The Audit Process
A to Z

ISA Framework & Standards Map ISA 200

The International Standards on Auditing (ISAs) are issued by the International Auditing and Assurance Standards Board (IAASB), a standard-setting body under the International Federation of Accountants (IFAC). In Bangladesh, the Institute of Chartered Accountants of Bangladesh (ICAB) has adopted the Clarified ISAs as Bangladesh Standards on Auditing (BSAs), which are substantively identical.

The ISA Architecture at a Glance

The Audit Process: High-Level Flow

1. Client Acceptance & Continuance ISA 220 ISQM 1

Before accepting any audit engagement, the firm must assess whether it is appropriate to do so. This is both a quality control obligation (ISQM 1) and an ethical requirement (IESBA Code of Ethics). For continuing engagements, this review is repeated annually.

New Client Acceptance Checklist

• Assess independence — identify all partners, staff, and firm financial interests that could create threats
• Assess competence — does the firm have sufficient industry knowledge and resources (e.g., banking sector expertise, IT auditors)?
• Obtain predecessor auditor communication (ISA 510) — inquire about reasons for change, disagreements with management, fraud suspicions
• Conduct KYC/AML checks on directors and beneficial owners
• Assess management integrity — litigation history, press clippings, regulatory sanctions
• Evaluate whether engagement risk (inherent, control, detection) is acceptable
• Obtain engagement partner approval before formally accepting
• Document the acceptance decision in the client acceptance form

Predecessor Auditor Communication (ISA 510)

For initial engagements, the incoming auditor must communicate with the predecessor. In Bangladesh, this is governed by ICAB's Ethical Standards. The predecessor must respond unless legally prohibited. Key areas of inquiry include opening balances, contentious accounting policies, and any concerns about management integrity.

2. Engagement Letter ISA 210

ISA 210 requires the auditor to agree on the terms of the audit engagement with management (or those charged with governance). The engagement letter is the formal written record of this agreement and must be renewed or updated when terms change materially.

Mandatory Contents of an Engagement Letter

• The objective and scope of the audit
• Responsibilities of the auditor (ISA 200)
• Responsibilities of management (for financial statements, internal controls, and providing complete information)
• Identification of the applicable financial reporting framework (IFRS/BFRS/BFRS for SMEs)
• Form and content of any reports to be issued
• Fee basis and billing arrangements
• Basis for resolution of disputes
• Access to records, documents, and personnel
• Limitation of liability (if legally permissible)

3. Overall Audit Strategy ISA 300

The auditor shall establish an overall audit strategy that sets the scope, timing and direction of the audit, and guides the development of the detailed audit plan. ISA 300 requires this to be documented in writing.

Elements of the Overall Audit Strategy

• Characteristics of the engagement — size, complexity, reporting framework, regulatory requirements, use of IT systems, group audit considerations
• Reporting objectives — deadlines, nature of communications required (audit report, management letter, regulatory filings)
• Significant factors — significant risks identified at planning, areas of high inherent risk, areas requiring specialist involvement
• Results of preliminary engagement activities — acceptance/continuance, predecessor communication, prior year findings
• Nature, timing and extent of resources — allocation of partner/manager/senior/junior time, use of experts
• Coordination with internal audit — if the entity has an internal audit function

4. Materiality & Performance Materiality ISA 320

Materiality is fundamental to the audit. Misstatements, including omissions, are considered material if they could reasonably be expected to influence the economic decisions of users of the financial statements. ISA 320 requires the auditor to determine materiality for the financial statements as a whole, and if applicable, materiality levels for particular classes of transactions, balances, or disclosures.

Determining Materiality — Common Benchmarks

Performance Materiality

Performance materiality is set at an amount less than overall materiality (typically 50%–75%) to reduce to an appropriately low level the probability that aggregate uncorrected and undetected misstatements exceed overall materiality. It drives sample sizes and the extent of testing.

5. Risk Assessment — Understanding the Entity ISA 315

ISA 315 (Revised 2019) requires the auditor to identify and assess the risks of material misstatement through understanding the entity and its environment, including the entity's internal control. This is the cornerstone of a risk-based audit approach.

