What is an Audit?
Published: 20 May 2025
13 minute read
In this podcast episode, Kate O'Neill, Director of Stakeholder Engagement and Corporate Affairs, and Project Directors, Ramana McConnon and Peter Kitson, discuss the crucial role audit plays in enhancing trust, confidence and transparency in financial statements.
You can also listen on Apple Podcasts and Spotify.
Transcript
0:09
Hello there, and welcome to another FRC In Conversation.
0:13
My name is Kate O'Neill.
0:14
I'm the Director of Stakeholder Engagement and Corporate Affairs here at the FRC.
0:19
And today I'm joined by two project directors in our audit and assurance policy team, Ramana McConnon and Peter Kitson.
0:29
Welcome, Ramana and Peter.
0:31
So today, we're really taking things back to basics here because it's clear that not everybody in our audit ecosystem always understands what an audit is, why we do audits.
0:45
And I think it'd be great to hear from the experts of Peter and Ramana to remind people, let's start at the very beginning.
0:52
What is an audit?
0:53
Ramana, do you want to kick us off?
0:56
Sure.
0:56
Happy to Kate.
0:57
So an audit is a professional services engagement in which an auditor or a team of auditors expresses an opinion where what we call a reasonable assurance opinion, which I'll come back to in a moment on whether the financial statements of an entity are true and fair or free.
1:12
Material misstatement is another way we sometimes refer to that.
1:16
So reasonable assurance is obviously a sort of technical term.
1:19
So it's worth unpacking that.
1:20
Look at here.
1:21
The first thing to note is it doesn't mean absolute assurance.
1:24
The auditor is not there to find out penny that might be wrong in the financial statements.
1:28
They're they're guided by materiality, which I'll again, I'll come back to in a moment.
1:31
And reasonable assurance is obtained when an auditor has obtained sufficient appropriate audit evidence to reduce the risk that they haven't identified a material with statement that might actually be there to an acceptably low level.
1:44
Just to jump in there, Peter, does that mean an audit is only about the numbers or do auditors look at other items that the company has relied on or used in putting together its accounts?
1:57
So the auditors primary focus is going to be on the financial statements and ultimately the numbers.
2:02
But the auditor is also usually required to confirm that the disclosures in the financial statements are also materially accurate, that there's no material misstatement in them.
2:14
And typically the auditor will have other responsibilities as well within the annual report, what you might call the front half.
2:20
And there's a responsibility there to make sure that it's consistent with the financial statements.
2:26
And the auditor is also required to give an opinion on whether the selection of the going concern basis of accounting in the preparation of those financial statements by management is appropriate.
2:38
So it's not just about the numbers.
2:39
There's quite a lot of judgement involved as well.
2:42
So Ramana, you know, you were talking about looking at obviously what Peters just said, you know, the whole of the accounts.
2:49
But how does that happen?
2:50
I mean, does the audit to just take them away, read them and come back and say to management or the board of a company, will these look fine?
2:58
You know, well done.
3:00
Some companies might wish that it was that sort of hands off.
3:02
But no, I'm afraid the auditor will be there most days asking questions, asking for information.
3:08
The audit work starts long before the financial statements are actually finished.
3:12
So there'll be a planning phase often before the year end.
3:15
For some larger companies, there might also be some controls work at that point too, but not necessarily.
3:20
But before year end, the auditor and the company being audited should agree a sort of timeline for when the company might have their financial statements ready and crucially when they might have supporting information ready to sort of back that up.
3:32
Because there's little point.
3:33
And this does happen in practice sometimes there's little point, the auditor going out to the company to start the audit and then finding that the information isn't actually there.
3:40
And then it wastes everyone's time and cost extra money.
3:43
But in terms of the information that the auditors will get, it will start with the financial statements and the trial balance or general Ledger that underpins that.
3:50
So that's often it's in accounting software these days.
3:53
It records all of an entity's transactions and journal entries in the accounting.
3:58
And it is the basis of the financial statements.
4:00
So it's a really useful resource for the auditor to to tie things back to in terms of ensuring that everything is sort of all working towards the same goal, like breakdowns, that they can then look at sampling and things like that to vouch to support the information.
4:13
That's a lot of information, that's a lot of planning.
4:16
But I guess Peter, I, what would you say to someone who says, well, what's the purpose of an audit?
