Audit Midterm 2

Internal Control

The method by which an entity’s board & management provide reasonable assurance about achievement for financial reporting, operations, and compliance

Auditors primary focus

Reliability of financial reporting

Management

Who’s responsibility is maintaining adequate internal controls?

Audit Strategy

Auditor’s understanding of client’s internal controls is a major factor in determining?

Control Environment

The “tone at the top” of the organization

Factors that affect the control environment

Integrity & ethical values, commitment to competence, managements philosophy & operating style, participation of those charged with governance, and organizational structure & assignment of authority

5

How many components of internal controls are there?

COSO

Who created the 5 components of internal controls?

Risk assessment

Management must perform a risk assessment by identifying business risks, estimate their significance, assess likelihood of occurrence, and determine actions to manage risks

Information Systems & Communication

An effective accounting system establishes methods & records that will:

1. Identify & record all valid transactions.

2. Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions for financial reporting

3. Measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements.

4. Determine the time period in which transactions occurred to permit recording of transactions in the proper accounting period.

5. Properly present the transactions & related disclosures in the financial statements

Control Activities

Policies & procedures that help ensure management’s directives are carried out

Control Activities

Where the bulk of internal control testing by auditor is done

Monitoring of Controls

Establishes a baseline for control effectiveness, designs & execute monitoring procedures, and assess & report results

Planning an Audit Strategy

Develop an understanding of internal controls by evaluating design of controls and testing the implementation of controls

Substantive Strategy

Set control risk at max, do not rely on internal controls; just obtain an understanding of them

Reasons to use Substantive Strategy

No controls pertain to the assertion, controls are assessed as ineffective, testing the effectiveness of controls is inefficient

Reliance Strategy

Assess control risk below max, plan to rely on internal controls; perform tests of internal controls to assess if they’re operating effectively

Reasons to use Reliance Strategy

If substantive testing is time consuming or client is required to have an audit of internal controls

How to obtain understanding of internal controls

1. Inquiry of management & personnel

2. Inspection of documents & reports

3. Walkthrough

4. Document it

Preventive Controls

Helps prevent misstatements

Detective controls

Identify & correct misstatements that have occurred

Automated Controls

Computer controls

Manual Controls

Are controls performed by humans

Assessing Control Risk

1. Identify specific controls that will be relied upon

2. Perform tests of controls

3. Conclude on the achieved level of control risk

Design Effectiveness

The control is suitably designed to prevent or detect & correct, material misstatements

Operating Effectiveness

Was the control consistently applied throughout the period under audit, as designed

Type #1 Report

Describes the service organization’s controls and assesses whether they are suitably designed to achieve specified internal control objectives

Type #2 Report

Goes further by testing whether the controls provide reasonable assurance that the related control objectives were achieved during the period

Type 2

The type of report that allows the auditor to reduce control risk below the maximum

Limitations of an Entity’s Internal Control

Management Override of Internal Control, Human Errors or Mistakes, Collusion

Management Override of Internal Controls

Management may intentionally circumvent internal control systems in order to fraudulently manipulate financial reports or cover up theft

Human Errors or Mistakes

Humans may make mistakes when performing controls

Collusion

2+ people work together to circumvent the controls

Interim

Testing Before year end

Year End

Testing after year end

CEO & CFO

Who has responsibility regarding internal control over financial reporting

CEO & CFO Signatures

Who signs and takes responsibility for the accuracy & completeness of corporate financial reports

Management’s Responsibility

Accepts responsiblity for establishing and maintaining adequate internal controls, Evaluate effectiveness of ICFR, Support its evaluation with sufficient evidence including documentation, and Report & assert whether ICFR is effective as of fiscal year end

Auditor’s Responsibility

Issue opinion on effectiveness of internal controls as of fiscal year end

Integrated Audit

Perform audit of both Financial statements and Internal controls together

Design deficiencies

Control is improperly designed to prevent, or detect and correct an error

Operating Effectiveness

The control as designed is not operating effectively

Material Weakness

Reasonable possibility a material misstatement would not be prevented or detected & corrected

Significant Deficiency

A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance

Control Deficiency

The design or operating effectiveness of a control does not allow management or employees to prevent, or detect & correct, misstatements on a timely basis

