General Auditing Principles and Auditor's Responsibilities
Exhaustive, 100% complete CA Final study notes based strictly on the ICAI Study Material. Covering the core behavioral standards of the audit profession: SA 240 (The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements), SA 250 (Consideration of Laws and Regulations in an Audit of Financial Statements), SA 260 (Communication with Those Charged with Governance), SA 299 (Joint Audit of Financial Statements), and SA 402 (Audit Considerations Relating to an Entity Using a Service Organisation).
CA. Bijoy has served as the statutory auditor of a listed company for the last 3 years. The audits of the preceding two years were conducted in accordance with Standards on Auditing, no wrongdoings were noticed, and unmodified opinions were expressed in the audit reports.
Of late, however, the company finds itself in the news in financial circles for all the wrong reasons. There have been serious public allegations of flouting the Securities Contracts (Regulation) Rules by clandestinely controlling more than the mandated percentage of shares. In addition, the company has been accused of violating other provisions of securities laws, manipulating share prices, artificially keeping market valuations inflated, and failing to disclose all related party transactions.
The company is highly leveraged. Although there has been no actual default and the company has met its commitments to date, SEBI is seized of the matter on its own.
- What do such allegations reflect? Allegations of securities law violations, price rigging, and concealed related-party dealings constitute actionable fraud risk factors. While fraud risk factors may not necessarily prove fraud, they are frequently present where frauds occur, signifying an increased risk of material misstatement due to fraud.
- How should the auditor proceed in the ensuing year? Due to heightened audit risk, audit procedures must be redesigned and expanded at both the financial statement level and the assertion level.
- What about non-compliance with laws (SA 250)? Suspected non-compliance involving securities laws can attract severe regulatory penalties and litigation. If management is not forthcoming, should the auditor obtain independent legal advice? What is the impact on the audit opinion under SA 705?
- Communication with Governance (SA 260): If the auditor suspects fraud involving management, should these suspicions be communicated to the audit committee, and should the nature, timing, and extent of necessary audit procedures be discussed with them?
1. General Auditing Principles & Auditor's Responsibilities
SA 200 establishes the independent auditor’s overall responsibilities when conducting an audit of financial statements in accordance with SAs. An audit has to be planned and performed with professional skepticism, recognizing that circumstances may exist that cause the financial statements to be materially misstated.
Misstatements in financial statements can arise from errors (unintentional) or frauds (intentional).
- SA 240 deals with the auditor’s responsibilities relating to fraud in an audit of financial statements. The auditor must remain alert throughout the audit, recognizing that material misstatement due to fraud could exist.
- SA 250 addresses the auditor's responsibilities regarding laws and regulations. Non-compliance can result in fines, litigation, or regulatory bans that materially impact financial statements.
- SA 260 establishes a structured framework for timely, effective two-way communication between the auditor and Those Charged with Governance (TCWG).
- SA 299 lays down special considerations and allocates responsibilities among joint auditors in a Joint Audit.
- SA 402 governs the user auditor's responsibilities to obtain sufficient appropriate audit evidence when an entity outsources activities to a third-party Service Organisation.
The core theoretical contents of SA 200 ("Overall Objectives of the Independent Auditor"), SA 210 ("Agreeing the Terms of Audit Engagements"), and SA 230 ("Audit Documentation") are taught in depth at the Intermediate level. At CA Final level, the application aspect of these standards is tested in the form of integrated case studies alongside SA 240, SA 250, SA 260, SA 299, and SA 402.
2. SA 240: The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements
SA 240 assists the statutory auditor in identifying and assessing the risks of material misstatement due to fraud and in designing and implementing audit procedures to detect such misstatements.
- To identify and assess the risks of material misstatement in the financial statements due to fraud;
- To obtain sufficient appropriate audit evidence about the assessed risks of material misstatement due to fraud, through designing and implementing appropriate responses; and
- To respond appropriately to identified or suspected fraud.
Meaning of Fraud and its Characteristics
Fraud is an intentional act by one or more individuals among management, those charged with governance, employees, or third parties, involving the use of deception to obtain an unjust or illegal advantage.
Misstatements in the financial statements can arise from either fraud or error. The distinguishing factor between fraud and error is whether the underlying action that results in the misstatement of the financial statements is intentional or unintentional.
Although fraud is a broad legal concept, the statutory auditor is strictly concerned with fraud that causes a material misstatement in the financial statements. The auditor does NOT make legal determinations of whether fraud has actually occurred.
Two Types of Intentional Misstatements Relevant to the Auditor
Intentional misstatements, including omissions of amounts or disclosures in financial statements, designed to deceive financial statement users (e.g., earnings management, window dressing).
Theft or defalcation of an entity's assets, often perpetrated by employees in small amounts, but also by management who can disguise thefts through complex entries.
Fraud, whether arising from fraudulent financial reporting or misappropriation of assets, involves three converging conditions:
- Incentive or Pressure: Incentive or pressure to commit fraudulent financial reporting exists when management is under pressure from outside or inside the entity to achieve an expected (and perhaps unrealistic) earnings target or financial outcome—particularly since the consequences of failing to meet financial goals can be significant. Similarly, individuals have an incentive to misappropriate assets when they are living beyond their means or face personal financial obligations.
- Perceived Opportunity: A perceived opportunity to commit fraud exists when an individual believes internal control can be overridden (e.g., because the individual is in a position of trust or has knowledge of specific deficiencies in internal control).
- Rationalization / Attitude: Individuals may be able to rationalize committing a fraudulent act. Some individuals possess an attitude, character, or set of ethical values that allow them knowingly and intentionally to commit a dishonest act. However, even otherwise honest individuals can commit fraud in an environment that imposes sufficient pressure on them.
2.2 How Fraudulent Financial Reporting May be Caused by Entities
Fraudulent financial reporting involves intentional misstatements including omissions of amounts or disclosures to deceive users. It can be caused by the efforts of management to manage earnings in order to influence user perceptions of performance and profitability.
Such earnings management may start out with small actions or inappropriate adjustments of assumptions and changes in judgments by management. Pressures and incentives may lead these actions to escalate into fraudulent financial reporting. Management may be motivated to reduce earnings by a material amount to minimize tax, or inflate earnings to secure bank financing or meet market expectations.
- Manipulation, falsification (including forgery), or alteration of accounting records or supporting documentation from which the financial statements are prepared.
- Misrepresentation in, or intentional omission from, the financial statements of events, transactions, or other significant information.
- Intentional misapplication of accounting principles relating to amounts, classification, manner of presentation, or disclosure.
