Audit, Assurance and Forensics · May 2026

: New Breath Bank Plc.

a. Objectives of external audit (ISA 200, CAMA 2020) include,

i. obtaining reasonable assurance that the financial statements are free from material misstatement;

ii. expressing an independent opinion on the financial statements; and

iii. enhancing credibility of financial statements to shareholders, regulators, creditors, and the public. Audit expectation gap: The possible audit expectation gap include:

i. Reasonableness gap: Users expect auditors to detect all frauds and guarantee solvency. This is unreasonable and it is borne out of ignorance of the objectives of an audit.

ii. Performance gap: Performance gap exists when the audit fails to comply with standards. In this case: Shareholders would expect auditors to detect fraudulent loan approvals by management, prevent losses and avoid going concern issues, however, the auditors’ role is limited to reasonable assurance.

b. Internal control weaknesses and responsibilities at New Breath Bank

(i) weaknesses

• Irregular loan approvals (the credit risk management is weak)

• Ineffective internal audit (it focusses only on compliance reviews)

• No proper monitoring of non-performing loans.

(ii) Responsibilities

• Management should design, implement, and maintain effective internal controls.

• Internal auditors should evaluate control effectiveness and risk management in the Bank.

• The external auditor should assess internal control design and effectiveness for audit planning (ISA 315), but the external auditor is not responsible for internal control implementation.

c. Audit evidence and forensic techniques Evidence needed in the scenario (ISA 500) i. Loan agreements and approval documents 94

ii. External confirmations from borrowers (ISA 505) iii. Bank reconciliations iv. Reports of regulators v. Written representations obtained from management (ISA 580) to confirm completeness Forensic techniques: i. Investigate related-party transactions. ii. Use computer forensics to trace hidden assets of Finance Director iii. U lifestyle audit to detect unexplained wealth. iv. Searche at property and company registries to trace assets. v. Apply machine learning by identifying potential assets and transactions using algorithms. vi. Make third party search involving reviewing any third-party vendors or experts like attorneys, accountants to identify potential and hidden assets.

d. Ethical threats and safeguards Threats i. Gift from management. This poses self-interest and familiarity threats ii. Pressure to conceal whistle-blower report. This poses intimidation threat iii. Weak governance. This poses advocacy threat. Safeguards i. Refuse the gift, and disclose the gift offer to the Board/Audit Committee. ii. Escalate whistle-blower findings to regulators like Board of Directors, Central Bank of Nigeria (CBN), Nigeria Deposit Insurance Corporation (NDIC), Financial Reporting Council (FRC) and Economic and Financial Crimes Commission (EFCC). iii. Maintain professional skepticism throughout the course of the audit. iv. Document all ethical decisions in accordance with IFAC and ICAN Codes.

e. Application of technology in audit

i. Blockchain validation Banks are adopting blockchain technology in areas like interbank settlements, trade finance and digital assets. Auditors can use blockchain validation to:

• Confirm transaction integrity: Since blockchain entries are fundamentally immutable, auditors can verify the authenticity and accuracy of recorded transactions without relying heavily on third- party confirmations.

• Enhance transparency: Real-time access to blockchain records provides auditors with an auditable trail of banking transactions, reducing the risk of hidden adjustments or backdated entries.

• Support compliance testing: Smart contracts embedded in blockchain can automatically enforce and document compliance 95 with lending terms or settlement rules, which auditors can review to confirm adherence.

ii. Statistical analysis Given the volume of transactions processed daily by banks, auditors cannot check everything manually. Statistical analysis helps them focus on areas of greatest risk. Key applications include:

• Sampling and testing: Using stratified or random sampling, auditors can select representative transactions and assess whether the control environment is working effectively.

• Trend and variance analysis: By comparing current-year performance with prior years or industry norms, auditors can spot anomalies such as unusual movement in loan income or unexpected expense spikes.

• Risk modeling: Statistical methods can be applied to loan portfolios to estimate the likelihood of default and test whether provisions for credit losses are reasonable/adequate.

iii. AI Tools Artificial Intelligence (AI) tools expand auditors’ capabilities by analysing large data sets quickly and uncovering patterns that may not be visible through traditional methods. Practical uses include:

• Transaction monitoring: AI algorithms can scan millions of banking transactions to highlight unusual or suspicious activities, improving fraud detection.

• Document review: Natural language processing tools can examine loan agreements, contracts, and compliance reports to identify inconsistencies or missing disclosures.