The Five Components of Understanding (ISA 315.19)

• The entity and its environment — industry, regulatory environment, nature of operations, ownership structure, financing
• The applicable financial reporting framework — BFRS, Bangladesh Bank Master Circulars, BSEC rules
• The entity's system of internal control — control environment, risk assessment process, information systems, control activities, monitoring
• The entity's accounting policies — appropriateness, consistency, judgement-heavy areas
• Entity's objectives and strategies — business risks that may result in material misstatement

Inherent Risk Factors (ISA 315 Revised)

ISA 315 (Revised 2019) introduced the concept of inherent risk factors — qualitative characteristics that affect the susceptibility of an assertion to misstatement:

• Complexity — complex financial instruments, group structures, multi-currency operations
• Subjectivity — fair value estimates, expected credit losses (ECL), warranty provisions
• Change — new accounting standards, new business lines, management changes
• Uncertainty — litigation outcomes, going concern doubts, contingent liabilities
• Susceptibility to misappropriation — cash handling, inventory, payroll

Risk Assessment Procedures

• Inquiries of management, internal audit, legal counsel, and other relevant personnel
• Analytical procedures (trend analysis, ratio analysis, peer comparison)
• Observation and inspection (factory visits, document review, board minutes)
• Review of prior year audit file and management letter
• Review of interim financial information, budgets, and management accounts
• Review of regulatory reports (Bangladesh Bank inspection reports, BSEC filing, etc.)
• IT general controls walkthrough (if entity relies on IT systems)

The Risk of Material Misstatement (RMM)

RMM = Inherent Risk (IR) × Control Risk (CR). The auditor uses this to determine Detection Risk and, consequently, the nature, timing, and extent of substantive procedures.

Documents to Collect During Risk Assessment

• Memorandum and Articles of Association / Certificate of Incorporation
• Latest audited financial statements (prior 3 years)
• Board meeting minutes (all meetings during the year)
• Audit Committee meeting minutes
• Management accounts / Monthly MIS reports
• Organisation chart and staff list
• Approved budgets vs. actual reports
• Regulatory inspection reports (Bangladesh Bank, BSEC, IDRA, etc.)
• List of related parties signed by management
• Legal correspondence file / Pending litigation list
• Chart of accounts / Accounting policies manual
• IT system documentation / User access control policy
• Internal audit reports and management responses
• Significant contracts (loan agreements, lease agreements, major supply contracts)
• Insurance policies schedule

6. Fraud Risk Assessment ISA 240

ISA 240 requires the auditor to maintain an attitude of professional skepticism and identify and assess the risks of material misstatement due to fraud. Two types of fraud are relevant: fraudulent financial reporting and misappropriation of assets.

Fraud Risk Factors (The Fraud Triangle)

• Incentive/Pressure — management under pressure to meet earnings targets, excessive bonuses tied to results, financial distress
• Opportunity — weak internal controls, dominant management, ineffective oversight by those charged with governance
• Rationalisation/Attitude — management disregard for controls, history of violations, poor ethical culture

Mandatory Procedures Under ISA 240

• Team discussion — the engagement team must hold a mandatory fraud brainstorming discussion, where and how could fraud occur in this entity?
• Management inquiries — inquire of management about known or suspected fraud, and about its fraud risk assessment process
• Presume revenue recognition is a fraud risk — this is a rebuttable presumption; must document basis if rebutted
• Management override of controls — always a significant risk; test journal entries, accounting estimates, and unusual transactions
• Journal entry testing — select unusual/late journal entries; trace to supporting documentation

7. Detailed Audit Plan ISA 300 ISA 330

The detailed audit plan translates the overall audit strategy into specific procedures for each assertion and each financial statement area. It documents the nature, timing, and extent of planned audit procedures, including both tests of controls and substantive procedures.

The Five Financial Statement Assertions

8. Internal Controls Testing ISA 315 ISA 330

When the auditor intends to rely on controls (i.e., reduce the extent of substantive testing based on the expectation that controls are effective), tests of controls must be performed. This is particularly important in banking and large-entity audits where IT-dependent controls are pervasive.