Fraudulent financial reporting often involves management override of controls using techniques such as:
- 1. Recording fictitious journal entries, particularly close to the end of an accounting period, to manipulate operating results or achieve other objectives.
- 2. Inappropriately adjusting assumptions and changing judgments used to estimate account balances.
- 3. Omitting, advancing or delaying recognition in the financial statements of events and transactions that have occurred during the reporting period.
- 4. Concealing, or not disclosing, facts that could affect the amounts recorded in the financial statements.
- 5. Engaging in complex transactions structured to misrepresent the financial position or financial performance of the entity.
- 6. Altering records and terms related to significant and unusual transactions.
2.3 How Misappropriation of Assets May be Accomplished by Entities
Misappropriation of assets involves the theft of an entity’s assets. While often perpetrated by employees in relatively small and immaterial amounts, it can also involve management who are usually more able to disguise or conceal misappropriations in ways that are difficult to detect.
Misappropriation of assets can be accomplished in a variety of ways including:
- Embezzling receipts: For example, misappropriating collections on accounts receivable or diverting receipts in respect of written-off accounts to personal bank accounts.
- Stealing physical assets or intellectual property: For example, stealing inventory for personal use or for sale, stealing scrap for resale, colluding with a competitor by disclosing technological data in return for payment.
- Causing an entity to pay for goods and services not received: For example, payments to fictitious vendors, kickbacks paid by vendors to the entity’s purchasing agents in return for inflating prices, payments to fictitious employees.
- Using an entity’s assets for personal use: For example, using the entity’s assets as collateral for a personal loan or a loan to a related party.
Misappropriation of assets is often accompanied by false or misleading records or documents in order to conceal the fact that the assets are missing or have been pledged without proper authorization.
The primary responsibility for the prevention and detection of fraud rests with BOTH those charged with governance of the entity and management.
It is important that management, with the oversight of those charged with governance, place a strong emphasis on:
- Fraud Prevention: Which may reduce opportunities for fraud to take place.
- Fraud Deterrence: Which could persuade individuals not to commit fraud because of the high likelihood of swift detection and punishment.
This involves a commitment to creating a culture of honesty and ethical behavior which can be reinforced by active oversight by those charged with governance.
2.5 Responsibilities of the Auditor & Inherent Limitations
An auditor conducting an audit in accordance with SAs is responsible for obtaining reasonable assurance that the financial statements taken as a whole are free from material misstatement, whether caused by fraud or error.
Owing to the inherent limitations of an audit, there is an unavoidable risk that some material misstatements may not be detected, even though the audit is properly planned and performed in accordance with SAs.
The risk of not detecting a material misstatement resulting from fraud is substantially higher than the risk of not detecting one resulting from error.
This is because fraud may involve sophisticated and carefully organized schemes designed to conceal it, such as forgery, deliberate failure to record transactions, or intentional misrepresentations made to the auditor. Such attempts at concealment may be even more difficult to detect when accompanied by collusion. Collusion may cause the auditor to believe that audit evidence is persuasive when it is, in fact, entirely false.
- The skillfulness of the perpetrator;
- The frequency and extent of manipulation;
- The degree of collusion involved;
- The relative size of individual amounts manipulated; and
- The seniority of those individuals involved.
Furthermore, while the auditor may identify potential opportunities for fraud, it is difficult to determine whether misstatements in judgment areas (such as accounting estimates) are caused by fraud or error.
Management Fraud vs. Employee Fraud: The risk of not detecting a material misstatement resulting from management fraud is greater than for employee fraud, because management is frequently in a position to directly or indirectly manipulate accounting records, present fraudulent financial information, or override control procedures designed to prevent similar frauds by other employees.
Exhaustive Catalogue of Fraud Risk Factors (ICAI Study Material)
Fraud risk factors are events or conditions that indicate an incentive or pressure to commit fraud or provide an opportunity to commit fraud.
1. Incentives / Pressures
(i) Financial stability or profitability is threatened by economic, industry, or entity operating conditions:
- High degree of competition or market saturation, accompanied by declining margins.
- High vulnerability to rapid changes, such as changes in technology, product obsolescence, or interest rates.
- Significant declines in customer demand and increasing business failures in either the industry or overall economy.
- Operating losses making the threat of bankruptcy, foreclosure, or hostile takeover imminent.
- Recurring negative cash flows from operations or an inability to generate cash flows from operations while reporting earnings and earnings growth.
- Rapid growth or unusual profitability, especially compared to that of other companies in the same industry.
- New accounting, statutory, or regulatory requirements.
(ii) Excessive pressure exists for management to meet requirements or expectations of third parties:
- Profitability or trend level expectations of investment analysts, institutional investors, significant creditors, or other external parties (particularly aggressive or unrealistic expectations), including expectations created by management in press releases or annual report messages.
- Need to obtain additional debt or equity financing to stay competitive—including financing of major research and development or capital expenditures.
- Marginal ability to meet exchange listing requirements or debt repayment or other debt covenant requirements.
- Perceived or real adverse effects of reporting poor financial results on significant pending transactions, such as business combinations or contract awards.
(iii) Personal financial situation of management or TCWG is threatened by entity performance:
- Significant financial interests in the entity.
- Significant portions of compensation (bonuses, stock options, earn-out arrangements) contingent upon achieving aggressive targets for stock price, operating results, financial position, or cash flow.
- Personal guarantees of debts of the entity.
(iv) Excessive pressure on management or operating personnel to meet financial targets established by TCWG, including sales or profitability incentive goals.
2. Opportunities
(i) Nature of the industry or entity's operations provides opportunities:
- Significant related-party transactions not in the ordinary course of business, or with related entities not audited or audited by another firm.
- A strong financial presence or ability to dominate a certain industry sector that allows the entity to dictate terms or conditions to suppliers or customers resulting in inappropriate or non-arm’s-length transactions.
- Assets, liabilities, revenues, or expenses based on significant estimates that involve subjective judgments or uncertainties that are difficult to corroborate.
- Significant, unusual, or highly complex transactions, especially those close to period end that pose difficult “substance over form” questions.
- Significant operations located or conducted across international borders where differing business environments and cultures exist.
- Use of business intermediaries for which there appears to be no clear business justification.
- Significant bank accounts or subsidiary/branch operations in tax-haven jurisdictions for which there appears to be no clear business justification.
(ii) Monitoring of management is not effective:
- Oversight by those charged with governance over the financial reporting process and internal control is not effective.
- Domination of management by a single person or small group (in a non owner-managed business) without compensating controls.