4:21
It's just a box ticking exercise.
4:23
Who benefits from it?
4:24
What do people get from it?
4:26
So I think the underlying purpose of the audit really is to enhance the confidence of intended users in the financial statements.
4:34
So, you know, the the origins of audit to some extent sort of gets tied back to the idea that if you have a limited company, you have the distinction between the shareholders and the managers, the people who actually run the business and the people who ultimately own the business.
4:48
So the role of the audit in in terms of how it emerge was to sort of fill that information gap to make sure that the owners actually understood what the managers were doing in terms of how it's sort of moved on from those origins.
5:00
It's really also aimed at making sure that all stakeholders who have an interest in an entity's financial statements have that enhanced confidence in terms of what's included within them.
5:11
Isn't the audit just only dependent on really the information they get?
5:16
Or do auditors have to also, I don't know, challenge really push management on what they're telling the auditors?
5:24
I think it depends very much on the type of material that you'll be working with.
5:29
So in areas of the audit where there is a significant amount of judgement, where the underlying accounting is complexity is complex and management is required to apply judgement.
5:43
And that's the type of area where auditors will really be expected to apply professional skepticism to understand the basis for the determination of those estimates and how management had come up with those judgments.
5:55
The real key thing to bear in mind as well is that no audit should really be undertaken without the application of professional skepticism and the use of professional judgments by the auditor undertaking it.
6:08
It's fair to say that there are some areas where that is going to be more pronounced.
6:13
So for instance, accounting estimates, which can be very complex and require management to apply judgement in terms of their preparation.
6:21
Whereas if you sort of think about the stock in trade of everyone's audit, really they're they're sort of going through expenditure, invoices and things like that, where there's still judgement involved, but they're considerably more process based in terms of testing, in terms of understanding what the underlying source material is.
6:41
So the degree of that type of judgement and professional skepticism will differ across the audit, but it's absolutely essential that it's always there.
6:49
And when it comes to the point of coming up with a final opinion on the financial statements, the auditor really has to apply those professional attributes as much as possible.
6:58
But I guess who needs an audit reminder, does everyone have to get an audit?
7:03
Are they all of the same requirements?
7:05
Because lots of companies are different sizes, different complexities.
7:09
So who needs to get an audit?
7:11
Some companies legally have to get an audit.
7:14
It's in statute and that can come from a range of different sources.
7:17
The highlights of that would be that there's a small company exemptioned that would people refer to when they say statutory audit and any other audit is what by choice.
7:29
That's right.
7:29
And there are a range of reasons a company might choose to get an order even if they don't have to by statute.
7:34
Going back to what we discussed earlier about the sort of confidence you give the intended users and your stakeholders about what you've put in your financial statements.
7:41
That has a range of benefits from cheaper access to capital or indeed access to capital.
7:46
If banks and other sequences might acquire order to furnish statements, companies that are intending to scale up quite quickly might start getting an audit even before it's required because they think they're going to have to get one eventually, so they might as well get ahead of the curve.
7:58
And then lastly, there's the point about getting an extra pair of professional and informed eyes on your business and on your controls and processes.
8:05
There are ethics and independence considerations there about what they want to take, can give advice on, and that can be valuable to businesses.
8:12
And on that point, Peter, I mean, sounds like there's value not just for what you described before with stakeholders being able to get confidence from an audit about how companies run its activities, its controls.
8:25
But do you think some companies actually learn from the audit things they could do better, differently improve?
8:32
I think there's often the case that that takes place, Kate, to give one example of the auditors responsibilities during an audit, they are required to report anything on significant deficiencies and internal controls and that they identified during the course of the audit.
8:47
So, you know, sort of recommendations to management in terms of how their controls and processes could be improved is very much part of the the audit process itself.
8:57
So the auditor has to adhere to a variety of auditing standards during the course of an audit.
9:04
And to our listeners, Peter and Ramana are involved in pulling together those standards for auditors to adhere to.
9:11
But it's not just one-size-fits-all, right?
9:14
Because the standards are the starting point for the audit.
9:18
But should they be applied by complexity, by size, by sector?
9:23
I mean, I guess both of you wouldn't want to be hearing that they're just being applied bluntly and blindly to every company in the same way.
9:32
I mean, Peter, do you want to kick off on that one?
