a whole are free from material misstatement, whether caused by fraud or error. “Material” means capable of influencing the economic decisions of users. Materiality is therefore a matter of professional judgement, affected by magnitude, nature and context.

Management’s responsibility and the auditor’s responsibility

Management is responsible for preparing the financial statements, selecting appropriate accounting policies, maintaining relevant internal control and making appropriate estimates and disclosures. Those charged with governance oversee the financial reporting process and the relationship with the auditor.

The auditor’s responsibility is to obtain sufficient appropriate audit evidence and form an independent conclusion. The auditor does not prepare the statements for management, guarantee that every fraud will be detected, or assume responsibility for the entity’s operations.

Why independent audit is valuable

Audit creates value through several connected mechanisms:

• Information credibility: independent testing reduces uncertainty about reported information.
• Stewardship: managers are more accountable when their reports are subject to scrutiny.
• Capital-market efficiency: credible reporting can reduce information risk and improve resource allocation.
• Control improvement: audit findings may identify weaknesses in systems and processes.
• Regulatory confidence: audited information supports supervision and public accountability.
• Behavioural discipline: the prospect of independent examination can deter misstatement and misconduct.

These benefits are not automatic. They depend on auditor competence, independence, professional scepticism, appropriate evidence and effective regulation.

2. Historical development of auditing

Auditing has ancient roots in the practice of checking records and orally reporting financial accounts. In early administrative systems, independent checking helped rulers and public officials control taxation, inventories and expenditure. The term “audit” derives from the Latin audire, meaning “to hear”, reflecting the historical practice of hearing accounts presented by custodians.

The modern audit evolved alongside commercial enterprises and the separation of ownership from management. During the nineteenth century, industrialisation, joint-stock companies and expanding capital markets increased the need for independent examination. Legislation in several jurisdictions progressively required companies to prepare accounts and, in specified circumstances, obtain an audit.

Early audits often concentrated on detecting fraud and errors through detailed checking of transactions. As organisations grew, complete verification became impractical. Auditors increasingly adopted sampling, internal-control evaluation and risk-based approaches. The focus shifted from verifying every transaction to obtaining persuasive evidence about risks of material misstatement.

Contemporary auditing is shaped by international standards, national company law, securities regulation, professional ethics and public-interest oversight. Digital accounting systems, continuous data streams, cybersecurity risks, climate-related reporting and complex estimates have broadened the auditor’s evidence environment. Nevertheless, the central purposes remain independence, evidence-based evaluation and enhanced confidence in information.

3. Audit, review and other engagements

“Assurance engagement” is the broad category. In an assurance engagement, a practitioner obtains sufficient appropriate evidence to express a conclusion designed to enhance the confidence of intended users, other than the responsible party, about the outcome of evaluating a subject matter against suitable criteria.

The principal elements are:

• Three-party relationship: practitioner, responsible party and intended users;
• Subject matter: for example, financial statements, controls, sustainability information or compliance;
• Suitable criteria: rules or benchmarks against which the subject matter is evaluated;
• Evidence: information supporting the evaluation; and
• Written assurance report: communicating the conclusion.

Comparison of common engagements

A review is not a lesser-quality audit. It is a different engagement with a different objective, evidence base, cost and conclusion. Review procedures generally include enquiry and analytical procedures but do not ordinarily provide the same depth of evidence as an audit. The conclusion is expressed negatively: the practitioner states that nothing has come to their attention indicating material misstatement, rather than positively stating that the information is fairly presented.

Agreed-upon procedures are frequently useful where users need specific factual findings—for example, checking whether selected grant expenditures are supported by invoices. The practitioner reports procedures performed and findings observed. Users draw their own conclusions; the practitioner does not provide assurance.

Compilation engagements involve assisting management in presenting financial information. Because the practitioner does not obtain assurance, independence requirements and reporting language differ from an audit or review, although ethical competence and care remain important.

4. Assurance concepts and the assurance model

Assurance is fundamentally about reducing information risk. Information risk is the possibility that information used for a decision is materially wrong or misleading. A useful conceptual relationship is:

This is a conceptual model, not a measurement equation. “Inherent information risk” refers to the risk before assurance procedures, while “risk reduction from assurance” represents the persuasive effect of evidence and professional evaluation. The relationship assumes that assurance procedures are relevant and competently performed; it does not imply that risk can be reduced to zero.

Assurance quality depends on:

• competence and professional judgement;
• independence and objectivity;
• a clear and suitable subject matter;
• reliable criteria;
• sufficient appropriate evidence;
• professional scepticism;
• effective communication; and
• quality control and engagement supervision.

