🔎 Auditing

1. Under the International Framework for Assurance Engagements, an assurance engagement involves a three-party relationship among the practitioner, the responsible party and:

1. the authority that licenses the firm
2. the reviewer of the practitioner's file
3. the intended users of the information
4. the entity's internal audit function

The Framework describes three parties to an assurance engagement: the practitioner, the responsible party and the intended users, who are the persons or groups that the practitioner expects to use the assurance report. A licensing authority supervises the firm but is not a party to the engagement. The quality reviewer belongs to the firm's own quality management, and the internal audit function is part of the entity, so neither is the third party.

2. In an assurance engagement, reasonable assurance is best described as:

1. an absolute level of assurance that no misstatement exists
2. a high but not absolute level of assurance, in positive form
3. a limited level of assurance, given in a negative form
4. a level of assurance that depends on the size of the entity

Reasonable assurance is a high, but not absolute, level of assurance; paragraph 13(m) of ISA 200 applies this definition to an audit of financial statements. Under the International Framework for Assurance Engagements, the practitioner in a reasonable assurance engagement reduces engagement risk to an acceptably low level and expresses the conclusion as an opinion, traditionally called a positive form of expression. Absolute assurance cannot be obtained because of inherent limitations such as the use of judgment and testing. A limited level of assurance belongs to a limited assurance engagement and is traditionally given in a negative form, and the level of assurance does not depend on the size of the entity.

3. Company X asks a practitioner to report on the effectiveness of its internal control against a recognised framework. The practitioner performs the measurement of the subject matter himself and presents the resulting information in the report. This engagement is:

1. an attestation engagement, because the entity prepared the information
2. a compilation engagement, because the practitioner assembled the data
3. a direct engagement, because the practitioner measured the subject matter
4. an agreed-upon procedures engagement, because procedures were agreed

In a direct engagement the practitioner measures or evaluates the underlying subject matter against the criteria and presents the resulting subject matter information in the report, as the Framework explains. In an attestation engagement the responsible party performs that measurement and the practitioner evaluates it, which is not the situation described. Compilation and agreed-upon procedures engagements do not give an opinion or conclusion that provides assurance, so they are not assurance engagements.

4. Each of the following is an element of an assurance engagement under the International Framework for Assurance Engagements EXCEPT:

1. a three-party relationship including the intended users
2. suitable criteria against which the subject matter is measured
3. a written assurance report appropriate to the engagement
4. an appointment by the general assembly of the entity

The Framework lists five elements: a three-party relationship, an appropriate underlying subject matter, suitable criteria, sufficient appropriate evidence and a written assurance report. The three-party relationship, the suitable criteria and the written report are therefore elements. An appointment by the general assembly may exist for a statutory audit under the Companies Law, but it is not an element of every assurance engagement.

5. Under ISA 200, professional skepticism is an attitude that includes:

1. a questioning mind and a critical assessment of audit evidence
2. a presumption that management is dishonest until proven otherwise
3. a reliance on past experience of the honesty of management
4. the use of training and experience to reach informed decisions

Paragraph 13(l) of ISA 200 describes professional skepticism as an attitude that includes a questioning mind, alertness to conditions that may indicate misstatement and a critical assessment of audit evidence. It does not start from a presumption of dishonesty, and it does not rest on past experience of management's honesty. Using training, knowledge and experience to make informed decisions describes professional judgment, a different concept defined in paragraph 13(k).

6. Under ISA 200, audit risk is a function of the risks of material misstatement and:

1. inherent risk, the susceptibility of an assertion to misstatement
2. detection risk, the risk that procedures fail to find a misstatement
3. business risk, the risk that the entity does not meet its objectives
4. firm risk, the risk that the firm's reputation is harmed by the work

Paragraph 13(c) of ISA 200 defines audit risk as the risk of expressing an inappropriate opinion when the financial statements are materially misstated, and it is a function of the risks of material misstatement and detection risk (paragraph 13(e)). Inherent risk is one component of the risks of material misstatement, which also include control risk, so it is not the second factor. Business risk concerns the entity's objectives, and the firm's reputational exposure is not audit risk.