The COSO Framework — Five Components of Internal Control

• Control Environment — tone at the top, ethics, governance, competence, accountability
• Risk Assessment — entity's own process to identify and respond to business risks
• Control Activities — authorisation, reconciliations, segregation of duties, IT controls, physical safeguards
• Information & Communication — quality of financial reporting systems, management information
• Monitoring — internal audit, management review of KPIs, exception reporting

Types of Tests of Controls

• Inquiry — ask the control owner how the control works; least reliable on its own
• Observation — watch the control being performed (e.g., observe cash counting procedures)
• Inspection — examine documents that provide evidence the control operated (e.g., approved payment vouchers, system access logs)
• Re-performance — independently perform the control procedure (e.g., re-perform bank reconciliation)

IT General Controls (ITGCs)

• Access controls — user authentication, privilege management, segregation of duties in IT
• Change management — procedures for authorising, testing, and implementing system changes
• Computer operations — job scheduling, data backup, disaster recovery
• Program development — SDLC controls for new system development

Reporting Control Deficiencies (ISA 265)

The auditor must communicate significant deficiencies in internal control in writing to those charged with governance (the audit committee / board). A significant deficiency is one that is of sufficient importance to merit attention. This is typically done through the Management Letter.

9. Substantive Procedures ISA 330 ISA 500

Substantive procedures are audit procedures designed to detect material misstatements at the assertion level. They comprise tests of details (examining individual transactions, balances, or disclosures) and substantive analytical procedures.

Key Substantive Procedures by Area

Revenue & Receivables

• Trace revenue transactions to supporting documents (invoice, dispatch note, delivery confirmation)
• Test cut-off — review transactions 10 days before and after year-end; ensure goods delivered = revenue recognised
• Perform debtors' circularisation (external confirmation per ISA 505)
• Review credit notes issued after year-end (may indicate overstatement)
• Analytical procedures — gross margin by product/segment vs. prior year and budget
• Test journal entries posting revenue (especially manual adjustments at year-end)

Inventory

• Attend physical inventory count (ISA 501) — test count accuracy, identify slow-moving items, review condition
• Test valuation — confirm cost (lower of cost / NRV); obtain NRV evidence (selling price lists, post-year sales)
• Trace count sheets to inventory listing; reconcile to ledger
• Review aged inventory report — assess obsolescence provision adequacy
• Test cut-off at physical count date

Bank & Cash

• Obtain bank confirmation letters from all banks (ISA 505) — balances, loans, securities pledged
• Review and test bank reconciliations at year-end
• Vouch outstanding cheques and deposits in transit to subsequent clearance
• Review intercompany/interbank transfers around year-end (kiting risk)
• For large cash balances: surprise cash count

Loans & Advances (Banking Entities)

• Obtain loan schedule; agree to general ledger
• Select sample of large loans; review credit files, security documentation, repayment history
• Confirm classification against Bangladesh Bank BRPD Circular No. 14 criteria
• Test adequacy of provisioning — specific and general provisions
• Review LFAT (Large Loan Funded) returns to Bangladesh Bank for consistency
• Obtain legal confirmations for loans under litigation

Property, Plant & Equipment (PPE)

• Agree opening balances to prior year audited accounts
• Vouch additions (purchase invoices, contractor bills, capitalisation policy compliance)
• Test disposals (approval, proceeds received, gain/loss calculation)
• Physically verify a sample of assets (existence and condition)
• Test depreciation calculation for a sample (rate, method, consistency)
• Review impairment indicators (IAS 36)
• For revaluations: assess qualifications and independence of valuer; review valuation report

Provisions & Contingent Liabilities

• Obtain schedule of all provisions; agree to ledger
• For each major provision, assess whether IAS 37 recognition criteria are met
• Obtain legal confirmation letter from entity's legal counsel (ISA 501)
• Review correspondence files for unrecorded claims
• Review post-year board minutes for subsequent events affecting provisions
• Review adequacy — compare to historical experience

10. Audit Sampling ISA 530

Audit sampling involves applying audit procedures to less than 100% of a population such that all sampling units have a chance of selection, allowing the auditor to project results to the entire population. ISA 530 does not mandate specific sample sizes but requires the sample to be sufficient to provide a reasonable basis for conclusions.

Sampling Approaches

Factors Affecting Sample Size

• Higher desired confidence → larger sample
• Higher tolerable misstatement / tolerable deviation rate → smaller sample
• Higher expected error rate → larger sample
• Larger population → marginally larger sample (for statistical sampling)
• Results of prior year testing (if significant errors found, increase sample)

11. Analytical Procedures ISA 520

Analytical procedures involve evaluating financial information through analysis of plausible relationships among financial and non-financial data. They are used at three stages: planning (as risk assessment procedures), fieldwork (as substantive procedures for lower-risk areas), and completion (overall review).

