Missing Audit Procedures: Protecting Audit Quality and Financial Reporting
EQC video briefing · Core guide
Audit Quality: Connect Risk, Procedure, Evidence and Conclusion
Strong audit documentation tells one connected story. This video shows how assessed risks should lead to responsive procedures, persuasive evidence and a properly supported conclusion. It highlights the importance of professional judgement, appropriate challenge, timely review and clear working papers so that an independent reviewer can understand the audit trail.
Missing audit procedures can undermine an audit even where the file contains substantial work. A gap between the risks identified, the audit response performed and the conclusion reached may leave a financial-reporting assertion insufficiently addressed. The consequences can include an inappropriate audit conclusion, missed indicators of material misstatement or fraud, and a record that does not allow an experienced auditor to understand the work performed, evidence obtained and significant professional judgments made.
For Hong Kong audit teams, the practical response is a disciplined, risk-based process rather than a generic checklist exercise. High-level HKSA concepts emphasise understanding the entity and its environment, assessing risks of material misstatement, designing responsive procedures and documenting the basis for conclusions. The examples below are general professional education only: teams should apply current authoritative standards, their firm methodology and professional judgment to the facts and circumstances of each engagement.
Key Audit Issues
Risk assessment is not translated into an audit response
A planning memorandum may identify significant transactions, estimates, unusual journal entries or control weaknesses, yet the planned or completed work does not clearly respond to those risks. This disconnect can result in important financial-statement assertions receiving insufficient attention.
Generic procedures do not address the entity's circumstances
Standard programmes can omit the features that drive risk for a particular entity, such as non-routine revenue arrangements, complex valuations, overseas operations, related-party activity or manual processing. Procedures should be tailored to the nature, timing and extent of the assessed risk.
Documentation does not demonstrate the audit trail
A conclusion without a clear link to the relevant risk, population, selection approach, procedures, evidence and evaluation is difficult to review. Incomplete cross-referencing may obscure whether the work supports the conclusion on the relevant HKFRS accounting treatment or disclosure.
Contradictory or incomplete evidence is not resolved
Missing follow-up procedures can allow exceptions, inconsistencies or gaps in evidence to remain unexplained. This may lead the team to place inappropriate reliance on management information, representations or evidence that does not address the assertion being tested.
Review and consultation occur too late
If engagement-quality review, supervisory review or specialist input is obtained only near completion, omitted work may be identified when evidence is harder to obtain. Late remediation can also weaken the clarity of contemporaneous documentation and the credibility of the final audit trail.
Tailored Audit Procedures
Reconcile risks, assertions and planned responses
Map each assessed risk to the affected financial-statement assertions, relevant controls where applicable, and planned substantive or control procedures. Investigate unexplained gaps or duplicated work, and update the plan when the risk assessment changes.
Perform focused preliminary analytics and enquiries
Use information available at planning to identify unexpected trends, relationships or movements, then discuss them with appropriate management personnel and corroborate explanations. The objective is to direct further work to matters that may affect the risk assessment or financial reporting.
Tailor procedures to the source of risk
For each material area, design procedures that address the transaction flow, accounting policy, data source and relevant assertion rather than relying solely on standard wording. Consider whether the balance involves estimation uncertainty, management judgment, unusual terms, cut-off risk or a significant disclosure.
Test management-produced information before relying on it
Where reports, schedules or system extracts form audit evidence, evaluate their relevance and reliability in the context of the intended procedure. This may include understanding how the information was produced, checking key inputs or parameters and considering whether the population is complete and accurate for the audit purpose.
Evaluate exceptions and link work to conclusions
Document exceptions, contradictory evidence and matters requiring further work, together with their effect on the risk assessment, planned procedures and conclusion. Cross-reference the final evaluation to supporting working papers so the basis for significant judgments is clear.
Use technology with disciplined review
Where the firm elects to use audit technology, including Audit Program 4.1 (AP4.1), retain professional responsibility for assessing whether the generated or organised work is relevant to the engagement. Review the tailoring, inputs, evidence and conclusions, and document amendments made in response to the entity's circumstances.
Controls and Evidence to Consider
Risk-to-procedure completion record
Maintain a current record that connects assessed risks and assertions to planned procedures, responsible team members, completion status and reviewer sign-off. This supports prompt identification and resolution of missing responses.
Structured working-paper index and cross-references
Use consistent indexing, naming and cross-referencing to link planning, control understanding, testing, exceptions, financial-statement disclosures and conclusions. A clear file structure makes the audit trail reviewable and helps identify unsupported conclusions.
Evidence reliability and exception log
Keep a record of significant information used as evidence, its source, the procedures undertaken to evaluate its reliability and all unresolved exceptions. The log should show escalation, follow-up and the final evaluation of matters that could affect the audit.
Timely supervisory review and consultation record
Document review points, review notes, their resolution and consultations on complex or contentious matters. Completing these steps before finalisation provides evidence that significant judgments and incomplete procedures received appropriate attention.
Related Reading
Practical compliance support
Turn insight into practical next steps
Speak with EQC about audit quality, quality management, AML / CTF compliance, inspection readiness, technical documentation, or Audit Program 4.1 (AP4.1) workflow support for your practice.