A424 Audit Exam 2

Management Assertions (definition)

Expressed or implied representations by management regarding the recognition, measurement, presentation and disclosure of information in the financial statements and related disclosures

2 Categories of Management Assertions

1. Assertions about classes of transactions and events for the period under audit & disclosures (Income Statement Accounts)

2. Assertions about account balances and disclosures at the end of the period (Balance Sheet Accounts)

3 Concepts of Audit Evidence

1. Nature of audit evidence

2. Sufficiency and appropriateness of audit evidence

3. Evaluation of audit evidence

Sufficiency is…

Sufficiency is the measure of the quantity of audit evidence.

• Greater risk of misstatement requires a higher quantity of audit evidence (increase sample size)

• Higher quality audit evidence results in a lower quantity of audit evidence

Appropriateness

Appropriateness is the measure ofthe quality of audit evidence.

• Relevance refers to its relationship to the assertion or to objective of the control being tested

• Reliability refers to whether a particular type of evidence can be relied upon to signal the true state of an assertion

3 Categories of Audit Procedures

1. Risk Assessment Procedures: used to obtain an understanding of the entity and its environment, including its internal control, to assess the risk of material misstatement at the financial statement and relevant assertion levels.

2. Test of Controls: used to test the operating effectiveness of controls in preventing or detecting and correcting, material misstatements at the relevant assertion level.

3. Substantive Procedures: used to detect material misstatement at the relevant assertion level. Substantive procedures include test of details and substantive analytical procedures.

Inspection of records and documents

Evidence obtained from external documents is more reliable than evidence obtained from internal documents.

• vouching (occurrence/existence) - journal/ledger to source document

• tracing (completeness) - source document to journal/ledger

Inspection of tangible assets

physical examination of a tangible asset

Observation

The process of watching a process or procedure being performed by others.

Inquiry

In conducting inquiry, the auditor should:

• Consider the knowledge, objectivity, experience, responsibility, and qualifications of the individual to be questioned.

• Ask clear, concise, and relevant questions.

• Use open or closed questions appropriately.

• Listen actively and effectively.

• Consider the reactions and responses and ask follow-up questions.

• Evaluate the response.

Confirmation

The process of obtaining a representation of information or of an existing condition directly from a third party.

• The reliability of evidence obtained through confirmations is directly affected by factors such as:

  • The form of the confirmation

  • Prior experience with the entity

  • The nature of the information being confirmed

  • The intended respondent

Recalculation

Determining the mathematical accuracy of documents or records.

Reperformance

The auditor’s independent execution of procedures or controls that were originally performed by company personnel.

Analytical Procedures

Evaluations of financial information made by a study of plausible relationships among both financial and nonfinancial data.

Scanning

Review of accounting data to identify significant or unusual items.

Which buckets does controls testing and risk assessment procedures fill?

• completeness

• accuracy

• cutoff

• occurrence/existence

• valuation

Which buckets does substantive analytical procedures fill?

• completeness

• accuracy

• cutoff

• occurrence/existence

• valuation

Which buckets does test of details fill?

• completeness

• accuracy

• cutoff

• presentation and disclosure

• valuation

• rights and obligations

Purpose of Risk Assessment Procedures

Used to assist the auditor to better understand the business and to plan the nature, timing, and extent of audit procedures.

Purpose of Substantive Analytical Procedures

Used to obtain evidential matter about particular assertions related to account balances or classes of transactions.

Purpose of Final Analytical Procedures

Used as an overall review of the financial information in the final review stage of the audit.

Management is responsible for designing and maintaining a system of internal control that...

• Provides reasonable assurance that assets and records are properly safeguarded

• The entity’s information system generates reliable information

Auditor is responsible for

1. Obtaining an understanding of internal control, and

2. Assessing control risk (to design tests of controls and substantive testing)

Internal Control (definition)

A process designed and carried out by an entity’s board of directors, management, and other personnel to provide reasonable assurance about the achievement of the entity’s objectives in the following categories:

1. Reliability, timeliness, and transparency of internal and external, nonfinancial and financial reporting

2. Effectiveness and efficiency of operations, including safeguarding assets

3. Compliance with applicable laws and regulations

(established by COSO’s Internal Control-Integrated Framework)

The COSO Framework

Five Components: (CRIME)

Control Environment

Entity’s Risk Assessment

Control Activities

Information and Communication

Monitoring Activities

Control Environment Definition

The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control and expected standards of conduct.

Control Environment - Principles

• Principle 1: The organization demonstrates a commitment to integrity and ethical values.

• Principle 2: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

• Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

• Principle 4: The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

• Principle 5: The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

Examples of Control Environment

• Think of it as “tone at the top”

• Elements of the control environment include:

  • Corporate governance, the Board of Directors, and Audit Committee

  • Organization-wide commitment to integrity and ethics

  • Management operating style Organizational structure

  • Commitment to financial reporting competencies

  • Authority and responsibility

  • Human resource policies

Risk Assessment (Definition)

Risk assessment involves a dynamic and iterative process for identifying and analyzing risks to achieving the entity’s objectives, thereby forming a basis for determining how risks should be managed. Management considers possible changes in the external environment and within its own business model that may impede its ability to achieve its objectives.

