Module 5 Acc 372

Key objective for f/s audit

reliable financial reporting

reminder: internal control in cosos framework

provide reasonable assurance regarding effective and efficient operations, reliable financial reporting, and compliance with laws and regulations.

What is the internal control reporting objective for audits of issuers?

issue an opinion of effectiveness of ic over fr

How does the COSO Integrated Framework help auditors achieve that objective?

benchmark for evaluation

How is Internal Control over Financial Reporting (I/C over F/R) Defined?

a process designed to provide reasonable assurance regarding the reliability of financial reporting & preparation of F/S in accordance with GAAP

key features of ic over fr

Accurate Detailed Records Maintained
Transactions Authorized & Recorded
Unauthorized Use of Assets Detected

purposes of i/c

prevent and detect MM

Physical Security

Prevent assets from being misappropriated (stolen)

Reconciliation

Detect misstatements so they can be corrected (bank accounts)

physical security and reconciliation are examples of which type of activity

overall controls

TYPES OF I/C procedures

overall and it controls

Manual

performed by people to authorize, approve, and review

examples of IT controls

General and application

overall processing environment

Ensure system updates & maintain network security

Specific transaction input, processing & output:

Payroll System - Ensure only actual employees are paid.

overall processing environment and specific transaction input are examples of

types of i/c’s, it system

What are Limitations of Internal Control?

-People design, implement & execute I/C
-Cost-benefit constraints
-Risk of employee collusion
-Management override of I/C

What very important I/C is most affected by cost?

segregation of duties, ‘ARC’

Generally, what specific cause of MM is collusion related to?

MA

What specific cause of MM is mgt. override related to?

FFR

KEY LIMITATIONS of ic

Effective I/C may not prevent or detect/correct MM & I/C effectiveness may change over time.

An auditor would most likely be concerned with internal controls that provide reasonable assurance about the…

Entity’s ability to initiate, authorize, record, process, and report financial data.

Proper segregation of duties reduces the opportunities to allow persons to be in positions both to…

Perpetrate and conceal fraud and error

Engagement Planning & Internal Control: What are Key Steps in the Process?

1.. Obtain understanding of i/c system
2.. evaluate system design and implementation by the key tool: TRANSACTION WALKTHROUGH
3.. preliminary c/r assessment

What are other important benefits of transaction walkthroughs?

understand i/c’s, identify where ics are missing, and places in the system where ics not preventing or detecting and correcting MM

KEY TO RELIANCE of engagement planning and internal controls

Evidence of I/C Effectiveness

examples of obtaining understanding of i/c system

client manuals, narratives, flowcharts

Step 3: preliminary c/r assessment

Do I/Cs look like they could prevent or detect/correct MM? Can the auditor POTENTIALLY rely on I/C?

if Step 3: preliminary c/r assessment is NO…

c/r is at max, no reliance, and do not test

if Step 3: preliminary c/r assessment is yes…

perform a test of controls to obtain evidence of effectiveness and then assess c/r

step 3 Assessed C/R if I/C Ineffective?

high control risk

step 3 Assessed C/R if I/C Effective?

low control risk

Engagement planning steps: Do we always plan scope of substantive procedures

Yes we do, regardless of no or yes. this is key to the audit.

If assessed c/r is high (low d/r)

nature: highest quality

extent: larger sample size

timing: balance sheet date

If assessed c/r is low (high d/r)

nature: less persuasive option to obtain evidence
timing: interim and update on y/e
extent: smaller sample sizes

steps on planning and performing test of controls

1.. MM of concern for an account/assertion
2.. i/c in place to prevent/detect MM?
3. Choose audit procedures and test i/c
4.. results= assess c/r

Which of the following does not describe a test of controls?

Comparing recorded sales to industry benchmarks and historical sales patterns.

Which of the following is true regarding the scope of an auditor’s substantive tests when the level of control risk has been assessed as high?
Increase Perform tests and sample size at an interim date

yes, no

Audit of I/C over F/R Required for Public Companies objective:

express an opinion on effectiveness of i/c over f/r

main question for i/c over f/r

are there material weaknesses in i/c over f/r?

MATERIAL WEAKNESSES

Reasonable possibility that MM in F/S NOT prevented or detected & corrected

What are key indicators of Material Weaknesses?

1.. restatement of f/s
2.. detect of MM
3.. ineffective audit committee

audit of i/c over f/r entry level controls

Control Environment
Controls Over Management Override
Period-end F/R Process

audit of i/c over f/r
Controls over account balances & transactions;
Factors affecting risk of material weakness are

Transaction volume & complexity changes from prior period

what must the auditor consider?

the likelihood I/C will fail & magnitude of potential misstatement.

what are the 3 TYPES OF DEFICIENCIES IN I/C OVER F/R

deficiency, significant deficiency, material weakness

DEFICIENCY

I/C design/operation NOT prevent or detect & correct MM.

SIGNIFICANT DEFICIENCY

Deficiency in I/C important enough to report to Audit Committee.

MATERIAL WEAKNESS

Deficiency in I/C & REASONABLE POSSIBILITY OF MM in F/S.

Compensating i/c

another control that addresses the same risk of MM precisely enough to make up for a missing or failing i/c

if compensating i/c is working

significant deficiency and unqualified opinion

if compensating i/c is NOT working

material weakness and adverse opinion

does material weakness mean that f/s are MM?

NO, does not mean that f/s are MM. it just means there is a possibility that there could be a MM in the f/s, not that there was one

UNQUALIFIED

no material weakness

adverse

material weakness

what level of assurance is expressed?

reasonable assurance

AUDIT REPORT ON I/C OVER F/R INCLUDES:

Definition and limitations of I/C over F/R. Some limitations are:
May not prevent or detect/correct MM.
Effectiveness may change over time.

WHAT IS THE FRAMEWORK FOR AUDITING I/C OVER F/R?

Coso’s framework

Which of the following is an accurate statement about internal control weaknesses?

Material weaknesses are also control deficiencies