9:33
And then Romana, I think it's useful to think of the auditing standards as a guide towards producing a high quality audit.
9:42
But they're not necessarily a complete guide.
9:45
Because even within, you know, say the audit of a bank or or a retailer, there's going to be subject matter specific considerations that the auditor will need to take into account, which is going to be possible to include that within any sort of standards framework because it would just make the standards even longer than they are at the moment.
10:06
So there's that sort of point really around the practitioners themselves have got to use the auditing standards as a starting point.
10:14
And the fundamental idea within the Isas really is this idea of risk based audit that the auditor needs to sort of be going in there alive to the risks that are specific to a particular entity and then design appropriate responses to those risks during their audit to detect any risks of material misstatement.
10:36
Some of the standards are international standards.
10:38
They're not just UK auditing standards, right?
10:41
All of them are based on the international framework.
10:44
We occasionally make small modifications in the UK to reflect our context, but yeah, they're based on the international standards.
10:50
Then if you're an audit firm, I mean you might be a global audit firm, do you just apply a global approach or do you would auditors kind of depending on their jurisdiction or the country they're operating in, adjust the methodology, adjust how they apply the standards depending on that?
11:06
That's a good question.
11:07
If that does vary by by firm and by network, that the larger firms will often have a global network methodology which is then tailored within jurisdictions in the UK that will be pretty close.
11:18
I would say it's not a very precise term, but pretty close to the international version.
11:22
UK additions are always making things slightly more robust.
11:25
So it'll be slightly more robust, stringent demanding methodology in in the UK than the international baseline, but it's pretty close.
11:31
I'd say we have significant alignment.
11:33
So other jurisdictions there is further divergent there sort of legislative business context can be a bit further removed, which means some extra distance occurs between the international baseline and weather calling that jurisdiction.
11:46
And on the other end, some jurisdictions adopt the international standards word for word so that they have exact international line.
11:52
But Peter, if you're a company and you think all the audits coming around, do you think it should be a kind of, I'm not going to say collaborative process, but a very engaged process with the auditors to really understand what the scope of the audit's going to be because it's not the same scope every year.
12:07
I mean, there probably would be a baseline, but some of these audits would change from year to year depending on what's happening with the company, I guess.
12:15
Absolutely, right.
12:16
And I think that's really part of the real audit process, that one of the things that preparers can do to really expedite the process is to sort of highlight issues and changes in their organisation, which may require the auditor to change their approach from what they might have done previously.
12:34
So when I was in practise, one of the phrases you heard an awful lot of was a sort of no surprises approach from both parts of the audit process.
12:42
That that importance of two way communication to identify things that have changed and set out expectations was a really key path to making sure that the audit process was as smooth as possible.
12:55
We heard Peter talking about professional scepticism and challenge doesn't mean the conversation between the auditor and the preparer has to be kind of quite aggressive or confrontational.
13:07
That's about being challenged and being robust, right?
13:09
I think that's really part of the skill of being a good auditor is maintaining that professional scepticism while maintaining a good working relationship with the auditor.
13:17
Lenski as I said, professional scepticism is is really about sort of curiosity and having an inquiring questioning mind.
13:24
I think is the time used in the auditing standards start looking for contradictory as well as cooperative evidence to support or contradict an assertion made by management.
13:32
But that's not a combative or aggressive process.
13:35
That's just looking for the evidence to support an assertion and critically assessing that information as well.
13:41
Peter, at the end of an audit process, prepare against what's called a management letter.
13:46
Is that just a yes, that's all good tick the box or is it more detailed?
13:50
How does an audit end and what information does the company receive?
13:54
So from the company's perspective, the most important document they will receive is the auditors report, which will be included in their financial statements when they're deposited at company's house or or published online.
14:07
The management letter itself will essentially describe the audit process as well as identify any recommendations that the auditor might have in terms of how the audit process itself could be made better or whether there are particular control deficiencies which could be rectified and cause additional complexities for the audit process itself.
14:29
So that I think is the key sort of aspects of communication that come through at the end of the audit.
14:35
What happens when the management says, no, this is wrong, we're great, Our internal controls framework is perfect.
14:41
We disagree with what you've put in the report.
14:44
I mean, how does that play out?
14:46
Because I guess to Peter's earlier point, there are a lot of stakeholders who are very interested in the confidence and veracity of the report, whether they're going to invest, whether they're going to supply goods to a company, maybe even get employed by a company.
