OXFORD UNIVERSITY PRESS SOUTHERN AFRICA

AUDITING FUNDAMENTALS IN A SOUTH AFRICAN CONTEXT Editors: Pieter von Wielligh Frans Prinsloo Gerrit Penning Rika Butler Dana Nathan (Josset) Rolien Kunz Vincent Motholo Graeme O'Reilly Riaan Rudman Henriette Scholtz OXFORD UNIVERSITY PRESS SOUTHERN AFRICA

CONTENTS CONTENTS IN BRIEF i" ACKNOWLEDGEMENTS PREFACE LIST OF AUTHORS ABOUT THE BOOK NTSIMBI PIPING COMPANY PROFILE xiii xiv xvi xviii xix PART A: THE CONTEXT WITHIN WHICH THE EXTERNA! AUDITOR OPERATES 1 CHAPTER 1 Introduction 5 Learning outcomes 5 Reference list 5 1.1 Background 5 1.2 What is the purpose of and need for accounting records? 6 1.2.1 Purpose of accounting records 6 1.2.2 Examples of accounting records 7 1.3 What is the objective of and need for flnancial statements? 8 1.3.1 The objective of flnancial statements 8 1.3.2 Responsibility for accounting records and flnancial statements 9 1.3.3 The assertions made by the (flnancial Statement) preparers 9 1.3.4 Companies Act requirements for accounting records and flnancial statements 11 1.4 Why are externa! auditors needed and what is the purpose of an external audit? 13 1.4.1 The need for external auditors 13 1.4.2 Thehistoryofauditing 14 1.4.3 The history of the external auditing profession in South Africa 14 1.4.4 The purpose of an external (flnancial Statement) audit 15 1.4.5 Providing assurance 16 1.4.6 The definition of an external audit 20 1.4.7 Auditing postulates 21 1.4.8 Types of auditors 22 1.5 What are examples of major corporate accounting scandals in recent years? 22 1.5.1 International corporate accounting scandals 23 1.5.2 South African corporate accounting Standards 27 1.6 What are the structures of the accounting and auditing professions? 29 1.6.1 Professional bodies 29 1.6.2 International accounting bodies 29 1.6.3 Structure of the accounting and auditing professions in South Africa 30 Assessment questions 32 CHAPTER 2 Ethics 34 Learning outcomes 34 Reference list 34 2.1 What is the nature of ethics? 36 2.2 Why do professions have codes of ethics? 36 2.2.1 Background to codes of ethics of professions 36 2.2.2 Rules-based versus principles-based codes of ethics 37 2.2.3 Examples of ethical misconduct by auditors 38 2.3 What are the ethical codes and rules applicable to external auditors In South Africa? 39 2.4 What constitutes prohibited actions for the external auditor? 39 2.4.1 IRBA Rules Regarding Improper Conduct 39

CONTENTS 2.4.2 SAICA's punishable offences 39 2.5 How do the SAICA and IRBA disciplinary processes work? 41 2.5.1 SAICA disciplinary process 41 2.5.2 IRBA disciplinary process 43 2.5.3 Examples of SAICA and IRBA disciplinary processes 44 2.6 What is the content of the SAICA and IRBA Codes of Professional Conduct? 44 2.6.1 Background to the SAICA and IRBA Codes of Professional Conduct 44 2.6.2 Difference between SAICA and IRBA Codes of Professional Conduct 46 2.6.3 The SAICA Code of Professional Conduct 46 2.7 How do ethics fit into the audit process? 74 Assessment questions 75 CHARTER 3 Legal responsibilities of the auditor 77 Learning outcomes 78 Reference list 78 3.1 Introduction 79 3.1.1 Legislation and regulations governing the audit function 80 3.1.2 Legislation and regulations with which the auditor has to be familiar 80 3.2 What are the statutory and regulatory requirements for an audit? 81 3.2.1 Companies that have to be audited 81 3.2.2 What if a Company does not have to be audited? 86 3.3 How does the statutory appointment, removal and rotation of the auditor work and what are his or her rights? 86 3.3.1 Requirements to be met by the auditor in order to be appointed 86 3.3.2 First appointment of the auditor 88 3.3.3 Resignation of the auditor 88 3.3.4 Dismissal of the auditor 89 3.3.5 Appointment of a replacement auditor 89 3.3.6 Rotation of auditors 89 3.3.7 Statutory rights and functions of the auditor 90 3.4 What are the statutory requirements to practise as an auditor? 