Evidence and professional scepticism

Sufficient evidence concerns quantity; appropriate evidence concerns relevance and reliability. Evidence from independent external sources may be more persuasive than internally generated evidence, although reliability depends on circumstances. Inspection, observation, external confirmation, recalculation, reperformance, analytical procedures and enquiry may all be used.

Professional scepticism is an attitude involving a questioning mind and a critical assessment of evidence. It requires the auditor to remain alert to contradictory information, conditions suggesting fraud and evidence that is less reliable than expected. Scepticism does not mean assuming dishonesty; it means avoiding unjustified acceptance.

Materiality and audit risk

Materiality connects professional judgement to user decisions. An error can be quantitatively small but qualitatively material—for example, an error that changes a profit into a loss, conceals a breach of covenant or affects directors’ remuneration.

Audit risk is commonly described conceptually as the risk that an inappropriate opinion is expressed when the financial statements contain a material misstatement. It reflects inherent risk, control risk and detection risk. These components support audit planning, but they are not precise, objectively measurable quantities in ordinary engagements. The auditor responds to assessed risks by changing the nature, timing and extent of procedures.

5. Reasonable and limited assurance

Reasonable assurance is a high, but not absolute, level of assurance. The practitioner obtains sufficient appropriate evidence to reduce engagement risk to an acceptably low level and expresses a positive conclusion.

Limited assurance is a lower level of assurance than reasonable assurance. The practitioner performs fewer or less extensive procedures, commonly centred on enquiry and analytical review, and reduces engagement risk to a level acceptable for a limited-assurance conclusion. The conclusion is generally expressed in negative form.

The distinction is not simply the number of procedures. The nature, timing and extent of work depend on subject matter, criteria, risk, materiality, professional judgement and the intended users’ needs.

6. Agency theory and accountability

Agency theory

Agency theory examines the relationship between a principal, who delegates authority, and an agent, who exercises that authority. In a company, shareholders are principals and directors or managers are agents. Information asymmetry arises because managers usually know more about operations than external owners. Managers may also have incentives to pursue personal objectives, manipulate performance measures or conceal poor decisions.

Audit is one governance response to this problem. It reduces information asymmetry and supports monitoring. It may also reduce agency costs by increasing confidence among shareholders, lenders and other stakeholders. However, audit cannot remove conflicts of interest. It provides evidence-based assurance about selected information, not constant observation of every managerial action.

Accountability theory

Accountability is the obligation to explain and justify conduct, accept responsibility and face consequences. It is broader than financial reporting. Public bodies, charities and companies may be accountable for legality, stewardship, performance, sustainability and social impact.

Audit strengthens accountability by creating a formal examination of reported information. The auditor’s report gives users a basis for questioning management and governance. In public-sector settings, accountability may extend to taxpayers and service users who do not directly contract with management.

A useful accountability chain is:

Figure: Assurance within the accountability relationship.

7. The expectation gap

The expectation gap is the difference between what users believe auditors should do and what auditors are required or able to do. It is not one single gap but a useful framework for analysing several differences:

• Reasonableness gap: users expect more than an audit can realistically provide, such as a guarantee that the entity will remain solvent.
• Standards gap: users expect responsibilities that professional standards do not require.
• Performance gap: auditors fail to perform work required by standards or fail to communicate adequately.

The gap may arise because users misunderstand reasonable assurance, materiality, sampling, management’s responsibilities or the distinction between fraud prevention and fraud detection. It may also arise from poor audit quality or unclear reporting.

Reducing the gap requires action by several parties: clearer auditor reports, stronger education, transparent communication by management, effective audit committees, robust standards and enforcement against poor performance. The solution is not to promise absolute assurance, which is impractical and potentially misleading.

8. Social value, ethics and public interest

Audit has a public-interest dimension because users beyond the audit client may rely on the report. Independence is therefore essential. A practitioner should identify and evaluate threats such as self-interest, self-review, advocacy, familiarity and intimidation. Safeguards may include independent review, rotation policies, restrictions on non-audit services and removal of conflicted personnel.

Core ethical principles commonly include integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. Confidentiality does not prevent compliance with legal reporting obligations, professional requirements or legitimate regulatory investigations.

Audit also has limitations. It is subject to sampling risk, the possibility of management override, collusion, concealment, estimation uncertainty, time constraints and imperfect evidence. A clean opinion does not mean that the entity is profitable, well managed, free from fraud or certain to continue indefinitely.