• Continuous auditing: Instead of reviewing data only at year-end, AI- driven systems can monitor transactions throughout the year, giving auditors real-time assurance.

• Automation of routine tasks: Robotic process automation (RPA) can handle reconciliations and routine checks, allowing auditors to spend more time on areas that require professional judgment.

Examiner’s report The question tests the candidates’ knowledge of objects of external audit, internal control, audit evidence ethical threats, and technology in audit. Being a compulsory question, 100% of the candidates attempted the question, but the performance was just average. The commonest pitfall was the candidates’ inability to relate their answers to the contents and peculiarities of the real-life scenarios, thereby giving answers out of context. Candidates are advised to learn the process of applying their knowledge and scholarship to practical scenarios. They should also cover the syllabus adequately, 96 especially the contemporary audit areas like application of Information Technology (IT).

Marking guide

a. Explanation of the objectives of an external auditor and possible expectation gap Objectives of an audit. (1 mark each for 3 correct points) 3 Audit expectation gap: (I mark each for 3 correct points) 3 6

b. Internal control weaknesses and responsibilities of management and external auditors Internal Control weaknesses: (1 mark each for 3 correct points) 3 Responsibilities of Management and External Auditors: (1 mark each for 3 correct point) 3 6

c. Types and sources of audit evidence and forensic techniques to be used to investigate (1 mark each subject to a maximum of 6 correct points) 6 d. Ethical threats and conflicts in a given scenario and applicable safeguards (1 mark each subject to a maximum of 6 correct points) 6 e. Application of technology in audit (2 marks each for correct point explained for 3 correct points) 6 TOTAL 30

a. Differences between audit, assurance, and attestation services: Though closely related, audit, assurance, and attestation are not the same. They differ in scope, purpose, and application.

i. Audit Services

• Definition: An audit is an independent examination of financial statements, usually conducted in accordance with auditing standards and relevant legislations to express an opinion on whether the financial statements present a true and fair view (or are fairly stated in all material respects)

• Scope: Primarily focused on historical financial statements of an entity. 97

• Objective: To provide a high level of assurance to stakeholders that the financial statements are free from material misstatement, whether due to fraud or error.

• Example: The annual statutory audit of a company’s financial statements under CAMA 2020.

ii. Assurance services

• Definition: Assurance is a broader concept that refers to any independent professional service that improves the quality of information for decision-making.

• Scope: Not limited to financial statements—it can cover non- financial information such as compliance, sustainability reports, internal controls, or risk management.

• Objective: To enhance the reliability and relevance of information provided to stakeholders, thereby building trust and confidence.

• Example: An assurance engagement to review a bank’s internal control system or to evaluate a company’s sustainability reporting.

iii. Attestation Services

• Definition: In attestation, a professional accountant or auditor is engaged to issue a report on a subject matter—or an assertion about a subject matter—that is, the responsibility of another party.

• Scope: Narrower than assurance, but broader than audit. It includes examinations, reviews, and agreed-upon procedures on financial and non-financial information.

• Objective: To attest or confirm the reliability of the information presented by management.

• Example: o Reviewing the effectiveness of internal controls over financial reporting (ICFR). o Attesting to compliance with regulatory requirements. o Verifying management’s claim that a company meets certain environmental or social standards. The alternative presentation is the following table Summary of Differences Feature Audit Assurance Attestation Focus Historical financial Financial and non- statements financial information Assertions or subject matter presented by management Scope Narrow, compliance-driven statutory, Broad (any information decision- makers rely on) Middle ground – focused on validating management’s assertions Objective Give an opinion on fairness of financial statements Improve quality and credibility of information Provide a conclusion on reliability of subject matter 98 Feature Audit Assurance Attestation Example Annual audit statutory Review of sustainability Attestation report controls claims on internal or compliance

b. Need for audit: Ninalowo requires an external audit under The Companies and Allied Matters Act (CAMA) 2020 in Nigeria which makes it mandatory for a limited company to undergo an external audit. This requirement exists because of the special nature of public interest entities, their accountability to a wide range of stakeholders, and the need to protect the investing public Key reasons include: i. Protection of shareholders and Investors

• Public interest entities raise capital from a broad base of investing public, many of whom are not involved in day-to-day management.