91 3.4.1 The requirements to become a 'Registered Auditor' 91 3.4.2 Firms as Registered Auditors 92 3.4.3 Limitations to what an auditor may do 93 3.4.4 Statutory duties of auditors 93 3.4.5 Inspections of auditors 93 3.4.6 Liability of auditors for losses suffered by the dient and/or third parties 94 3.5 What does the auditor s statutory responsibility to identify and respond to Reportable Irregularities entail? 96 3.5.1 Definition of a Reportable Irregularity 96 3.5.2 The auditor's reporting duties with regard to Reportable Irregularities 97 3.5.3 The implications of a Reportable Irregularity for the auditee 99 3.6 How is auditing in the public sector different from auditlng in the private sector? 99 3.6.1 Background to auditing in the public sector 99 3.6.2 Who performs public sector audits? 100 3.6.3 To what Standards are these public sector audits conducted? 100 3.7 What other legislation and regulations may impact on the scope of the audit function? 101 3.7.1 The Johannesburg Stock Exchange (JSE) Listings Requirements 101 3.7.2 What special qualifications are required to audit an Company listed on the JSE? 101 3.7.3 What are the specific responsibilities of auditing firms and individual authors conducting audits of companies listed on the JSE? 101 3.7.4 The Sarbanes-Oxley Act of 2002 101 3.8 What role can the auditor play to aid good corporate governance? 102 3.8.1 The combined assurance model 102 3.8.2 The concept of 'combined assurance' 103 3.8.3 The role of the audit committee with regards to the audit function 103 Assessment questions 104

vi AUDITING FUNDAMENTALS PART B: THE AUDITEE'S RESP0NS1BIL1TY FOR FINANCIAL INFORMATION 107 CHAPTER 4 Basic concepts of governance and internal control 110 Learning outcomes HO Reference list HO 4.1 What is 'governance'? 110 4.2 What is the relationship between governance and internal control? 111 4.2.1 Risks within a business III 4.2.2 Risk management III 4.3 What is 'internal control'? 113 4.3.1 A system of internal control 113 4.3.2 Components of a system of internal control 114 4.3.3 Inherent limitations of a system of internal control 122 4.3.4 Impact when the system of internal control does not operate as intended 123 4.4 How does one design a system of internal control? 123 4.4.1 Step 1: Identify the risks 123 4.4.2 Step 2: Formulate control objectives 125 4.4.3 Step 3: Design a system of appropriate internal controls 128 Assessment questions 13 CHAPTER 5 Introduction to risks and internal controls in a computerised environment 133 Learning outcomes 134 5.1 Introduction 134 5.2 How has Information Technology evolved? 135 5.3 How and why do companies have to govern their Computer Information systems? 138 5.4 What is the impact of upgrading a manual accounting system to an electronic accounting system? 139 5.5 What are the key components of a Computer Information system? 141 5.6 How does a computerised accounting system operate? 142 5.7 How are Computer controls classified? 143 5.8 How are general controls classified? 145 5.8.1 Organisational controls and personnel practices 147 5.8.2 System development and change controls 150 5.8.3 Access controls 156 5.8.4 Business continuity controls 161 5.8.5 Operating controls and system maintenance controls 162 5.9 Which controls relate to the computerised processing of business transactions? 163 5.9.1 Background 163 5.9.2 Manual versus Computer controls 165 5.9.3 Overview of application controls 165 5.10 How are controls identifled in advanced technologies? 176 5.10.1 Electronic commerce, electronic funds transfers and other data communication 176 5.10.2 Service organisations, outsourcing and data warehousing 177 Assessment questions 178 Appendix: Electronic fund transfer controls 180 CHAPTER 6 Revenue and receipts cycle 183 Learning outcomes 184 Reference list 184 6.1 What are the nature, purpose and accounting implications of the cycle? 185 6.1.1 Nature and purpose 185 6.1.2 Forms of revenue from sale of goods and rendering of services 185 6.1.3 The varied nature of the cycle 186 6.1.4 How transactions in the cycle are triggered (initiated) 186 6.1.5 Major accounts affected by the cycle 188