7. Which of the following is NOT an inherent limitation of an audit described in ISA 200?

1. the judgment that management applies in preparing the financial statements
2. the possibility that management withholds information from the auditor
3. the auditor's failure to apply professional skepticism when planning
4. the need to complete the audit within a reasonable time and at reasonable cost

Paragraph 5 of ISA 200 and its application material explain that the inherent limitations arise from the nature of financial reporting, the nature of audit procedures, and the need to complete the audit within a reasonable time and at reasonable cost. Management judgment in preparing the statements, the possibility that management withholds information, and the time and cost constraint are therefore inherent. Failing to apply professional skepticism is a failure to comply with the standard, so it is a deficiency in the work and not an inherent limitation.

8. Before accepting an audit engagement, the auditor obtains the agreement of management that it acknowledges and understands its responsibility for each of the following EXCEPT:

1. preparing the financial statements under the applicable framework
2. maintaining the internal control needed to prepare the statements
3. providing the auditor with the information and access to persons it needs
4. designing the audit procedures needed to obtain sufficient evidence

Paragraph 6(b) of ISA 210 requires management to acknowledge responsibility for preparing the financial statements under the applicable framework, for the internal control it determines to be necessary, and for giving the auditor the information and access that the audit requires. These three responsibilities are therefore part of the precondition for an audit. Designing the audit procedures is the auditor's responsibility under the auditing standards, not management's.

9. Halfway through the audit of Najd Logistics Company, its manager, Mr Faisal, asks the auditor to change the engagement to a review engagement, citing the cost of the audit. Under ISA 210, before agreeing to the change, the auditor must:

1. decide whether there is reasonable justification for the change
2. agree to the change because management sets the engagement terms
3. refuse the change because the engagement has already started
4. agree to the change if the fee is reduced by the same proportion

Paragraph 14 of ISA 210 states that, before the audit is completed, a request to change to an engagement conveying a lower level of assurance requires the auditor to determine whether there is reasonable justification for doing so. Whether the cost concern is a reasonable justification is a matter of the auditor's judgment, so the auditor neither accepts the change because management asks nor refuses it just because fieldwork has begun. A proportional fee reduction is not a criterion in the standard.

10. On the audit of Al-Waha Furnishings, the engagement partner delegated the review of the audit file to the senior manager and took no further part after planning. Which statement is correct under ISA 220 (Revised)?

1. the delegation is acceptable because the manager is responsible for quality
2. the partner has not been sufficiently and appropriately involved throughout
3. the firm's quality reviewer takes over responsibility for engagement quality
4. the delegation is acceptable if the partner signs the report at the end

Paragraph 13 of ISA 220 (Revised) gives the engagement partner overall responsibility for managing and achieving quality on the engagement and requires sufficient and appropriate involvement throughout it, which stopping after planning does not satisfy. Under paragraph 15, assigning procedures or tasks to other team members does not remove the partner's overall responsibility, which is exercised through direction, supervision and review of their work. An engagement quality reviewer, where one is required, evaluates significant judgments objectively and does not take over the partner's responsibility, and signing the report at the end does not replace involvement during the work.

11. ISA 230 requires the auditor to complete the assembly of the final audit file on a timely basis after the date of the auditor's report. The application material indicates that an appropriate time limit is ordinarily not more than:

1. 30 days
2. 45 days
3. 60 days
4. 90 days

Paragraph 14 of ISA 230 requires the administrative process of assembling the final audit file to be completed on a timely basis after the date of the auditor's report, and its application material (paragraph A21) points to a limit of ordinarily not more than 60 days. Thirty and 45 days are shorter than that benchmark, and 90 days is longer than it, so none of them is the ordinary limit.

12. After the date of the auditor's report on Najd Logistics Company, the auditor performs new audit procedures in exceptional circumstances and draws a new conclusion. In addition to the circumstances encountered, the auditor must document:

1. nothing further, because the final audit file has already been assembled
2. the changes where they alter the opinion in the auditor's report
3. the reasons for the client's request, without the procedures performed
4. when and by whom the resulting changes were made and reviewed

Paragraph 13 of ISA 230 requires the auditor, when new or additional procedures are performed or new conclusions are drawn after the date of the report, to document the circumstances, the new procedures, evidence and conclusions with their effect on the report, and when and by whom the resulting changes to the documentation were made and reviewed. Assembling the final file does not remove this duty. The duty does not depend on a change of opinion, and the procedures performed must be recorded, not only the client's reasons.

