ICAEW ARF Assurance and Risk Fundamentals: mock exams and practice questions

Sample question 1 · 1 · The concept, process and need for assurance

Ridgeway Haulage Ltd has asked Penrose & Daly LLP to carry out a set of procedures, specified by Ridgeway's lender, on the company's aged receivables listing. Penrose & Daly will report the procedures performed and the factual findings only, and the lender will draw its own conclusions. What level of assurance does this engagement provide?

1. A Reasonable assurance, because the lender has specified the procedures in detail
2. B Limited assurance, expressed as a negative-form conclusion on the listing
3. C No assurance, because the firm reports factual findings and gives no conclusion
4. D Limited assurance, because the work covers only one balance in the accounts

Show the answer

Answer: C. This is an agreed-upon procedures engagement (ISRS 4400). The practitioner performs procedures agreed with the engaging party and reports the factual findings, but expresses no conclusion, so it provides no assurance. Users such as the lender evaluate the findings themselves. Compilation engagements (ISRS 4410) also provide no assurance. By contrast, a reasonable assurance engagement ends in a positive-form opinion, and a limited assurance engagement in a negative-form conclusion.

Sample question 2 · 2 · Risk, internal controls and information flows

Assurance engagement risk is the risk that a practitioner gives an inappropriate conclusion when the subject matter information is materially misstated. In an audit of financial statements it is called audit risk. Which statement about the components of audit risk is correct?

1. A Control risk can be reduced to nil if the auditor's tests of controls find no deviations in the sample.
2. B Detection risk forms part of the risk of material misstatement, together with inherent and control risk.
3. C Inherent and control risk belong to the entity; the auditor manages detection risk through its procedures.
4. D Inherent risk is assessed only at the financial statement level, never for individual assertions.

Show the answer

Answer: C. Audit risk = inherent risk x control risk x detection risk (ISA (UK) 200).

- Inherent risk is how susceptible an assertion is to misstatement before considering controls.
- Control risk is the risk that the entity's controls fail to prevent, or detect and correct, a material misstatement.
- Together these form the risk of material misstatement (RoMM), which belongs to the entity and exists whether or not an audit takes place. ISA (UK) 315 (Revised July 2020) requires inherent risk and control risk to be assessed separately, at both the financial statement and assertion levels.
- Detection risk is the only component the auditor controls, by changing the nature, timing and extent of further audit procedures. It can be reduced but never removed, because audit testing is selective and evidence is persuasive rather than conclusive.

Sample question 3 · 3 · Obtaining assurance evidence

ISA (UK) 230 sets the standard for how complete audit documentation must be. The documentation must be sufficient to enable which person to understand the procedures performed, the evidence obtained and the significant matters and conclusions?

1. A The engagement partner who signs the auditor's report on the financial statements
2. B Any member of the engagement team who worked on that particular audit
3. C An experienced auditor who has had no previous connection with the audit
4. D A member of the client's audit committee who holds an accounting qualification

Show the answer

Answer: C. ISA (UK) 230 requires documentation sufficient to enable an experienced auditor, having no previous connection with the audit, to understand:

- the nature, timing and extent of the procedures performed
- the results of those procedures and the evidence obtained
- significant matters arising, the conclusions reached and the significant professional judgements made.

The test is deliberately set from the viewpoint of an outsider, so the file must stand on its own without anyone needing to explain it. People who worked on the audit (including the partner) know more than the file shows, so they are not the benchmark.