ACC 401 Exam #2

management assertions are based on what guidance for public companies

AS No. 1105 (PCAOB)

what are the 5 basic assertions about the financial statements that need to be tested by an auditor

1. existence or occurrence

2. completeness

3. valuation or allocation

4. rights and obligations

5. presentation and disclosure

explain existence or occurrence

concerns whether assets and liabilities exist as of a given date and if recorded transactions actually occurred during the period (includes authorization)

explain completeness

all transactions and accounts that should be presented in the financial statements have been included

explain valuation andr allocation

concerns whether assets, liabilities, revenues, and expense components have been included in the FS at the appropriate amounts

subcomponents of this assertion:

- accuracy (math, posting, tie off)

- cut-off

- classification

- valuation/realizable value

explain rights and obligations

determines whether assets are actually the rights of the entity and liabilities are the obligations of the entity

explain presentation and disclosure

are the components of the financial statements properly classified, described, and disclosed

each of the management assertions is

tested through the collection and analysis of audit evidence

what is audit evidence

information used by the auditor as the basis for the audit opinion issued

what are some basic examples of the types of audit evidence collected

- oral responses received from questions asked

- visual observations

- paper documents

- electronic documents

- electronic data

what are the important aspects of audit evidence

1. nature (type of info)

2. sufficiency (quantity - did we collect enough?)

3. appropriateness (quality)

when it comes to the appropriateness of audit evidence, what are we looking for

relevance and reliability

what are the most important questions to answer when evaluating audit evidence

- is there sufficient appropriate evidence to support management's assertions?

- is the evidence persuasive?

what things affect the reliability of evidence

- source

- documentary vs. verbal

- original vs. photocopy

- strength of client's internal controls

how does the source of evidence affect its reliability depending on whether it's internal or external evidence

we trust external evidence (existed outside the client and subjected to outside verification) more than internal evidence (100% within the client) - for internal evidence, the only people with control over it are the people in the org, so they may have manipulated it

how does the independence of the source of evidence affect its reliability

we must consider whether management is providing the info or an independent third party - an independent third party would have less inclination to skew info

if an auditor has the direct ability to find evidence and gain knowledge about it themselves, is this more or less reliable

more reliable - if the auditor can get evidence directly themselves, this is better than asking someone else

ex: we can walk out to the client's warehouse and see inventory is actually there to verify it

how does documentary vs. verbal evidence affect reliability

evidence is always more reliable if it is written down - there is less chance of a misunderstanding, less likelihood someone will go back on their word, etc. (if you do have verbal communications, you typically create a memo for that conversation to document it)

how does an original vs. a photocopy for evidence affect reliability

the original is more reliable - it can't really be tampered with, whereas on a photocopy, someone could change info (this is less common of an issue today since we use less paper documents, but still important)

how does the strength of the client's internal controls affect reliability

if they have strong controls over documentation, we are more likely to trust the documents - this is especially important when it is internal documentation

what are audit procedures and what are the different kinds

acts performed by the auditor to gather evidence to determine if specific assertions are being met

1. risk assessment procedures

2. test of controls

3. substantive procedures

which audit procedures will be present on every audit

we will always have risk assessment and substantive procedures - we do not have to have tests of controls every time

what are the different procedures for obtaining audit evidence

1. inspection

2. observation

3. inquiry

4. confirmation

5. recalculation (math accuracy)

6. reperformance (executing a process or control)

7. analytical procedures

when conducting inspections, what are the different areas looked at

1. inspection of documents or records: looking at details (dates, official prices, etc. to make sure things were recorded correctly)

2. inspection of documents or records: scanning for unusual items or items that need further investigation

3. inspection of tangible assets: literally physically checking if they have things

what is scanning

looking at items at a high level for the purpose of determining if any of them are unusual - determine if any of them require us to pull more info and place more attention on them

what is an important relevance issue when inspecting documents and records

the direction of testing...

vouching: starting with something already recorded in the financial statements or ledgers and working back to find source documents that confirm it is legit (journal to source documents)

tracing: starting with the source documentation that tells you some transaction happened, and then figure out if this info actually was captured/recorded in financial statements (source documents to journal)

the direction of testing has a lot of impact on

whether the evidence we gather is actually relevant

what are vouching and tracing usually used for

vouching: typically tests for OVER statements and existence

tracing: typically tests for UNDER statements and completeness

the bulk of the evidence gathered by the auditor comes from

inspection

what is observation

looking at a process or procedure being performed by others - useful in helping auditor's understand the entity's process, but not considered very reliable (what we observe one day may be completely different the next day)

what is inquiry

asking questions of client personnel or third parties to seek info (both financial and nonfinancial)

what are confirmations

always a direct communication between an auditor and some party OUTSIDE of the organization (the confirming party) - can be paper or electronic

confirmations usually provide reliable evidence for the

existence assertion

what is recalculation

verifying the math accuracy of various information - can be done manually or electronically (includes footing, crossfooting, reconciling, and testing postings)

what is reperformance

the auditor independently executes a process to see if they arrive at the same numbers/conclusions that the company originally did

recalculation and reperformance are considered

highly reliable because the auditor is performing it themselves

explain which evidence is considered highly reliable, in the middle, and low

high: inspection of an asset, reperformance, recalculation

middle: inspection of records and documents, confirmation, analytical procedures

low: observation, inquiry

what is the assurance bucket made up of

1. risk assessment proceudres (required to be on every single audit)

