COPYRIGHT NOTICE — This document is intended for internal use. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (“CPA Canada”). These may not be modified, copied or distributed in any form as this would infringe CPA Canada’s copyright. Reproduced, with permission, from the CPA Canada Handbook, The Chartered Professional Accountants of Canada, Toronto, Canada.
4010 Understanding the Subject Matter in Planning an Audit
Audit standards require that the engagement leader and the team have sufficient competence concerning the subject matter and that the team obtains sufficient knowledge of the subject matter so it can identify and assess risks, and design and perform appropriate audit procedures in response. At the beginning of the audit, the audit team conducts research to gain an understanding of the subject matter of the audit, including internal controls relevant to the audit.
This section discusses the following topics
- Understanding the subject matter including factors to consider when obtaining and updating knowledge
- Some specific requirements when understanding the subject matter
- Determining the extent of work needed to obtain an understanding of the subject matter
CSAE 3001 Requirements
35. The engagement partner shall:
(c) Have sufficient competence in the underlying subject matter and its measurement or evaluation to accept responsibility for the assurance conclusion. (Ref: Para. A66-A67)
50. The practitioner shall make inquiries of the appropriate party(ies) regarding:
(a) Whether they have knowledge of any actual, suspected or alleged intentional deviation, including non-compliance with laws and regulations affecting the underlying subject matter; (Ref: Para. A99-A100)
(b) Whether the responsible party has an internal audit function and, if so, make further inquiries to obtain an understanding of the activities and main findings of the internal audit function with respect to the underlying subject matter; and
(c) Whether the responsible party has used any experts in dealing with the underlying subject matter. (Ref: Para. A102)
51R. The practitioner shall obtain an understanding of the underlying subject matter and other engagement circumstances sufficient to:
(a) Enable the practitioner to identify and assess the risks of significant deviation; and
(b) Thereby, provide a basis for designing and performing procedures to respond to the assessed risks and to obtain reasonable assurance to support the practitioner’s conclusion. (Ref: Para. A99-A103, A105-A109)
52R. In obtaining an understanding of the underlying subject matter and other engagement circumstances under paragraph 51R, the practitioner shall obtain an understanding of internal control relevant to the engagement. This includes evaluating the design of those controls pertinent to the objective of the engagement and, if relevant, determining whether they have been implemented by performing procedures in addition to inquiry of the personnel responsible for the underlying subject matter. (Ref: Para. A105-A108)
CSAE 3001 Application Material
A35. In a public sector environment, some of the preconditions for an assurance engagement may be assumed to be present, for example:
(a) The roles and responsibilities of public sector audit organizations and the government entities scoped into assurance engagements are assumed to be appropriate because they are generally set out in legislation;
(b) Public sector audit organizations’ right of access to the information necessary to perform the engagement is often set out in legislation;
(c) The practitioner’s conclusion, in the form appropriate to either a reasonable assurance engagement or a limited assurance engagement, is generally required by legislation to be contained in a written report; and
(d) A rational purpose is generally present because the engagement is set out in legislation.
A36. If suitable criteria are not available for all of the underlying subject matter but the practitioner can identify one or more aspects of the underlying subject matter for which those criteria are suitable, then an assurance engagement can be performed with respect to that aspect of the underlying subject matter in its own right. In such cases, the assurance report may need to clarify that the report does not relate to the original underlying subject matter in its entirety.
Roles and Responsibilities (Ref: Para. 14(n), 14(q), 14(u), 15, 26(a), Appendix 1)
A37. All assurance engagements have at least three parties: the responsible party, the practitioner, and the intended users.
Appropriateness of the Underlying Subject Matter (Ref: Para. 26(b)(ii))
A38. An appropriate underlying subject matter is identifiable and capable of consistent measurement or evaluation against the applicable criteria and can be subjected to procedures for obtaining sufficient appropriate evidence to support a reasonable assurance or limited assurance conclusion, as appropriate.
A39. The appropriateness of an underlying subject matter is not affected by the level of assurance; that is, if an underlying subject matter is not appropriate for a reasonable assurance engagement, it is also not appropriate for a limited assurance engagement, and vice versa.