• An external audit provides independent assurance that the financial statements present a true and fair view and protect investors from misleading or fraudulent reporting.

ii. Public interest obligation

• Unlike private companies, public interest entities operate in the public domain and often handle large pools of funds.

• Because their operations affect the economy and public confidence, CAMA 2020 requires an audit to ensure transparency and accountability.

iii. Corporate governance and oversight

• An external audit enhances governance by serving as an independent check on management’s activities.

• It reduces the risk of management bias, errors and fraud, thereby strengthening confidence in the integrity of the company’s financial reporting.

iv. Regulatory compliance

• Under CAMA 2020, all public interest entities must file audited financial statements with the Corporate Affairs Commission (CAC).

• These audited financial statements are also relevant for regulators such as the Securities and Exchange Commission (SEC), the Nigerian Exchange Limited (NGX), and the Financial Reporting Council (FRC) ensuring compliance with listing and disclosure requirements.

v. Creditworthiness and investor confidence 99

• External audits increase the credibility of financial statements, which is vital for attracting new investors, securing loans, and maintaining market confidence.

• Without audited financial statements, it would be difficult for stakeholders to make informed decisions about investing or lending.

c. Roles of external auditors, internal auditors, and audit committee and their contributions to corporate governance:

i. External auditors Roles

• Provide an independent opinion on whether the company’s financial statements give a true and fair view of its financial position.

• Assess whether accounting policies comply with relevant standards and regulations.

• Identify material misstatements caused by fraud or error.

• Report on matters that affect shareholders and regulators. Contributions to corporate governance

• Enhance the credibility of financial reporting.

• Provide assurance to shareholders, creditors, and the public that management’s financial statements can be trusted.

• Act as an external check on management’s stewardship of resources.

ii. Internal auditors Roles

• Operate as part of the company, but with independence from highest level of management.

• Review and test internal controls, risk management, and governance processes.

• Ensure operational efficiency, compliance with laws, regulations and company policies, and safeguarding of assets.

• Provide continuous monitoring rather than just an annual review. Contributions to corporate governance

• Strengthen internal control systems and reduce operational and financial risks.

• Provide management and the audit committee with insight into weaknesses before they become major problems.

• Help promote a culture of accountability and ethical conduct.

iii. Audit committee Roles

• Composed mainly of non-executive directors and shareholders’ representatives. 100

• Provide oversight of financial reporting, risk management, and audit processes.

• Recommend the appointment and remuneration of external auditors.

• Review audit findings and ensure that management implements recommendations.

• Serve as a link between management, auditors, and shareholders.

• Authorise investigations into any activity of the company. Contributions to corporate governance

• Act as a watchdog ensuring management does not override controls.

• Facilitate effective communication between internal and external auditors.

• Ensure that the audit function remains objective and independent. Interaction among the Three i. Internal auditors and audit committee

• Internal auditors report their findings to the audit committee.

• The committee uses these reports to oversee risk management and ensure that corrective actions are taken. ii. External auditors and audit committee

• External auditors communicate audit findings, material weaknesses, and independence matters to the audit committee.

• The audit committee evaluates external auditors’ performance and independence. iii. External and internal auditors

• They may coordinate work to avoid duplication and ensure coverage of all risk areas.

• External auditors may rely on the work of internal auditors where appropriate. In summary: External auditors give independent assurance to shareholders, internal auditors provide continuous monitoring of controls and risks, and audit committee ensures oversight and coordination between the two. Together, they form a triangular defence system that reinforces corporate governance.

Examiner’s report The question tests the candidates’ knowledge of audit assurance, attestation services, the roles of external auditors, internal auditors, and the audit committee, highlighting how they strengthen corporate governance. About 90% of the candidates attempted the question, but the performance was generally poor. The commonest pitfall was their inability to interpret the requirements of the question, thereby giving wrong or vague solution to it, especially the part asking 101 candidates to explain the relationship of external auditors, internal auditors and the audit committee to strengthen corporate governance. Candidates are advised to understand the requirements of a question and provide answers accordingly.