CONTENTS vii 6.1.6 IAS 18 and the treatment of revenue for financial reporting purposes 188 6.2 What functional areas exist in the cycle? 189 6.2.1 Description of the functional areas 189 6.2.2 Summary of functional areas by department 191 6.3 What Information system is used in the cycle? 192 6.3.1 Accounting for revenue and receipt transactions 192 6.3.2 Supporting documents, Journals and ledgers 193 6.3.3 Databases and masterfiles (computerised systems only) 196 6.3.4 Reports 197 6.3.5 Reconciliations 197 6.3.6 Illustration: Transaction flow in the revenue and receipts cycle 197 6.4 What could go wrong (risks) in the cycle? 201 6.4.1 Financial reporting risks 201 6.4.2 Misappropriation risks 204 6.5 What Computer technologies are used in the cycle? 206 6.5.1 Point-of-sale systems and barcode scanning 206 6.5.2 Electronic funds transfer 206 6.5.3 Internet-based (web) sales 206 6.6 What are the control objectives in the cycle? 206 6.6.1 Control objectives in the cycle 206 6.6.2 Achievement of the control objectives in the cycle 208 6.6.3 Link between the control objectives in the cycle and management's assertions 209 6.7 What are the controls in the cycle (manual and computerised)? 212 6.7.1 Internal control activities in the cycle 212 6.7.2 Internal control tables 214 6.8 Cycle Illustration: The revenue and receipts cycle at Ntsimbi Piping 240 6.8.1 Credit management 240 6.8.2 Receiving Orders from customers 241 6.8.3 Authorisation of sales orders 243 6.8.4 Picking of goods from warehouse 244 6.8.5 Despatch and delivery of goods to customers 244 6.8.6 Invoicing 245 6.8.7 Recording of sales in the accounting records 246 6.8.8 Receipt of cash from customers 247 6.8.9 Recording of receipts in the accounting records 248 6.8.10 Processing and recording of returns and other sales adjustments 249 Assessment questions 250 CHARTER 7 Rurchases and payments cycle 254 Learning outcomes 255 7.1 What are the nature, purpose and accounting implications of the cycle? 256 7.1.1 Nature and purpose 256 7.1.2 Forms of purchases 256 7.1.3 The varied nature of the cycle 257 7.1.4 How transactions in the cycle are triggered (initiated) 257 7.1.5 Example of a typical transaction in the purchases and payments cycle 258 7.1.6 Major accounts affected by the cycle 258 7.1.7 Accounting treatment of certain specific transactions in the cycle 258 7.2 What functional areas exist in the cycle? 262 7.2.1 Description of functional areas 262 7.2.2 Summary of functional areas by department 263 7.3 What Information system is used in the cycle? 263 7.3.1 Accounting for purchases and payments transactions 263 7.3.2 Supporting documents, journals and ledgers 264 7.3.3 Databases and masterfiles (computerised systems only) 268 7.3.4 Reports 268 7.3.5 Reconciliations 268

viii AUDITING FUNDAMENTALS 7.3.6 Illustration: Transactiori flow in the purchases and payments cycle 269 7.4 What could go wrong (risks) in the cycle? 272 7.4.1 Financial reporting risks 272 7.4.2 Misappropriation risks 273 7.5 What Computer technoiogies are used in the cycle? 274 7.5.1 Electronic funds transfer (EFT) 274 7.5.2 Electronic data interchange (EDI) 274 7.6 What are the control objectives in the cycle? 275 7.6.1 Control objectives in the cycle 275 7.6.2 Achievement of the control objectives in the cycle 275 7.6.3 Link between the control objectives in the cycle link and the management's assertions 277 7.7 What are the controls in the cycle (manual and computerised)? 280 7.7.1 Internal control activities in the cycle 280 7.7.2 Internal control tables 282 7.8 Cycle Illustration: The purchase and payments cycle at Ntsimbi Piping 302 7.8.1 Purchase requisition 302 7.8.2 Ordering goods from suppliers 303 7.8.3 Receiving goods from suppliers 305 7.8.4 Recording of purchases 307 7.8.5 Payment preparation 308 7.8.6 Paying the supplier 309 7.8.7 Recording of payment 310 7.8.8 Returning goods and recording a purchase return 311 Assessment questions 313 CHAPTER 8 Inventory and productlon cycle 316 Learning outcomes 317 Reference list 317 8.1 What are the nature, purpose and accounting implications of the cycle? 