9. Technology, data and contemporary assurance

Digital systems have changed both the risks faced by organisations and the methods available to auditors. Enterprise systems create extensive electronic records; automated controls can process thousands of transactions; data analytics can identify unusual patterns; and artificial intelligence can assist risk assessment and document review.

Technology does not remove the need for professional judgement. Auditors must assess data completeness and accuracy, understand algorithms, protect confidential information, evaluate access controls and avoid treating a correlation as proof of misstatement. Automated procedures may test an entire population, but the auditor still needs to determine whether the population is appropriate, whether the rule is valid and how exceptions should be investigated.

Emerging assurance areas include sustainability reporting, greenhouse-gas emissions, cyber controls, digital assets and algorithmic governance. These engagements require suitable criteria, reliable measurement methods and clear boundaries around what is assured. Assurance over non-financial information may involve significant estimation and different levels of maturity in systems and controls.

10. Illustrative case: Northbridge Community Energy Ltd

Background. Northbridge Community Energy Ltd operates renewable-energy projects and is seeking a bank loan. Its directors prepare annual financial statements under the applicable reporting framework. The bank requests an audit because it will rely on reported assets, revenue and debt obligations.

Problem. Revenue includes estimates for electricity generated but not yet invoiced. The company also capitalises development expenditure and has a large loan covenant based on adjusted earnings. Management argues that a review would be sufficient because the company is small.

Analysis. The bank is an intended external user requiring a high degree of confidence. The estimated revenue and capitalised expenditure are risk areas because they involve judgement and could affect covenant compliance. The auditor must understand the reporting framework, test relevant controls, examine contracts and generation records, evaluate estimates, inspect supporting invoices and confirm loan terms. The auditor must remain alert to management bias because covenant pressure creates an incentive to overstate earnings.

A review would normally involve less extensive enquiry and analytical procedures. It could be appropriate for some users, but it would not satisfy the bank’s stated need for reasonable assurance if the bank’s lending decision depends significantly on the financial statements.

Approach and outcome. The auditor obtains evidence from independent meter data, subsequent invoices, engineering reports and lender confirmations. An error in capitalised expenditure is identified and corrected. The final statements are materially reliable, and the auditor issues an unmodified opinion. The auditor also communicates a control deficiency concerning approval of project costs.

Learning points. The engagement is selected according to user needs, not merely company size. Estimates and covenants require scepticism. Assurance improves confidence but does not guarantee future cash flows or prevent all fraud. Corrective communication about controls can create value beyond the opinion itself.

11. Professional best practices

Effective assurance work is supported by the following practices:

1. agree the engagement’s scope, subject matter, criteria and intended users clearly;
2. preserve independence in fact and appearance;
3. understand the entity, its environment, governance and information systems;
4. identify risks before selecting procedures;
5. link procedures to assertions and assessed risks;
6. obtain evidence that is sufficient in quantity and appropriate in quality;
7. document significant judgements and contradictory evidence;
8. communicate with those charged with governance throughout the engagement;
9. use technology with controls over data integrity, access and confidentiality; and
10. explain clearly what the conclusion does and does not mean.

Chapter Summary

Audit is an independent, systematic evaluation of information that enhances users’ confidence. Its historical development reflects the growth of commerce, separation of ownership from management and increasing public reliance on reported information. Assurance engagements require a practitioner, responsible party, intended users, subject matter, suitable criteria, evidence and a conclusion.

A financial statement audit provides reasonable assurance and a positive opinion; a review provides limited assurance and a negative-form conclusion; agreed-upon procedures and compilation provide no assurance conclusion. Agency theory explains how audit addresses information asymmetry and monitoring problems, while accountability theory highlights the obligation to explain and justify stewardship. The expectation gap arises when users’ expectations exceed auditors’ responsibilities or when auditors fail to meet professional requirements.

Audit creates social value through credibility, accountability, governance and improved information, but it is not a guarantee of solvency, honesty or future success. Independence, ethics, professional scepticism, materiality and evidence remain central, while technology and emerging sustainability and cyber risks are expanding the assurance profession.

Key Terms

Audit: An independent evaluation of information resulting in an assurance opinion.

Assurance engagement: An engagement designed to enhance intended users’ confidence in evaluated subject matter.

Reasonable assurance: A high, but not absolute, level of assurance.

Limited assurance: A lower level of assurance, commonly reported in negative form.

Materiality: The significance of an omission or misstatement to users’ decisions.

Information risk: The risk that information used for decisions is materially wrong or misleading.

Professional scepticism: A questioning mind and critical assessment of evidence.

Sufficient appropriate evidence: Evidence adequate in quantity and relevant and reliable in quality.

