Audit C6 Quiz

Purpose of an audit (ASB principle)

To express an opinion on financial statements prepared by management, who is responsible for preparing them and giving the auditor the information needed for the audit

ASB principle: Responsibilities

Have competence and capability; comply with ethical requirements; maintain professional skepticism; exercise professional judgment

ASB principle: Performance

Obtain sufficient appropriate audit evidence supporting reasonable (not absolute) assurance that the financial statements are free of material misstatement

ASB principle: Reporting

Express an opinion in a written report based on evaluation of the audit evidence, or state that an opinion cannot be expressed

GAAS Performance: key elements

Planning and supervision; materiality considered throughout; risk assessment (understand entity and environment, including internal control); determine necessary effectiveness of substantive tests; sufficient appropriate evidence

Sufficient audit evidence refers to…

Quantity

Appropriate audit evidence refers to…

Quality

Management's responsibility for internal control

Design and maintain controls that give reasonable assurance that assets and records are safeguarded and the information system generates reliable information for decision making

Auditor uses risk assessment procedures to (4)

Understand the entity's internal control; identify key controls; recognize types of potential misstatements; design tests of controls and substantive procedures

Auditor's two responsibilities for internal control

1) Obtain an understanding of internal control; 2) Assess control risk

The auditor's understanding of internal control is a major factor in determining…

The overall audit strategy

COSO internal control definition

A system designed and carried out by the board, management, and other personnel to provide reasonable assurance about achieving the entity's objectives

COSO's three objective categories

1) Reliability, timeliness, and transparency of financial and nonfinancial reporting; 2) Effectiveness and efficiency of operations; 3) Compliance with laws and regulations

Five components of internal control (COSO)

Control environment; risk assessment; control activities; information and communication; monitoring of controls

Control environment (definition)

The standards, processes, and structures that are the basis for carrying out internal control across the organization; the board and senior management set the "tone at the top"

Control Environment Principle 1

The organization demonstrates a commitment to integrity and ethical values

Control Environment Principle 2

The board demonstrates independence from management and exercises oversight of the development and performance of internal control

Control Environment Principle 3

Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities

Control Environment Principle 4

The organization demonstrates a commitment to attract, develop, and retain competent individuals

Control Environment Principle 5

The organization holds individuals accountable for their internal control responsibilities

Entity's risk assessment process (definition)

A dynamic, iterative process for identifying and analyzing risks to achieving objectives, forming the basis for how risks should be managed; management considers changes in the external environment and its own business model

Risk Assessment Principle 6

The organization specifies objectives with sufficient clarity to enable identification and assessment of risks

Risk Assessment Principle 7

The organization identifies risks across the entity and analyzes them as a basis for determining how they should be managed

Risk Assessment Principle 8

The organization considers the potential for fraud in assessing risks

Risk Assessment Principle 9

The organization identifies and assesses changes that could significantly impact the system of internal control

Control activities (definition)

Actions established by policies and procedures to ensure management directives to mitigate risks are carried out; performed at all levels, at various stages within business processes, and over the technology environment

Control Activities Principle 10

The organization selects and develops control activities that mitigate risks to acceptable levels

Four types of control activities

Performance reviews; physical controls; segregation of duties; information processing controls

Control Activities Principle 11

The organization selects and develops general control activities over technology

Control Activities Principle 12

The organization deploys control activities through policies (what is expected) and procedures (that put policies into action)

Purpose of segregation of duties

To minimize the chance of fraud or theft

Four functions to separate for adequate segregation of duties

Authorization of transactions; recording of transactions; custody of assets; periodic reconciliation

Information and communication (definition)

Information needed to carry out internal control responsibilities; communication occurs internally and externally and allows upward flow of operating information to management

Information and Communication Principle 13

The organization obtains or generates and uses relevant, quality information to support the functioning of internal control

Five transaction objectives under Principle 13

Identify and record all valid transactions; classify properly; measure value properly; record in the proper period; properly present transactions and disclosures

Information and Communication Principle 14

The organization internally communicates information, including objectives and responsibilities for internal control

Information and Communication Principle 15

The organization communicates with external parties regarding matters affecting the functioning of internal control

Monitoring of controls (definition)

A process that assesses the quality of internal control performance over time, using ongoing evaluations, separate evaluations, or both

Monitoring Principle 16

The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning

Monitoring Principle 17

The organization evaluates and communicates internal control deficiencies in a timely manner to those responsible for corrective action, including senior management and the board

Auditor's understanding of internal control is used to (3)

Identify types of potential misstatement; pinpoint controls meant to mitigate the risk of material misstatement; design tests of controls and substantive procedures to reduce misstatement risk to an acceptably low level