Who material weakness is reported to

Externally, to audit committee, and to management

Who significant deficiency is reported to

Audit committee and management

Who Control Deficiency is reported to

Management

Compensating Controls

If one control fails, the other controls can reduce the magnitude of possible misstatements

Auditor’s Responsibility performing an Audit of Internal Controls

1. Plan the audit of ICFR

2. Identify controls to test using a top-down, risk based approach

3. Test design and operating effectiveness of selected controls

4. Evaluate identified control deficiencies

5. Form an opinion on the effectiveness of ICFR

Bottom-up Approach

Audit every Control

Top-Down, Risk based approach

Audit High level controls

Identify Entity-Level Controls

1. Control Environment

2. Risk Assessment

3. Information & Communication

4. Controls over financial closing & reporting process

5. Monitoring

Likely Sources of Misstatement

Identify Material Accounts & complex areas, identify points in the entity’s processes where a material misstatement could arise, select controls to test

False

If you test the internal controls, you don’t have to do any substantive testing

Magnitude

Large amounts & high volume activity

Indicators of a Material Weakness

Fraud by senior management, ineffective audit committee oversight, restatement of financial statements, identification of a material misstatement by auditors during audit

Remediation

The process of correcting a material weakness in ICFR

True

If the auditor tests the correction in material weakness before the “as of” date, does not have to be material weakness

Unqualified Opinion

Client’s internal controls are designed & operating effectively in all material aspects

Adverse Opinion

Required if a material weakness is identified

Disclaimer

A serious scope limitation requires the auditor to disclaim an opinion

True

Material weakness automatically leads to an adverse opinion

Management Representation Letter

Auditor obtains management representations for F/S audit and ICFR Audit. Must be signed by management

Audit Sampling

Auditor’s can’t test all transactions or control activities

Critical audit assumption

Sample is representative of population

Sampling Risk

Possibility the sample is not representative of the population

Type I Error (Risk of incorrect rejection)

Sample indicates the. control is not operating effectively when, in fact it is operating effectively

Type II Error (Risk of incorrect Acceptance)

The s ample indicates the control is operating effectively when, in fact, it is not

Type II

Which error is the auditor more concerned about?

Confidence Level

Desired level of assurance in results

Tolerable Error

Acceptable defect rate

Expected Error

Historical defect rate

Sample size increases

What happens to sample size if confidence level increases?

Precision Formula

Tolerable error - Expected error

Precision

Cushion/breathing room between the tolerable amount and expected amount of errors

Statistical Sampling

Uses laws of probability to compute efficient sample size, select sample items, and evaluate results

Non-Statistical Sampling

Rely on professional judgement to compute efficient sample size, select sample items, evaluate results

Step 1 of applying sampling to audit of internal controls

Determine test object: evaluate the operating effectiveness of the internal control

Step 2 of applying sampling to audit of internal controls

Define the population characteristics

Sampling unit

One item of the population

Deviation

Departure from adequate performance of the internal control

Step 3 of applying sampling to audit of internal controls

Determine sample size

Tolerable Deviation Rate

The maximum deviation rate from a prescribed control that the auditor is willing to accept & still consider the control effective

Positive correlation

Desired confidence level relationship with sample size

Inverse

Tolerable deviation rate relationship with sample size

Positive

Expected deviation rate relationship with sample size

Step 4 of applying sampling to audit of internal controls

Selecting sample items

Step 5 of applying sampling to audit of internal controls

Perform the audit procedures

False

If there is a voided item you cannot find, you can just replace it with another item

Step 6 of applying sampling to audit of internal controls

Calculate the sample deviation rate & Computer upper deviation rate

Step 7 of applying sampling to audit of internal controls

Draw final conclusions

Haphazard sampling

Sampling items are selected without any conscious bias

Judgemental Sampling

Sampling items are selected based on auditor judgement

Existence and cutoff

What are the first and second main assertions at risk for cash?

Documents used to test cash

Bank reconciliation, Standard Bank Confirmations, Original Bank Statments

Deposit in transit/how to test

cash that has not yet been recorded by the bank. Pull sample from reconciliation & agree to bank statements

Outstanding checks/hot to test

Check that has not been cashed or cleared yet. Pull a sample of checks & wires from bank statement for month after year end

Skimming

Remove cash from company before its entry into accounting system