Marking guide

a. Differences between audit, assurance and attestation services (2 marks each for defining and explanation for the 3 services) 6

b. Why Ninalowo MFB Ltd requires an external audit (2 marks each subject to a maximum of 3 correct explanation) 6

c. Roles of External Auditors Internal Auditors and audit committee and the interaction between them. Roles and contributions of external auditors (1 mark each for 2 points) 2 Roles and contributions of internal auditors (1 mark each for 2 points) 2 Roles and contributions of audit committee (1 mark each for 2 points) 2 (1 mark each for 2 correct points on interaction amongst external auditors, internal auditors and the audit committee) 2 8 TOTAL 20

: Mount Pisgah Supermarkets Limited

a. Objectives and main components of internal control Objectives of internal control Internal control is a system of policies, procedures, and practices designed to ensure that an organisation achieves its goals effectively and efficiently. The key objectives are:

i. Reliability of financial reporting – Ensure that accounting records and financial statements are accurate, complete, and timely. ii. Safeguarding of assets – Protect cash, inventory, and other resources against theft, misuse, or loss. iii. Compliance with laws and regulations – Ensure that operations follow legal requirements and organisational policies, legal and regulatory requirement. 102

iv. Operational efficiency and effectiveness – Promote the economical and efficient use of resources in delivering services or products. v. Prevention and detection of fraud and errors – Reduce opportunities for mismanagement, intentional fraud, or inadvertent mistakes. Main components of internal control (based on the committee of sponsoring organisation of the Treadway Commission (COSO) framework i. Control Environment

• The overall culture, values, and ethical tone set by management.

• Integrity, competence, and oversight by the board.

ii. Risk assessment

• Identifying and analysing risks that could affect achievement of objectives (e.g., theft of inventory, errors in sales recording). iii. Control activities

• The policies and procedures designed to mitigate identified risks. examples-authorization of sales discounts, segregation of duties, reconciliations.

iv. Information and communication

• Systems that capture and share relevant information in a timely manner.

• Reporting channels for staff to raise concerns about irregularities. v. Monitoring

• Regular review of controls to ensure they are effective.

• Monitoring can involve internal audits, surprise checks, or performance reviews.

b. Weaknesses in Mount Pisgah computerised environment and mitigating security measures Identified weaknesses: i. The Cashiers control both cash handling and its records. This shows evidence of lack of segregation of duties. ii. Password sharing among staff is a major weakness in access control. Mitigating security measures: i. Institute, mandate and enforce segregation of duties. ii. Enforce unique user IDs/passwords, and institute regular password changes. iii. Do a regular review of audit trail logs.

c. Strengthening internal control in Mount Pisgah Supermarkets Supermarkets handle large volumes of cash, credit transactions and fast- moving inventory. Weak controls can lead to losses from theft, fraud or errors. The ways mount Pisgah can strengthen its internal control include: i. Cash Handling Controls 103

• Use point-of-sale (POS) systems that automatically record transactions.

• Separate responsibilities for cash collection, recording, and reconciliation.

• Perform daily cash counts and bank reconciliations.

ii. Inventory management controls

• Install electronic inventory systems with barcode scanning to track inventory.

• Carry out regular inventory checks, counts and reconcile with records.

• Restrict warehouse and storeroom access to authorised staff only.

iii. Segregation of duties

• No single employee should be responsible for sales, recording, and cash deposits, for example, the cashier collects cash, while another staff member verifies deposits.

iv. Authorisation and approval

• Require manager’s approval for discounts, returns, and voided sales.

• Ensure purchase orders are authorised before suppliers deliver goods.

v. Use of technology

• CCTV surveillance in cash points, storerooms, and entrances.

• POS systems integrated with accounting software to reduce manual errors

vi. Compliance and training

• Train staff on fraud awareness, ethical behaviour, and customer service.

• Enforce compliance with policies through employee handbooks and disciplinary measures.

vii. Monitoring and Review

• Regular internal audit checks of sales, inventories, and cash balances.

• Surprise inspections by supervisors to detect irregularities and act as deterrents.

• Use of key performance indicators (for example shrinkage ratios, cash discrepancies) to monitor efficiency. 104

Examiner’s report The question tests the candidates’ knowledge of internal control. This being a popular area in auditing, about 97% of the candidates attempted the question, but the performance was fair. The commonest pitfall of the candidates was their inability to explain internal control as it relates to a computerised environment. Candidates are enjoined to acquire adequate knowledge in auditing as it relates to computer environment.

