ISSAI 400

1. ISSAI 400 Fundamental PrinciplesofCompliance Audit ComplianceAuditSubcommittee Vilnius, Lithuania 19th-20th of September 2012 Mona Paulsrud, CAS harmonization team

2. ISSAI 400 presentation • The approachofthe CAS harmonization team to ISSAI 400 • Structure and contentsof ISSAI 400

3. CAS’ contribution to thedevelopmentofpublicsectorauditing

4. The purpose and authorityofISSAI 400 ISSAI 400 PrinciplesofComplianceAudit ISSAI 4000 ComplianceAudit Guidelines 4100 4200

6. AIM OF ISSAI 400 To provide a coherent, highlevelframeworkofComplianceAudit in thepublicsector, coveringboth ISSAI 4100 and ISSAI 4200.

7. CAS’ approach in developing ISSAI 400 • Financial audit – the cradle of the audit profession and audit theory • Defines basic concepts and terminology of auditing

8. ComplianceAudit – The extendedperspective

9. CAS’ strategy in developingISSAI 400 • Builduponexistingcontents and terminologyofthe ISSAI 4000 series • Create a coherent story ofComplianceAudit • High, genericlevelofconcepts and principles • Dual approach – updated IFAC terminology

10. ISSAI 400 – Basic structure • Introduction • Purpose and authorityof ISSAI 400 • The nature ofComplianceAudit} Story of CA • Elements ofComplianceAudit} Audittheory • PrinciplesofComplianceAudit} Requirements • Makingreference to theISSAIs

11. The nature ofCompliance Audit The independentasessmentofwhether a particularsubject matter is in compliancewithestablishedcriteria.

12. The nature ofComplianceAudit Originsof cash flow in thepublicsectorarethedecisions and premisesofthelegislature.

13. Public sectorcontextofthe SAI AUTHORITIES AUTHORITIES AUTHORITIES ComplianceAudit

14. The elements ofComplianceAudit SAI ISSAI 4100 or ISSAI 4200?

15. Authorities and criteria AUTHORITIES CRITERIA

16. SUBJECT MATTER Underlying subject matterSubject matter information

17. The threepartiesofCompliance Audit THE LEGISLATURE THE GOVERNMENT THE SAI

18. Assurance in Compliance Audit

19. Forms ofreporting • Long form reporting • Short form reporting • Findings • Opinions & various forms ofconclusions

20. VariationsofCompliance Audit SUBJECT MATTER ASSURANCE APPROACH FORMS OF REPORTING AUDIT EVIDENCE

21. The elements ofComplianceAudit SAI ISSAI 4100 or ISSAI 4200?

22. PrinciplesofComplianceAudit Principles: at thelevelof an individualaudit

23. PrinciplesofComplianceAudit Principles = «shouldstatments» Able to fit all variationsofComplianceAudit. To be translatedinto «shall statements» whenlevel 4 is to be used as authoritative standards.

24. PRINCIPLES TO BE APPLIED IN CONDUCTING A COMPLIANCE AUDIT • General principles: to be considered prior to comencement and at more thanonepointthroughouttheauditprocess 2. Principlesrelated to theauditprocess: related to steps in theauditprocessitself

25. General principles • Legal basis • Ethics and independence • Qualitycontrol • Audit team management and skills • Audit risk • Materiality • Professional judgment and skeptisim • Documentation • Communication

26. Auditteam management and skills … includes an understanding of and practical experience of the type of audit being undertaken; an understanding of the applicable standards and authorities; an understanding of the entity’s legal basis and operations; and the ability and experience to exercise professional judgement. ISSAI 400 para. 54

27. Audit risk Audit risk in Compliance Audit covers both attestation and direct engagements. inherent risk - control risk -detection risk The degree to which these components are relevant to the audit is affected by the nature of the subject matter, whether the audit is performed as a reasonable assurance or limited assurance audit and whether it is a direct or an attestation engagement. ISSAI 400 para. 56

28. Materiality

29. Materiality Materiality in Compliance Audit consists of both quantitative and qualitative factors. … An essential part of determining materiality is to consider the importance of compliance for the intended users and the consequences of potential or identified instances of non-compliance. ISSAI 400 para. 58

30. Principlesrelated to theauditprocess 1. Planning and designing a complianceaudit • Subject matter and criteria • Auditscope • Understandingtheentity • Risk assessment • Understaning internalcontrol and controlenvironment • Risk offraud • Auditstrategy and audit plan 2. Gatheringauditevidence 3. Evaluatingauditevidence, concluding and reporting • Evaluatingauditevidence and forming conclusions • Reporting • Follow up

31. Planning and designing a complianceaudit 1. Subject matter and criteria

32. Gatheringauditevidence Sufficient and appropriateauditevidence.

33. Evaluatingauditevidence, concludingand reporting