A40. Different underlying subject matters have different characteristics, including the degree to which information about them is qualitative versus quantitative, objective versus subjective, historical versus prospective, and relates to a point in time or covers a period. Such characteristics affect the:
(a) Precision with which the underlying subject matter can be measured or evaluated against criteria; and
(b) The persuasiveness of available evidence.
A41. Identifying such characteristics and considering their effects assist the practitioner when assessing the appropriateness of the underlying subject matter and also in determining the content of the assurance report (see paragraph A164).
A42. In some cases, the assurance engagement may relate to only one part of a broader underlying subject matter. For example, the practitioner may be engaged to report on one aspect of an entity’s contribution to sustainable development, such as a number of programs run by an entity that have positive environmental outcomes. In determining whether the engagement exhibits the characteristic of having an appropriate underlying subject matter in such cases, it may be appropriate for the practitioner to consider whether the practitioner’s report is likely to meet the information needs of intended users as a group, and whether there are more significant programs with less favorable outcomes that the entity has not asked the practitioner to report upon.
A66. A practitioner may be requested to perform assurance engagements with respect to a wide range of underlying subject matter. Some may require specialized skills and knowledge beyond those ordinarily possessed by a particular individual.
A67.The relevant rules of professional conduct / code of ethics require the professional accountant in public practice to agree to provide only those services that the professional accountant in public practice is competent to perform. The practitioner has sole responsibility for the assurance conclusion expressed, and that responsibility is not reduced by the practitioner’s use of the work of a practitioner’s expert. Nonetheless, if the practitioner using the work of a practitioner’s expert, having followed this CSAE, concludes that the work of that expert is adequate for the practitioner’s purposes, the practitioner may accept that expert’s findings or conclusions in the expert’s field as appropriate evidence.
A89. In the circumstances described in paragraph 48, when some or all of the underlying subject matter is not appropriate for an assurance engagement and the practitioner continues with the engagement, a qualified conclusion or a disclaimer of conclusion would be appropriate depending on, in the practitioner’s professional judgment, how significant and pervasive the matter is.
A99. Discussions between the engagement partner and other key members of the engagement team, and any key practitioner’s external experts, about the susceptibility of the underlying subject matter to significant deviation, and the application of the applicable criteria to the facts and circumstances of the engagement, may assist the engagement team in planning and performing the engagement. It is also useful to communicate relevant matters to members of the engagement team, and to any practitioner’s external experts not involved in the discussion.
A100. The practitioner may have additional responsibilities under law, regulation or relevant ethical requirements regarding an entity's non-compliance with laws and regulations, which may differ from or go beyond the practitioner's responsibilities under this CSAE, such as:
(a) Responding to identified or suspected non-compliance with laws and regulations, including requirements in relation to specific communications with management and those charged with governance and considering whether further action is needed;
(b) Communicating identified or suspected non-compliance with laws and regulations to an auditor; 6 (7) and
(c) Documentation requirements regarding identified or suspected non-compliance with laws and regulations.
Complying with any additional responsibilities may provide further information that is relevant to the practitioner's work in accordance with this and any other CSAE (e.g., regarding the integrity of the responsible party or those charged with governance). Paragraphs A192-A197 further address the practitioner's responsibilities under law, regulation or relevant ethical requirements regarding communicating and reporting identified or suspected non-compliance with laws and regulations
A101. Obtaining an understanding of the underlying subject matter and other engagement circumstances provides the practitioner with a frame of reference for exercising professional judgment throughout the engagement, for example, when:
- Considering the characteristics of the underlying subject matter;
- Assessing the suitability of criteria;
- Considering the factors that, in the practitioner’s professional judgment, are important in directing the engagement team’s efforts, including where special consideration may be necessary (for example, the need for specialized skills or the work of an expert);
- Establishing and evaluating the continued appropriateness of quantitative and qualitative factors that are significant;
- Developing expectations for use when performing analytical procedures;
- Designing and performing procedures; and
- Evaluating evidence, including the reasonableness of the oral and written representations received by the practitioner.