Marking guide

a. Objectives and main components of Internal control (1 mark for a key objective, subject to a maximum of 4) 4 Component of internal control (1½ marks for each component, subject to a maximum of 4) 6 10

b. Internal control weaknesses and mitigating security measures (I mark for each weakness and security measure subject to a maximum of 4 points) 4 c. Strengthening internal control system in Pisgah (1½ marks each, subject to a maximising of 4 correct points) 6 10 TOTAL 20

: Bluebird Airlines Plc.

a. Need for maintaining audit documentation

(i) Definition: Audit documentation is the standardised term for all records of audit procedures carried out, audit evidence obtained, and conclusions reached. (ii) Justification

• It provides support for auditor’s opinion (ISA 230).

• It is the evidence of compliance with ISAs and regulatory frameworks.

• It assists supervision and review of audit work.

• It facilitates planning for future audits.

• It provides basis for legal defence in case of litigation.

• In Blue bird Airlines Plc., it is clear that documentation is crucial since there are going concern problems and there are missing evidence on expenses. 105

• Audit documentation ensures traceability, compliance and quality control to support conclusions and audit opinion. (iii) Role of audit documentation in supporting conclusions and audit opinion

• Audit documentation shows traceability-the nature, timing and extent of the audit work

• Provision of written proof of every major decision

• It enables the understanding of the reason why the audit teams arrive at a definite conclusion.

• Compliance with professional guidelines (ISA 230)

• Serving as a legal shield in the case of litigation

• Ensuring quality control to support conclusion and audit opinion.

b. (i) Written representations (ISA 580): Letter of Representation should be obtained from client management when other evidence cannot be obtained or are insufficient such as completeness of liabilities in this case Blue Bird Airlines Plc.

(ii) Discussions with senior audit team members (ISA 450): Required for significant misstatements or judgement areas, such as

• aircraft maintenance expense issues; and

• going concern risks. Matters discussed with these senior audit team members must be recorded in working papers with management’s responses.

c. Material Uncertainty Related to Going Concern Material uncertainty related to going concern (ISA 570 Revised):

i. If the uncertainty is adequately disclosed by management, then include a “Material Uncertainty Related to Going Concern” paragraph (not a qualification).

ii. If disclosure is inadequate, then issue a qualified or adverse opinion AUDIT REPORT TO THE MEMBE OF BLUEBIRD AIRLINES PLC (extract) We draw attention to Note X in the financial statements which indicates that the company has incurred recurring losses and is dependent on bank financing. These events indicate a material uncertainty which may cast significant doubt on the company’s ability to continue as a going concern. Our opinion is not modified in respect of this matter.” Examiner’s report The question tests the candidates’ knowledge of audit documentation; written representation and audit report. 106 About 25% of the candidates attempted the question and their performance was poor. Candidate commonest pitfalls were their exhibition of poor knowledge of written representation and their inability to draft an audit report. Candidates are advised to study well for examinations and make good use of the Study Texts and other relevant Institute’s publications.

Marking guide

a. Need for maintaining audit documentation (1 mark for definition) 1 (1 mark each for justification subject to maximum of 4 correct points) 4 (1 mark each for 2 roles in supporting conclusions and audit opening) 2 7

b. Written representation and discussions with senior Audit team members (ISA 450) Written representation 2 Discussion with senior manager 3 Documentation 1 6 Reporting going concern issues material/uncertainty 4

c. Draft audit report on going concern status 3 7 TOTAL 20

: Bright Pharmaceuticals Limited

a. Meaning of Forensic Accounting Forensic accounting can be referred to as the preparation of financial information to be used as evidence in court proceedings and it is divided into forensic investigation and forensic auditing. Objectives of Forensic Accounting i. Detect fraud. Where fraud is suspected, it is the objective of forensic accounting to dig into the matter to unearth all that transpired and obtain evidence that can be tendered in court to recover stolen assets. ii. Quantify damages. Forensic accounting possesses the skills and tools to assess the economic damages suffered by the concerned entity. iii. Provide litigation support. Forensic accounting would be available to help the client scale through all the processes so that the lost assets can be recovered. 107

iv. Give expert testimony. The forensic accountant has the skills to make presentations in court in support of his/her client and assist in resolving disputes involving financial matters. b.(i) Investigating procurement/employee fraud Step Title What to Do Allegation • Obtain this from the whistle blower, management or law enforcing organisation Initial assessment

• Ascertain the credibility of the allegation

• Assess the potential impact of the fraud on the organisation Planning and Preparation

• Understand the client's needs and the nature of the suspected issue.

• Define the objectives, scope, and methodology. Evidence Collection

• Obtain relevant documents (e.g., accounting records, emails, contracts).