2. tests of controls (not required for every single audit)

3. substantive analytical procedures (technically not required for all audits - we are required to do substantive procedures, but not substantive ANALYTICAL)

4. remaining assurance needed from tests of details

conduct each in order - each will determine how much is collected in each bucket. the percent represents how much evidence is being collected in each category

the assurance bucket must be

filled with sufficient appropriate evidence to obtain the level of assurance necessary to support the auditor's opinion

the mix within the assurance bucket will vary from

- from engagement to engagement

- for different areas within an audit engagement

what is audit documentation (aka workpapers)

the auditor's principal record of the audit procedures performed, evidence obtained, and conclusions reached

what are the primary functions of the workpapers

- to provide support for the audit report

- to aid in the conduct and supervision of the audit

- to provide evidence for quality reviews of the audit work

why are workpapers so important

according to AS 1215, if it is not documented in the work papers, it didn't happen

audit documentation can be stored in either

permanent files: contain historical data about the entity (corporate charter, chart of accounts, contracts, IC documentation, etc.)

current files: contain info and data related specifically to the current year's engagement (audit plan/report, audit programs, working trial balance, current financial statements, etc.)

what is the audit program

a set of audit steps designed to test assertions for a particular business process or account - each step generally ties directly to the assertion being tested (team member completing the procedure 'signs off')

what does the format of audit documentation look like

heading: client name, title of the working paper, client's year-end date

indexing and cross referencing: notations that provide a trail from financial statements to audit documents, and

between work papers

tick marks: notations made next to work paper items indicating auditor/reviewer actions

tick marks are explained in

a tick mark legend (usually at the bottom of a work paper)

who has access to the audit documentation

even though the information in the workpapers pertains to the client, the workpapers are the property of the auditor - under the confidentiality rule of the code of professional conduct, there are limitations on the auditor's ability to share this info with 3rd parties

how long must audit documentation be retained for after the completion of an audit

SOX (and PCAOB AS3) requires audit documentation to be retained for 7 years from the completion date of the engagement

what are analytical procedures

evaluating financial information by looking at plausible relationships among financial and non-financial data (investigate, if necessary, fluctuations in relationships that are inconsistent with other info)

what are the types and purposes of analytical procedures

1. preliminary analytical procedures: assist the auditor to better understand the business and assess RMM in order to plan the nature, timing, and extent of audit procedures

2. substantive analytical procedures: used to obtain evidence about particular assertions related to account balances or classes of transactions

3. final analytical procedures: used as an overall review of the financial information in the final review stage of the audit

explain which analytical procedures are required vs. optional and which level each is looked at

1. preliminary: required, done at a high-level view

2. substantive: optional, done at a detailed-level

3. final: required, done at a high-level view

what are some types of analytical procedures

trend analysis, ratio analysis, and the reasonableness test

what is trend analysis

examines changes over time - can involve balances or ratios/relationships

*generally used in preliminary analytical procedures*

what is ratio analysis

examines relationships between accounts or to non-financial data - common size financial statements, compared over time or to benchmarks, etc.

*generally used in preliminary analytical procedures*

when looking at trend and ratio analysis, what is the auditor's perspective

from an auditor perspective, we are looking at ratios to see if they meet expectations - if sales went up way high when the rest of the industry our client is in was suffering, we would see that as something that needs to be examined because it is outside of our expectations

what is the reasonableness test

develop an expectation (using financial and non-financial data) and see if the ending balance matches our prediction

*commonly used in substantive procedures*

the reasonableness test is often used for

account balances we expect to be very standard from one year to the next (ex: office supplies expense)

what is the purpose of substantive analytical proceudres

to substantiate that a recorded balance is fairly stated

what is the process of conducting substantive analytical procedures

1. develop expectations - based off of prior years, industry info, budgets, etc.

2. define tolerable difference - how close does our prediction have to be to the recorded balance to conclude it is reasonable?

3. investigate differences > tolerable difference - use client explanations with other forms of evidence, and maintain professional skepticism

what factors determine the precision of our expectations

- is this something that is actually predictable?

- availability of data that is sufficiently disaggregated

- reliability of available data

*the more precise the expectation, the more reliable the test*

substantive analytical procedures are optional - why?

they are used kind of sparingly - we only use them in situations where we actually have the relevant data that will build us a good prediction model

what is an area that is often tested using substantive analytical procedures

interest - it is usually very easy to predict

how do we conduct a reasonableness test (a type of substantive analytical procedure)

compare the PY balance to the CY balance - calculate the % increase or decrease, and if it exceeds expected reasonable limits, investigate

what is the purpose of preliminary analytical procedures

to help plan the audit and highlight areas where additional audit effort is needed

after planning, what is the next step in an audit

consider and audit internal control

chapter 6 focuses on

internal control in a financial statement audit - applies to ALL audits of financial statements (must gain an understanding)

what is internal control (COSO's definition)

a system designed to provide reasonable assurance that an entity's objectives are being achieved in...