(iii) Complex or unstable organizational structure:
- Difficulty in determining the organization or individuals that have controlling interest in the entity.
- Overly complex organizational structure involving unusual legal entities or managerial lines of authority.
- High turnover of senior management, legal counsel, or those charged with governance.
(iv) Internal control components are deficient:
- Inadequate monitoring of controls, including automated controls and controls over interim financial reporting.
- High turnover rates or employment of accounting, internal audit, or IT staff that are not effective.
- Accounting and information systems that are not effective, including situations involving significant deficiencies in internal control.
3. Attitudes / Rationalizations
- Communication, implementation, support, or enforcement of the entity’s values or ethical standards by management that are not effective, or communication of inappropriate values.
- Non-financial management’s excessive participation in or preoccupation with the selection of accounting policies or the determination of significant estimates.
- Known history of violations of securities laws or other laws and regulations, or claims alleging fraud.
- Excessive interest by management in maintaining or increasing the entity’s stock price or earnings trend.
- Practice by management of committing to analysts, creditors, and other third parties to achieve aggressive or unrealistic forecasts.
- Management failing to remedy known significant deficiencies in internal control on a timely basis.
- Interest by management in employing inappropriate means to minimize reported earnings for tax-motivated reasons.
- Low morale among senior management.
- The owner-manager makes no distinction between personal and business transactions.
- Dispute between shareholders in a closely held entity.
- Recurring attempts by management to justify marginal or inappropriate accounting on the basis of materiality.
-
Strained relationship between management and the current or predecessor auditor:
- Frequent disputes with the auditor on accounting, auditing, or reporting matters.
- Unreasonable demands on the auditor, such as unrealistic time constraints regarding completion of audit.
- Restrictions on the auditor that inappropriately limit access to people or information.
- Domineering management behavior in dealing with the auditor, especially involving attempts to influence audit scope or selection of personnel.
1. Incentives / Pressures
- Personal financial obligations creating pressure on employees with access to cash or assets susceptible to theft.
-
Adverse relationships between the entity and employees with access to cash or assets:
- Known or anticipated future employee layoffs.
- Recent or anticipated changes to employee compensation or benefit plans.
- Promotions, compensation, or other rewards inconsistent with expectations.
2. Opportunities
(i) Susceptibility of assets to misappropriation:
- Large amounts of cash on hand.
- Inventory items that are small in size, of high value, or in high demand.
- Easily convertible assets, such as bearer bonds, diamonds, or computer chips.
- Fixed assets which are small in size, marketable, or lacking observable identification of ownership.
(ii) Inadequate internal control over assets:
- Inadequate segregation of duties or independent checks.
- Inadequate oversight of senior management expenditures, such as travel and other reimbursements.
- Inadequate management oversight of employees responsible for assets (e.g., inadequate supervision of remote locations).
- Inadequate job applicant screening of employees with access to assets.
- Inadequate record keeping with respect to assets.
- Inadequate system of authorization and approval of transactions (e.g., in purchasing).
- Inadequate physical safeguards over cash, investments, inventory, or fixed assets.
- Lack of complete and timely reconciliations of assets.
- Lack of timely and appropriate documentation of transactions (e.g., credits for merchandise returns).
- Lack of mandatory vacations for employees performing key control functions.
- Inadequate management understanding of information technology, enabling IT staff to perpetrate misappropriation.
- Inadequate access controls over automated records, including controls over and review of computer system event logs.
3. Attitudes / Rationalizations
- Disregard for the need for monitoring or reducing risks related to misappropriations of assets.
- Disregard for internal control over misappropriation of assets by overriding existing controls or by failing to take appropriate remedial action on known deficiencies.
- Behavior indicating displeasure or dissatisfaction with the entity or its treatment of the employee.
- Changes in behavior or lifestyle that may indicate assets have been misappropriated.
- Tolerance of petty theft.
Why Evaluation of Fraud Risk Factors is Necessary: The auditor shall evaluate whether one or more fraud risk factors are present. While fraud risk factors may not necessarily prove fraud, they have often been present in circumstances where frauds have occurred. Fraud risk factors cannot easily be ranked in order of importance, and their significance varies widely. The determination of whether a fraud risk factor is present and whether it impacts RMM requires professional judgment.
The auditor shall maintain professional skepticism throughout the audit, recognizing the possibility that a material misstatement due to fraud could exist, notwithstanding past experience of the honesty and integrity of management and TCWG.
Unless the auditor has reason to believe the contrary, the auditor may accept records and documents as genuine. If conditions identified cause the auditor to believe that a document may not be authentic or that terms have been modified but not disclosed, the auditor shall investigate further.
Where responses to inquiries of management or TCWG are inconsistent, the auditor shall investigate the inconsistencies.
The discussion among the engagement team shall place particular emphasis on:
- How and where the entity’s financial statements may be susceptible to material misstatement due to fraud; and
- How fraud might occur, including how management could perpetrate and conceal fraudulent financial reporting.
This discussion shall occur notwithstanding the engagement team members’ beliefs that management and those charged with governance are honest and possess integrity.
2.8 Risk Assessment Procedures and Presumption of Fraud in Revenue
When performing risk assessment procedures under SA 315, the auditor shall:
- Make inquiries of management, internal audit, and others within the entity;
- Obtain an understanding of how TCWG exercise oversight of management’s processes for identifying and responding to fraud risks and the internal controls established to mitigate these risks;
- Evaluate unusual or unexpected relationships identified when performing analytical procedures; and
- Evaluate whether one or more fraud risk factors are present.
Under SA 240, when identifying and assessing RMM due to fraud, the auditor shall, based on a presumption that there are risks of fraud in revenue recognition, evaluate which types of revenue, revenue transactions, or assertions give rise to such risks.
This presumption may be rebutted only in rare and simple cases (e.g., single-unit rental income under a long-term lease). If the auditor concludes that the presumption is not applicable, the auditor SHALL DOCUMENT the reasons for that conclusion.
2.9 Responses to Assessed Risks of Fraud at Financial Statement Level
In determining overall responses at the financial statement level, the auditor shall:
- Assign and supervise personnel: Taking account of the knowledge, skill, and ability of the individuals to be given significant engagement responsibilities;
- Evaluate accounting policies: Evaluate whether the selection and application of accounting policies by the entity (particularly subjective measurements and complex transactions) may indicate fraudulent financial reporting from earnings management; and
- Incorporate an element of unpredictability: In the selection of the nature, timing, and extent of audit procedures (e.g., performing unannounced procedures at selected locations, changing sample selection parameters).
