Foundations of Auditing and Assurance

Introduction and Context

Modern organisations depend on financial and non-financial information to obtain finance, allocate resources, comply with laws, evaluate performance and make strategic decisions. Investors, lenders, regulators, employees, customers and other stakeholders often use information prepared by management, even though they cannot directly observe all underlying transactions and events. This creates a need for an independent professional to enhance confidence in that information.

Auditing and assurance address this need. An audit is not simply an inspection of accounting records, nor is it a guarantee that an organisation is free from fraud or failure. It is a systematic, evidence-based process through which an independent practitioner evaluates whether subject matter conforms, in all material respects, with suitable criteria and communicates a conclusion to intended users.

The field is grounded in accountability, agency relationships, information economics, professional ethics and governance. Understanding these foundations is essential before studying audit planning, risk assessment, internal controls, substantive procedures and audit reporting.

Learning Objectives

After studying this chapter, you should be able to:

1. Explain the purpose, nature and social value of auditing and assurance.
2. Analyse auditing through accountability, agency and information theories.
3. Describe the assurance framework and its principal elements.
4. Distinguish reasonable assurance from limited assurance.
5. Explain the expectations gap and its implications for audit quality.
6. Classify major types of audits and assurance engagements.
7. Use key auditing terminology accurately.
8. Recognise important ethical, governance, technological and regulatory issues.

The Purpose and Nature of Auditing

An audit provides an independent opinion on whether financial statements are prepared, in all material respects, in accordance with an applicable financial reporting framework. The opinion is directed to intended users, such as shareholders or members, rather than being prepared exclusively for management.

Three characteristics are especially important:

• Systematic: The audit follows a planned methodology involving risk assessment, evidence gathering, evaluation and reporting.
• Evidence-based: Conclusions must be supported by sufficient appropriate audit evidence.
• Independent: The auditor must be free from relationships or interests that compromise—or appear to compromise—professional judgment.

The auditor does not prepare the financial statements. Management is responsible for selecting accounting policies, maintaining records, designing internal controls and making estimates and disclosures. The auditor evaluates management’s assertions and reports a conclusion.

Materiality and reasonable assurance

Audits do not examine every transaction. They are designed to obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error. A misstatement is material if it could reasonably influence the economic decisions of users.

Materiality involves both magnitude and nature. A relatively small amount may be material if it conceals an unlawful transaction, breaches a loan covenant or changes a reported profit into a loss. The auditor applies professional judgment when setting materiality and evaluating identified misstatements.

Reasonable assurance is a high, but not absolute, level of assurance. It is limited by sampling, judgment, the nature of evidence, management estimates, time constraints and the possibility of deliberate concealment. Consequently, an unmodified audit opinion does not mean that every amount is correct or that fraud cannot exist.

Accountability and Stewardship

Accountability is the obligation of one party to explain and justify the use of resources entrusted to it. In a company, directors and management are accountable to shareholders and other stakeholders for the stewardship of assets and the conduct of operations. In a public-sector entity, officials may be accountable to legislators, citizens and oversight bodies.

Auditing strengthens accountability by providing an independent evaluation of reported information. It can:

• reduce uncertainty about management’s reports;
• support transparency and responsible stewardship;
• identify weaknesses in controls and reporting processes;
• improve compliance with laws, contracts and policies; and
• increase confidence among capital providers and other stakeholders.

Accountability is broader than financial reporting. It may include performance, sustainability, use of public funds, compliance and governance. However, the auditor’s responsibilities depend on the terms of the engagement and the applicable professional standards.

The Agency Theory of Auditing

Agency theory examines relationships in which one party, the principal, delegates decision-making authority to another party, the agent. In a company, shareholders are principals and directors or executives are agents. Because agents usually possess more information about the organisation than principals, information asymmetry arises.

Agency problems may occur because:

• management’s objectives differ from shareholders’ objectives;
• management controls the preparation of information used to evaluate its performance;
• shareholders cannot continuously observe management’s actions; and
• managers may have incentives to overstate performance, conceal losses or manipulate estimates.

An independent audit can reduce agency costs by increasing the credibility of management’s reports. Auditing does not eliminate agency problems, however. The auditor cannot observe everything, and management may attempt to override controls or conceal fraud.

Agency theory also explains why audits are demanded even when management believes its information is reliable. The audit is valuable not merely because management needs help preparing accounts, but because external users need independent verification.

