Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CPA] AUD: The Foundation of a Quality Audit: Preliminary Engagement Activities
Transcript
- Marcus: Welcome to VoraPrep Audio's Office Hours. Today, we're talking about the very first step in any quality audit: the preliminary engagement activities. Ava: It's a topic that sounds administrative, but getting this wrong can have massive consequences for a firm. Why is this first step so critical, Marcus? Marcus: Because it’s the firm's primary line of defense. Think of it as the foundation of a house. If you build on unstable ground—say, a client that lacks integrity or has overly complex issues your firm can't handle—the entire structure is at risk. A bad start can lead to a failed audit, lawsuits, and catastrophic reputational damage. Ava: So how does a firm ensure it’s building on solid ground? What's the governing framework here? Marcus: It’s all governed by the firm's System of Quality Management, or SQMS. For the exam, it's crucial to know that this new risk-based approach, under SQMS Number 1, has replaced the old Quality Control standards. The old "HELP ME" mnemonic is out. Ava: A risk-based approach. What's the main objective of this new system when it comes to accepting a client? Marcus: The system is designed to ensure a firm only takes on an engagement if it can answer "yes" to three fundamental questions. First, are we competent and do we have the capabilities—the time and resources—to do this job well? Ava: Okay, can we do the work? What’s the second question? Marcus: Can we comply with all relevant ethical requirements? The most significant one here is independence. Ava: Right, are we allowed to do the work? And the third? Marcus: Have we considered the integrity of the client's management? And based on what we know, do we have any reason to believe they lack integrity? Ava: So: can we, are we allowed to, and should we? That seems like a solid filter. Marcus: Exactly. And those questions are answered through a formal process of acceptance and continuance procedures. Ava: Let's get practical. A potential new client calls your firm. What are the specific procedures you perform? Marcus: The first thing we evaluate is management integrity. And this goes way beyond a gut feeling. Ava: Integrity feels so subjective. How do you actually gather evidence on something like that? Marcus: You do the work. You perform background checks on the key executives. You make inquiries with third parties who know them—their bankers, their lawyers. You read news articles and regulatory filings. A history of changing auditors frequently or an aggressive attitude toward accounting are major red flags. Ava: So you're building a case file on their character, essentially. After integrity, what’s next? Marcus: We have to determine if we have the necessary competence and capability. It's an honest self-assessment. Ava: And competence is more than just having enough licensed CPAs on staff, right? Marcus: Absolutely. It’s about having the *right* expertise. Auditing a regional bank requires a completely different skillset than auditing a software-as-a-service company with complex revenue recognition. If we need a specialist, like an IT expert or an actuary, we have to confirm we have access to one. It’s about matching the team to the client's specific risks. Ava: Okay, so we've checked their integrity and our own team's competence. The last piece must be independence. Marcus: Correct. We have to verify that the firm and the engagement team are independent of the client in both fact and appearance. That means a formal check for any financial interests, family relationships, or other conflicts that would violate the ethical code. Ava: That makes sense. What happens if the potential client is leaving another audit firm? That seems like a critical piece of the puzzle. Marcus: It is, and the standards are very clear on this. For a new client, communicating with the predecessor auditor is mandatory. Ava: But auditors have a duty of confidentiality to their clients. How does that work? Marcus: Great question. It works because the successor auditor—that’s us, the new firm—must first get the prospective client's permission to speak with the predecessor. We ask the client to authorize the old auditor to speak freely with us. Ava: And what if the client refuses to give permission? Marcus: That is a massive red flag. You have to ask yourself, what are they trying to hide? In that situation, you would ordinarily decline the engagement. Ava: Let's say they do grant permission. What specific questions are you asking the previous auditor? Marcus: You want to be direct. You ask about anything that might bear on management’s integrity. You ask about any disagreements they had with management over accounting principles or auditing procedures. Ava: So, you're asking about the tough conversations. Marcus: Exactly. You also ask about any communications they had with the board regarding fraud or noncompliance with laws. And finally, you ask for their understanding of why there’s a change in auditors. You want to hear their side of the story. Ava: Okay, so we've done our due diligence, we've talked to the predecessor, and we’ve decided to accept the client. Do we just... start auditing? Marcus: Not quite. The next step is to formalize the relationship and make sure everyone is on the same page. This is done with an engagement letter. Ava: The contract for the audit. Marcus: Precisely. But before we can even issue that letter, auditing standards require us to establish that certain preconditions for an audit are present. Ava: Preconditions? What has to be in place *before* we can even agree to do the audit? Marcus: There are two. First, management must be using an acceptable financial reporting framework. For most US companies, that means US GAAP. We can't audit statements prepared with a framework that isn't valid. Ava: That makes sense. You can't audit a secret, made-up accounting language. What's the second precondition? Marcus: This is the big one. Management must acknowledge and agree, in writing, to its responsibilities. They are responsible for the financial statements, for designing and maintaining internal controls, and for providing the auditor with unrestricted access to all information and personnel. Ava: So, they have to formally accept that it's *their* company