2.10 Responses to Assessed Risks of Fraud at the Assertion Level
The auditor shall design and perform further audit procedures whose nature, timing, and extent are responsive to assessed risks of fraud at the assertion level. For example:
- Design external confirmations not only to confirm outstanding debtor balances, but also to confirm the specific terms of sales agreements, including dates, delivery terms, and any rights of return.
- Supplement external confirmations with inquiries of non-financial personnel regarding changes in sales contracts.
2.11 Audit Procedures Responsive to Management Override of Controls
Management is in a unique position to perpetrate fraud because of its ability to manipulate accounting records and override controls that appear to be operating effectively.
Due to the unpredictable way override can occur, it is a risk of material misstatement due to fraud and thus a Significant Risk present in all entities. Irrespective of the auditor's assessment of control strength, the auditor SHALL:
- Test the appropriateness of journal entries: Test entries recorded in the general ledger and other adjustments made in preparing the financial statements. Examine entries made at period-end, entries passed by unauthorized individuals, entries lacking narrations, or entries with unusual round sums.
- Review accounting estimates for biases: Review estimates and judgments for bias and evaluate whether circumstances producing bias represent fraud risk. Perform a retrospective review of management judgments and assumptions reflected in prior-year estimates.
- Evaluate business rationale: For significant transactions outside the normal course of business or that appear unusual, evaluate whether the business rationale (or lack thereof) suggests they were entered into to engage in fraudulent financial reporting or conceal misappropriation of assets.
- Evaluate whether analytical procedures performed when forming an overall conclusion indicate a previously unrecognized risk of fraud.
- When a misstatement is identified, evaluate whether it indicates fraud. Recognizing that an instance of fraud is unlikely to be an isolated occurrence, evaluate the implications for other aspects of the audit, particularly the reliability of management representations.
- If senior management is involved, re-evaluate the risk assessment and consider possible collusion.
2.13 Auditor Unable to Continue the Engagement (Withdrawal Protocol)
If, as a result of a misstatement resulting from fraud or suspected fraud, the auditor encounters exceptional circumstances that bring into question the auditor’s ability to continue performing the audit, the auditor shall:
- Determine the professional and legal responsibilities applicable in the circumstances, including whether there is a requirement to report to appointing authorities or regulators;
- Consider whether it is appropriate to withdraw from the engagement, where legally permitted; and
-
If the auditor withdraws:
- Discuss with the appropriate level of management and TCWG the auditor’s withdrawal and the reasons therefor; and
- Determine whether there is a professional or legal requirement to report the withdrawal and reasons to appointing authorities or regulators.
The auditor shall obtain written representations from management and TCWG that:
- They acknowledge their responsibility for the design, implementation, and maintenance of internal control to prevent and detect fraud;
- They have disclosed to the auditor the results of management’s assessment of the risk that the financial statements may be materially misstated due to fraud;
-
They have disclosed to the auditor their knowledge of fraud or suspected fraud affecting the entity involving:
- Management;
- Employees who have significant roles in internal control; or
- Others where the fraud could have a material effect on the financial statements; and
- They have disclosed to the auditor their knowledge of any allegations of fraud affecting the entity’s financial statements communicated by employees, former employees, analysts, regulators, or others.
2.15 Communications to Management and Those Charged With Governance
The auditor shall communicate identified or suspected fraud on a timely basis to the appropriate level of management.
Unless all of TCWG are involved in management, if the auditor identifies or suspects fraud involving management, employees with significant roles in internal control, or others resulting in material misstatement, the auditor shall communicate these matters to TCWG on a timely basis. If management fraud is suspected, the auditor shall discuss with TCWG the nature, timing, and extent of procedures necessary to complete the audit.
2.16 Communications to Regulatory and Enforcement Authorities
The auditor shall determine whether there is a statutory duty to report fraud to parties outside the entity. Although professional duty of confidentiality ordinarily precludes disclosure, the auditor’s legal responsibilities override confidentiality in specific circumstances (e.g., statutory reporting of bank fraud to RBI).
| Statute / Order | Threshold & Scope | Mandatory Reporting Process |
|---|---|---|
| Section 143(12) of Companies Act, 2013 (Frauds $\ge$ ₹ 1 Crore) |
Offence of fraud committed against the company by its officers or employees involving ₹ 1 Crore or above. |
• Report to Board/Audit Committee within 2 days seeking reply within 45 days. • Forward report with management reply to Central Government (MCA) in Form ADT-4 within 15 days of receipt of reply (or expiry of 45 days). |
| Section 143(12) (Frauds < ₹ 1 Crore) |
Fraud committed against the company by officers/employees involving amount < ₹ 1 Crore. |
• Report to Audit Committee / Board within 2 days. • Disclosed in Board’s Report under Section 134(5). (Not reported to Central Govt). |
| CARO 2020: Clause (xi) |
(a) Any fraud by or on the company noticed/reported during the year. (b) Whether Form ADT-4 filed. (c) Whether whistle-blower complaints considered. |
Disclose nature, amount involved, Form ADT-4 filing details, and consideration of whistle-blower complaints in the CARO annexure. |
The auditor's documentation shall include:
- Significant decisions reached during the engagement team discussion regarding susceptibility to fraud;
- Identified and assessed risks of material misstatement due to fraud at the financial statement level and at the assertion level;
- Overall responses at the financial statement level and nature, timing, and extent of procedures and linkage with assessed risks at the assertion level;
- Results of audit procedures, including those designed to address management override of controls;
- Communications about fraud made to management, TCWG, regulators, and others; and
- If the presumption of fraud in revenue recognition was rebutted, the reasons for that conclusion.
3. SA 250: Consideration of Laws and Regulations in an Audit of Financial Statements
SA 250 assists the auditor in identifying material misstatements due to non-compliance with laws and regulations. However, it does NOT apply to other assurance engagements where the auditor is specifically engaged to test and report separately on compliance with specific laws.
The objectives of the auditor are:
- To obtain sufficient appropriate audit evidence regarding compliance with laws and regulations generally recognized to have a direct effect on material amounts and disclosures in the financial statements;
- To perform specified audit procedures to help identify instances of non-compliance with other laws that may have a material effect on the financial statements; and
- To respond appropriately to non-compliance or suspected non-compliance identified during the audit.
3.3 Responsibility of Management for Compliance with Laws and Regulations
It is the responsibility of management, with the oversight of TCWG, to ensure that the entity’s operations are conducted in accordance with laws and regulations.
Examples of policies and procedures an entity may implement include:
- Monitoring legal requirements and ensuring operating procedures meet them.