A102. Whether a party employed or otherwise engaged by a responsible party is an expert for the purposes of this CSAE is a matter of professional judgment for the practitioner. For example, a responsible party may engage an individual or organization possessing skills and experience not normally possessed by the responsible party. In the practitioner’s judgment, depending on the circumstances of the engagement, this may indicate that the responsible party has used the work of an expert that significantly affects the underlying subject matter and has important implications for the engagement. Paragraph 59 deals with circumstances when information to be used as evidence has been prepared using the work of a responsible party’s expert.
A103.The practitioner ordinarily has a lesser depth of understanding of the underlying subject matter and other engagement circumstances than the responsible party. The practitioner also ordinarily has a lesser depth of understanding of the underlying subject matter and other engagement circumstances for a limited assurance engagement than for a reasonable assurance engagement. For example, while in some limited assurance engagements the practitioner may obtain an understanding of internal control relevant to the underlying subject matter, this is often not the case.
A105. In a reasonable assurance engagement, understanding internal control relevant to the underlying subject matter assists the practitioner in identifying the types of deviations and factors that affect the risks of significant deviation. Professional judgment is needed to determine which controls are relevant in the engagement circumstances.
A106. When the objective of a reasonable assurance engagement is to assess the design or implementation of controls over a process (for example, a process for dealing with patients in a hospital emergency room), the practitioner is required, during the initial planning phase, to identify the internal controls to the extent necessary to inform the engagement scope and the risk assessment. The practitioner is not required to evaluate the design or determine the implementation of the controls during the initial planning phase. This work would be performed later in the engagement since internal controls form the underlying subject matter for this engagement.
A107. When the objective of a reasonable assurance engagement is to conclude on a specific outcome of a process, controls may not be relevant to that engagement. For example, an assurance engagement may be designed to reach a conclusion regarding whether the time taken to process specific items (for example, applications to receive a service) over a specified period of time exceeds what is permitted under stated policies. The practitioner might simply examine all the items processed during the specified period and conclude on whether there was compliance with the stated policies.
A108. When controls are pertinent to the objective of a reasonable assurance engagement, the practitioner evaluates the design of internal controls by documenting the key controls, and identifying deficiencies such as poorly designed or missing controls, if any. To determine if the controls have been implemented, the practitioner often may perform walk-throughs, or observe the control being performed by, for example, the responsible party's personnel.
A109. In both a reasonable assurance and a limited assurance engagement, the results of the entity’s risk assessment process may also assist the practitioner in obtaining an understanding of the underlying subject matter and other engagement circumstances.
Financial Administration Act
Section 138(3) Before an examiner commences a special examination, he shall survey the systems and practices of the corporation to be examined and submit a plan for the examination, including a statement of the criteria to be applied in the examination, to the audit committee of the corporation, or if there is no audit committee, to the board of directors of the corporation.
FAA 138(5) An examiner shall, to the extent he considers practicable, rely on any internal audit of the corporation being examined conducted pursuant to subsection 131(3).
The audit team shall obtain up-to-date knowledge of the subject matter to be examined in order to determine significance and risk and to properly scope the audit. [Nov-2015]
As part of understanding the subject matter, the audit team shall inquire as to any relevant intentional non-compliance, internal audit activities, and findings, and work of entity experts and assess the implications on planning the audit. [Nov-2015]
As part of understanding the subject matter, the audit team shall obtain an understanding of internal controls relevant to the audit. [Nov-2015]
In special examinations, the audit team shall identify all affiliated entities of the Crown corporation and decide whether these affiliated entities are to be scoped into the audit. [Nov-2011]
What CSAE 3001 means for understanding the subject matter in planning
Understanding the subject matter involves updating or obtaining sufficient information about the relevant entity(ies) and topic areas of the audit, including obtaining an understanding of internal control relevant to the audit. CSAE also requires some specific inquiries to be made by audit teams as part of this work (see the section below that describes these requirements in more detail).