• Use interviews, surveillance, and other investigative techniques. Data Analysis

• Analyze financial data for irregularities or patterns of fraud.

• Use forensic technology tools for data mining and reconstruction. Reporting • Document findings clearly and factually.

• Prepare reports suitable for submission in court. Court Proceedings

• Present findings as an expert witness.

• Respond to cross-examination and scrutiny.

(ii) Methods of Tracing hidden assets:

• Bank account analysis.

• Property records search.

• Related-party transactions.

• Lifestyle audit (matching income with expenditure).

• Digital or financial analysis to identify and track assets.

• Using algorithms to identify potential assets.

• Using legal tools and court orders to assess undisclosed assets.

c. Expert report contents

i. Introduction and terms of reference. ii. Methodology used. iii. Findings of fraud investigation. iv. Financial impact quantified. v. Conclusions and expert opinion. vi. Declaration of independence. 108

Examiner’s report The question tests the candidates’ knowledge of forensic accounting. About 85% of the candidates attempted the question and the performance was fair. The commonest pitfall was the candidates inability to apply current development in auditing to requirements of the question. Candidates should prepare well for future examinations and cover all areas of the syllabus.

Marking guide

a. Explanation of forensic accounting and its objectives Meaning of forensic accounting 2 Objectives of forensic accounting 1 mark for each correct point subject to a maximum of 3 points 3 5

b. Process of Investigating procurement/employee fraud 1 mark for each correct point subject to maximum of 4 points. 4 Tracing of hidden assets ½ mark for each correct point subject to a maximum of 4 points 2 6

c. Contents of expert report 1 mark for each correct point subject to a maximum of 4 points 4 TOTAL 15

: Royal Bank Plc.

a. Importance of professional ethics in maintaining Credibility and Independence

• Ethical compliance ensures that audit opinions are perceived as objective and trustworthy.

• In banking, credibility affects not just the firm’s reputation but also financial stability and depositors’ confidence in the bank.

ii. Importance of professional ethics in protecting the Public Interest

• Refusing inducements and reporting irregularities, auditors prevent concealment of systemic risks that could harm depositors, investors, and the wider economy. 109

• Ethical oriented auditors act as a line of defence against corruption and financial mismanagement in the financial system.

• Ensuring credibility of audit opinion.

• Protecting public interest (shareholders, depositors, regulators).

• Ensuring trust in financial reporting and the profession.

b. Ethical threat from holiday gift Types of threat: Self-interest and familiarity threat. Appropriate Safeguards i. The audit partner’s acceptance or even consideration of a free holiday trip from the bank’s managing director threatens independence and objectivity. ii. It constitutes a self-interest and familiarity threat under the IFAC and ICAN Codes, as it could compromise impartial judgment or create the perception of bias. iii. Such gifts should be declined and reported to the firm’s ethics partner, and safeguards such as reassignment of the engagement partner may be necessary. iv. Rotate audit partner in line with regulatory requirements.

v. Reinforce firm’s independence policy. vi. Involve the Audit committee.

c. Whistleblowing (NOCLAR) responsibilities ISA 250 and the IFAC Code state that all Non-Compliance with Laws and Regulations (NOCLAR)must be reported.

• If the NOCLAR, in this case, is material, intentional, or affects public interest, the auditor may be legally or ethically obliged to report the matter to an appropriate authority such as the Central Bank of Nigeria (CBN), the Nigerian Deposit Insurance Corporation (NDIC), or other financial regulators (e.g. FRC or even EFCC).

• This external reporting should occur even if management refuses consent, provided it is allowed or required under applicable laws and regulations. Audit procedures in this Case Step Action Purpose

1. Identify and verify Confirm the validity of the whistle-blower’s claims through audit evidence To establish whether NOCLAR has occurred

2. Communicate internally Discuss partner findings with senior audit To ensure appropriate and ethics committee escalation 3. Engage with Those Charged With Report issue to the audit committee and board for due To give management an opportunity to act 110 Step Action Purpose Governance(TCWG) response

4. Assess impact Determine if non-compliance affects the financial statements or going concern To decide audit opinion implications

5. Report externally If material or un-remedied, report to CBN or NDIC or appropriate legal and regulatory authority. To protect public interest and comply with laws

6. Document thoroughly Record all steps, judgments, and communications To demonstrate compliance with professional standards

d. The five fundamental ethical principles Professional ethics provide the moral and regulatory foundation for the auditor’s work. They ensure that audit judgments are not influenced by personal gain or pressure from clients. The five fundamental ethical principles (as per the IFAC Code) are:

i. Integrity – being straightforward and honest in all professional relationships. ii. Objectivity – avoiding bias, conflicts of interest, or undue influence. iii. Professional competence and due care – maintaining the required knowledge and skill. iv. Confidentiality – respecting information obtained but not concealing wrongdoing. v. Professional behaviour – complying with laws and regulations to avoid actions that discredit the profession.