- Instituting and operating appropriate systems of internal control.
- Developing, publicising, and following a code of conduct.
- Ensuring employees are properly trained and understand the code of conduct.
- Monitoring compliance and acting appropriately to discipline employees who fail to comply.
- Engaging legal advisors to assist in monitoring legal requirements.
- Maintaining a register of significant laws and regulations and a record of complaints.
In larger entities, these procedures are supplemented by assigning responsibilities to an internal audit function, audit committee, or compliance function.
3.4 Responsibility of the Auditor & The Two-Tier Legal Classification
The auditor is not responsible for preventing non-compliance and cannot be expected to detect non-compliance with all laws. In the context of laws and regulations, the effects of inherent limitations are far greater because:
- Many laws relate principally to operating aspects of the business that do not affect the financial ledger and are not captured by financial reporting systems.
- Non-compliance may involve deliberate concealment (collusion, forgery, management override).
- Whether an act constitutes non-compliance is ultimately a matter for legal determination by a court of law.
- The further removed non-compliance is from transactions reflected in financial statements, the less likely the auditor is to become aware of it.
| Category of Law | Nature & Statutory Scope | Auditor's Statutory Responsibility |
|---|---|---|
| Tier 1: Direct Effect Laws | Laws and regulations generally recognized to have a direct effect on the determination of material amounts and disclosures (e.g., Income Tax Act, GST, Labour Laws, Schedule III). | The auditor SHALL OBTAIN SUFFICIENT APPROPRIATE AUDIT EVIDENCE regarding compliance with these provisions. |
| Tier 2: Fundamental Operating Laws (Indirect) | Other laws that do not directly affect financial amounts, but compliance is fundamental to operating aspects, going concern continuance, or avoiding material penalties (e.g., environmental laws, factory operating license, RBI Net Owned Funds requirements for NBFCs). |
Responsibility is STRICTLY LIMITED TO 2 SPECIFIED PROCEDURES: (a) Inquiring of management and TCWG as to compliance; and (b) Inspecting correspondence with relevant licensing or regulatory authorities. |
The auditor shall obtain written representations that all known instances of non-compliance or suspected non-compliance whose effects should be considered when preparing financial statements have been disclosed.
3.5 Audit Procedures When Non-Compliance is Identified or Suspected
- Obtain an understanding of the nature of the act and the circumstances in which it occurred, and further information to evaluate the possible effect on financial statements.
- Discuss the matter with management and TCWG. If they do not provide sufficient information supporting compliance and the effect may be material, consider the need to obtain legal advice.
- If sufficient information cannot be obtained, evaluate the lack of audit evidence on the auditor’s opinion.
- Evaluate the implications for the auditor’s risk assessment and reliability of written representations.
3.6 Reporting of Identified or Suspected Non-Compliance
- To TCWG: Communicate matters involving non-compliance other than clearly inconsequential matters. If believed to be intentional and material, communicate as soon as practicable. If management/TCWG are involved, communicate to the next higher level of authority (Audit Committee/Supervisory Board) or consider obtaining legal advice.
-
In the Auditor's Report (SA 705):
- Material effect not adequately reflected: Qualified or Adverse Opinion.
- Precluded by management from obtaining evidence (Scope limitation): Qualified or Disclaimer of Opinion.
- To Regulators: Determine whether there is a statutory responsibility to report non-compliance to authorities outside the entity, overriding client confidentiality.
The auditor shall document identified or suspected non-compliance with laws and regulations and the results of discussions with management, TCWG, and parties outside the entity.
4. SA 260: Communication with Those Charged with Governance
“Those Charged with Governance” (TCWG) denotes the person(s) or organization(s) (e.g., corporate trustee, Board of Directors, Audit Committee) with responsibility for overseeing the strategic direction of the entity and obligations related to the accountability of the entity, including overseeing the financial reporting process.
Governance structures vary widely: supervisory boards separate from executive boards, single unitary boards, committees of management, trustees, or owner-managers. The auditor determines the appropriate persons with whom to communicate using the understanding obtained under SA 315.
Significance & 4.1 Objectives of Auditor under SA 260
Effective two-way communication develops a constructive working relationship while maintaining independence. The objectives are:
- To communicate clearly the responsibilities of the auditor and an overview of planned scope and timing;
- To obtain from TCWG information relevant to the audit;
- To provide TCWG with timely significant observations arising from the audit; and
- To promote effective two-way communication between the auditor and TCWG.
4.2 Matters to be Communicated by the Auditor (ICAI Core 4 Matters)
Communicating that the auditor is responsible for forming and expressing an opinion on financial statements prepared by management with TCWG oversight, and that the audit does not relieve management or TCWG of their responsibilities.
Overview of planned scope and timing, including communicating significant risks identified. Caution: Care is necessary not to compromise audit effectiveness by making procedures too predictable!
- Qualitative Aspects of Accounting Practices: Views about significant qualitative aspects of accounting policies, estimates, and disclosures. Explaining why an acceptable practice is not considered most appropriate.
-
Significant Difficulties Encountered:
- Significant delays by management in providing information;
- An unnecessarily brief time to complete the audit;
- Extensive unexpected effort required to obtain evidence;
- Unavailability of expected information;
- Restrictions imposed by management;
- Management unwillingness to make/extend going concern assessment.
- Significant Matters Discussed with Management: Events, business conditions, consultations with other accountants, disagreements with management, and written representations requested.
- Circumstances Affecting Report Form & Content: Expected modifications (SA 705), Going Concern uncertainties (SA 570), Key Audit Matters (SA 701), Emphasis of Matter / Other Matter paragraphs (SA 706), or uncorrected other info misstatements (SA 720).
- Any other significant matters relevant to financial reporting oversight.
In the case of listed entities, the auditor SHALL communicate IN WRITING:
- A statement that the engagement team, firm, and network firms have complied with relevant ethical requirements regarding independence; and
-
(i) All relationships and other matters between the firm, network firms, and the entity that may reasonably be thought to bear on independence, including total fees charged during the period for audit and non-audit services allocated into clear categories; and
(ii) The related safeguards applied to eliminate identified threats or reduce them to an acceptable level.
Under Section 177 of the Companies Act, 2013, the Audit Committee is statutorily required to monitor auditor independence.
The Communication Process, Adequacy & 4.4 Documentation
The auditor communicates the form, timing, and expected content. Significant findings and listed independence must be communicated in writing when oral dialogue is inadequate.