Knowledge of the subject matter informs the audit team’s risk assessment, significance considerations, scoping decisions, and audit approach. In the case of performance audits, it may also inform the audit objective. (These topics are discussed in OAG Audit 4020 Risk assessment; OAG Audit 4025 Internal controls; OAG Audit 4041 Audit Objective; OAG Audit 4042 Audit scope and approach; OAG Audit 4043 Audit criteria; and OAG Audit 4044 Developing the audit strategy: audit logic matrix). Understanding the subject matter also helps the audit team to determine if the subject matter is appropriate—a pre-condition for continuing with the audit (OAG Audit 3011 Acceptance and continuance).
Understanding the subject matter also helps the audit team to determine if the subject matter is appropriate—a pre-condition for continuing with the audit (OAG Audit 3012 Preconditions for a direct engagement) and (OAG Audit 3011 Acceptance and continuance). If the audit team determines that the subject matter is not appropriate (i.e. the subject matter is not identifiable; cannot be consistently measured against appropriate criteria and that sufficient appropriate evidence cannot be obtained to support a reasonable assurance conclusion on it), then the audit team will either have to withdraw from the engagement OR express a qualified or a disclaimer of conclusion (OAG Audit 7040 Audit conclusion).
Understanding the subject matter
The term “underlying subject matter” is used in CSAE 3001 and is defined as the phenomenon that is measured or evaluated by applying criteria. In other words, “underlying subject matter” is the area being audited. The underlying subject matter in a performance audit may be the activity, process or program within an individual entity or one which spans multiple entities, or the performance audit may be for an entity overall. The underlying subject matter is measured directly against applicable criteria during a defined period or at a point in time.
For the purposes of this direct engagement manual, the term “subject matter” is used and refers to both the relevant entity(ies) and topic areas being audited, as relevant.
In some cases the subject matter will be primarily a government entity. For example, in a special examination, the subject matter is considered to be the Crown corporation.
In some performance audits, the subject matter may be primarily topic based and often involves more than one entity. For example an audit of a function or activity within and/or across government (e.g. human resource management). In these cases, the audit team should obtain an understanding of the topic area as well as how it operates in each organization selected for audit. When there may be multiple entities responsible for the underlying subject matter, obtaining sufficient understanding of the entities and their interrelationships enables the audit team to appropriately scope, plan and conduct the performance audit.
Factors to consider when obtaining and updating knowledge of subject matter. The audit team should obtain information about all the key features of the subject matter (audited entity(ies) and topics) and the environment relevant to that subject matter. Some factors for the audit team to consider when gathering information to understand the subject matter include
- nature of the subject matter (i.e. the governing authorities; form of organizations and objectives);
- accountability relationships;
- programs, operations, and activities;
- systems, controls, and practices;
- external environment;
Not all these elements are relevant to every performance audit and the list is not necessarily complete. Many of these elements form the basis of the control environment which is considered as part of understanding internal control. This topic is discussed in Internal Controls (OAG Audit 4025).
Nature of the subject matter. The nature of subject matter includes three interrelated elements that teams consider:
The governing authorities: these include such things as legislation; regulations, Order in Councils; Treasury Board decisions, policies, directives, etc.
The organizations involved, their form and their legal structures: Governments carry out policies and deliver services through different forms of organization. Some common forms of organization include government departments, statutory or service agencies, special operating agencies, Crown corporations, and agents of Parliament. Different forms of organization are subject to different rules, policies, and requirements. For example, Crown corporations have broad financial powers and operational authority delegated to their management under legislation, and are more autonomous.
The objectives and mandates related to subject matter and involved entities: Different forms of organization have different objectives. Different program areas or functions within government also have different objectives.
Information about the nature of the entity may assist the audit team in understanding:
- the authority for the entity's programs, operations and activities;
- any specific financial, administrative and operational powers and responsibilities granted by governing authorities;
- the basis for its accountability relationships and performance goals; and
- significant external constraints on the entity's operations.
Accountability relationships. An understanding of the accountability relationships relevant to the subject matter permits the audit team to determine which entities (or parts of the entity(ies)) are responsible for which elements of performance related to the subject being audited and the resources the entities use to meet their objectives.
