Assurance Engagements and Quality Management

Assurance Engagements and Quality Management

Syllabus tag: KASNEB CPA | Advanced Level | CA36 Advanced Auditing and Assurance

1. The assurance framework — ISAE 3000

An assurance engagement: a practitioner expresses a conclusion to enhance the confidence of intended users about the outcome of evaluating subject matter against criteria. Three parties: practitioner, responsible party, intended users.

Reasonable assurance → positive conclusion: "In our opinion, the subject matter conforms in all material respects with the applicable criteria." Limited assurance → negative conclusion: "Nothing has come to our attention that causes us to believe..."

2. Review engagements — ISRE 2400 / ISRE 2410

A review of financial statements or interim financial information provides limited assurance. Procedures are primarily inquiry and analytical procedures — no evidence gathering as in a full audit. Cost-effective alternative to audit for smaller or interim periods.

3. Agreed-upon procedures — ISRS 4400

Practitioner performs specific procedures agreed with the engaging party and reports factual findings. No assurance is expressed — users draw their own conclusions. The report is restricted to parties who agreed the procedures. Used for specific, narrow tasks (e.g. verifying specific balances for a lender).

4. Compilation engagements — ISRS 4410

Practitioner assists management to prepare financial information using management's data. No audit or review procedures are performed. The compilation report makes clear that no assurance is expressed. Used by small entities that do not require audit or review.

5. Forensic auditing

Applies accounting and auditing skills to legal matters — primarily fraud investigations. Distinctive features: evidence must be suitable for legal proceedings; chain of custody of evidence is critical; practitioner may testify as expert witness; professional scepticism is heightened. Applications: fraud investigations, loss quantification for litigation, anti-corruption work, insurance claims.

6. Quality management — ISQM 1 and ISA 220

ISQM 1 requires firms to design and implement a system of quality management providing reasonable assurance of compliance with professional standards. Key elements: governance and leadership (tone at the top), ethical requirements (independence), acceptance and continuance, engagement performance, resources (people, technology, intellectual), information and communication, monitoring and remediation.

ISA 220 places responsibility for engagement quality on the engagement partner. An Engagement Quality Review (EQR) is mandatory for listed entity audits — an independent partner reviews significant judgements before the report is issued.

7. Regulatory landscape in Kenya

ICPAK (Institute of Certified Public Accountants of Kenya) — professional body; KASNEB — examination board; Financial Reporting Centre (FRC) — anti-money laundering oversight; Auditor General — public sector audit; Capital Markets Authority (CMA) — financial reporting oversight for listed companies.