Risk Assessment - Principles

• Principle 6: The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

• Principle 7: The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

• Principle 8: The organization considers the potential for fraud in assessing risks to the achievement of objectives.

• Principle 9: The organization identifies and assesses changes that could significantly impact the system of internal control.

Examples of Risk Assessment

• The client’s business risks can arise or change due to the following circumstances:

  • Changes in the operating environment

  • Corporate restructuring

  • Expanded international growth

  • New personnel

  • New technology

  • Rapid growth

  • New accounting pronouncement

  • New information systems

  • New business models, products, or activities

Control Activities (Definition)

Control activities are the actions established by policies and procedures to help ensure that management directives to mitigate risks to the achievement of objectives are carried out. Control activities are performed at all levels of the entity and at various stages within business processes, and over the technology environment.

Control Activities - Principles

• Principle 10: The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

  • Performance Reviews | Physical Controls | Segregation of Duties (Authorization, Recording, Custody) | Information Processing Controls

• Principle 11: The organization selects and develops general control activities over technology to support the achievement of objectives.

• Principle 12: The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

Examples of control activities

• Segregation of duties

• Approval and co-signing requirements

• Documentation trails and pre-numbered sequence controls

• Restricted physical access

• Reconciliations

• Computerized controls for accounting information systems (e.g., data validation controls)

Information and Communication (Definitions)

Information is necessary for the entity to carry out internal control responsibilities in support of achievement of its objectives. Communication occurs both internally and externally and provides the organization with the information needed to carry out day-to-day internal control activities. Communication enables personnel to understand internal control responsibilities and their importance to the achievement of objectives.

Information and Communication - Principles

• Principle 13: The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. - Identify and record all valid transactions

  • Classify transactions properly | Measure the value of transactions properly | Record transactions in the proper period | Properly present transactions and disclosures

• Principle 14: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

• Principle 15: The organization communicates with external parties regarding matters affecting the functioning of internal control.

Monitoring Activities (Defintions)

Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, are present and functioning. Findings are evaluated and deficiencies are communicated in a timely manner, with serious matters reported to senior management and to the board.

Monitoring Activities - Principles

• Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

• Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Examples of Monitoring

• Detection procedures to ensure proper functioning and prompt reporting / remediation of control violations

• Think of it as “controls over the controls”

• Examples:

  • Employee hotlines to facilitate whistleblowing

  • An effective internal audit function

  • Checks and reconciliations

How to Determine When to Rely on Controls?

• Consider a substantive strategy when one or all of the following exist:

  • Controls do not pertain to an assertion

  • Controls are assessed as ineffective (design or operation)

  • Testing of the effectiveness of controls is inefficient

Determine whether you intend to rely on the controls

• No → Substantive strategy

  • set control risk at the maximum, and only perform substantive testing

• Yes → Reliance strategy

  • Set control risk at less than maximum, plan and perform tests of controls, and then perform substantive testing

• Perform substantive procedures based on the level of control risk

Reliance Strategy

• Using a reliance strategy means the auditor intends to rely on entity’s controls

  • Obtain an understanding of internal control

  • Plan and perform tests of controls

    • If test results indicate that achieved control risk is higher than planned → increase the planned substantive procedures and document the revised control risk assessment

    • If test results support the planned level of control risk, no revisions of the planned substantive procedures are required

Procedures to obtain an understanding of internal controls:

• Inquiries of management and entity personnel

• Inspection of entity documents and reports

• Observation of entity activities and operations

Understanding of internal controls is used to:

• Identify types of potential misstatements

• Pinpoint the factors that affect the RMM

• Design tests of controls and substantive procedures

Limitations of an Entity’s Internal Control

• Management override of internal control

• Human errors or mistakes

• Collusion

• Cost prohibitive (especially for smaller entities)

Background on audits of ICFR

• Congress passed Sarbanes-Oxley (SOX) Act of 2002 related to publicly-traded companies

  • Management required to report on the effectiveness of its ICFR

    • Section 302 requires quarterly certifications

    • Section 404(a) requires annual report

  • External audit required on the effectiveness of ICFR

    • Section 404(b) requires an audit based on PCAOB standards, Audit Standard No. 5 (AS5)

    • AS5 guidance:

      • Integrated audits of ICFR and financial statements

      • Top-down, risk-based approach to evaluating ICFR

  • Dodd-Frank Act of 2010 exempts smaller public companies, “non-accelerated filers,” (common equity of < $75 million)

Management Responsibilities under Section 404 (Reporting & Compliance)

• Management’s report includes:

1. Their responsibility for establishing and maintaining adequate ICFR

2. Their assertion on the effectiveness of ICFR as of the end of the fiscal year (“as of” assertion)

If control deficiencies during the year are remediated prior to year-end, can still issue an unqualified “clean” report