In federal departments and other non-corporate government organizations, ministers are charged with developing policy and making the major decisions assigned by law. An appointed senior public servant, such as a Deputy Minister, is primarily accountable to a Minister and is responsible for advising the Minister and for administration. Such senior public servants may have additional accountabilities to the Prime Minister, and to central bodies such as a Treasury Board, Public Service Commission, or Public Accounts Committee. Further, the powers and responsibilities of those senior public servants are usually assigned through governing authorities. Crown corporations in contrast are responsible to the government and to the legislature through a Minister. An appointed board of directors is charged with the overall direction of the business, activities, and other affairs of the corporation. The board of directors delegates to the chief executive officer and other senior management officials, the responsibility for administration. Crown corporations are often not subject to all of the governing authorities that apply to departments.
The audit team also identifies other relevant accountability relationships such as those within the relevant entities themselves (i.e. governance structure and organization); those between relevant entities, including subsidiaries; and those with other governments.
Programs, operations, and activities. The audit team analyzes operations undertaken by the relevant entity(ies) so as to clearly understand the subject matter. This understanding helps the audit team determine whether the audit entity(ies) are operating within its powers, how the entity(ies) achieve the objectives and performance goals related to the subject matter, and any risks that need to be managed in doing so.
Understanding the entity's significant programs, operations and activities include obtaining information about
the intended outputs, such as goods or services;
the outcomes and impacts of the programs, operations and activities, which may be positive or negative effects of a program, operation or activity, and they may be intentional or unintentional;
the organizational structure, including identifying the divisions and branches, determining their responsibilities and degree of autonomy;
the source, nature and amount of resources used in program delivery;
the method of program delivery; and
the pricing or fee structures.
Performance. The audit team needs knowledge of the relevant entity(ies)’s and/or overall government performance as it relates to the subject matter to understand such matters as the relevance of the activities to clients and stakeholders; trade-offs among conflicting objectives; and information available and used to manage activities. Performance involves factors such as: outputs, outcomes, and impacts relative to objectives, goals, and inputs; quality; level of service; and stakeholder satisfaction (e.g. its beneficiaries or customers, resource providers, competitors, policy centres and special interest groups). Audit teams consider actual performance as it relates to the subject matter, but also to the suitability of the performance goals (i.e. whether those goals are consistent with the governing authorities). Information about the entity’s performance may help the audit team identify areas of the entity that need to be examined, as well as those that may not warrant as much attention. For example, areas where performance goals are being met may not warrant as much attention as those areas that are clearly not meeting performance goals, taking into account the audit team’s assessment of importance and risk. Suitable performance goals may also be useful sources of criteria for the audit.
Resources. Organizations use physical, financial, and human resources to achieve their objectives and performance goals.
Physical resources: The audit team obtains information about the source, nature, location, condition, and value of the audit entity’s significant physical resources (such as land, buildings, equipment, and infrastructure) as they relate to the subject matter. This information could also include information about the acquisition, disposal, and lifecycle management processes.
Financial resources: Knowledge of the audit entity's financial resources (nature, source, and amount of the audit entity’s revenue and expenditures, and the source, amount, and location of its financial assets and liabilities) helps the audit team understand the magnitude of operations.
Natural resources: The audit team obtains information about the renewable and non-renewable resources.
Human resources: The audit team obtains information about human resources including information about employees (e.g. their number, qualifications and categories, skills and responsibilities) and the work environment as it relates to the subject matter (e.g. processes in place for human resource planning, staff evaluation, and training; the nature and condition of the workplace; and the relationship of management with other employees and with unions.)
Information about the entity’s resources may assist the audit team in understanding:
how resources relate to the entity’s objectives;
the allocation of resources to programs, operations and activities;
how government priorities inform the allocation of resources to the entity and the relative significance of specific programs, operations and activities;
the relationship between resources and the organizational structure; and
the relationship between resources and entity performance.
Systems, practices, and controls. Management establishes systems, practices, and controls to plan, control, monitor, and report on its achievement of objectives and activities for carrying out its mandate. The audit team needs knowledge of the systems, practices, and controls related to the subject matter in order to understand their suitability for the programs, operations, and activities and for understanding the risks to meeting the associated objectives. Understanding systems, practices, and controls also includes gathering information on the existence, mandate, and work of an internal audit function as it relates to the subject matter. Understanding internal controls is discussed in OAG Audit 4025 Internal controls.