Examiner’s report The question tests the candidates’ knowledge of professional ethics as it relates to auditors and non compliance with laws and regulations (NOCLAR). Almost all the candidates attempted this question because it is a fundamental auditing topic but the performance was fair. The commonest pitfall was the inability of the candidates to relate the answers to professional ethics and NOCLAR to the scenario given. Candidates are advised to cultivate the wherewithal to relate theoretical auditing to practical scenario or real-time situations. 111

Marking guide

a. Importance of professional ethics 2 marks for each of the 2 points explained 4 Identification of ethical threats to independence created by holiday gift and safeguards 1 Ethical threat Safeguards to ethical threats ½ mark for each correct point subject to a maximum of 4 points 2 3 Responsibilities of NOCLAR and audit procedures responsibilities 1 mark each for 2 correct 2 points 2 Audit procedure 1 mark each for each correct point subject to maximum of 4 procedures 4 6

b. Five fundamental ethical principles ½ mark for each principle subject to maximum of 4 2 TOTAL 15

: Channel Retail Plc.

a. Statistical analysis for outliers Statistical analysis helps auditors identify unusual or inconsistent sales transactions that may indicate fraud, manipulation, or error in the accounting records. By applying statistical tools, auditors can focus attention on high-risk items rather than testing all transactions manually. In the case of Channel Retail Plc., where manipulation of sales figures is suspected, statistical analysis can reveal outliers-transactions that deviate significantly from the normal sales pattern. Outliers identified through statistical analysis are not basically or automatically fraudulent, but they highlight transactions requiring further audit procedures, such as: i. Verifying supporting documents (invoices, receipts), ii. Confirming with customers or suppliers. Common statistical techniques for outliers include: Method Description Use in Channel Retail Plc. Z-Score Analysis Calculates how far each transaction is from the mean in standard deviation units. Identify stores or dates with Z- scores \> 3, suggesting abnormal sales. Regression Analysis Predicts expected sales based on factors (e.g., store size, location, Detect stores whose sales are inconsistent with predicted 112 Method Description Use in Channel Retail Plc. seasonality) and flags significant deviations. patterns. Benford’s Law Analyses the frequency of leading digits in sales amounts; abnormal distributions suggest manipulation. Identify fabricated or rounded sales figures. Time-Series Analysis Detect sudden spikes or drops in daily sales inconsistent with normal cycles. Cluster Analysis Examines trends and seasonal patterns in sales data over time. Groups transactions with similar characteristics and flags those that don’t fit any group. Detect sales that differ sharply from normal patterns in similar branches and dispensation. In checking for outliers: i. Check for system overrides or manual adjustments, ii. Review the timing of revenue recognition.

b. Interrogating accounting software Modern organisations, including retailers, rely heavily on computerised accounting systems like ERP platforms to process, record, and report financial transactions. For auditors, it is essential to interrogate, understand, test, and evaluate these systems because:

i. Reliability of Financial Information Auditors depend on the accounting system’s data to form an opinion on the financial statements. If the system is flawed, incomplete, or susceptible to manipulation, the financial statements may be materially misstated. Therefore, auditors must assess whether the software accurately records and summarizes transactions.

ii. Assessment of Internal Controls (ISA 315) An ERP system automates key controls—authorisation, segregation of duties, and access rights. Interrogating the system helps auditors:

• Understand control design and configuration;

• Evaluate whether automated controls are effective;

• Identify weaknesses such as unauthorised access or override of controls. This determines the extent of reliance auditors can place on system-generated data. iii. Detection of Fraud and Irregularities Manipulation can occur within digital environments—for example, through backdated entries or system overrides. By examining system logs, audit trails, and configuration settings, auditors can detect:

• Unusual system activities;

• Unauthorized changes to master files or accounting rules; 113

• Suspicious user accounts or deleted transactions.