Information Theory and Decision Usefulness

Information theory, in the auditing context, focuses on the value of reducing uncertainty for decision-makers. Investors and lenders make decisions using information that may be incomplete, biased or difficult to verify. An audit improves the reliability of that information by testing it against evidence and reporting an independent conclusion.

The value of audited information tends to be greater when:

• decisions involve significant financial consequences;
• the information is complex or difficult for users to verify;
• management has strong incentives to present a favourable picture; and
• many users would otherwise incur substantial individual verification costs.

Audited information can therefore reduce information risk—the risk that users make inappropriate decisions because published information is materially misstated. The audit does not remove business risk, investment risk or the risk that an organisation will fail after receiving an unmodified opinion.

The Assurance Framework

Assurance is a professional service intended to enhance the confidence of intended users, other than the responsible party, about the outcome of evaluating or measuring a subject matter against suitable criteria.

The assurance framework contains five fundamental elements:

The responsible party is responsible for the subject matter. The practitioner evaluates it and expresses a conclusion. Intended users are the persons for whom the assurance report is prepared. In some engagements, the responsible party and intended users may be different groups; in others, they may overlap.

Criteria must be suitable. They should be relevant, complete, reliable, neutral and understandable. For example, a financial statement audit normally uses an identified financial reporting framework. An assurance engagement on greenhouse-gas emissions requires defined measurement and reporting criteria, such as a recognised emissions protocol.

Evidence must be both sufficient and appropriate. Sufficiency concerns quantity; appropriateness concerns relevance and reliability. More evidence is not necessarily better if it is unreliable or irrelevant.

Attestation and direct engagements

In an attestation engagement, the responsible party measures or evaluates the subject matter and presents information about it. The practitioner then reports on that information. A financial statement audit is a common example.

In a direct engagement, the practitioner directly measures or evaluates the subject matter against criteria and reports the result. For example, a practitioner may assess an entity’s compliance with specified privacy controls and report the findings.

Reasonable and Limited Assurance

Assurance engagements differ in the level of assurance provided.

Reasonable assurance

A reasonable-assurance engagement provides a high level of assurance, expressed positively. In a financial statement audit, the auditor typically reports that the financial statements “present fairly, in all material respects” or are “prepared, in all material respects,” in accordance with the applicable framework.

The work generally includes risk assessment, tests of controls where appropriate, substantive procedures, evaluation of accounting estimates, consideration of fraud risks and extensive professional judgment.

Limited assurance

A limited-assurance engagement provides a lower level of assurance than a reasonable-assurance engagement. The conclusion is expressed negatively, often in the form: “Nothing has come to our attention that causes us to believe that…”

The practitioner generally performs fewer procedures, often consisting primarily of inquiries and analytical procedures. Limited assurance is not “no assurance”; it is a meaningful but lower level of confidence.

The distinction is substantive, not merely linguistic. A practitioner cannot provide reasonable assurance simply by changing the wording of a limited-assurance report.

The Expectations Gap

The expectations gap is the difference between what users believe auditors should do and what auditing standards and professional responsibilities actually require. It has several components:

1. Reasonableness gap: Users expect more from auditors than auditors can reasonably provide.
2. Standards gap: Standards may not fully reflect reasonable public expectations.
3. Performance gap: Auditors may fail to perform or communicate in accordance with applicable standards.

Common misunderstandings include the belief that auditors:

• guarantee that financial statements are completely accurate;
• detect every fraud;
• prepare the accounts;
• ensure that an organisation will remain solvent; or
• examine every transaction.

In reality, management prepares the financial statements, auditors provide reasonable—not absolute—assurance, and fraud detection is affected by concealment, collusion and management override. Nevertheless, auditors must not use the inherent limitations of auditing as an excuse for inadequate work. High-quality planning, professional scepticism, robust evidence and clear reporting help reduce the expectations gap.

Types of Audits and Assurance Engagements

Financial statement audit

A financial statement audit evaluates whether general-purpose financial statements comply with an applicable reporting framework. It is commonly required by company law, stock-exchange rules, loan agreements or stakeholder demand.

Compliance audit

A compliance audit evaluates adherence to laws, regulations, contracts, grants, policies or other requirements. It is common in government, banking, healthcare and highly regulated industries.

Performance or operational audit

A performance audit examines economy, efficiency and effectiveness. It may ask whether resources were acquired economically, processes operate efficiently and programmes achieve intended outcomes. A performance audit may be conducted by internal audit departments, public-sector auditors or specialised practitioners.