13. Under ISA 240, in assessing the risks of material misstatement due to fraud, the auditor presumes that there are risks of fraud in revenue recognition. This presumption:

1. can be rebutted in some engagements, with the reasons documented
2. is irrebuttable, so each type of revenue is a fraud risk
3. is limited to entities whose shares are listed on an exchange
4. is limited to entities where management has a profit target

ISA 240 presumes that there are risks of fraud in revenue recognition and requires the auditor to identify the types of revenue, revenue transactions or assertions that give rise to those risks. The presumption is rebuttable: where the auditor concludes that it does not apply in the circumstances of the engagement, the reasons for that conclusion must be documented. It therefore does not make each type of revenue a fraud risk, and it is not restricted to listed entities or to entities whose management has a profit target.

14. In responding to the risk of management override of controls, ISA 240 requires the auditor to perform each of the following procedures EXCEPT:

1. testing the appropriateness of journal entries and other adjustments
2. requesting external confirmations of receivables from all customers
3. reviewing accounting estimates for indications of management bias
4. evaluating the business rationale of significant unusual transactions

ISA 240 treats management override of controls as a significant risk present in all entities and, irrespective of the auditor's assessment of that risk, requires the auditor to test the appropriateness of journal entries and other adjustments, to review accounting estimates for bias, and to evaluate the business rationale of significant transactions outside the normal course of business or that appear unusual. External confirmation of receivables may respond to an assessed risk of fraud in revenue recognition, but ISA 240 does not require it as a response to management override, let alone for every customer.

15. While auditing Company X, a food manufacturer, the auditor notes that its operating licence could be withdrawn for breaches of food-safety regulations. Under ISA 250 (Revised), for such regulations the auditor is required to:

1. obtain sufficient appropriate evidence of compliance, as for tax laws
2. perform no procedures unless non-compliance is already suspected
3. inquire about compliance and inspect correspondence with the regulator
4. state in the report that the company complies with the licence terms

ISA 250 (Revised) distinguishes laws with a direct effect on the amounts and disclosures in the financial statements, such as tax laws, for which paragraph 13 requires sufficient appropriate evidence of compliance, from other laws that may be fundamental to the entity's ability to continue in business, such as the terms of an operating licence. For the latter, paragraph 14 requires specified procedures to help identify non-compliance: inquiry of management and, where appropriate, those charged with governance, and inspection of any correspondence with the licensing or regulatory authority. Performing no procedures conflicts with that requirement, and the auditor's report does not certify compliance, because the auditor's responsibility for such laws is limited to these specified procedures.

16. Under ISA 260 (Revised), the auditor must communicate significant findings from the audit to those charged with governance in writing if:

1. management of the entity has requested a written report
2. the audit has taken longer than the planned timetable
3. the financial statements include significant accounting estimates
4. the auditor judges that oral communication would not be adequate

Paragraph 19 of ISA 260 (Revised) requires written communication of significant findings from the audit when, in the auditor's judgment, oral communication would not be adequate. The standard does not make the form depend on a request by management, on the audit running late, or on the presence of significant estimates; these may affect the content of the findings but not the required form.

17. The significant findings from the audit that ISA 260 (Revised) requires the auditor to communicate to those charged with governance include all of the following EXCEPT:

1. the detailed test steps the auditor will perform on each account balance
2. the auditor's views on qualitative aspects of the accounting practices
3. significant difficulties the auditor encountered while performing the audit
4. the written representations that the auditor requested from management

Paragraph 16 of ISA 260 (Revised) lists the significant findings to be communicated: the auditor's views on significant qualitative aspects of accounting practices, significant difficulties encountered, written representations requested, and other matters significant to oversight of financial reporting. Detailed test steps are not findings. The planned scope and timing is communicated under paragraph 15 as an overview only, and the application material notes that communicating the detail of the procedures can reduce the effectiveness of the audit.

18. Under ISA 265, significant deficiencies in internal control identified during the audit must be communicated to those charged with governance:

1. orally on a timely basis, with a note of the discussion kept on file
2. in writing, on a timely basis, describing the deficiencies and effects
3. in the auditor's report, within an emphasis of matter paragraph
4. to the shareholders at the annual meeting of the general assembly

Paragraph 9 of ISA 265 requires the auditor to communicate significant deficiencies in internal control identified during the audit in writing to those charged with governance on a timely basis, and paragraph 11 requires that written communication to describe the deficiencies and explain their potential effects. Oral communication with a file note is not sufficient, and the matter is not reported through an emphasis of matter paragraph in the auditor's report. Shareholders are not the addressees of this communication; the auditor's report to the general assembly under Article 20(5) of the Companies Law is a separate output.

