Auditing & Assurance Services

If you invest, lend, prepare financials, or sit on a board, you rely on audits you probably don't understand. This book explains the machinery: how auditors plan, gather evidence, test controls, and form opinions. Accounting students and new auditors get the full framework; executives and investors learn what an audit does and doesn't promise. It's dense, but the fraud stories make the stakes concrete.

1. 1Chapter 1

   Three parties, one opinion

   Picture a company's management preparing financial statements, investors and creditors deciding whether to put money in, and an independent auditor standing between them. The book opens by defining assurance services as independent professional services that improve the quality of information—or its context—for decision makers. The whole structure rests on that three-party relationship: responsible party, independent practitioner, intended users. Then it hands you the classic definition of auditing, the American Accounting Association's: a systematic process of objectively obtaining and evaluating evidence about assertions regarding economic actions and events, checking them against established criteria, and communicating the results to interested users.

   The idea

   Auditing is fundamentally about evidence and criteria, not suspicion. Management makes assertions; the auditor tests whether those assertions match established criteria, then tells the users what was found. An audit that finds nothing still produces a report, because the opinion itself is the product. Independence is what makes the middle party useful—if the practitioner isn't independent, the information gains nothing.

   Try this: Next time you read an annual report, identify the three parties: who prepared the statements, who audited them, and who the report is really for.

2. 2Chapter 2

   Two laws built the modern audit

   The Securities Act of 1933 required companies issuing new securities to the public to file a registration statement that included audited financial statements. A year later, the Securities Exchange Act of 1934 mandated annual audited financial statements for public companies and created the SEC. The book also presents the Sarbanes-Oxley Act of 2002 as landmark regulation. It created the Public Company Accounting Oversight Board to oversee audits of public companies, and its Section 404 requires management to assess and report on internal control over financial reporting—with auditors attesting to that assessment.

   The idea

   Auditing's shape comes from statute, not just professional preference. The 1933 and 1934 Acts made audited statements a condition of public markets; Sarbanes-Oxley added oversight of the auditors themselves and put internal control on the audit agenda. Section 404 makes management, not just the auditor, publicly accountable for controls.

   Try this: Look up whether a company you follow discloses a management report on internal control over financial reporting in its annual filing.

3. 3Chapter 3

   One equation runs the whole audit

   Before any fieldwork, an auditor sits down to plan—and the book centers that planning on a single equation: Audit Risk = Inherent Risk × Control Risk × Detection Risk. Auditors set detection risk based on the assessed levels of the other two, aiming for an acceptably low overall audit risk, then use the model to plan the nature, timing, and extent of procedures. Alongside risk sits materiality: the magnitude of an omission or misstatement that, given the circumstances, would probably change or influence the judgment of a reasonable person relying on the information—judged with both quantitative and qualitative factors.

   The idea

   The model is a budgeting tool for risk. Auditors use it to plan the nature, timing, and extent of procedures. Materiality sets the threshold for what matters to a reasonable person relying on the information, judged with both quantitative and qualitative factors.

   Try this: For any company you analyze, ask two questions: how risky are its accounts inherently, and how strong are its controls? That ratio shapes how much scrutiny its audit needs.

4. 4Chapter 4

   The fraud triangle

   The book frames why fraud happens with the fraud triangle—pressure or incentive, opportunity, and rationalization—and SAS No. 99 (AU-C 240) requires auditors to consider all three when assessing fraud risk.

   The idea

   Fraud needs all three legs—pressure, opportunity, rationalization—and auditors are required to probe each one.

   Try this: When a company's earnings look too smooth, ask what pressure management faced, what opportunity its structure gave them, and how they might justify it to themselves.

5. 5Chapter 5

   Evidence: enough of it, and the right kind

   An auditor's working life is a hunt for evidence, and the book sets the standard plainly: it must be sufficient—quantity—and appropriate—quality, meaning relevant and reliable. Reliability isn't random; it follows rules. Evidence is more reliable when it comes from independent sources outside the entity, when it's generated internally under effective controls, when the auditor obtains it directly, and when it's documentary rather than oral. The requirement is codified in AU-C 500: 'The auditor must obtain sufficient appropriate audit evidence by performing audit procedures to afford a reasonable basis for an opinion regarding the financial statements under audit.'

   The idea

   Two dials control evidence quality: how much you have, and how good each piece is. Reliability follows rules: independent outside sources, internally generated records under effective controls, direct auditor observation, and documents over oral representations.

   Try this: When someone gives you a number verbally, ask for the document behind it—and note who produced that document and under what controls.

6. 6Chapter 6

   COSO: five components, one foundation

   To judge whether a company's controls are any good, auditors turn to the COSO Internal Control—Integrated Framework, the book's standard for evaluation. COSO defines internal control as a process effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance about achieving objectives in three categories: operations, reporting, and compliance. The framework has five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.

   The idea

   Internal control is a process run by people at every level, from the board down—not a manual on a shelf. The five components interlock, with the control environment as the foundation for all the other components.

   Try this: Judge a company's control environment first: what does leadership reward, and what does it look away from? Everything else in the control system follows that tone.