15:01
I mean, that must, I guess, happen probably behind closed doors.
15:05
But what is everyone's role in that situation?
15:09
It's a good question and a very nuanced question, which I think there's no sort of clean answer to that.
15:14
I think disagreements between the finance team and the audiences can occur all through the process.
15:19
What happens next is a bit different depending on when that happens.
15:22
If it's sort of mid audit, there might be disagreement about sort of accounting treatment.
15:26
And that's where it is just discussions and trying to convince the other person of your position is probably a bit to assertive is it's a discussion trying to get to the right answer.
15:35
If the disagreement persists and both sides can't come to an agreement that they're both comfortable with based on that sort of professional standards, then presumably the company will report the number that they want to report.
15:46
And then the auditor will have to say in their orders to report that they do not believe that that's true and fair, that materially misstated and that will inform stakeholders as you said about that disagreement and that can give fair signal.
15:58
So as you say, it's not something that either side really wants to end up in.
16:01
But ultimately, if the auditor has to space on their sort of ethical codes, they have to be fun and be willing to disagree if they don't think it's the right answer.
16:09
You know, what would you say to people who are saying, why are we doing this podcast?
16:12
You know, why do you have to explain all of these?
16:15
And you know, it's been in a very interesting discussion and quite nuanced, as Ramana said, what's the value of this podcast?
16:21
Because maybe people just assume that they know what audits are.
16:24
And I guess what we're trying to do is bring some of these nuances to life.
16:28
But also help people understand some of the basics of an audit.
16:32
I mean, what's your thinking on that?
16:35
Well, I think there's two aspects of that.
16:37
I mean, there's what's always been called the expectation gap in terms of what stakeholders expect out of an audit, and that will include management and what the auditor actually delivers in terms of their professional requirements.
16:50
But I think there's also a risk that people perceive auditors, as you said earlier, a purely box ticking.
16:59
Yeah, that's very true.
17:01
And I think, you know, there is an element to which, you know, if a company needs to have an audit, it is a compliance exercise, but that doesn't necessarily then feed through to how the work is done.
17:11
When people describe audit as a sort of box ticking exercise, I don't think that really is sufficiently reflective of the importance of professional judgement in terms of working out what the appropriate procedures are, the amount of judgement that's often required in coming to a conclusion on often very complex account areas.
17:30
So I think it's really, really important to communicate that point around the art of the audit.
17:36
I suppose if you want to put it in that way that it is not just a simple sort of, you know, deterministic flow chart approach.
17:43
It does require the application of judgement and quite a lot of thoughts and care.
17:48
Ramana, as a backup to these helpful podcasts, we've put together some collateral that's going out at the same time as the podcast and can be found on our website.
17:56
What do you want people to use that for or how do you want them to engage with that question?
18:02
And in many ways I think I'm really just gonna be echoing what Peter has just said because I think understanding the centrality of professional judgement to audit is I would say probably the number one thing.
18:11
We would like people to take away that expectations gap where sometimes the wider public can think the auditors there to for every forward, even if it's only 50 P and that scrutinise everything.
18:22
That isn't the case and it really does come back to professional judgement.
18:24
Professional judgement is required for the auditor to determine how much is enough in terms of evidence.
18:29
Have I reduced the risk of an acceptability level?
18:32
That's a judgement that's not something that can be sort of quantified of, oh, I've reduced the risk to 2.3%.
18:37
It doesn't work for that.
18:38
Judgement is unavoidable and necessary and I think we should be empowering and encouraging auditors to use that judgement because it makes the profession interesting if nothing else.
18:49
Well, thank you both Peter and Ramana for a really interesting discussion.
18:53
And I think I love that expression, closing the expectation gaps and understanding gaps around audit because I think both of you are right, it's either been reduced in some people's mind to the box ticking compliance exercise in other people's minds being a little bit unsure of what they have to do to help a good audit.
19:14
So hoping that this podcast today has been put to listeners in maybe closing those understanding gaps, which perhaps many people don't want to admit that they didn't know all of this.
19:25
So please look out on our website for the collateral material.
19:28
I think it'd be very useful for both preparers and auditors when looking into their next audit plan, whether it's a statutory audit or not.
19:37
Thanks again for listening to another FRC in conversation.