What a financial statement audit is and what it is not

• State the two overall objectives of the auditor in AU-C 200.12.
• Explain reasonable assurance and why it is high but not absolute.
• Identify the three sources of the inherent limitations of an audit.
• Distinguish management’s responsibilities from the auditor’s.

The purpose of an audit

An audit exists to give users of financial statements an opinion from an independent auditor on whether those statements are presented fairly, in all material respects, in accordance with an applicable financial reporting framework (AU-C 200.04). Users are lenders, owners, boards, grantors and regulators who cannot inspect the books themselves. The opinion raises their confidence in the statements. It does not certify that every number is right, and it does not say the business is well run.

The financial statements belong to the entity. Management prepares them, with oversight from those charged with governance (AU-C 200.05). If you draft the statements for a client, that is a nonattest service with its own independence conditions. It never moves responsibility for the statements to you.

The two overall objectives

AU-C 200.12 sets two objectives that sit above every other AU-C section:

1. Obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, so you can express an opinion on fair presentation.
2. Report on the financial statements, and communicate as GAAS requires, in accordance with your findings.

If you cannot obtain reasonable assurance and a qualified opinion is not enough to inform users, AU-C 200.13 requires you to disclaim an opinion or withdraw where law or regulation permits.

Reasonable assurance

AU-C 200.14 defines reasonable assurance as "a high, but not absolute, level of assurance." You get there by obtaining sufficient appropriate audit evidence to reduce audit risk to an acceptably low level (AU-C 200.19). Audit risk is the risk that you express an inappropriate opinion when the statements are materially misstated. It is a function of the risks of material misstatement (inherent risk and control risk, which belong to the entity) and detection risk (which belongs to you). You manage detection risk through the nature, timing and extent of your procedures. The audit risk model guide walks through the arithmetic.

Inherent limitations

AU-C 200.A49 explains that you cannot reduce audit risk to zero. The limitations come from three sources:

• The nature of financial reporting. Estimates and judgments mean some amounts have a range of acceptable outcomes.
• The nature of audit procedures. Management may not give you complete information. Fraud can involve forgery and collusion designed to defeat procedures. An audit is not a legal investigation, so you have no subpoena power.
• Timeliness and cost. The audit has to be completed within a reasonable time and at a reasonable cost.

AU-C 200.A52 adds a limit on the limit: difficulty, time or cost is not by itself a valid reason to omit a procedure for which there is no alternative or to accept evidence that is less than persuasive. AU-C 200.A55 lists areas where these limitations bite hardest: fraud involving senior management or collusion, related party relationships, noncompliance with laws and regulations, and going concern.

What this means in a real file

The opinion covers the statements as a whole, so your work is scoped to material misstatement, not to every error. That framing drives every later step: materiality sets the size threshold, risk assessment tells you where misstatement is likely, and your responses gather evidence until risk is acceptably low.

Common file problems tied to this lesson:

• Engagement letters or reports that imply a guarantee, or that drop the statement that an unavoidable risk exists that some material misstatements may not be detected.
• Files that treat the absence of detected misstatement as proof that none exists, with no evaluation of whether evidence is sufficient.
• Teams skipping a procedure because records are hard to get, then writing "not practical" without considering AU-C 200.A52.

Read the full text of AU-C 200 once; every other section in this course assumes it.

Explaining the limits of an audit to a new client