The systems, processes and controls that the audit team may consider include:
The systems and controls in place for controlling, monitoring and reporting on significant programs, operations and activities;
The systems and controls in place for planning, reporting on, and safeguarding and controlling the entity's physical, financial, natural and human resources;
The systems and controls in place to facilitate the entity's compliance with governing authorities; and
The existence, mandate and work of an internal audit function.
Information about the entity’s systems, processes and controls may assist the audit team in understanding:
- Risks to programs, operations and activities that the entity has identified;
- Elements of performance that management is assessing;
- The entity’s performance criteria;
- The methods of data collection and analysis;
- How the entity uses performance information; and
- The nature and frequency of reporting.
External environment. The external environment includes factors over which management has limited control, such as government policies, client demand, availability of resources, competitors, partners, and special interest groups. The external environment is a source of risk because changes in that environment may significantly affect the objectives; accountability relationships; performance; programs, operations, and activities; resources; and systems, practices, and controls relevant to the subject matter. Elements of the external environment include factors such as the service or business environment; political factors such as government priorities; social, economic, financial, environmental, legal or technological factors; as well as clients, stakeholders, and partners related to the subject matter.
The audit team may obtain information about constraints imposed by governing bodies or constituents (e.g., beneficiaries, customers, resource providers, competitors, special interest groups), such as:
- budget reductions;
- budget amendments;
- cost-recovery requirements;
- revenue targets;
- changes to legislation, contracts or agreements;
- operating or availability constraints;
- safety, service-level or pricing constraints; and
- changes in reporting relationships.
Risks. Risks may be inherent to the nature of the topic and/or entities being audited. Risks may also exist because systems, controls, and practices are inadequate or inappropriate to control inherent risks of the subject matter (control risk). The audit team should understand the risks faced by the relevant entity(ies) in relation to the subject matter. A starting point for this information is often determining how the relevant entity(ies) identify, assess, monitor, and control its risks. This topic is discussed further in OAG Audit 4020 Risk assessment.
Starting point for gathering information
There are various sources of information an audit team can use to gather the necessary information and to document its understanding of the subject matter and its environment. Audit teams start by reviewing key documents (e.g., legislation, Hansard, strategic plans, business plans, meeting minutes, risk assessments, internal audit reports, management reports, sector publications, research studies, other assurance engagements, media reports) as well as consulting knowledgeable individuals within the relevant entity(ies), and within the OAG. Within the OAG, teams consult the annual audit teams, entity teams, as well as teams that have conducted previous audits related to the subject matter. Teams also consult with internal specialists where relevant to discuss difficult or contentious matters (see OAG Audit 3081 Consultations). Teams identify key stakeholders and clients and, if relevant, also gather information from their perspective that is relevant to the subject matter.
The audit team reviews the information gathered for the strategic audit plan and identifies additional information required to update knowledge of the entity and subject matter (OAG Audit 1505 Acquiring and maintaining knowledge of business for performance audits). The audit team should obtain input from the audit team that prepared the strategic audit plan as appropriate as well as other related entity and/or sectoral area strategic audit plans.
In a special examination, the OAG issues an opinion on the corporation’s systems and practices selected for examination. The conclusion is based on the examiners’ selection of the systems and practices considered essential to providing the corporation with reasonable assurance that it is meeting its statutory control objectives. Understanding the entity’s mandate, objectives, strategies, and performance is essential in helping the audit team identify the entity’s current challenges and inherent risks. The team should also obtain a better understanding of how the organization views itself and why it has set or established certain goals, objectives, and direction. With such an understanding, the audit team can identify a deficiency if the entity does not understand or appropriately interpret its mandate. In such a case, it would be difficult for the corporation to meet the statutory control objectives.
Audit teams should start with the previous special examination report and obtain information on significant changes to the corporation’s operating environment, such as mandate amendments, new products or services, and any other significant changes.