Evaluating Adequacy: The auditor shall evaluate whether two-way communication has been adequate. If not, the auditor evaluates the impact on RMM and ability to obtain evidence, taking appropriate action.
Documentation: Oral communications documented with date and person; copies of written communications retained.
5. SA 299: Joint Audit of Financial Statements
A Joint Audit is an audit of financial statements of an entity by two or more auditors appointed with the objective of issuing the audit report. Such auditors are described as joint auditors.
Section 139(3) of the Companies Act, 2013 provides that members of a company may resolve to provide that the audit shall be conducted by more than one auditor. SA 299 does NOT deal with branch auditors or component auditors (principal auditor vs component auditor).
5.1 Objectives of SA 299
- To lay down broad principles for joint auditors in conducting the joint audit;
- To provide a uniform approach to the process of joint audit;
- To identify distinct areas of work and coverage by each joint auditor; and
- To identify individual responsibility and joint responsibility of joint auditors.
5.2 Audit Planning, Risk Assessment & Allocation of Work
- Engagement partners and key team members from each joint auditor must be involved in planning; overall audit strategy is established jointly.
- Division of Work: Joint auditors divide work by mutual discussion in terms of identifiable units, specified areas, or assets/liabilities/income/expenditure. Certain areas owing to importance are covered by all joint auditors.
- Work Allocation Document: After identification and allocation of work, the work allocation document SHALL BE SIGNED by ALL joint auditors and communicated to TCWG and management. This avoids disputes regarding scope.
- Joint auditors shall obtain a common engagement letter and common management representation letter.
5.3 Responsibility and Coordination among Joint Auditors
| Responsibility Type | Covered Areas & Scope | Governing SA 299 Rule |
|---|---|---|
| Individual Responsibility (Each joint auditor alone) |
• Audit work allocated to that joint auditor. • Proper execution of audit procedures in allocated areas. • Study and evaluation of internal control and risk assessment of allocated areas. • Obtaining information and explanations from management in respect of allocated divisions/zones. |
Each joint auditor is solely responsible for their allocated work, whether or not a separate report is prepared. |
| Joint & Several Responsibility (All joint auditors together) |
1. Audit work not divided and carried out by all joint auditors. 2. Decisions taken jointly in audit planning regarding nature, timing, and extent of procedures. 3. Matters brought to notice of all joint auditors and on which there is agreement. 4. Examining that financial statements comply with relevant statute. 5. Presentation and disclosure under applicable financial reporting framework (AFRF). 6. Ensuring audit report complies with relevant statutes, SAs, and ICAI pronouncements. |
All joint auditors are held jointly liable for undivided work, joint decisions, statutory compliance, and reporting. |
In respect of common audit areas: All joint auditors are responsible ONLY for the appropriateness of planning decisions concerning nature, timing, and extent agreed upon among them. Proper execution of these procedures is the individual responsibility of the joint auditor concerned!
Coordination: If a joint auditor discovers matters relevant to areas of other joint auditors, they shall communicate the same to all other joint auditors in writing prior to completion of the audit.
5.4 Audit Conclusion and Reporting: Disagreement & The 2-1 Rule
The joint auditors are normally required to issue a common audit report. However:
Where joint auditors disagree regarding the opinion or matters to be reported, a joint auditor is NOT bound by the majority opinion (e.g. 2-1) and SHALL express their opinion in a SEPARATE audit report.
In such circumstances, both reports must cross-reference each other under the heading "Other Matter Paragraph" as per SA 706.
Reliance on Branch Audited by Another Joint Auditor: Where financial statements of a division/branch are audited by one joint auditor, the other joint auditors are entitled to proceed on the basis that such financial statements comply with legal requirements and present a true and fair view without re-auditing.
5.5 Communication with Those Charged with Governance
When joint auditors expect to modify the opinion, they communicate circumstances and proposed wording under SA 705. When expecting an Emphasis of Matter or Other Matter paragraph, they communicate expectation and proposed wording under SA 706.
6. SA 402: Audit Considerations Relating to an Entity Using a Service Organisation
- Service Organisation: A third-party organisation that provides services to user entities that are part of those entities’ information systems relevant to financial reporting.
- User Entity: An entity that uses a service organisation and whose financial statements are being audited.
- Service Auditor: An auditor who, at the request of the service organisation, provides an assurance report on the controls of a service organisation.
- User Auditor: An auditor who audits and reports on the financial statements of a user entity.
When are Services Part of the User Entity's Information System? (ICAI 6 Areas)
Services affect the financial reporting information system if they affect:
- The classes of transactions in the user entity's operations that are significant to financial statements;
- The procedures (both IT and manual) by which transactions are initiated, recorded, processed, corrected, transferred to the general ledger, and reported;
- The related accounting records and specific accounts used to record and report transactions;
- How the information system captures events and conditions other than transactions;
- The financial reporting process used to prepare financial statements, including estimates and disclosures; and
- Controls surrounding journal entries, including non-standard journal entries.
6.1 Objectives of User Auditor
- To obtain an understanding of the nature and significance of services provided and their effect on internal control, sufficient to assess RMM; and
- To design and perform audit procedures responsive to those risks.
6.2 Type 1 Report vs Type 2 Report (Master Comparison Table)
| Feature | Type 1 Report (Design as at a Date) | Type 2 Report (Design + Operating Effectiveness) |
|---|---|---|
| Report Title | Report on description and design of controls at a service organisation. | Report on description, design, and operating effectiveness of controls at a service organisation. |
| Timing | As at a specific date. | Throughout a specified period. |
| Scope & Opinion | Service auditor's opinion on whether description fairly presents the system and controls are suitably designed to achieve objectives as at a specific date. | Opinion on system description, design suitability, AND OPERATING EFFECTIVENESS of controls throughout the period. |
| Tests of Controls Included? | NO. Does not include tests of controls or results. | YES. Detailed tests of controls and results are explicitly included. |
| Audit Use | Provides evidence to support understanding internal control (SA 315). Cannot reduce substantive testing. | Provides evidence to support ASSESSING CONTROL RISK BELOW HIGH and reducing substantive procedures (SA 330). |
6.3 Obtaining an Understanding of Services (4 Audit Procedures)
The user auditor obtains an understanding of:
- The nature and significance of services and effect on internal control (sources: user manuals, contracts, service auditor reports);
- Nature and materiality of transactions processed;
- Degree of interaction: The extent to which the user entity is able to and elects to implement effective controls over processing; and
- Nature of the relationship, including contractual terms.