19. Under Article 18 of the Companies Law, when the general assembly removes the company's auditor, the manager or the chairman of the board must inform the Competent Authority of the removal and the reasons for it within how many days of the decision?

1. 3 days
2. 4 days
3. 5 days
4. 30 days

Article 18(2) of the Companies Law (text read on 4 November 2026) lets the partners, the general assembly or the shareholders remove the auditor, without prejudice to his right to compensation where justified, and gives the manager or the chairman of the board at most five days after the decision to inform the Competent Authority of the removal and its reasons. Periods of 3 and 4 days are shorter than the period in the Article. Thirty days is the period in Article 20(4) after which the auditor may call a meeting himself, which is a different rule.

20. A limited liability company qualifies as a small company and its articles of association say nothing about an auditor. During its second fiscal year it issues debt instruments. Under Article 19 of the Companies Law, the appointment of an auditor under Article 18 is:

1. not required, because the company is within its first two fiscal years
2. not required, unless partners with 10% of the interests request one
3. required, but after the Competent Authority has issued an order
4. required, because debt instruments are an exception to the exemption

Article 19(1) of the Companies Law exempts micro and small companies from the Article 18 appointment requirement, except in listed cases that include issuing debt instruments (paragraph 1(c)). Article 19(2) only sets when a company is deemed micro or small (during its first fiscal year of registration or for two consecutive fiscal years) and does not override those exceptions. The right of partners holding at least 10% of the interests to request an auditor under Article 19(3) (text read on 4 November 2026) concerns companies the exemption covers, not this company, which must appoint one. No order from the Competent Authority is needed, as the Article places the duty on the company itself.

21. Under Article 20 of the Companies Law, the auditor asks the manager or board to call a meeting of the partners, shareholders or general assembly to review difficulties he faces in carrying out his assignment. If no meeting is called within 30 days of the request, the auditor:

1. must resign by written notice and inform the Competent Authority
2. may himself call for a meeting of the partners or shareholders
3. must report the board to the Competent Authority within five days
4. may extend the deadline for the audit report by another 30 days

Article 20(4) of the Companies Law lets the auditor access the company's records at any time. If he meets a difficulty, he reports it to the manager or board; if they still fail to facilitate his work, he asks them to call a meeting of the partners, shareholders or general assembly, and if no meeting is called within 30 days of that request (text read on 4 November 2026), the auditor himself may call for a meeting. Resignation is a separate right under Article 18(3) and is not triggered by this failure. The five-day period belongs to the notice of removal under Article 18(2), and the Article gives the auditor no power to extend the reporting deadline.

22. According to ISA 300, the overall audit strategy:

1. Fixes the audit fee and the timetable that management agreed in the engagement letter
2. Lists the detailed procedures for each account and so replaces the audit plan
3. Sets the scope, timing and direction of the audit and guides the audit plan
4. Is finalised after the opinion is formed, once the audit evidence is evaluated

Paragraph 7 of ISA 300 requires an overall audit strategy that sets the scope, timing and direction of the audit and guides the development of the audit plan. The detailed procedures belong to the audit plan described in paragraph 9, not to the strategy. The fee and timetable are commercial terms of the engagement letter (ISA 210), and the strategy is updated during the audit as needed rather than finalised after the opinion.

23. Which of the following is NOT a component of the entity's system of internal control described in ISA 315 (Revised 2019)?

1. The auditor's detection risk assessment
2. The entity's risk assessment process
3. The information system and communication
4. The control environment of the entity

ISA 315 (Revised 2019) describes five components of the entity's system of internal control: the control environment, the entity's risk assessment process, the entity's process to monitor the system of internal control, the information system and communication, and control activities. Detection risk is an element of the audit risk model that depends on the auditor's own procedures, so it is not part of the entity's system. The other three options are components of that system.