- reliable reporting

- effective & efficient operations; safeguarding of assets

- compliance with laws & regulations

when it comes to internal controls, who has what responsibilities

management: responsible for maintaining controls

auditor: primarily concerned with reliability of financial reporting

*reminder: UNDERSTANDING the client's IC is a GAAS principles requirement*

what is COSO

the Committee of Sponsoring Organizations of the Treadway Commission

what is the COSO framework

components of internal control that define what a company's internal control system should look like - it is supported by 17 principles that underly the components

what are the components of the COSO framework

1. control environment

2. entity's risk assessment

3. information and communication

4. control activities

5. monitoring

*the control environment is overarching of the whole framework*

what is the control environment component of COSO

actions, policies, and procedures that reflect the attitudes of management, directors, and owners ("tone at the top")

what are the principles of the control environment

- commitment to integrity and ethical values

- BOD oversight

- communication of reporting lines and responsibilities

- commitment to competence

- accountability

what is the entity's risk assessment component of COSO

process for identifying and responding to business risks facing the entity

what are the principles of an entity's risk assessment

- clearly identifying objectives so that risks can be identified

- identifying potential risks and how they should be managed

- consideration of fraud potential

- identification of changes that could impact internal control

what is the information and communication component of COSO

consists of hardware, software, people, procedures, and data

an effective AIS should do what for transactions

- identify & record all valid transactions

- describe them with sufficient detail and timeliness to allow proper classification

- measure them so they can be reported at the proper monetary value in the F/S

- record in correct time period

- properly present and disclose in the F/S

what are the principles of information and communication

- production and use of quality info

- communication of info internally

- communication of info externally

what is the control activities component of COSO

the policies and procedures that help ensure that management's directives are carried out

what are examples of control activities

- physical controls

- performance reviews/independent checks of performance

- information processing controls

- segregation of duties

what are physical controls

primarily consists of safeguarding assets, authorization requirements, and periodic counting and comparison with records

what are segregation of duties

separating the authorization, recoding, and custody functions - used to preserve the system of checks and balances in a company

what are performance reviews/independent checks of performance

independently checking the performance of an individual or a process by reperforming or observing someone (checks that whatever is supposed to occur actually occurs in that manner)

what are information processing controls

- general (network, program changes, etc): have to do with more general, systemwide issues. If there are any changes happening to the system, we must document somewhere what is happening and who made the change (system itself rather than the execution of the system)

- application (authorization and accurate processing of individual transactions): when we are actually executing things, make sure the applications themselves are working correctly and processing correctly

what is an example of an application information processing control

limit check on the size of a paycheck that can be processed in a payroll system (based on employees' salaries, we can set a maximum amount that should be issued to them) - we would enter a paycheck that exceeds the limit to make sure it properly prevents this

what is the monitoring component of COSO

process that assesses the quality of internal control performance over time

what are the principles of monitoring

- monitoring can be accomplished through ongoing activities or separate evaluations

- deficiencies should be communicated in a timely manner so that appropriate corrective action can be taken

how does entity size affect the COSO framework in different companies

the basic concepts of the five components should be present in all companies, but they are likely to be less formal in a small or mid-size company than in a large company (also keep in mind cost-benefit concerns)

how do we obtain an understanding of internal control

- PY workpapers or permanent files

- client inquiry

- observation

- inspection of documents

- perform a walkthrough

what is a walkthrough

an auditor walks through a process to see what actually happens and ensure it matches expectations - in a typical walkthrough, you pick a sample of transactions, go from where it was originated to where it was finally recorded, and look through every single step along the way (documented in a memo)

how/where does an auditor document an understanding of internal control

- procedure manuals/organizational charts

- internal control questionnaires

- narrative description

- flowchart

what are procedure manuals/organizational charts

company documents that typically have a section in which internal controls and AIS may be documented

what are internal control questionnaires

exist for auditors as a way to help them identify where the areas are that look like controls are lacking - asks a series of questions and if there is a big area where all the answers are no, this is an indicator that that area is lacking in controls

what is a narrative description for documenting internal control

understanding is documented in a memo - this is common when the entity has a very simple internal control system

what are flowcharts

provides a diagrammatic picture of how internal control works - visually shows the processes

audit workpapers typically have a combination of

both narrative descriptions and flowcharts

review - what is the audit risk model

audit risk = inherent risk + control risk + detection risk

how do we assess control risk in relation to reliance on the controls

based on that initial assessment of their internal controls, we come up with a level of acceptable risk and determine if we are going to rely on controls or not...

1. lower assessment of CR (some planned reliance) requires testing of controls in order to rely on them

2. CR set at maximum indicates no planned reliance on controls - instead of extensive control testing, the auditor substitutes more substantive testing

can controls be expected to be effective 100% of the time?

no - there are many reasons why not:

- cost/benefit constraints on the extent and quality of controls

- human error or mistakes

- collusion to circumvent controls

- management overrides

*this is why control risk can NEVER be zero and we must have some substantive testing!*