- (a) Obtaining a Type 1 or Type 2 report, if available;
- (b) Contacting the service organisation, through the user entity, to obtain specific information;
- (c) Visiting the service organisation and performing procedures that provide necessary information about relevant controls; or
- (d) Using another auditor to perform procedures that provide necessary information.
6.4 Using Type 1/Type 2 Reports, CUEC & Sub-Service Organisations
In determining sufficiency and appropriateness of evidence, the user auditor must be satisfied as to the service auditor’s professional competence and independence, and the adequacy of standards under which the report was issued.
Controls that the service organisation assumes in the design of its service will be implemented by user entities, and which are identified in the system description. The user auditor must evaluate whether CUECs are relevant, and if so, understand whether the user entity has designed and implemented them.
When a service organisation outsources to a sub-service organisation:
• Inclusive Method: Sub-service org controls are included in description and tested in the report.
• Carve-Out Method: Sub-service org control objectives and controls are excluded from the report. User auditor must obtain separate evidence for sub-service operations.
6.5 & 6.6 Tests of Operating Controls at Service Organisation
When the user auditor expects controls at the service organisation to operate effectively, the auditor obtains evidence by: obtaining a Type 2 report, performing tests of controls at the service org, or using another auditor.
When using a Type 2 report as evidence of operating effectiveness, the user auditor evaluates:
- Whether description, design, and operating effectiveness is at a date or for a period appropriate for the user auditor;
- Whether Complementary User Entity Controls (CUEC) are relevant, understood, and tested for operating effectiveness at the user entity;
- The adequacy of the time period covered and time elapsed since testing; and
- Whether tests performed and results described are relevant to assertions in the user entity's financial statements.
- Unmodified (Clean) Audit Report: The user auditor SHALL NOT refer to the work of a service auditor in an unmodified report unless required by law or regulation. If required by law, the report shall indicate that the reference does not diminish the user auditor's responsibility for the audit opinion.
- Modified Audit Report: If reference to the service auditor’s work is relevant to an understanding of a modification to the audit opinion, the user auditor’s report shall indicate that such reference DOES NOT DIMINISH the user auditor’s responsibility for that opinion.
7. ICAI Test Your Understanding (TYU 1 to 5) — Fully Solved
The need to set up a new plant involving huge capital outlays to stay competitive creates excessive pressure on management to secure external debt or equity financing. Under SA 240, excessive pressure on management to meet third-party expectations or obtain financing is a recognized Fraud Risk Factor under Incentives/Pressures. In such situations, management may be tempted to inflate revenues to present a rosy financial picture.
The company's revenues jumped from ₹ 750 crore to ₹ 1,000 crore without any expansion in plant capacity. This significant anomaly elevates the assessed risk of material misstatement due to fraud.
- Perform substantive analytical procedures relating to revenue (correlating raw material consumption, power units, and capacity with production).
- Deploy Computer Assisted Audit Techniques (CAATs) to identify unusual revenue transactions booked near year-end or on non-business days.
- Perform rigorous tests of controls over sales order processing, dispatch gate passes, and customer invoicing.
- Circulate external confirmations under SA 505 verifying contract terms, delivery dates, and return rights.
Under SA 240, management failing to remedy known significant deficiencies in internal control on a timely basis is an explicit Fraud Risk Factor for misstatements arising from fraudulent financial reporting (Attitudes/Rationalizations).
When management fails to correct known deficiencies, it reflects an attitude, character, or ethical posture that allows them knowingly and intentionally to tolerate control gaps that facilitate dishonest acts:
- Lack of timely receivables reconciliation can conceal fictitious billings, unrecorded credit notes, or teaming and lading defalcations.
- Failure to review credit limits can lead to granting credit beyond customer creditworthiness, resulting in intentional tying up of funds with risky or collusive parties.
When the auditor becomes aware of investigations or searches by government departments (DGGI, IRDAI), it indicates suspected non-compliance with laws and regulations.
Issuing invoices without supply of services is a serious offence under GST laws involving heavy fines and prosecution (Tier 1 direct law). Furthermore, violation of IRDAI regulations (Tier 2 operating law) may result in revocation of broking license, calling into question the entity's continuance as a going concern (SA 570).
- Obtain an understanding of the nature of the act and evaluate the possible effect on financial statements.
- Discuss the matter with management and TCWG. If management fails to provide sufficient supporting evidence and the effect is material, consider obtaining independent legal advice.
- Evaluate whether a provision or contingent liability disclosure is required under Ind AS 37.
- If evidence is withheld, evaluate scope limitation under SA 705 (Qualified or Disclaimer of Opinion). If non-compliance is unadjusted, issue a Qualified or Adverse Opinion.
Under SA 260 and SA 701, the auditor communicates preliminary views about Key Audit Matters when discussing the planned scope and timing of the audit, and refines them as audit findings emerge.
- Alleviates the practical challenges of attempting to have a robust two-way dialogue about KAMs at the eleventh hour when financial statements are being finalized for issuance.
- Enables TCWG to understand the basis for the auditor's determination and how the matter will be described in the auditor's report.
- Provides TCWG and management an opportunity to consider whether new or enhanced disclosures in the financial statements are needed.
Under SA 299, in respect of common audit areas, all joint auditors are responsible ONLY for the appropriateness of the decisions concerning the nature, timing, and extent of planned audit procedures agreed upon among them.
However, PROPER EXECUTION of these audit procedures is the INDIVIDUAL RESPONSIBILITY of the joint auditor concerned!
Because testing controls over batch processing was actually carried out by the team of DES & Associates, the sole responsibility and liability for lapses in execution lies EXCLUSIVELY with DES & Associates.
8. ICAI Test Your Knowledge (TYK 1 to 18) — Fully Solved
NO. Joint auditor B is NOT required to go by the majority opinion of 2-1.
Under SA 299, where joint auditors disagree regarding the opinion or matters to be covered in the audit report, a joint auditor is not bound by the views of the majority and shall express their opinion in a separate audit report.
Both reports must cross-reference each other under the heading "Other Matter Paragraph" in accordance with SA 706.
CA Shelly Goel's view is incorrect.
Under SA 260, in the case of listed entities, the auditor shall communicate in writing with TCWG regarding independence compliance, total fees for audit and non-audit services by firm and network firms, and safeguards applied.
Furthermore, Section 177 of the Companies Act, 2013 legally mandates the Audit Committee to review and monitor auditor independence. Thus, the requirement is well within its statutory purview.
Verification under SA 250: Verify that the company has instituted systems and procedures by examining documented policies, internal controls, employee sensitization programs, compliance registers, and opinions of legal advisors.