24. Under ISA 315 (Revised 2019), inherent risk factors are:

1. Weaknesses in the entity's controls that allow a misstatement to go undetected by management on time
2. Features of the audit approach that affect the risk of the auditor failing to detect a misstatement
3. Conditions in the entity's industry that require the engagement partner to assign a more experienced team
4. Characteristics of events or conditions that affect susceptibility to misstatement, before controls

ISA 315 (Revised 2019), paragraph 12(f), defines inherent risk factors as characteristics of events or conditions that affect the susceptibility of an assertion to misstatement, before consideration of controls. Examples are complexity, subjectivity, change, uncertainty and susceptibility to management bias. Control weaknesses relate to control risk, and the features of the audit approach relate to detection risk. Staffing decisions are a response to risk and not a definition of it.

25. When the auditor assesses inherent risk under ISA 315 (Revised 2019), the assessment is made by considering:

1. The effectiveness of controls designed to prevent or detect a misstatement
2. The likelihood of a misstatement occurring and the magnitude it could have
3. The amount of audit evidence that can be obtained at a reasonable cost
4. The probability that the audit procedures will fail to detect a material misstatement

Paragraph 31 of ISA 315 (Revised 2019) requires the auditor to assess inherent risk by assessing the likelihood and magnitude of a misstatement, taking into account how the inherent risk factors affect susceptibility. The effectiveness of controls is considered in assessing control risk, and the probability that procedures fail to detect a misstatement is detection risk. The cost of obtaining evidence is not a criterion for assessing inherent risk.

26. ISA 315 (Revised 2019) requires the auditor to identify, in the control activities component, controls that address risks of material misstatement at the assertion level. These include controls that:

1. Address a risk of material misstatement assessed as a significant risk
2. Management has documented in the accounting policies manual of the entity
3. Apply to every class of transactions, whatever the assessed risks are
4. Exist in the control environment, whichever risks they address in practice

Paragraph 26(a) of ISA 315 (Revised 2019) requires the auditor to identify, in the control activities component, controls that address a significant risk, controls over journal entries, controls whose operating effectiveness the auditor plans to test (including those addressing risks for which substantive procedures alone cannot provide sufficient appropriate audit evidence) and other controls the auditor considers appropriate. Documentation in an accounting policies manual does not by itself bring a control into this group. Controls are not identified merely because they apply to every class of transactions or form part of the control environment; identification depends on the assessed risks.

27. When the auditor chooses a percentage to apply to a benchmark to determine materiality for the financial statements as a whole, ISA 320 indicates that the percentage:

1. Is the same for every benchmark, whether profit or revenue is used
2. Must equal the percentage that the auditor used in the prior period
3. Is a matter of professional judgment, not a prescribed fixed figure
4. Is set by the management of the entity in the engagement letter

Paragraph A7 of ISA 320 explains that determining the percentage to apply to a chosen benchmark involves professional judgment, and ISA 320 prescribes no fixed percentages. It adds that the percentage applied to profit before tax from continuing operations is normally higher than the one applied to total revenue, so the percentage is not the same for every benchmark. Materiality is reassessed each period, so the percentage need not equal the prior-period percentage, and it is the auditor's determination, not a figure set by management in the engagement letter.

28. Under ISA 600 (Revised), when component auditors have performed work on the financial information of some components, responsibility for the group audit opinion rests with:

1. Each component auditor, for the financial information of its own component
2. The group engagement partner, who remains responsible for the group audit
3. The group management, which signs the representation letter on the group
4. The group engagement partner, shared with the component audit partners

ISA 600 (Revised) makes the group engagement partner responsible for the direction, supervision and performance of the group audit and for the opinion on the group financial statements, whatever work component auditors perform. That responsibility is not shared with component auditors, and the component auditors report on the work requested from them. Management prepares the group financial statements and provides representations but does not hold responsibility for the audit opinion.

29. General IT controls are best described as controls that:

1. Check the accuracy and completeness of individual transactions in a single application program
2. Management performs by reviewing the exception reports that the system produces each month
3. The auditor builds into computer-assisted audit techniques to test the integrity of client data
4. Support the continued proper operation of the IT environment, such as access controls

Paragraph 12 of ISA 315 (Revised 2019) defines general IT controls as controls over the entity's IT processes that keep the IT environment operating properly, including the continued functioning of information processing controls and the integrity of information; examples are controls over access, program changes and IT operations. Controls that check individual transactions in one program are application (information processing) controls. A management review of exception reports is a review control over transactions, and techniques the auditor uses are audit procedures, not the entity's controls.