Internal audit

Internal auditing is an independent and objective assurance and consulting activity designed to add value and improve an organisation’s operations. It evaluates governance, risk management and control processes. Internal auditors are part of the organisation, although effective internal audit functions require organisational independence and direct access to those charged with governance.

Forensic audit and investigation

Forensic work applies accounting, auditing and investigative skills to suspected fraud, disputes or legal proceedings. Its procedures are shaped by the question under investigation and the evidential requirements of the relevant legal setting.

Information systems and cybersecurity assurance

These engagements assess controls over information systems, access management, data integrity, change management, business continuity and cybersecurity. They are increasingly important because financial reporting depends on automated systems and third-party technology providers.

Sustainability and other non-financial assurance

Organisations increasingly report climate, social and governance information. Assurance may be provided over emissions data, sustainability metrics, supply-chain claims or social-impact reports. The reliability of these engagements depends heavily on clear criteria, consistent measurement boundaries and traceable data.

Important Auditing Terminology

Several terms recur throughout auditing practice:

• Audit risk: The risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated.
• Inherent risk: Susceptibility of an assertion to misstatement before considering related controls.
• Control risk: Risk that a misstatement will not be prevented, detected or corrected promptly by internal control.
• Detection risk: Risk that audit procedures will not detect an existing material misstatement.
• Assertion: A representation by management, explicit or implied, about transactions, balances and disclosures.
• Professional scepticism: An attitude involving a questioning mind and critical assessment of audit evidence.
• Professional judgment: Applying relevant training, knowledge and experience within the framework of auditing and ethical standards.
• Independence: Freedom from interests and relationships that compromise objectivity.
• Those charged with governance: Persons responsible for overseeing the strategic direction and accountability of the entity.
• Audit evidence: Information used by the auditor in reaching conclusions.
• Working papers: Documentation of procedures performed, evidence obtained and conclusions reached.
• Substantive procedures: Procedures designed to detect material misstatements at the assertion level.
• Test of controls: A procedure evaluating whether controls operated effectively during the relevant period.
• Unmodified opinion: An opinion issued when the auditor concludes that the financial statements are presented appropriately in all material respects.
• Modified opinion: A qualified opinion, adverse opinion or disclaimer of opinion, depending on the nature and pervasiveness of the matter.
• Fraud: An intentional act involving deception to obtain an unjust or illegal advantage.
• Error: An unintentional misstatement or omission.
• Going concern: The assumption that an entity will continue operating for the foreseeable future.

A Conceptual Example: GreenFields Manufacturing Ltd.

Background

GreenFields Manufacturing Ltd. is a medium-sized company seeking a bank loan to expand its production facility. Management reports strong profits and presents financial statements prepared under the applicable reporting framework. The bank requires audited financial statements before approving the loan.

Problem

The company holds specialised inventory that is difficult to value. Management estimates that the inventory is worth $4.8 million, but falling demand may have reduced its recoverable value. The finance director also receives a bonus based on reported profit. These circumstances create incentives and uncertainty relevant to audit risk.

Analysis

The auditor identifies valuation as a significant risk. The relevant assertion is whether inventory is recorded at an appropriate amount and whether related disclosures are complete. The auditor evaluates controls over inventory records, attends a physical inventory count, inspects sales after year-end, reviews market information and tests management’s valuation assumptions.

The auditor also considers independence. If the audit firm had prepared the inventory valuation, a self-review threat could arise. Appropriate safeguards—or withdrawal from the engagement—would be necessary.

Approach and outcome

Suppose the auditor concludes that inventory is overstated by $600,000 and management refuses to adjust the financial statements. The auditor evaluates materiality, the effect on profit and the pervasiveness of the misstatement. If the issue is material but not pervasive, a qualified opinion may be appropriate. If the overstatement distorts the financial statements as a whole, an adverse opinion may be required.

The bank should not interpret an unmodified opinion in a different engagement as a guarantee that GreenFields will repay the loan. The audit addresses financial statement misstatement, not the bank’s entire lending risk.

Learning points

This case illustrates the interaction of management responsibility, agency incentives, materiality, professional scepticism, evidence, independence and audit reporting. It also demonstrates why audit conclusions depend on criteria, intended users and the specific subject matter.

Ethics, Governance and Regulation

Auditing is a public-interest profession. Ethical principles normally include integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. Independence in mind and appearance is particularly important because users must trust the auditor’s impartiality.