and *their* financial statements. Marcus: Yes. If management won't accept those responsibilities, we cannot accept the engagement. Period. The engagement letter is where we document their agreement to all of this. Ava: And what else goes in that letter? Marcus: It lays out the entire arrangement to prevent misunderstandings. It states the objective and scope of our audit, our responsibilities as the auditor, and management's responsibilities, which we just discussed. It also includes a statement about the inherent limitations of an audit and, of course, the financial reporting framework being used. Ava: Okay, the terms are set. Now we plan. I know the exam often tests the difference between the "overall audit strategy" and the "audit plan." They sound very similar. Marcus: They're related, but distinct. The best analogy is building a house. The overall audit strategy is the architect's blueprint. It’s high-level. It sets the overall scope, timing, and direction for the entire project. Ava: The big picture. So the audit plan is... what? Marcus: The audit plan is the contractor's detailed construction schedule. It's the execution document. It describes the specific nature, timing, and extent of the audit procedures we'll perform to address the risks we've identified. The strategy guides the plan. Ava: You’ve mentioned risk a few times. How does an auditor formally connect the client's risk to the amount of work in the audit plan? Marcus: We use the audit risk model. Think of it as a seesaw. On one end is the Risk of Material Misstatement, or RMM. That’s the client’s risk. On the other end is Detection Risk, which is our risk as auditors—the risk our procedures won't catch a misstatement. Ava: And the goal is to keep the seesaw balanced? Marcus: The goal is to keep the overall Audit Risk—the risk of us issuing the wrong opinion—at an acceptably low level. That's the fixed point. If the client’s risk, RMM, is high, that side of the seesaw goes up. To keep the balance, we have to push our side, Detection Risk, down. Ava: And how do you push Detection Risk down? Marcus: By doing more work. More effective, rigorous, and extensive audit procedures. A lower target for detection risk means we have to design a more demanding audit plan. Ava: Can we walk through a scenario? I think the QuantumLeap AI example from the lesson would really help connect these ideas. Marcus: Of course. So, you're an audit partner. A prospective client, QuantumLeap AI, comes to you. They were previously with a Big 4 firm. First, you evaluate integrity. You find the CEO has a history, with a prior SEC inquiry at his last company related to aggressive revenue recognition. Ava: That's a definite red flag for management integrity. Marcus: It is. Next, competence. Your firm audits tech clients, but QuantumLeap’s AI contracts are incredibly complex. You also learn your top expert in that specific area is going on sabbatical right when the audit would be happening. Ava: So that's a resource and capability risk. Marcus: A big one. The CEO agrees to let you speak with the predecessor auditor. The prior firm tells you they had significant disagreements with management over capitalizing software development costs and that management tended to ignore their own internal audit department. Ava: That confirms the integrity risk and points to a high risk of material misstatement in the financials. Marcus: Exactly. So your firm's acceptance committee gets together. You have high management integrity risk, high financial reporting risk due to the accounting disagreements, and high engagement performance risk because your internal expert isn't available. Ava: With all those risks stacked up, what's the decision? Marcus: You decline the engagement. The potential fee isn't worth the significant risk to the firm's reputation and the likelihood of a contentious, high-risk audit where you might not even have the right staff available. Ava: That's a perfect example of the system working as a shield. Now, for the exam, when we're creating that detailed audit plan, is there a good way to remember what it needs to specify? Marcus: There is. For every area you test, the plan details the NET of the work. N for Nature—*what* kind of procedure will you do? Confirmation, observation, etc. E for Extent—*how much* work will you do? This refers to things like sample size. And T for Timing—*when* will you do the work? At an interim date or at year-end? Ava: NET. Nature, Extent, and Timing. Simple enough. What's a common trap people fall into when thinking about the planning phase? Marcus: Thinking that it's a one-time event that ends before the "real work" begins. That's wrong. Planning is a continuous and iterative process. If you find something unexpected during your testing—say, internal controls are weaker than you thought—you must go back and revise the plan. You might need to change the Nature, Extent, or Timing of your tests in response. Ava: So the plan is a living document. Any final advice for an exam question on this topic? Marcus: Questions on preliminary activities often test the *sequence* of events. Remember the logical flow. You perform client acceptance procedures, including talking to the predecessor, *first*. Then, you ensure the preconditions for an audit are met *before* you sign the engagement letter. The detailed audit plan comes only after the engagement is formally accepted. Ava: That sequence is key. To recap: preliminary activities are governed by the firm’s risk-based System of Quality Management. The process involves vetting the client's integrity and your firm's competence and independence, communicating with the predecessor auditor, and then, only if the preconditions are met, establishing terms in an engagement letter. Marcus: And from there, you develop the high-level strategy—the blueprint—and the detailed audit plan, which specifies the NET of your procedures. Ava: This has been incredibly helpful. If you're studying and want more lessons and thousands of practice questions like the ones we've discussed, check out VoraPrep. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can get started and try it for free at Vora Prep dot com. Marcus: Remember, a strong start is the foundation of a quality audit. Get these steps right, and you're setting yourself up for success. Thanks for joining us for Office Hours.