318 8.1.1 Nature and purpose 318 8.1.2 Types of inventory and production 319 8.1.3 The varied nature of the cycle 319 8.1.4 The link between this cycle and the other cycles 320 8.1.5 How transactions in the cycle are triggered (initiated) 321 8.1.6 Example of a typical transaction in the inventory and production cycle 322 8.1.7 Major accounts affected by the cycle 323 8.1.8 IAS 2 and the treatment of inventory for flnancial reporting purposes 323 8.2 What functional areas exist In the cycle? 323 8.2.1 Description of the functional areas 325 8.2.2 Summary of the functional areas by department 326 8.3 What Information system is used in the cycle? 326 8.3.1 Accounting for inventory and production transactions 326 8.3.2 Supporting documents, journals and ledgers 329 8.3.3 Databases and masterfiles (computerised systems only) 329 8.3.4 Reports 329 8.3.5 Reconciliations 329 8.3.6 Illustration: Transaction flow in the inventory and production cycle 329 8.4 What could go wrong (risks) in the cycle? 333 8.5 What Computer technoiogies are used in the cycle? 333 8.6 What are the control objectives in the cycle? 333 8.6.1 Control objectives in the cycle 333 8.6.2 Achievement of the control objectives in the cycle 334 8.6.3 Link between the control objectives in the cycle and management's assertions 336 8.7 What are the controls in the cycle (manual and computerised)? 336 8.7.1 Internal control activities in the cycle 336 8.7.2 Internal control tables 338 8.7.3 Controls relating to the conducting of inventory counts 350

CONTENTS ix 8.8 Cycle Illustration: The inventory and production cycle at Ntsimbi Piping 351 8.8.1 Background to inventory and production 351 8.8.2 Inventory counts 353 Assessment questions 356 CHARTER 9 Human resources cycle 359 Learning outcomes 360 9.1 What are the nature, purpose and accounting implications of the cycle? 363 9.1.1 Nature and purpose 363 9.1.2 Relationship with other cycles 364 9.1.3 The varied nature of the cycle 364 9.1.4 How transactions in the cycle are triggered (initiated) 365 9.1.5 Major accounts affected by the cycle 366 9.1.6 Applicable accounting Standards, legislation, listings requirements and corporate governance principles 366 9.1.7 Executive remuneration 370 9.1.8 Deductions from employees'remuneration 370 9.2 What functional areas exist in the cycle? 371 9.2.1 Description of functional areas in the cycle 371 9.2.2 Summary of functional areas by department 372 9.3 What Information system is used in this cycle? 373 9.3.1 Accounting for salaries, wages and related transactions 373 9.3.2 Supporting documents, Journals and ledgers 373 9.3.3 Databases and masterfiles (computerised systems only) 375 9.3.4 Reports 376 9.3.5 Reconciliations 376 9.3.6 Illustration: Transaction flow in the human resources cycle 376 9.4 What could go wrong (risks) in the cycle? 384 9.4.1 Financial reporting risks 384 9.4.2 Misappropriation risks 384 9.5 What Computer technologies are used in the cycle? 384 9.5.1 Access control systems 384 9.5.2 Payroll Software 385 9.5.3 Electronic funds transfers 386 9.6 What are the control objectives in the cycle? 387 9.6.1 Control objectives in the cycle 387 9.6.2 Achievement of control objectives in the cycle 387 9.6.3 Link between the control objectives in the cycle and management's assertions 389 9.7 What are the controls in the cycle (manual and computerised)? 390 9.7.1 Internal control activities in the cycle 390 9.7.2 Internal control tables 392 9.8 Cycle Illustration: The human resources cycle at Ntsimbi Piping 414 9.8.1 Background to the human resources cycle of Ntsimbi Piping 414 9.8.2 Appointment of employees and personnel records 414 9.8.3 Timekeeping - wage employees 416 9.8.4 Calculation and recording of salaries and wages 416 9.8.5 Payment preparation and payment of wages and salaries 417 9.8.6 Payment of deductions 418 9.8.7 Recording the salary and wage transactions in the accounting records 419 Assessment questions 420 CHARTER 10 Investment and financing cycle 423 Learning outcomes 424 Reference list 424 10.1 What are the nature, purpose and accounting Implications of the cycle? 425 10.1.1 Nature and purpose 425 10.1.2 Forms of transactions and major accounts affected by the cycle 427