Some specific requirements related to understanding the subject matter
As part of obtaining sufficient understanding of the subject matter, the audit team is required to undertake some specific work. The audit team assesses the impact of the information gathered as part of this work on the audit approach. In particular, specific work related to understanding the subject matter is required in the following areas:
- confirmation of engagement leader competency;
- three specific inquiries;
- internal control;
- for special examinations, affiliated entities.
Confirmation of engagement leader competency: Audit standards require that the engagement leader have sufficient competence in the underlying subject matter and its measurement to accept responsibility for the conclusion of the engagement. Some audits may require specialized knowledge beyond those ordinarily possessed by a particular individual or may require knowledge in an area that is relatively new to the engagement leader. In these cases, the engagement leader will need to ensure mitigating strategies are in place to manage the risk and enable him or her to form a conclusion on the subject matter. Mitigating strategies will often include using an expert. Using an expert is discussed in section OAG Audit 2070. In practice, this requirement is met by assessing and mitigating engagement risk (which includes an assessment of both the engagement leader and team competency). Engagement risk is discussed in OAG Audit 4020 Risk assessment.
Three specific inquiries: As part of obtaining sufficient understanding of the subject matter, CSAE 3001 requires the audit team to make some specific inquiries and to use this information to inform its planning decisions. These inquiries should be made with the appropriate senior officials within the relevant entity(ies) such as the Chief Audit Executive, senior managers, board of directors, audit committee, and so forth. These inquiries can be made through interviews during the planning phase and documented by the team through meeting minutes. Formal or written responses are not required.
Intentional deviation or non-compliance: The audit team is required to inquire about any intentional deviations or non-compliance affecting the subject matter. In other words: Do senior entity officials have knowledge of any instances (actual, suspected, or alleged) where the underlying subject matter does not intentionally conform with the applicable criteria, including any intentional non-compliance with laws and regulations affecting the subject matter of the audit? The audit team should start its inquiry by discussing this matter with any relevant OAG financial audit teams. Subsequent discussion should be held with the Chief Audit Executive and/or risk officers and senior managers of the responsible area. The audit team will assess the impact of these discussions on the audit approach. If an intention deviation or non-compliance affecting the subject matter is identified, the audit team may need to adjust its audit design to respond to this risk and/or adjust its mitigating strategies to respond to an increase engagement risk. In such instances, the audit team should consult with the relevant internal specialist(s) (i.e. wrong doing and fraud; legal) as needed. Refer to OAG Audit 3081 for more information on consultations.
Internal audit: The audit team is required to inquire about relevant internal audit work and to determine the impact on the audit design. In other words: Is there an internal audit function and, if so, what are its activities and main findings with respect to the underlying subject matter? The audit team then determines how this information affects the audit approach. For example, the team may use this information to help identify and assess subject matter risks (see OAG Audit 4020 Risk assessment), to exclude areas from the scope of the audit if the team feels the issues have been adequately addressed by internal audit, or to include these areas in the scope of the audit for further work. If included in the audit, the team may decide to rely on the work of internal audit, in which case further work would be required by the team to ensure its adequacy as evidence. Relying on the work of internal audit is addressed in OAG Audit 4030. This topic is also covered in OAG Audit 4042 Audit scope and approach.
Entity(ies)’s use of experts: The audit team is required to inquire about the responsible party’s use of an expert whose work is relevant to the subject matter and then to determine whether this work significantly affects the underlying subject matter. A responsible party’s expert is usually engaged when the audited entity does not possess the needed skills and experience on the subject. In other words: Have the entity(ies) subject to the audit used the work of any expert individual or organization not normally part of its regular operations related to the subject matter of the audit? Determining whether there is a relevant entity expert and whether this work significantly affects the underlying subject matter and requires professional judgment. For example, in an audit of Canada Pension Plan disability, the use of doctors by the responsible entity would likely not be considered “entity experts” because the work being performed by the doctors in assessing applicant’s eligibility is a core function of the subject matter and part of the normal process of managing the program. However if the entity had hired a time and motion expert to evaluate the processing and input speed and efficiency for inputting and processing applications, this individual would be an entity expert whose work could significantly affect the underlying subject matter and could have important implications for the engagement. If relevant to the audit, the work of that expert, could, for example, help the team identify and assess subject matter risks (see OAG Audit 4020 Risk assessment), exclude an area from the audit that the team feels have been adequately managed by the entity, or include areas in the scope if those areas are deemed higher risk. Audit teams may or may not decide to use the work of the expert; each option may have different implications that should be assessed by the audit team. Using the work of an audited entity’s expert is discussed further in OAG Audit 2070 Use of experts.