Types of Analytical Procedures

• Trend analysis — compare current year to prior years (5-year trend)
• Ratio analysis — gross margin %, current ratio, debt-equity, days receivable, days payable
• Cross-sectional analysis — compare to industry peers / sector benchmarks
• Reasonableness tests — develop an independent expectation (e.g., payroll: headcount × average salary)
• Regression analysis — statistical relationship between variables (advanced)

12. Going Concern ISA 570

Management is responsible for assessing the entity's ability to continue as a going concern. The auditor is responsible for assessing whether management's use of the going concern assumption is appropriate, and whether there are material uncertainties that need to be disclosed.

Going Concern Indicators

Financial Indicators

• Net current liability position (working capital deficit)
• Net liability position (negative equity)
• Recurring operating losses
• Significant deterioration in key financial ratios
• Loan covenants in breach or near breach
• Substantial operating cash outflows
• Arrears in dividends, debt service, or tax payments

Operational & Other Indicators

• Loss of key customers or suppliers without replacement
• Regulatory actions (licence suspension, heavy fines)
• Uninsured catastrophic events (fire, flood)
• Loss of key management with no succession plan
• Fundamental change in technology making product obsolete

Audit Procedures for Going Concern

• Review management's going concern assessment and supporting cash flow forecasts
• Evaluate reasonableness of assumptions in forecasts
• Check whether forecasts extend at least 12 months from the reporting date
• Review loan agreements for covenant compliance
• Obtain letters of support from parent/controlling shareholder (if applicable)
• Review post-year events for evidence about going concern
• Inquire of legal counsel about litigation and regulatory matters

13. Related Party Transactions ISA 550

Related party transactions carry inherent risk because they may not be at arm's length, may conceal conflicts of interest, and may be used for fraudulent financial reporting (e.g., fictitious revenue from a related entity). ISA 550 requires the auditor to be particularly alert to fraud risk in this area.

Audit Procedures for Related Parties

• Obtain a complete list of related parties from management (signed) at the start of the audit
• Review board minutes, shareholder registers, corporate governance disclosures for related party relationships
• Search the general ledger for transactions with entities on the related party list
• For significant transactions, obtain evidence of arm's length pricing (transfer pricing documentation, market comparisons)
• Obtain external confirmation of related party loan balances
• Review whether disclosures in the financial statements comply with IAS 24
• Be alert to undisclosed related parties — compare supplier/customer addresses to director residential addresses, review interbank transfers

14. Subsequent Events ISA 560

Subsequent events are events that occur between the financial statement date and the date of the auditor's report. ISA 560 distinguishes between adjusting events (which must be reflected in the financial statements) and non-adjusting events (which require disclosure if material).

Audit Procedures for Subsequent Events

• Read post-year board minutes and audit committee minutes
• Review management accounts / interim financial statements after year-end
• Inquire of management about subsequent events (using a standard inquiry list)
• Review correspondence files and major contracts entered into after year-end
• Review post-year legal correspondence for new claims or regulatory actions
• Review post-year debt facility changes (new borrowings, covenant waivers)
• Verify that major customers or suppliers have not failed after year-end

15. Written Representations ISA 580

Written representations are a form of audit evidence. ISA 580 requires the auditor to obtain written representations from management — and where appropriate, those charged with governance — about their responsibilities and specific matters relevant to the audit.

Mandatory Representations

• Management has fulfilled its responsibility for preparing the financial statements
• All information provided to the auditor has been complete and accurate
• All known or suspected fraud has been disclosed to the auditor
• All known instances of non-compliance with laws and regulations have been disclosed
• Completeness of related party disclosures
• Subsequent events inquiry confirmation
• Going concern assessment
• Accounting estimates — basis and appropriateness of key judgements

16. Using Experts & Service Organisations ISA 620 ISA 402

The auditor may use the work of an expert (ISA 620) when a specialist area requires expertise beyond the auditor's own competence — such as property valuation, actuarial calculations, environmental assessments, or forensic investigations. ISA 402 deals with entities that use service organisations (e.g., payroll processors, IT service providers).