x I AUDITING FUNDAMENTALS 10.1.3 Characteristics of the investment and financing cycle 428 10.1.4 Relevant accounting Standards 429 10.1.5 How transactions in the cycle are triggered (initiated) 429 10.2 What functional areas exist in the cycle? 430 10.2.1 Financing 430 10.2.2 Investments 433 10.3 What Information system is used in the cycle? 435 10.3.1 Accounting for investment and financing transactions 435 10.3.2 Supporting documents and Journals 436 10.3.3 Illustration: Transaction flow in the investment and financing cycle 438 10.4 What could go wrong (risks) in the cycle? 441 10.4.1 Financial Statement level risks 441 10.4.2 Assertion level risks 442 10.5 What Computer technologies are used in the cycle? 443 10.6 What are the control objectives in the cycle? 444 10.6.1 Control objectives in the cycle 444 10.6.2 Achievement of the control objectives in the cycle 445 10.6.3 Link between the control objectives in the cycle and management's assertions 446 10.7 What are the controls in the cycle (manual and computerised)? 448 10.8 Cycle Illustration: The Investment and financing cycle at Ntsimbi Piping 451 Assessment questions 451 PART C: THE EXTERNAL AUDIT PROCESS 453 CHARTER 11 Overview of the audit process 455 Learning outcomes 457 Reference list 457 11.1 Introduction 457 11.2 What terminology is used by the auditor when performing an audit? 457 11.3 What are the objectives of an audit? 458 11.4 What are the International Standards on Auditing (ISAs)? 459 11.5 How is the audit and audit evidence documented? 459 11.5.1 Characteristics of audit evidence 460 11.6 What are the stages in the audit process? 461 11.6.1 Pre-engagement activities (refer to Chapter 12 for a detailed discussion) 462 11.6.2 Planning (refer to Chapter 12 for a detailed discussion) 462 11.6.3 Obtaining audit evidence (refer to Chapters 13 and 14 for a detailed discussion) 466 11.6.4 Evaluating, concluding and reporting (refer to Chapter 15 for a detailed discussion) 467 11.7 How do computerised environments impact on the audit process? 468 11.8 Is there a link between the stages of the audit process and the ISAs? 469 Assessment questions 471 CHAPTER 12 Pre-engagement and planning activities 473 Learning outcomes 475 Reference list 475 12.1 Introduction 477 12.1.1 The concepts of 'Overall audit strategy', 'Audit plan' and 'Audit approach' 478 12.2 How does the auditor perform pre-engagement activities? 478 12.2.1 Requirements 479 12.2.2 Application in practice 482 12.3 How are the terms of the engagement documented? 486 12.3.1 Importance of documenting the terms 486 12.3.2 Contents of the engagement letter 487 12.4 How does the auditor obtain an understanding of the entity? 487 12.4.1 Aspects of the entity to be understood 487 12.4.2 Method of obtaining the understanding 495

CONTENTS xi 12.5 How does the auditor assess the risk of material misstatement? 499 12.5.1 Conceptual aspects of risk assessment 499 12.5.2 The need to consider risk arising from going concern issues 513 12.5.3 The need to consider the risk of fraud 515 12.5.4 Identification of risks that require special audit consideration ('significant risks') 517 12.5.5 Risks for which substantive procedures alone do not provide sufficient appropriate audit evidence 519 12.6 How can the auditor respond to identified risks of material misstatement? 519 12.6.1 Responding to detection risk at the financial Statement level 520 12.6.2 What options are available to the auditor to achieve desired changes to the level of detection risk at the financial institutions/disclosure level? 520 12.6.3 Responding to detection risk at an account balance/class of transactions/disclosure level 523 12.6.4 The implications of combined testing versus substantive testing 525 12.6.5 Updating the audit approach and plan throughout the audit 528 12.7 What is 'planning materiality' and how is it calculated? 