Threats to independence include self-interest, self-review, advocacy, familiarity, intimidation and management participation. Common safeguards include rotation of key personnel, independent review, restrictions on non-audit services, disclosure of relationships and consultation with those charged with governance.

Audit committees play an important governance role by overseeing financial reporting, internal control, risk management, the external audit and auditor independence. Effective governance does not transfer management’s responsibility to the auditor; rather, it creates oversight and challenge.

Auditing standards are issued or adopted by relevant national and international authorities. International Standards on Auditing provide a widely used framework for financial statement audits, while assurance engagements other than audits may be governed by standards such as those in the ISAE 3000 series. Students must always consider the law and standards applicable in the jurisdiction of practice.

Technology, Data Analytics and Artificial Intelligence

Auditors increasingly use data analytics to examine complete populations, identify unusual journal entries, compare trends and investigate exceptions. Automated tools can improve efficiency, but they do not replace professional judgment.

Artificial intelligence creates both opportunities and risks. It may assist with document classification, anomaly detection and contract analysis. However, auditors must assess data quality, model bias, explainability, access controls, confidentiality and the reliability of generated outputs. An algorithmic result is not automatically audit evidence. The auditor remains responsible for evaluating whether evidence is relevant and reliable and for documenting the basis of conclusions.

Cybersecurity, cloud computing and outsourced accounting systems also require attention to information-processing risks. A strong audit approach combines technological competence with an understanding of business processes, controls and reporting requirements.

Challenges and Limitations of Auditing

Important limitations include:

• the use of sampling rather than examination of every item;
• reliance on estimates and management representations;
• persuasive rather than conclusive evidence;
• time and cost constraints;
• collusion, forgery and management override;
• rapidly changing technology and business models; and
• difficulty defining and measuring non-financial information.

These limitations do not make auditing ineffective. They explain why audit quality depends on careful risk assessment, suitable procedures, effective supervision, consultation, documentation and professional scepticism. Auditors should communicate significant risks and limitations clearly without weakening the usefulness of their conclusions.

Best-Practice Principles for Beginning Auditors

A competent auditor should:

1. Understand the entity, its environment and its reporting framework.
2. Maintain independence and identify threats before accepting or continuing an engagement.
3. Design procedures in response to assessed risks rather than applying a mechanical checklist.
4. Seek evidence that is both sufficient and appropriate.
5. Challenge inconsistent evidence and investigate unexpected results.
6. Document significant judgments and the reasoning supporting conclusions.
7. Communicate promptly with management and those charged with governance.
8. Protect confidential information and use technology responsibly.
9. Distinguish clearly between management’s responsibilities and the auditor’s responsibilities.
10. Keep technical knowledge current as standards, risks and technologies change.

Chapter Summary

Auditing is an independent, systematic and evidence-based process that enhances confidence in information. Its central purpose is to reduce information risk for intended users, while recognising that management remains responsible for preparing financial statements and maintaining controls. Accountability theory explains auditing as a mechanism for reporting on stewardship; agency theory highlights conflicts and information asymmetry between principals and agents; and information theory explains the value of independent verification.

The assurance framework consists of a practitioner, responsible party, intended users, subject matter, suitable criteria, evidence and a written report. Reasonable assurance provides a high but not absolute level of confidence and is expressed positively. Limited assurance provides a lower level of confidence, normally through mainly inquiry and analytical procedures, and is expressed negatively.

Audits may address financial statements, compliance, performance, internal controls, forensic matters, information systems or sustainability information. Materiality, independence, professional scepticism, professional judgment and audit evidence are central concepts. The expectations gap arises when public beliefs about auditing exceed—or differ from—professional responsibilities. Ethical conduct, effective governance and responsible use of technology are essential to maintaining audit quality and public trust.

Key Terms

Accountability: The obligation to explain and justify the use of entrusted resources.

Agency theory: A theory concerning delegated authority, conflicting interests and information asymmetry.

Assurance: A professional service that enhances users’ confidence in evaluated information.

Audit evidence: Information used to support the auditor’s conclusions.

Audit risk: The risk of expressing an inappropriate opinion on materially misstated information.

Criteria: Benchmarks used to evaluate or measure a subject matter.

Detection risk: The risk that audit procedures fail to detect a material misstatement.

Expectations gap: The difference between what users expect auditors to do and what auditors are required or able to do.

Independence: Freedom from interests or relationships that compromise objectivity.

Information asymmetry: A situation in which one party has more or better information than another.