• Management must comply with the following requirements in order for the external auditor to complete an audit of ICFR:

  • Accept responsibility for the effectiveness of the entity’s ICFR

  • Evaluate the effectiveness of the entity’s ICFR using suitable control criteria

  • Support the evaluation with sufficient evidence, including documentation

  • Present a written assessment regarding the effectiveness of ICFR at year-end

Auditor Responsibilities under Section 404 (assertion)

• Audit management’s assertion about the effectiveness of ICFR

  • Objective of audit is “to express an opinion on the effectiveness of the company’s ICFR”

  • Plan and perform the audit to obtain reasonable assurance about whether the entity maintained, in all material respects, effective internal control as of the date in management’s assertion (i.e., as of year-end)

Internal Control Deficiencies Defined

• Control Deficiency

  • Exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

    • Design deficiency exists when (1) a control is missing, or (2) an existing control is not properly designed to meeting the objective

    • Operating deficiency exists when a properly designed control does not operate as designed

Significant Deficiency (SD)

A control deficiency, or a combination of control deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.

Material Weakness (MW)

A deficiency, or a combination of deficiencies, in ICFR, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis

Evaluating Internal Control Deficiencies (Magnitude x Likelihood)

• Remote (nothing)

• Reasonably possible or probable and…

  • Material: Material Weakness —> report externally to audit committee and to management

  • Not Material but Significant: Significant Deficiency —> Report to audit committee and to management

  • Not Material or significant: Control Deficiency —> Report to management

Management’s Assessment Process

Management must follow a top-down, risk-based approach:

1. Identify financial reporting risk and controls

• Risk = risk of a material misstatement to f/s

• ID controls that address f.r. risks including entity-level controls and pervasive elements of ICFR (see next slide for examples)

2. Consider which locations and business units to include in the evaluation

3. Evaluate evidence about the operating effectiveness of ICFR

• Evidence = test controls, ongoing monitoring, or both

Management’s Assessment Process (Report)

• Management issues a report on ICFR If no material weaknesses, conclude ICFR is effective

• If a material weakness (MW), must disclose the following:

  • Nature of MW MW’s impact on financial reporting and its ICFR

  • Management’s plans for remediating the MW

Audit Reports on ICFR

• Unqualified report

  • ICFR provides reasonable assurance that the entity’s controls are designed and operating effectively in all material respects as of year-end

  • i.e., no material weaknesses

  • if only control deficiencies or significant deficiencies

• Adverse report

  • if one or more material weaknesses

  • Requires disclosures in the report:

    • Description of the MW

    • Impact of MW on the financial statement audit/opinion

Remediation of a Material Weakness

Remediation is the process of correcting a material weakness in the ICFR

• If a material weakness is corrected before the “as of” date, and both management and auditor test the operating effectiveness of new controls, a clean report on ICFR can be issues (i.e., that ICFR is operating effectively)

  • If there is not sufficient time for both management and the auditor to test the operating effectiveness of the control, an adverse opinion is still issued.

Indicators of MW’s: 100% Automatic

• Identification of fraud, whether or not material, committed by senior management

• Restatement of previously issued financial statements to reflect the correction of a material misstatement

• Identification by the auditor of a material misstatement of financial statements in the current period in circumstances that indicate that the misstatement would not have been detected by the entity’s ICFR

• Ineffective oversight of the entity’s external financial reporting and ICFR by the entity’s audit committee

• Several significant deficiencies, especially if all related to a similar area

Factors that Affect “Magnitude” Assessments

• F/s amounts or total of transactions exposed to deficiency

• Volume of activity in account balance or class of transactions (current and future) exposed to deficiency

4 Question Framework

1. Does the deficiency relate directly to the achievement of one or more financial statement assertions?

2. Is the likelihood of a misstatement resulting from the deficiency (or combination of deficiencies) at least reasonably possible?

3. Is the magnitude of the potential deficiency material to either the interim or annual financial statements?

4. Do compensating controls exist and operate effectively at a level of precision sufficient to prevent or detect a misstatement that could be material to interim or annual financial statements?

Management Assertion: Occurrence/Existence

Transactions and events have been recorded & Assets, liabilities, and equity exist

• Are the financial statement details valid (real)?

Management Assertion: Rights and Obligations

The entity holds or controls the rights to assets, and liabilities are the obligations of the entity

Management Assertion: Completeness

All transactions and events & assets, liabilities, and equity that should have been recorded have been recorded

• Are the financial statements complete? Is there anything missing?

Management Assertion: Authorization

All transactions and events have been properly authorized

Management Assertion: Accuracy/Valuation

Amounts, assets, liabilities, and equity have been recorded appropriately, and are valued or allocated appropriately

• Correct amount?

Management Assertion: Cutoff

Transactions and events have been recorded in the correct accounting period

• Right time period?

Management Assertion: Classification

Transactions and events & assets, liabilities, and equity have been recorded in the proper accounts

• Right account?

Management Assertion: Presentation

Disclosures are relevant and understandable