Accounting Q&A · Auditing · Topic 14

Practise sustainability assurance, AI, cybersecurity and digital evidence. Try each answer before revealing it.

Worked example

A sustainability report claims energy use fell 20%. Reconcile meter records and check sites added or removed. Recalculate and evaluate the disclosure.

Core concepts

1. What should you know about sustainability assurance?

An assurance engagement on sustainability information using suitable criteria.

2. What should you know about iSSA 5000?

The IAASB’s general standard for sustainability assurance engagements, subject to applicability and effective dates.

3. What should you know about limited assurance?

A meaningful assurance level lower than reasonable assurance, with a different nature and extent of work.

4. What should you know about reasonable assurance?

A high assurance level supported by procedures reducing engagement risk to an acceptably low level.

5. What should you know about reporting boundary?

The entities, operations and activities included in a reported metric.

6. What should you know about aI-assisted auditing?

Using AI to support procedures while retaining human review and professional judgement.

7. What should you know about cybersecurity risk?

Risk that systems or data are compromised, affecting the engagement where relevant.

8. What should you know about service organisation?

An external provider whose services may affect relevant controls or information.

9. What should you know about digital evidence provenance?

The origin and handling history of electronic evidence.

10. What should you know about model drift?

A change in model behaviour or accuracy as data or conditions shift.

Case 1

A sustainability report claims energy use fell 20%.

11. Which audit concept is central here?

Sustainability evidence.

12. What is the main objective?

Test whether the comparison uses a consistent boundary and method.

13. What evidence or procedure would you use?

Reconcile meter records and check sites added or removed.

14. What limitation should you consider?

A percentage without a comparable baseline can mislead.

15. What should happen next?

Recalculate and evaluate the disclosure.

Case 2

An AI tool flags transactions as suspicious.

16. Which audit concept is central here?

AI validation.

17. What is the main objective?

Assess whether the flags provide useful evidence for the objective.

18. What evidence or procedure would you use?

Validate inputs and review flagged and unflagged items as appropriate.

19. What limitation should you consider?

A tool output is not proof of misstatement.

20. What should happen next?

Document limitations and corroborate exceptions.

Case 3

A payroll provider suffers a ransomware incident.

21. Which audit concept is central here?

Service organisation and cyber risk.

22. What is the main objective?

Assess effects on payroll completeness and integrity.

23. What evidence or procedure would you use?

Reconcile independent payment and employee records and review incident evidence.

24. What limitation should you consider?

A provider’s assurance report may exclude the incident period.

25. What should happen next?

Adjust procedures and communicate relevant findings.

Professional standards reference. For statutory duties, confirm the rules in the relevant jurisdiction.