Services / 01 — Audit & assurance
Statutory and external audit, review engagements, agreed-upon procedures, donor and project audits, provident fund audits and SOC reporting — from a QCR-rated practice under Audit Oversight Board compliance.
Every audit produces a signed report. The difference between firms is what is underneath it — whether the risks were properly identified, whether the evidence actually supports the conclusion, and whether the file would survive inspection by someone who was not there. Ours has been inspected.
Audit slots are finite and the good dates go early. Tell us your year-end and we will tell you honestly whether we can meet it — before you commit to anything.
Our year-end has passed and we need an audit.
Scope, timeline and fee agreed before fieldwork, with a realistic date rather than an optimistic one.
A donor requires a project audit to their specification.
Donor formats differ from statutory audit in sampling, documentation and reporting. Getting the format wrong is a failed audit even when the numbers are right.
A lender or investor is asking for audited accounts.
An audit performed for a financing decision needs to anticipate the questions that decision will raise.
We want to change auditors.
Professional etiquette requires communication with the outgoing firm, which we handle. The transition is routine.
Our parent company needs group reporting.
Group instructions, materiality allocation and reporting to a component auditor's timetable, in the parent's format.
Our provident fund needs an audit.
Trust-based audits with their own rules on contributions, investments and member records.
This is our first audit and we do not know what to expect.
First audits are usually longer, because the opening position has to be established. We say so at scoping rather than at the deadline.
A customer is asking for a SOC report.
Service organisation reporting — SOC 1 for financial reporting controls, SOC 2 for security and availability.
Led by the Managing Partner, who holds ultimate responsibility for firm quality.
The annual audit required under the Companies Act, for companies of every size classification.
Audits performed to a funder's specification rather than to the statutory format — a distinct discipline.
Where full audit is not required but some level of independent comfort is.
Specific procedures performed and reported factually, without an opinion — useful when the question is narrow.
Trust audits with their own contribution, investment and member-record requirements.
For groups with subsidiaries, branches or joint ventures — in Pakistan or across borders.
Where an audit is required for a defined purpose rather than for general reporting.
Service organisation controls reporting for businesses their customers depend on.
Pakistani companies do not all report under the same standards. Applying the wrong framework is one of the more common — and more expensive — errors we are asked to correct.
| Classification | Financial reporting framework |
|---|---|
| Public interest companies | IFRS as notified in Pakistan, with the additional disclosure requirements of the Companies Act. Audits are also subject to Audit Oversight Board oversight, and the auditor must hold a satisfactory QCR rating. |
| Large-sized companies | IFRS as notified in Pakistan. |
| Medium-sized companies | IFRS for SMEs as notified in Pakistan. |
| Small-sized companies | Accounting and Financial Reporting Standard for Small-Sized Entities (AFRS for SSEs). |
| Not-for-profit organisations | The applicable framework depends on size classification, with additional requirements where donor or regulatory conditions apply. |
A field team spends weeks inside your business. Most of what they learn never reaches you, because the engagement was scoped to produce a report. We scope it to produce both.
The audit opinion tells a third party your statements are fair. The management letter tells you what we found — control weaknesses, process risks, things that will cause trouble next year. We treat it as the point of the engagement rather than an appendix to it.
Effort concentrates where your exposure is greatest rather than being distributed for the appearance of thoroughness. That means more work in some areas than a checklist audit would do, and less in others.
A control failure you hear about in March is a problem you can fix. The same finding at the reporting date is a disclosure. Nothing is saved up for the report.
The judgement worth paying for is formed during fieldwork, by someone senior enough to recognise what matters. A review at the end catches errors; it does not catch insight that was never captured.
Our standard is that an experienced auditor with no prior connection to the engagement could follow the file. That is also the standard a QCR reviewer applies — which is why we apply it whether or not anyone is scheduled to look.
We will decline non-audit work for an audit client where it would create a self-review threat, and we will tell you why. An auditor who will do anything you ask is not much of an auditor.
These are the firm's controls applied to assurance work specifically. The full set, applied to every engagement of any type, is published.
ICAP's Quality Control Review programme exists to monitor compliance with professional standards in the performance of audits.
ICAP's Quality Control Review programme exists to monitor compliance with professional standards in the performance of audits. A satisfactory QCR rating is a requirement for firms auditing listed and economically significant companies.
Muhammad Abbas & Co. holds a Satisfactory QCR rating, and complies with Audit Oversight Board requirements for the audit of public interest companies. What that review actually examined — and how to verify it independently — is published in full.
Satisfactory rating
Institute of Chartered Accountants of Pakistan
It depends on the company's classification under the Companies Act and, in some cases, on requirements imposed by lenders, investors, donors or regulators independently of the statute. Tell us the entity type, size and who is asking, and we will tell you what is actually required — including when the answer is that no audit is needed.
An audit gives reasonable assurance and involves testing evidence supporting the figures. A review gives limited assurance and is based primarily on enquiry and analytical procedures. A review costs less and concludes negatively — that nothing came to our attention suggesting the statements are misstated. Which is appropriate depends on who is relying on it and for what.
Generally no, and you should be cautious of a firm that says yes without qualification. Preparing the records and then auditing them creates a self-review threat under the ICAP Code of Ethics. For public interest entities the prohibition is strict; for other entities it depends on materiality and the safeguards available. We will tell you at the outset which side of that line your situation falls on rather than discovering it later.
It depends on the size of the entity, the state of the records and how quickly information is provided. First audits take longer because the opening position has to be established. We give a realistic timeline at scoping rather than an optimistic one, and we would rather decline than accept a date we cannot meet.
It is the letter setting out control weaknesses and process issues identified during the audit, with recommendations. The audit opinion serves third parties; the management letter serves you. It is the part of the engagement most likely to change how the business runs, and we treat it accordingly.
They are performed to the funder's specification rather than the statutory format, with different sampling, documentation and reporting requirements. Continued funding often depends on the audit being accepted by the donor — which means a technically correct file in the wrong format is a failed audit. We have performed World Bank project audits and audits for donor-funded programmes.
Yes. Foreign branches of state-owned Chinese construction groups are among our longest-standing clients, and we handle the SECP and Board of Investment compliance alongside the audit.
Statutory audit is normally a fixed fee for a defined scope, agreed in writing before fieldwork begins. Where the state of the records means significantly more work than scoped, we tell you before doing it rather than afterwards in an invoice.
Related
Let's work together
A partner will tell you what the audit involves, what it will cost, and whether we can meet your date — honestly, before you commit.