Factors for deciding whether an IT specialist is needed

Complexity of IT systems and controls; significance of system changes or new systems; extent data are shared among systems; e-commerce participation; emerging technologies (blockchain, robotics, AI); significance of audit evidence available only electronically

Ways the auditor gains an understanding of internal control

Read prior-year documentation; talk with the client about changes; interview personnel; interview/review internal audit; observe procedures; read policy and procedure manuals; inspect documents; use an internal control questionnaire; perform a walkthrough

Walkthrough

Tracing transactions through the information system process relevant to financial reporting

Four ways to document the understanding of internal control

Procedures manuals and organizational charts; flowcharts; internal control questionnaires; narrative descriptions

Audit risk model

AR = RMM x DR, or AR = (IR x CR) x DR

Detection risk formula

DR = AR / RMM

Steps in assessing control risk

1) Identify specific controls to be relied upon; 2) Perform tests of controls; 3) Conclude on the achieved level of control risk

Substantive strategy

Set control risk at high for some or all assertions and rely on substantive procedures instead of controls

Reasons to follow a substantive strategy

Controls do not pertain to an assertion; controls are assessed as ineffective; testing the effectiveness of controls is inefficient

Reliance strategy

Obtain an understanding of internal control to develop a planned assessment of control risk, then plan to rely on internal control and assess control risk at a lower level

Control activities for Occurrence assertion

Segregation of duties; prenumbered documents that are accounted for; daily or monthly reconciliation of subsidiary records with independent review

Control activities for Completeness assertion

Prenumbered documents that are accounted for; segregation of duties; daily or monthly reconciliation of subsidiary records with independent review

Control activities for Authorization assertion

General and specific authorization of transactions at important control points

Control activities for Accuracy assertion

Internal verification of amounts and calculations; monthly reconciliation of subsidiary records by an independent person

Control activities for Cutoff assertion

Procedures for prompt recording of transactions; internal review and verification

Control activities for Classification assertion

Chart of accounts

Control activities for Presentation assertion

Internal review and verification

Limitations of internal control (3)

Management override; human errors or mistakes; collusion

Top internal control weaknesses observed by CFEs (Fig 6-4)

Lack of internal controls, followed by lack of management review and management override of controls

Two timing periods for audit procedures

Interim and year end

Reasons to perform interim tests of controls

Assertion being tested is not significant; control was effective in prior audits; efficient use of staff time

Factors for performing interim substantive procedures

Control environment; availability of information later; purpose of the procedure; assessed risk of material misstatement; nature of transactions or balances and assertions; ability to cover the remaining period

Benefits of testing controls at interim

A material weakness can be corrected before year end; substantive procedures can be changed based on test of controls results; tests of transactions can be done at the same time for efficiency

Dual purpose testing

Performing a test of controls and a test of transactions (substantive) at the same time to be efficient

In auditor’s primary consideration regarding an entity’s internal controls is whether they

Affect the financial statement assertions.

Which of the following statements about internal control is correct?

The cost-benefit relationship is a primary criterion that should be considered in designing an internal control system.

Internal control is a process designed to provide reasonable assurance regarding the achievement of which objective?

All of the above are correct.

Monitoring is a major component of the COSO Internal Control— Integrated Framework. Which of the following is not correct in how the company can implement the monitoring component?

The independent auditor can serve as part of the entity’s control environment and continuous monitoring.

After obtaining an understanding of an entity’s internal control system, an auditor may set control risk at high for some assertions (i.e., plan to follow a substantive strategy) because the auditor

Believes the internal controls are unlikely to be effective.

Regardless of the assessed level of control risk, an auditor would perform some

Substantive procedures to restrict detection risk for significant transaction classes.

Assessing control risk below high (i.e., planning to follow a reliance strategy) involves all of the following except

Concluding that controls are ineffective.

Which of the following audit techniques would most likely provide an auditor with the least assurance about the effectiveness of the operation of a control?

Inquiry of entity personnel.

The highest-quality and most reliable audit evidence that segregation of duties is properly implemented is obtained by

Observation by the auditor of the employees performing control activities.

SOC 1, Type 2 reports issued by the service organization’s auditor typically

Assess whether the service organization’s controls are suitably designed and operating effectively.

Significant deficiencies are matters that come to an auditor’s attention that should be communicated to an entity’s audit committee because they represent

Significant deficiencies in the design or operation of the internal control.

An auditor anticipates assessing control risk at a low level in an IT environment. Under these circumstances, on which of the following controls would the auditor initially focus?

General controls.

An auditor’s flowchart of an entity’s accounting system is a diagrammatic representation that depicts the auditor’s

Understanding of the system.