528 12.7.1 Definition 529 12.7.2 Calculating planning materiality 530 Assessment questions 537 CHAPTER 13 Audit procedures: Essential concepts 542 Learning outcomes 544 Reference list 544 13.1 Where do audit procedures fit into the audit process? 545 13.2 What are'audit objectives'? 547 13.3 What is the nature' of audit procedures? 548 13.3.1 Determinants of the nature of audit procedures 548 13.3.2 Tests of controls 550 13.3.3 Substantive procedures 560 13.3.4. Dual purpose audit procedures 578 13.3.5 Recap 578 13.4 What is the 'timing' of audit procedures? 579 13.4.1 Determinants of the timing of audit procedures 579 13.4.2 Interim tests of controls 579 13.4.3 Interim substantive procedures 580 13.4.4 Relying on audit evidence obtained in prior audits 581 13.5 What is the'extent'of audit procedures? 582 13.5.1 Audit sampling 582 Assessment questions 586 CHAPTER 14 Audit procedures: Specific considerations 589 Learning outcomes 591 Reference list 591 14.1 Introduction 591 14.2 How do we formulate the nature of audit procedures for specific classes of transactions or account balances? 593 14.2.1 Wages: Attendance of a wage payout 593 14.2.2 Cash and bank 594 14.2.3 Inventory: Attendance of inventory counts 601 14.2.4 Creditors: Creditors' reconciliations 605 14.3 What are the requirements of International Standards on Auditing for dealing with specific complexities that may be encountered when performing audit procedures? 607 14.2.1 External confirmations 607 14.2.2 Management's written representations 618 14.2.3 Accounting estimates 620 14.2.4 Use ofother parties in the audit 622 14.4 What are Computer Assisted Audit Techniques (CAATs)? 627 14.4.1 The basics of CAATs 627

xii I AUDITING FUNDAMENTALS 14.4.2 The auditor's use of Computer Software to assist in the audit 633 14.4.3 Reasons for the use of CAATs in the audit process 638 14.4.4 Application of CAATs in the audit process 640 14.4.5 Steps in planning and performing CAATs 641 Assessment questions 644 Appendix: CAATs example 646 CHAPTER 15 Completion of the audit 649 Learning outcomes 651 Reference list 651 15.1 Introduction 652 15.2 What is the auditor's responsibility regarding subsequent events? 652 15.2.1 Introduction 652 15.2.2 Various periods pertaining to subsequent events 654 15.2.3 Auditor's responsibility 654 15.3 What is the auditor's responsibility regarding the going concern assumption? 656 15.3.1 Introduction 656 15.3.2 Managemente responsibility 656 15.3.3 Auditor's responsibility 659 15.3.4 Business rescue and its impact on the audit 660 15.4 How does the auditor deal with uncorrected misstatements in the financia! Statements? 661 15.4.1 Misstatements identified during an audit 661 15.4.2 'Final' materiality 662 15.4.3 Evaluating the materiality of uncorrected misstatements 664 15.4.4 Impact of uncorrected misstatements on the financial statements and audit report 665 15.5 How does the auditor draft the audit report? 665 15.5.1 Introduction 665 15.5.2 Contents of the audit report 666 15.5.3 Types of audit opinions 668 15.5.4 Other paragraphs in the audit report 671 15.5.5 Impact of going concern on the audit report 674 Assessment questions 676 CHAPTER 16 The independent revlew 679 Learning outcomes 680 Reference list 680 16.1 What is an independent review? 680 16.1.1 Nature of an independent review 680 16.1.2 Differences between independent reviews and audits 681 16.2 What are the statutory and regulatory requirements surrounding an independent review? 682 16.2.1 Applicability of independent reviews 682 16.2.2 Persons eligible to perform independent reviews 682 16.2.3 Reportable Irregularities discovered during an independent review 683 16.2.4 The scope of an independent review 685 16.3 How does one conduct an independent review? 685 16.3.1 Activities prior to, and during, the acceptance of the engagement 686 16.3.2 Planning the engagement 686 16.3.3 Performing the engagement 687 16.3.4 Finalising the engagement 689 16.3.5 Reporting on the engagement 690 16.3.6 Documenting the engagement 691 Assessment questions 691 APPENDIX: Examples of cycle documentation related to the business cycles 693 BIBLIOGRAPHY 733 INDEX 736