7. 7Chapter 7

   Opining on controls—and what a material weakness means

   For public companies, auditing internal control over financial reporting is its own engagement. Under AS 2201, the PCAOB standard the book presents, the auditor must express an opinion on the effectiveness of internal control over financial reporting. The stakes are defined precisely: a material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

   The idea

   This audit runs parallel to the financial statement audit. A 'material weakness' isn't a minor flaw—it's a control gap with a reasonable possibility of letting a material misstatement through undetected.

   Try this: Check a public company's 10-K for its internal control opinion—and read any disclosed material weaknesses closely, since they signal where misstatements could hide.

8. 8Chapter 8

   Sampling: the math of checking a slice

   Auditors can't test every transaction, so they sample—and the book names the risk that creates. Sampling risk is the risk that the auditor's conclusion based on a sample may differ from the conclusion if the entire population were subjected to the same procedure. It splits into two error types: Type I, the risk of incorrect rejection, which affects efficiency—the auditor does more work than needed; and Type II, the risk of incorrect acceptance, which affects effectiveness—the auditor accepts a population that's actually bad.

   The idea

   Sampling risk splits into two error types. Type I, incorrect rejection, affects efficiency; Type II, incorrect acceptance, affects effectiveness.

   Try this: When you judge anything from a sample—reviews, survey data, quality checks—ask which error would hurt you more: wrongly rejecting or wrongly accepting.

9. 9Chapter 9

   Why revenue is presumed risky

   The book anchors a rule with the HealthSouth case: revenue recognition is a significant fraud risk, and auditors should presume a risk of material misstatement due to fraud in revenue recognition. Common schemes include bill-and-hold transactions, channel stuffing, and side agreements.

   The idea

   Revenue is where companies most often lie, because it's the number markets watch. That's why auditing standards flip the usual burden: auditors must presume fraud risk in revenue recognition, not wait for red flags.

   Try this: Compare a company's revenue growth to its cash flow from operations; a widening gap is where presumptions about revenue fraud start.

10. 10Chapter 10

    The bank letter

    The standard process for auditing cash: auditors send a confirmation letter to every bank with which the client has done business during the year, requesting information on account balances, loans, and contingent liabilities. The confirmation is sent under the auditor's control—management never touches it in transit.

    The idea

    The bank confirmation is evidence design at its purest: direct, documentary, from an independent source, and outside management's hands. The confirmation covers loans and contingent liabilities, not just balances.

    Try this: For any financial claim you're evaluating, find the independent source you can confirm it with directly—and control the channel yourself.

11. 11Chapter 11

    McKesson & Robbins: the fraud that rewrote the audit

    The company's president, F. Donald Coster—actually Philip Musica, a convicted felon—fabricated $19 million in inventory and $9 million in fictitious receivables. Today, observation of physical inventory counting is a generally accepted auditing procedure—auditors must be present at the count to observe management's counting procedures, perform test counts, and inspect the condition of the inventory.

    The idea

    Observation of physical inventory counting is a generally accepted auditing procedure: auditors must be present at the count to observe management's counting procedures, perform test counts, and check condition.

    Try this: For any asset you're relying on, ask whether anyone has physically verified it exists and works—or whether it's only ever been a number on paper.

12. 12Chapters 12–13

    Waste Management's garbage trucks, and debt confirmations

    On the liability side, the book's discipline is simpler: auditors must confirm debt obligations directly with lenders, covering the principal amount, interest rate, payment terms, and any collateral or restrictive covenants—and examine loan agreements for compliance with debt covenants.

    The idea

    Debt is audited by going to the lender: confirm terms, check covenants.

    Try this: Compare a company's stated depreciation lives to industry norms; stretched asset lives are a quiet way earnings get inflated.

13. 13Chapter 14

    Finishing touches: subsequent events and going concern

    Under AU-C 560, the auditor must perform procedures to identify subsequent events through the date of the auditor's report—and the treatment splits in two: events providing additional evidence about conditions existing at the balance sheet date require adjustment to the statements; events involving conditions arising after that date require disclosure instead. The other end-of-audit judgment is going concern: the auditor must evaluate whether there is substantial doubt about the entity's ability to continue as a going concern for a reasonable period, not to exceed one year beyond the date of the financial statements being audited. Warning conditions include recurring operating losses, working capital deficiencies, and loan defaults.

    The idea

    The audit's final phase covers subsequent events and going concern. Events providing additional evidence about conditions existing at the balance sheet date require adjustment; events involving conditions arising after that date require disclosure. Going concern's horizon is fixed: one year out, no further.

    Try this: When reading a year-end report, check the subsequent events note and any going-concern language—they reveal what changed after the books closed.

14. 14Chapter 15

    The opinion, and who can sue you for it

    The standard unmodified report language: 'In our opinion, the financial statements referred to above present fairly, in all material respects, the financial position of X Company as of December 31, 20XX, and the results of its operations and its cash flows for the year then ended in accordance with accounting principles generally accepted in the United States of America.'

    The idea

    The opinion's wording is deliberately narrow: 'present fairly' and 'in all material respects'—not certify as correct.

    Try this: Read an actual audit report's opinion paragraph and notice the hedges: 'present fairly,' 'in all material respects'—that's the promise's exact boundary.

Accounting students, new auditors, and anyone preparing for the CPA exam who needs the full audit framework in one place. Investors, board members, and executives who want to understand what an audit actually does—and doesn't—promise will also get real value.

FAQ