iv. Completeness and Accuracy of Electronic Records In electronic environments, source documents like invoices, receipts, purchase orders are often digital. Auditors must ensure that all transactions recorded in the system are complete, accurate, and properly classified - particularly where no paper trail exists.

v. Integration with Other Systems For a large organisation like Channel Retail Plc, accounting software is often linked to:

• Inventory management,

• Point-of-sale (POS) systems,

• Supplier payment (possibly blockchain-based) modules. Interrogation helps confirm whether these modules interface correctly, preventing errors such as double counting, omission, or inconsistent postings.

c. Procedures for Interrogating the Client’s Accounting Software System Auditors follow a structured process in line with ISA 315(Understanding the Entity and Its Environment) and ISA 330 (Responses to Assessed Risks). Interrogating the client’s accounting software is not optional - it is vital for ensuring audit reliability in a technology-driven environment. By following a structured approach - understanding, testing, analysing, and evaluating system controls - auditors can:

• Reduce audit risk,

• Strengthen reliance on electronic data, and

• Provide more credible assurance on the financial statements. The eight steps are: Step 1: Preliminary Understanding

i. Obtain documentation on the accounting system (user manuals, data flow diagrams, system architecture). ii. Identify major modules like sales, purchases, inventory, general ledger. iii. Determine system ownership, version, and vendor support. Purpose: Gain an overview of how transactions are initiated, authorized, recorded, and reported. Step 2: Walkthrough and System Mapping

i. Trace a few sample transactions (e.g., a sale from POS to ledger posting) through the system. ii. Observe how data moves across different modules. iii. Identify key control points (authorization, review, reconciliation). 114 Purpose: Confirm understanding of the process flow and verify that controls are operating as designed. Step 3: Review of Access and Security Controls

i. Obtain a list of all user accounts and assigned roles. ii. Evaluate whether segregation of duties is enforced (such as no user can both approve and record payments). iii. Inspect password and access management policies. iv. Review audit trails for unauthorized access or system overrides. Purpose: Ensure system security and data integrity. Step 4: Configuration and Parameter Testing

i. Examine key system settings:

• Accounting period lockouts,

• Revenue recognition rules,

• Automatic journal posting controls,

• Tax and discount settings.

ii. Confirm that configurations align with company policies and accounting standards (e.g., IFRS). Purpose: Detect misconfigurations that could cause material misstatements. Step 5: Data Analytics and Computer-Assisted Audit Techniques (CAATs) i, Use audit software to extract and analyse data from the accounting system. ii. Apply filters and tests (e.g., duplicate invoices, unusual journal entries, gaps in document numbering). iii. Compare system-generated reports with independent records. Purpose: Identify anomalies or trends that require further investigation. Step 6: Testing of Automated Controls

i. Test system-enforced approvals, thresholds, and reconciliations. ii. Attempt dummy entries (in a test environment) to confirm the system rejects invalid or unauthorized transactions. Purpose: Verify that embedded controls function as intended. Step 7: Evaluation of Interface and Backup Systems

i. Examine interfaces with other applications (POS, payroll, blockchain payment systems). ii. Review data backup and recovery procedures. iii. Confirm data integrity during transfer between systems. Purpose: Ensure completeness, reliability, and recoverability of accounting information. 115 Step 8: Documentation and Reporting

i. Document all procedures performed, findings, and implications for audit risk. ii. If weaknesses are identified, recommend improvements or compensating manual controls. Purpose: To ensure that integrity of documentation and reporting is maintained.

Examiner’s report The question tests the candidates’ knowledge of application of current development in auditing like enterprise resource planning (ERP), block chain technology, and other IT related auditing areas to simulated business operations. About 15% of the candidates attempted the question and the performance was poor. The commonest pitfall was the candidates’ display a poor knowledge of IT and other contemporary issues on auditing. Candidates are advised to make it an absolute necessity to be well grounded in IT and current development areas in auditing.

Marking guide

a. Application of statistical analysis to deficit outliers

- 1 mark each for techniques subject to maximum of 4 4

- Procedures for checking for outliers 1 mark for each procedure for 2 points 2 6 b. Need to Interrogate softwares 2 marks each for correct procedure subject to a maximum of 3 points 6

c. Audit procedures for interrogating client’s enterprise resource planning (ERP) 1 mark for a correct procedure subject to a maximum of 3 points 3 TOTAL 15 116