Audit Exam 3 - Bryan

Ensure assets are safeguarded

Promote Reliable Financial Reporting

What do controls do? (2)

Obtain an understanding of internal controls

Assess control risk using risk assessment procedures

Auditor has the responsibility to:

Control Environment

Risk

Information and Communication

Monitoring

Existing (Controls)

Components of Internal Controls (CRIME)

Control Environment

The tone at the top relates to which aspect of internal controls

False

True or False: COSO is a set of rules that every publicly traded entity must follow

Ethics

Board Independence (Oversight)

Organizational Structure (Segregation of Duties)

Competence (Employees)

Accountability

What are the principles of the control environment in the COSO Framework?

Specify Objectives (Identify)

Assess Changes

Fraud Potential Consideration

Risk Analysis (Management)

What are the principles of Client’s Risk Assessment in the COSO Framework

• Obtain and use information

  • FACT

• Internally communicate information

• External Party Communication

What are the components of Information and Communication

Separate

Ongoing Evaluations

Deficiency Communications

What are the important aspects of the Monitoring section of the COSO Framework

Control Activities

Technology Controls

Policies and Procedures Deployment

What are the main points of Existing Controls section of the COSO Framework

Do they prevent, detect, and correct material misstatemetns

What are the three questions we ask regarding existing controls?

Completeness

Accuracy

Validity

Restricted Access

What are the objectives of the Existing Control Activities part of the COSO Framework

Authority

Control

Recording

What are the aspects of Separation of Duties

Enables personnel to understand internal control responsibilities

What does information and communication do?

Monitoring Activities

Ongoing, separate, or combined evaluations to determine if the principles of each component are present and functioning

True

True or False: If control risk is high the audit firm will use a non-reliance strategy

Procedure Manuals and Org Charts

Internal Control Questionnaires

Flowcharts

Narrative Descriptions

What are some ways one could document the understanding of internal controls in a client

Management Override

Human Error

Collusion

What are the limitations of an entity’s internal controls

Inquiry

Inspection of Documents

Observation of the application of the control

Reperformance

What are the 4 tests of controls a firm could perform

Description of the controls. (SOC Report)

What is a Type 1 Report

Opinion on the effectiveness of controls

What is a Type 2 Report

Control Deficiency

Internal Control Deficiencies

• Not Material

• Not Significant

• Can still give unqualified opinion

• Will still report to management

Significant Deficiency

Internal Control Deficiencies

• Not Material

• Significant

• Reported to Management and Board

• Still Results in Unqualified Opinion

Material Weakness

Internal Control Deficiencies

• Significant

• Material

• Results in Adverse Opinion

• Report to management, board, and everyone else

General Controls

Application Controls

What are the types of IT Controls

Management’s Responsibilities under 404

Evaluate the effectiveness of ICFR using a suitable control criterion

Support the evaluation with sufficient evidence

Present a written report as of the end of the fiscal year

prevent, detect, and correct

Effectiveness of Controls relates to the controls abilities to _______, ______, and ______ material misstatements

Internal Controls over Financial Reporting (ICFR)

• Maintenance of records that accurately and fairly reflect the transactions and dispositions of the assets of the company

• Reasonable assurance that transactions are properly authorized and recorded in accordance with GAAP

• Reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets

Control Environment

EBOCA is associated with which aspect of COSO

Risk Assesment

SAFR is associated with which aspect of COSO

Information and Communication

OIE is associated with which aspect of COSO

Monitoring

SOD is associated with which aspect of COSO

Existing Controls Activities

CATP is associated with which aspect of COSO

Ethics

Board Independence

Organizational Structure

Competence

Accountability

What does EBOCA stand for

Specify Objectives

Assess Changes

Fraud Potential Consideration

Risk Analysis

What does SAFR stand for

Obtain and Use Information

Internally Communicate Information

External Party Communication

What does OIE stand for

Separate

Ongoing Evaluations

Deficiency Communication

What does SOD stand for regarding Monitoring Activities

Control Activities

Technology Controls

Policies and Procedures Deployment

What does CATP stand for

Control Environment

Risk Assessment

Information and Communication

Monitoring

Existing (Controls) Activities

What does CRIME stand for

Special Consideration on using the work of others

Evaluate the nature of the controls subjected to the work of others

Evaluate competence and objectivity of those who performed the work

Test some of the work performed by others

Reasonable Assurance

The basic concept of internal control that recognizes the cost of internal control should not exceed the benefits expected to be derived is known as

Assess Control Risk

Test of Controls

Reassess Control Risk

Determine Extent of Substantive Testing.

What is the correct sequence of audit steps that come after first obtaining an understanding and documenting the entity's internal control?

Material Weaknesses and Significant Deficiencies

The auditor must report the following to the audit committee or others charged with governance:

General Controls

broad, foundational policies and procedures that apply across an organization's entire IT environment

Application Controls

specific to individual applications and focus on ensuring the accuracy and security of data within those applications

deficiency in operation.

A control deviation caused by an employee performing a control procedure that he or she is not authorized to perform is always considered a:

Entity-Level Controls

overarching policies and procedures designed to ensure that management directives are implemented and enforced across an entire organization, impacting the overall control environment and risk management

Understanding of the System

An auditor’s flowchart of an entity’s accounting system is a diagrammatic representation that depicts the auditor’s:

Substantive (Tests/Testing)

The following are tested during what kind of tests

• Existence/Occurrence

• Valuation/Allocation

• Rights & Obligations

• Completeness

• Accuracy

• Cutoff

• Classification & Presentation