When to Use an Expert

• Property, plant and equipment revaluation (requires registered valuer)
• Defined benefit pension obligation — actuarial valuation (IAS 19)
• Expected Credit Loss models — statistical/financial modelling (BFRS 9)
• Environmental provisions — environmental engineer
• Legal matters — legal specialist opinion
• IT systems and cybersecurity — IT auditor or IS specialist
• Complex financial instruments — derivative valuation specialist

Evaluating the Expert's Work

• Assess competence and independence of the expert
• Agree the scope of work, methodology, and assumptions to be used
• Evaluate whether the expert's work addresses the specific audit objective
• Review the reasonableness of assumptions and methods used
• Assess the relevance and reasonableness of findings in relation to other audit evidence

17. Evaluating Misstatements ISA 450

Throughout the audit, the auditor accumulates identified misstatements (both factual misstatements and judgmental misstatements). ISA 450 requires the auditor to evaluate whether uncorrected misstatements are material, individually or in aggregate.

Classification of Misstatements

• Factual misstatements — about which there is no doubt (e.g., arithmetic error, wrong amount posted)
• Judgemental misstatements — differences arising from judgements about accounting estimates or selections of accounting policies that the auditor considers unreasonable
• Projected misstatements — the auditor's best estimate of misstatements in the population, projected from a sample (e.g., error rate × population value)

The Misstatement Schedule

All identified misstatements above the trivial threshold are accumulated in a summary schedule (often called the "Summary of Audit Differences" or "Schedule of Unadjusted Differences"). This is reviewed at completion to determine whether, in aggregate, they are material.

18. Engagement Quality Control Review (EQCR) ISA 220 ISQM 1

For listed entity audits and other audits where deemed necessary by firm policy or professional requirements, an Engagement Quality Control Review (EQCR) is required before the auditor's report is issued. The EQCR is performed by a senior, independent partner who was not involved in the audit.

What the EQCR Partner Reviews

• Significant judgements made by the engagement team and the conclusions reached
• The appropriateness of planned responses to significant risks
• Whether the financial statements are in accordance with the applicable financial reporting framework
• Whether the draft auditor's report is appropriate
• Whether significant matters communicated to management and TCWG are appropriate
• Whether independence requirements have been satisfied
• The engagement team's assessment of fraud risks and responses

The auditor's report must not be dated until the EQCR partner has completed the review and is satisfied with the engagement team's judgements.

19. Forming the Audit Opinion ISA 700 ISA 705

Based on all audit evidence obtained, the auditor forms an opinion on whether the financial statements present fairly, in all material respects, in accordance with the applicable financial reporting framework. ISA 705 deals with modifications to this opinion.

The Decision Tree for Audit Opinion

Key Management Assertions at Completion

• Has sufficient appropriate audit evidence been obtained for all material areas?
• Have all identified misstatements been appropriately evaluated?
• Have significant risks received appropriate audit responses?
• Are accounting policies appropriate and consistently applied?
• Are disclosures adequate, complete, and understandable?
• Is the going concern assumption appropriate?
• Are there any matters requiring an Emphasis of Matter or Other Matter paragraph?
• Have KAMs (Key Audit Matters — listed entities) been identified and documented?

20. The Auditor's Report ISA 700 ISA 701

ISA 700 (Revised) prescribes the form and content of the auditor's report. The Revised ISA 700, effective for audits of periods ending on or after 15 December 2016, introduced significant enhancements to transparency, including the requirement for Key Audit Matters for listed entities.

Required Elements of the Auditor's Report (ISA 700)

• Title — "Independent Auditor's Report"
• Addressee — shareholders, board, or as required by law
• Audit Opinion — appears first; includes identification of entity, FY, financial statements audited, and financial reporting framework
• Basis for Opinion — conducted per ISAs; independence confirmed; sufficient appropriate evidence obtained
• Key Audit Matters (listed entities) — ISA 701; matters of most significance to the audit
• Going Concern — Material Uncertainty paragraph (ISA 570) if applicable
• Other Information — responsibilities for annual report / directors' report (ISA 720)
• Responsibilities of Management — for the financial statements and internal control
• Auditor's Responsibilities — for expressing an opinion; description of audit
• Other Reporting Responsibilities — Companies Act, regulatory requirements
• Engagement partner name — required for listed entity audits
• Auditor's signature and address
• Date of auditor's report

Modified Opinions — Key Phrases

21. Working Papers & Documentation ISA 230

ISA 230 requires the auditor to prepare documentation that enables an experienced auditor with no prior connection to the engagement to understand the nature, timing, and extent of procedures performed, the results and evidence obtained, and the significant professional judgements made.