Underscoring Fraud Risk under SA 240: The financial stability and profitability of the company may be threatened by severe new regulatory burdens. Under SA 240, new accounting, statutory, or regulatory requirements constitute a recognized Fraud Risk Factor under Incentives/Pressures that requires heightened skepticism.
Under SA 250 (Para 3.4), the effects are far greater because:
- Many laws relate principally to operational aspects of an entity that typically do not affect the financial statements and are not captured by financial reporting information systems.
- Non-compliance may involve conduct designed to conceal it (collusion, forgery, management override, intentional misrepresentations).
- Whether an act constitutes non-compliance is ultimately a matter for legal determination by a court of law.
- The further removed non-compliance is from events and transactions reflected in financial statements, the less likely the auditor is to become aware of it.
Under SA 240 (Para 2.13), the auditor shall:
- Determine professional and legal responsibilities, including whether there is a requirement to report to appointing authorities or regulators.
- Consider whether it is appropriate to withdraw from the engagement, where withdrawal is legally permitted.
- If withdrawing: discuss withdrawal and reasons with appropriate management and TCWG, and report withdrawal and reasons to appointing authorities or regulators.
CA Udhav omitted Significant Findings from the Audit. Under SA 260, this includes:
- Views about significant qualitative aspects of accounting practices (policies, estimates, disclosures).
- Significant difficulties encountered during the audit (delays, unreasonable deadlines, unavailable info).
- Significant matters discussed with management and written representations requested.
- Circumstances that affect the form and content of the auditor's report.
- Any other significant matters relevant to oversight of the financial reporting process.
YES, CA Akram is entirely CORRECT.
Under SA 402 (Para 6.8), the user auditor shall NOT refer to the work of a service auditor in an auditor’s report containing an unmodified opinion, unless required by law or regulation. Such a reference could mislead users into believing that audit responsibility is divided. The user auditor remains solely responsible for the opinion.
Under SA 240, there is a presumption that there are risks of fraud in revenue recognition. This presumption can be rebutted only in simple situations. Where an entity has multiple revenue streams and deficient internal controls over revenue, rebutting the fraud risk is improper. The audit team should have treated revenue recognition as a significant risk.
Diverting ₹ 43 crores involving company officers constitutes fraud $\ge$ ₹ 1 crore. Under Section 143(12) of the Companies Act, 2013, the auditor is statutorily required to report to the Central Government in Form ADT-4 within the prescribed timeframe. Disclose also under CARO 2020 Clause (xi).
(i) Financial Statement Level Responses (SA 240.29): Assign experienced personnel, evaluate revenue recognition accounting policies against Ind AS 115, and incorporate an element of unpredictability in audit procedures.
(ii) Assertion Level Responses (SA 240.30): Circularize external confirmations under SA 505 confirming not only balances but specific terms of sales agreements (dates, delivery terms, return rights); supplement with inquiries of non-financial personnel; perform rigorous sales cut-off tests at year-end.
Under SA 402 (Para 6.4), CA Tej must be satisfied as to:
- The service auditor’s professional competence and independence;
- The adequacy of standards under which the report was issued;
- Whether the report date/period aligns with the user entity’s financial reporting period; and
- Whether Complementary User Entity Controls (CUEC) identified by Chipmetric Ltd. have been implemented and tested at Key Ventures Ltd.
Management's contention is flawed. Under SA 250, Fire NOC falls under Tier 2 (other laws compliance with which is fundamental to operating aspects and avoiding material penalties).
Failure to hold a valid Fire NOC may lead to factory closure, sealing of premises, and revocation of operating license, directly impacting going concern (SA 570). The auditor must ascertain penal consequences; if material financial impact is unprovided or undisclosed, express a Qualified or Adverse Opinion under SA 705.
- Incentives/Pressures: Senior management compensation tied to unrealistic profitability targets; rapid unusual profitability compared to peers in a competitive industry.
- Opportunities: Significant, complex, and unusual transactions occurring very close to year-end posing difficult substance-over-form questions.
- Opportunities / Rationalization: High turnover of senior management and legal counsel creates low morale and indicates governance instability and deficient oversight.
Management intimidation and refusal to take corrective action represent exceptional circumstances casting serious doubt on auditor continuance. Under SA 240 (Para 2.13), CA F should:
- Determine statutory responsibilities: Report fraud $\ge$ ₹ 1 crore to the Central Government in Form ADT-4 under Section 143(12).
- Consider withdrawing from the engagement, where legally permitted.
- If withdrawing: discuss reasons with the Board and submit written notification to appointing authorities and regulatory bodies.
(i) Outdated Discount Rate: Reflects a significant qualitative defect in management's accounting estimates causing a ₹ 2 crore material misstatement—must be communicated under SA 260.
(ii) 10-Day Delay: Constitutes a significant difficulty encountered during the audit causing extensive unexpected effort.
Other Significant Findings: Disagreements with management, requested written representations, and circumstances affecting report modifications or Key Audit Matters.
Under SA 580 and SA 240, management's refusal to provide requested representations and withholding the investigation report compromises management integrity and creates a major limitation on audit scope.
CA Arvind must report under Section 143(12) (ADT-4 if $\ge$ ₹ 1 crore), CARO Clause (xi), and consider withdrawing from the engagement or issuing a Disclaimer of Opinion under SA 705.
1. Under SA 299, each joint auditor is responsible only for work allocated to them. Since GH & Associates executed debtor valuation, GH & Associates will be held responsible for the valuation lapse.
2. However, SA 299 mandates that the division of work SHALL BE ADEQUATELY DOCUMENTED and SIGNED by all joint auditors. Failing to document work allocation is a violation of SA 299 by BOTH GH & Associates and IJ & Co.!
CA Yash must obtain a Type 2 Report under SA 402 (Report on Description, Design, and Operating Effectiveness of Controls throughout a specified period). A Type 1 report is insufficient because it does not test operating effectiveness.
CA Yash must evaluate: time period covered, time elapsed since testing, relevance to hospital billing assertions, and verify whether SKY Hospital implemented necessary Complementary User Entity Controls (CUEC).
This represents a classic fictitious journal entry booked near year-end without commercial rationale to manipulate operating results (management override of controls).
- Since fraud amount is ₹ 1.30 crore ($\ge$ ₹ 1 crore), mandatory reporting to the Central Government in Form ADT-4 under Section 143(12) is triggered.
- Disclose under CARO 2020 Clause (xi).
- Assess management integrity; if unrectified, issue a Qualified or Adverse Opinion under SA 705, and evaluate withdrawal if exceptional circumstances persist.