ISSAI 400 Compliance Auditing
Elements (27 to 41)
Principles (42 to 60)
Framework (12 to 26)
Purpose and Authority (4-11)
Elements
ISSAI 100 mentioned 4 elements
*three parties,
*subject matter-criteria-subject matter information
* types of engagement –attest engagement or
direct reporting engagement
ISSAI 200 talks about additional aspects of
elements mentioned in ISSAI 100
Subject matter may be (a) activities, (b) financial
transactions or (c) information
ISSAI 400 says ‘criteria’ for compliance audit ….
come from the structure & content of Authorities
It says ‘Authorities’ include laws, rules, regulations,
budgetary laws, budgetary resolutions, policy,
codes, agreements … …… (regularity)-para 28,29
Compliance audits can also focus on propriety
where formal criteria are absent (?) or
shortcoming in legislation concerning their
application (?). Criteria would be general
principles governing sound financial management
and conduct of public officials.
General Principles (8)
(1) Adherence to ethical requirements & independence
prescribed by the organisation
(2) Auditor to comply with quality control requirements
prescribed by the organisation
(3) Auditor to possess the required knowledge, skills &
capabilities
(4) Auditor to plan and perform audit with professional
scepticism and professional judgement
General Principles
(5) use professional judgement to reduce the audit risk to
reduce inherent risk (where controls do not exist) and reduce
control risk (controls fail to detect and prevent mistakes)
(6) use professional judgement to determine the materiality
of the misstatement (whether significant to influence the
decision of users)
(7) Auditor needs to keep an effective system of
communication with management
(8) Auditor needs to document the entire process
particularly the extent of audit procedures used so that
others (other auditor) can understand the process
Principles related to Audit Process
Auditors should determine the audit scope
Auditor should identify the subject matter and
suitable criteria (for attest engagements
Auditors should develop audit strategy & audit plan
Auditors should gather sufficient and appropriate
evidence
Auditor should reach conclusions by evaluating the
audit evidence
Auditors should prepare a report (long/short form)
Framework for compliance auditing
CA may cover wide range of subject matter
Can provide reasonable or limited assurance
Compliance audits may be attestation or direct
reporting engagement or both at once
May cover all levels of government
Compliance audits of private entities are also
possible focusing for revenue on tax payers, for
expenditure; on those involved in management
of public services or public property through
partnerships, as recipients of grants or subsidies
Para 20 to 26
Compliance Auditing is generally conducted either
(i) in relation with audit of financial statement or
(ii) separately from audit of financial statement or
(iii) in combination with performance auditing
Auditing standard for (i) is ISSAI 4200 and this audit is
along with FA using ISSAI 1000-1810
Auditing standard for (ii) is ISSAI 4100
Under (iii), compliance is seen as one of aspects of 3Es
Why do we need a separate CA? Compliance aspect
can be additional element in FA,PA.
Framework for compliance auditing
Para 12: Compliance audits are carried out by
assessing whether activities, financial transactions
and information comply with authorities governing
the entity (see para 28,29 what is authority).
Compliance auditing is independent assessment of
whether the given subject matter is in compliance
with applicable authorities (identified as criteria).
What is the purpose of compliance audit?
How is it distinguished from FA and PA?
What would compliance auditing
in private entity involve ?
Governments regulate various aspects of private
business through promulgating laws and
regulations
Private sector entities are required to ‘comply’
with those laws and regulations. It is mandatory.
Non compliance would involve penal action often
impact the figures in balance sheet.
AICPA, has 4 sets of standards.
• SAS: Statements of Auditing Standards
• SSAE: Statements on Standards for Attestation
Engagements
• SSARS: S...on Standards for Accounting & Review Services
• SSCS: Statements on Standards for Consultancy Services
SSAE 10 Compliance Attestation
engagements related to an entity's compliance
with requirements of specified laws, regulations,
rules, contracts, or grants etc
USA – Federal Grants to entities
Audited by CPAs
Single Audit Act of 1984
OMB Circular A-133
Compliance Audit in addition to certification of
the accounts of the entity
SAS 117 of AICPA: Obtain sufficient appropriate
audit evidence to form opinion and report at
the level required in the governmental audit
requirement on whether the entity complied
with applicable compliance requirements.
IAASB of IFAC
International Standards on Auditing ISA 250
“considerations of laws & regulations in audit of
financial statements”
- Source of ISSAI 4200 which talks about CA in
combination of FA
IFAC Study Note 3 issued in October 1994 titled
“Auditing for Compliance with Authorities -------A public sector perspective”
- Source of ISSAI 4100 which talks about CA
separately from audit of financial statement