Audit File Structure

Documentation Requirements

• Every working paper must show: client name, year end, WP reference, preparer, date prepared, reviewer, date reviewed
• Conclusions must be clearly stated — "Based on the procedures performed, we are satisfied that…"
• Each WP must cross-reference to the audit plan and to corroborating evidence
• Lead schedules must reconcile to the trial balance / financial statements
• The audit file must be assembled within 60 days of the auditor's report date (ISQM 1)
• Retention period: minimum 7 years from the date of the auditor's report (ISQM 1; Bangladesh requirement per ICAB)

22. Specimen Documents — Master Index

The following documents should be collected, prepared, or obtained during the course of a standard statutory audit. This serves as a practical checklist for audit managers and engagement partners.

Documents to Collect from the Client

Documents Prepared by the Auditor

References & Standards

IAASB — International Standards on Auditing (Primary Source)

• ISA 200 — Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with ISAs
• ISA 210 — Agreeing the Terms of Audit Engagements
• ISA 220 (Revised) — Quality Management for an Audit of Financial Statements (effective 15 Dec 2022)
• ISA 230 — Audit Documentation
• ISA 240 — The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements
• ISA 260 (Revised) — Communication with Those Charged with Governance
• ISA 265 — Communicating Deficiencies in Internal Control to Those Charged with Governance and Management
• ISA 300 — Planning an Audit of Financial Statements
• ISA 315 (Revised 2019) — Identifying and Assessing the Risks of Material Misstatement
• ISA 320 — Materiality in Planning and Performing an Audit
• ISA 330 — The Auditor's Responses to Assessed Risks
• ISA 402 — Audit Considerations Relating to an Entity Using a Service Organisation
• ISA 450 — Evaluation of Misstatements Identified during the Audit
• ISA 500 — Audit Evidence
• ISA 501 — Audit Evidence — Specific Considerations for Selected Items
• ISA 505 — External Confirmations
• ISA 510 — Initial Audit Engagements — Opening Balances
• ISA 520 — Analytical Procedures
• ISA 530 — Audit Sampling
• ISA 540 (Revised) — Auditing Accounting Estimates and Related Disclosures
• ISA 550 — Related Parties
• ISA 560 — Subsequent Events
• ISA 570 (Revised) — Going Concern
• ISA 580 — Written Representations
• ISA 600 (Revised) — Special Considerations — Audits of Group Financial Statements
• ISA 610 (Revised) — Using the Work of Internal Auditors
• ISA 620 — Using the Work of an Auditor's Expert
• ISA 700 (Revised) — Forming an Opinion and Reporting on Financial Statements
• ISA 701 — Communicating Key Audit Matters in the Independent Auditor's Report
• ISA 705 (Revised) — Modifications to the Opinion in the Independent Auditor's Report
• ISA 706 (Revised) — Emphasis of Matter Paragraphs and Other Matter Paragraphs
• ISA 720 (Revised) — The Auditor's Responsibilities Relating to Other Information

Quality Management Standards

• ISQM 1 — Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements (effective 15 Dec 2022)
• ISQM 2 — Engagement Quality Reviews

Ethics

• IESBA Code of Ethics for Professional Accountants (2023 edition) — particularly Sections 300–399 (Independence for Audit & Review) and Section 510 (Financial Interests)
• ICAB Code of Professional Conduct and Ethics — substantively based on IESBA Code

Bangladesh-Specific References

• Bangladesh Standards on Auditing (BSAs) — issued by ICAB; based on IAASB ISAs
• Bangladesh Financial Reporting Standards (BFRSs) — adopted by ICAB; based on IFRSs
• Companies Act, 1994 (Bangladesh) — Section 213 et seq. (Audit Requirements)
• Bangladesh Bank BRPD Circular No. 14/2012 — Loan Classification and Provisioning
• BSEC Rules, 2018 — Audit committee, auditor independence for listed companies
• Financial Reporting Act, 2015 — Establishment of AFRAR (now FRC Bangladesh); oversight of audit profession

Further Reading & Reference Books

• IAASB Handbook of International Quality Control, Auditing, Review, Other Assurance, and Related Services Pronouncements (current edition) — iaasb.org
• Arens, Elder, Beasley & Hogan — Auditing and Assurance Services: An Integrated Approach (17th ed., Pearson)
• Whittington & Pany — Principles of Auditing
• ICAEW — Audit and Assurance Study Manual (ACA)
• ICAB — Advanced Audit and Assurance (CA Professional Level)
• KPMG — Insights into IFRS (for financial reporting framework reference)
• PCAOB Standards — pcaobus.org (useful for comparison with ISA requirements)