Limited assurance: A lower level of assurance, commonly expressed in negative form.

Materiality: The significance of a misstatement to users’ decisions.

Professional judgment: The informed application of knowledge and experience in making audit decisions.

Professional scepticism: A questioning attitude and critical evaluation of evidence.

Reasonable assurance: A high, but not absolute, level of assurance.

Responsible party: The party responsible for the subject matter.

Subject matter: The information or condition evaluated in an assurance engagement.

Those charged with governance: Persons responsible for oversight of an entity’s direction and accountability.

Unmodified opinion: An opinion that the information is appropriately presented in all material respects.

Review Questions

Short Answer Questions

1. What is the primary purpose of a financial statement audit?
2. Why does management, rather than the auditor, prepare the financial statements?
3. Identify the five elements of the assurance framework.
4. What is meant by reasonable assurance?
5. State two common misunderstandings that contribute to the expectations gap.

Long Answer Questions

1. Explain how agency theory provides a rationale for external auditing.
2. Compare reasonable assurance and limited assurance in terms of procedures, confidence and reporting language.
3. Discuss the importance of materiality and professional judgment in an audit.
4. Explain how accountability and information theory support the social value of auditing.
5. Describe the ethical and governance safeguards that support auditor independence.

Analytical / Application Questions

1. A company’s finance director receives a bonus based on profit and has proposed a highly optimistic inventory valuation. Identify the relevant risks, assertions and audit responses.
2. A bank interprets an unmodified audit opinion as proof that its borrower will remain solvent for the next five years. Analyse why this interpretation is inappropriate.
3. An auditor uses an artificial-intelligence tool to identify unusual journal entries but cannot explain how the model reached its results. Evaluate whether the output can be used as audit evidence and what additional steps are required.

Multiple Choice Questions with Answers

Question 1

Which party is primarily responsible for preparing an entity’s financial statements?

A. The external auditor

B. Management

C. The audit committee alone

D. The bank lending to the entity

Correct Answer: B. Management

Question 2

What is the main purpose of an assurance engagement?

A. To eliminate all business risk

B. To prepare accounting records for management

C. To enhance intended users’ confidence in evaluated information

D. To guarantee that no fraud exists

Correct Answer: C. To enhance intended users’ confidence in evaluated information

Question 3

Which of the following is an element of the assurance framework?

A. A guaranteed financial result

B. Suitable criteria

C. An unconditional loan approval

D. A management bonus scheme

Correct Answer: B. Suitable criteria

Question 4

Which conclusion is most commonly associated with limited assurance?

A. The statements are perfectly accurate

B. We guarantee that fraud has not occurred

C. Nothing has come to our attention that causes us to believe the information is materially misstated

D. The entity will remain solvent

Correct Answer: C. Nothing has come to our attention that causes us to believe the information is materially misstated

Question 5

Agency theory is especially concerned with which situation?

A. The absence of any information differences

B. Conflicts between principals and agents

C. The calculation of depreciation only

D. The design of audit software only

Correct Answer: B. Conflicts between principals and agents

Question 6

Which statement about reasonable assurance is correct?

A. It is absolute assurance

B. It requires examination of every transaction

C. It is a high but not absolute level of assurance

D. It is lower than limited assurance

Correct Answer: C. It is a high but not absolute level of assurance

Question 7

A misstatement is material when it could reasonably influence:

A. Only the auditor’s personal preferences

B. The economic decisions of users

C. The colour of the annual report

D. The auditor’s travel arrangements

Correct Answer: B. The economic decisions of users

Question 8

Which audit type focuses on economy, efficiency and effectiveness?

A. Performance or operational audit

B. Financial statement audit only

C. Payroll processing

D. Tax preparation

Correct Answer: A. Performance or operational audit

Question 9

Which behaviour best demonstrates professional scepticism?

A. Accepting every management explanation without corroboration

B. Ignoring contradictory evidence

C. Maintaining a questioning mind and critically evaluating evidence

D. Assuming all estimates are fraudulent

Correct Answer: C. Maintaining a questioning mind and critically evaluating evidence

Question 10

Why does an unmodified audit opinion not guarantee that an entity will remain solvent?

A. An audit addresses relevant financial reporting assertions, not every aspect of future business risk

B. Auditors are responsible for guaranteeing loans

C. An unmodified opinion is issued only for tax purposes

D. Solvency is always irrelevant to users

Correct Answer: A. An audit addresses relevant financial reporting assertions, not every aspect of future business risk