Internal control. As part of understanding the subject matter, audit standards require the audit team to obtain an understanding of internal control relevant to the audit. This topic is discussed in OAG Audit 4025 Internal controls.
For special examinations, affiliated entities. Audit teams for special examinations are required by the FAA to understand the extent of affiliated entities of the Crown corporation in order to determine if the affiliated entities should be included within the scope of the audit. Under part X of the FAA, section 83 defines when a corporation is a subsidiary of another.
If an affiliated entity is controlled and accountable to the parent Crown corporation and is significant to the operations of the parent Crown corporation, it is expected that there would be systems and practices in place in the parent Crown corporation to manage the affiliated entity, thus supporting the parent’s ability to fulfill its mandate and meet its statutory control objectives. In this context, when the audit team develops its understanding of the Crown corporation to be examined and its environment to establish the scope of the special examination, it also includes an understanding of all less than wholly-owned (LTWO) affiliated entities.
Documentation of LTWO-affiliated entities will help demonstrate that the special examination audit team collectively possesses adequate knowledge of the subject matter. Special examination audit teams should consult the annual audit files for the Crown corporation subject to examination to ascertain the most up-to-date information concerning the extent of ownership of LTWO-affiliated entities.
Determining the extent of work needed to obtain sufficient understanding of the subject matter
The amount of information required for understanding the subject matter and the audit team’s approach to obtaining this information will differ according to the size and complexity of the subject matter. The extent of work required also depends on the depth of existing knowledge of the audit team members. Professional judgment (OAG Audit 1042) will serve to determine when the audit team has done enough to obtain and document the necessary understanding. Professional skepticism (OAG Audit 1041) helps auditors critically assess the information gathered as part of understanding the subject matter.
If the audit team members have little or no previous experience or knowledge of business, sufficient work should be done to establish an appropriate base for the current audit. If the audit team members have previous experience with the subject matter (either entities and/or topic), the team should assess the relevance of that experience and then plan to update or enhance its knowledge—perhaps by focusing on significant changes. Some important considerations in planning the extent of work required include
identifying areas where more or in-depth knowledge is required;
assessing the need for any specialized knowledge or competence (including advice from internal specialists or hiring an external expert);
balancing time and costs in relation to usefulness in planning the audit; and
focusing on what is relevant and use professional judgment—the audit team needs to understand the concepts of significance and risk in the context of planning because these concepts will enable the audit team to determine the information required and to assess the information obtained.
It is also important to note that smaller entities may have less sophisticated systems and, as a result, there may be less control documentation available for examination. Thus, the team may be required to gain a better understanding of the informal processes in place through meetings, observation, and walkthroughs and then create its own corresponding documentation.
Planning a performance audit
Planning a performance audit is an iterative process. The following diagram illustrates one possible sequence of steps that may occur in the planning process.
The audit team uses its understanding of the subject matter (including internal controls—see OAG Audit 4025) to inform its risk assessment (see OAG Audit 4020), to make key scoping decisions including considering significance, and to finalize its audit design (see OAG Audit 4042 Audit scope and approach). This work informs the development of the audit logic matrix (ALM) (see OAG Audit 4044).
The audit team updates its understanding of the subject matter and refines the ALM throughout the planning phase. Remember that understanding the subject matter is an iterative process that is interrelated with risk assessments, significance, and scoping decisions.
After gaining a good understanding of the subject matter, the engagement leader determines whether the audit team has sufficient subject matter knowledge to conduct the audit, and whether it needs to engage consultants with specific subject matter expertise. If the engagement leader decides to hire a consultant, he or she must follow OAG policies for procurement and contracting and follow the guidance for using experts discussed in OAG Audit 2070.