Agency theory: A theory concerning conflicts and information asymmetry between principals and agents.

Accountability: The obligation to explain, justify and accept responsibility for conduct.

Expectation gap: The difference between users’ expectations and auditors’ actual responsibilities or performance.

Independence: Freedom from relationships or interests that compromise objectivity.

Responsible party: The party responsible for the underlying subject matter.

Intended users: Persons for whom the assurance report is prepared.

Suitable criteria: Benchmarks used to evaluate subject matter.

Review engagement: A limited-assurance engagement based mainly on enquiry and analytical procedures.

Agreed-upon procedures: An engagement reporting factual findings without an assurance conclusion.

Compilation: Assistance in presenting information without providing assurance.

Audit risk: The risk of expressing an inappropriate opinion when material misstatement exists.

Those charged with governance: Persons responsible for overseeing strategic direction and accountability, including financial reporting.

Review Questions

5 Short Answer Questions

1. What is the principal purpose of a financial statement audit?
2. Distinguish sufficient evidence from appropriate evidence.
3. What is meant by reasonable assurance?
4. Identify two components of the expectation gap.
5. Why is auditor independence important?

5 Long Answer Questions

1. Explain how the historical development of audit reflects changes in ownership, commerce and regulation.
2. Compare audit, review, agreed-upon procedures and compilation engagements.
3. Analyse how agency theory explains the demand for audit.
4. Discuss the social value and limitations of audit.
5. Explain the relationship between materiality, professional scepticism and audit evidence.

3 Analytical / Application Questions

1. A lender requests confidence in a small company’s financial statements, while management proposes a review to reduce cost. Evaluate which engagement is appropriate and explain why.
2. An auditor discovers that management has used aggressive revenue estimates to avoid breaching a loan covenant. Analyse the ethical, evidential and reporting implications.
3. A public body publishes sustainability indicators generated by an automated system. Design an assurance approach, identifying suitable criteria, data risks, evidence needs and communication issues.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the purpose of a financial statement audit?

A. To guarantee that the entity will remain profitable

B. To prepare the financial statements on behalf of management

C. To enhance users’ confidence by expressing an evidence-based opinion

D. To detect every instance of fraud

Correct Answer: C. To enhance users’ confidence by expressing an evidence-based opinion

Question 2

Which engagement normally provides limited assurance?

A. A financial statement audit

B. A review engagement

C. An agreed-upon procedures engagement

D. A compilation engagement

Correct Answer: B. A review engagement

Question 3

In agency theory, the auditor primarily helps address which problem?

A. The absence of accounting standards

B. Information asymmetry between principals and agents

C. The need to operate production machinery

D. The elimination of all business risk

Correct Answer: B. Information asymmetry between principals and agents

Question 4

Which conclusion is characteristic of limited assurance?

A. The statements are guaranteed to be accurate

B. We certify that no fraud exists

C. Nothing has come to our attention indicating material misstatement

D. The entity will continue as a going concern

Correct Answer: C. Nothing has come to our attention indicating material misstatement

Question 5

What does professional scepticism require?

A. Assuming that management is dishonest

B. Accepting internally generated evidence without question

C. A questioning mind and critical assessment of evidence

D. Testing every transaction in the population

Correct Answer: C. A questioning mind and critical assessment of evidence

Question 6

Which party is primarily responsible for preparing financial statements?

A. The external auditor

B. Management

C. The bank

D. The shareholders’ broker

Correct Answer: B. Management

Question 7

Which engagement reports factual findings without providing an assurance conclusion?

A. Agreed-upon procedures

B. Reasonable-assurance audit

C. Limited-assurance review

D. Attestation audit

Correct Answer: A. Agreed-upon procedures

Question 8

A clean audit opinion means that the entity:

A. Has no risk of future failure

B. Has no fraud whatsoever

C. Has financial statements free from material misstatement, based on the audit

D. Is managed optimally

Correct Answer: C. Has financial statements free from material misstatement, based on the audit

Question 9

Which situation most clearly represents a reasonableness gap?

A. An auditor fails to perform a required procedure

B. Users expect an audit to guarantee that a company will never fail

C. An auditor uses an inappropriate accounting framework

D. Management omits a required disclosure

Correct Answer: B. Users expect an audit to guarantee that a company will never fail

Question 10

Which factor is most directly associated with independence?

A. Freedom from interests that compromise objectivity

B. Using only computer-assisted procedures

C. Preparing management’s budgets

D. Reducing all audit procedures to analytical review

Correct Answer: A. Freedom from interests that compromise objectivity