Auditing and Internal Control Exam Review

Vocabulary practice flashcards covering fundamental auditing principles, internal control concepts, COSO components, and audit testing procedures from the exam review.

Reasonable Assurance and Inherent Limitations

The two foundational concepts that underlie management's design and implementation of a system of internal control.

Audit Program

The document that details the specific audit procedures to be performed for each type of audit test.

COSO Framework

The internal control framework used by most U.S. companies to design, implement, and evaluate their system of internal control.

Substantive Analytical Procedures

An audit test type that evaluates financial information through analysis of relationships among data and is usually the least costly audit test to perform.

Tests of Details of Balances

Audit procedures that focus on ending general ledger balances for balance sheet and income statement accounts, involve physical examination and confirmation, and are typically the most costly to perform.

Documenting Understanding of Internal Control

The process of recording the auditor's comprehension of internal controls, commonly accomplished via narratives, flowcharts, and internal control questionnaires.

Five-Step Control Deficiency Identification Approach

A systematic approach used to identify deficiencies, significant deficiencies, and material weaknesses, which begins with the first step of identifying existing controls.

Risk Assessment Procedures

Procedures performed by the auditor to obtain an understanding of the entity and its environment (including internal controls) in order to assess the risk of material misstatement; they are not considered further audit procedures.

Tests of Controls

Audit procedures directed toward testing the operating effectiveness of controls in support of a reduced assessed control risk.

Compensating Control

A control elsewhere in the system that offsets the absence of a key control, meaning the missing control is no longer considered key or tested via substantive tests.

Communication of Significant Deficiencies and Material Weaknesses

The formal reporting requirement mandating that significant deficiencies and material weaknesses be communicated to those charged with governance in writing.

Separation of Duties

A key control principle requiring that employees who authorize transactions should not have custody of the related assets; inadequate separation is often the biggest internal control challenge faced by smaller companies.

Control Environment

The overarching component of the COSO framework that sets the tone of an organization; without an effective control environment, other internal control components are unlikely to be effective regardless of quality.

Section 404 Internal Control Reporting

The requirement for public companies where both management and financial statement auditors provide an assessment of the effectiveness of internal control over financial reporting.

Key Controls

Controls identified and relied upon by the auditor because they are sufficient to achieve transaction-related audit objectives and promote audit efficiency.

Significant Deficiency

A deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with oversight of financial reporting.

System Walkthrough

Tracing a few transactions through the accounting system to understand its operations and determine whether internal controls have been properly implemented.

Evidence Mix

The combination of the various types of audit tests selected to obtain sufficient appropriate evidence for an audit cycle.

Control Risk Matrix

An audit tool commonly used by auditors to assist in assessing control risk for each transaction-related audit objective.

Occurrence and Existence Direct Relationship

The parallel audit relationship linking the occurrence transaction-related audit objective with the existence balance-related audit objective.

Planned Detection Risk

The risk component in the audit risk model that increases when tests of controls successfully support a reduced assessed level of control risk.

Test Data Approach

An automated audit technique in which auditors process their own test data using the client's IT system and application programs to evaluate control operation.

General Control

An internal control that applies to all parts of an organization's IT system and infrastructure.

Service Center Controls Testing

A professional standard requirement requiring auditors to test the controls of an outside service center if the client's application with that center processes significant financial data.