30. Which of the following is NOT a benchmark that the auditor might consider when determining materiality for the financial statements as a whole (ISA 320.A4)?

1. The audit hours budgeted for the engagement
2. Profit before tax from continuing operations
3. Total revenue or total expenses of the entity
4. Total equity or net asset value of the entity

Paragraph A4 of ISA 320 gives examples of benchmarks that depend on the entity's circumstances: profit before tax from continuing operations, total revenue, gross profit and total expenses, total equity or net asset value. The audit hours budgeted measure the auditor's own effort and say nothing about the financial information that users rely on, so they are not a benchmark.

31. Which of the following is NOT an example of an overall response to the assessed risks of material misstatement at the financial statement level (ISA 330.A1)?

1. Emphasizing to the team the need to maintain professional skepticism
2. Assigning more experienced staff or using experts on the engagement
3. Incorporating more unpredictability in selecting further audit procedures
4. Moving substantive procedures to an interim date to ease year-end work

Paragraph A1 of ISA 330 lists overall responses: emphasizing professional skepticism, assigning more experienced staff or staff with specialized skills or using experts, providing more supervision, adding unpredictability to the selection of procedures and making general changes to nature, timing or extent. The example it gives of a general change is performing substantive procedures at period end rather than at an interim date, which is the opposite of moving them earlier.

32. Under ISA 610 (Revised 2013), which of the following is NOT correct when the external auditor uses internal auditors to provide direct assistance?

1. The external auditor directs, supervises and reviews the work of the internal auditors
2. The internal auditors may perform procedures that involve significant judgments
3. The external auditor evaluates the objectivity and competence of the internal auditors
4. The responsibility for the audit opinion stays with the external auditor

ISA 610 (Revised 2013) permits direct assistance, where law or regulation does not prohibit it, after the external auditor has evaluated threats to the objectivity and the competence of the internal auditors, and the external auditor must direct, supervise and review their work. The internal auditors must not perform procedures that involve significant judgments in the audit, that relate to higher assessed risks where more than limited judgment is needed, or that concern work they were involved in and that has been or will be reported to management or those charged with governance. Using internal auditors does not reduce the external auditor's sole responsibility for the opinion.

33. Ms Noura, the auditor of Najd Logistics Company, assesses the risk of material misstatement in revenue cut-off as a significant risk. Which response does ISA 330 require for that risk?

1. The same substantive procedures used for revenue balances with a lower assessed risk
2. Tests of controls alone, because the controls over revenue appear well designed
3. Substantive procedures designed specifically to respond to that significant risk
4. Substantive analytical procedures alone, without any test of details

Paragraph 21 of ISA 330 requires substantive procedures that are specifically responsive to an assessed significant risk, and when the approach consists only of substantive procedures they include tests of details. Reusing the procedures designed for lower risks is not specific to the risk, tests of controls alone are not sufficient for a significant risk, and analytical procedures alone cannot replace tests of details.

34. Mr Faisal set materiality for Al-Waha Furnishings at the planning stage using forecast profit. During the final stage, actual profit is much lower and he concludes that a lower materiality would have been set. What should he do?

1. Revise materiality and reassess performance materiality and the further procedures
2. Keep the planning materiality, because it is fixed once it is recorded in the audit plan
3. Revise materiality when the management of the entity agrees to the change
4. Revise materiality for the report and leave performance materiality unchanged

Paragraph 12 of ISA 320 requires the auditor to revise materiality when information arises that would have led to a different amount at the start. Paragraph 13 requires the auditor to consider whether performance materiality and the nature, timing and extent of further audit procedures remain appropriate when the revised amount is lower. Materiality is not fixed by the plan and is not subject to management's agreement.

35. The sales of Najd Logistics Company are processed entirely by an automated system that produces no paper records, so substantive procedures alone cannot provide sufficient appropriate audit evidence for revenue. What must the auditor perform under ISA 330?

1. Substantive analytical procedures on monthly revenue figures
2. A larger sample of confirmations of year-end receivables
3. Inquiries of management about how the system operates
4. Tests of controls over the automated processing of sales

Paragraph 8(b) of ISA 330 requires tests of controls when substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level, which is typical of highly automated processing with little documentation. Analytical procedures, a larger sample of confirmations and inquiries of management are substantive or inquiry procedures, and the facts state that substantive procedures alone are insufficient.