Risk Assessment & Internal Controls

What is audit risk?

The risk that an auditor issues an inappropriate opinion when the financial statements contain a material misstatement.

What is inherent risk (IR)?

The probability that, in the absence of internal controls, material errors or fraud could occur.

What factors affect inherent risk?

Nature of the business, competitive strategy, major transaction types, and the effectiveness and integrity of management and accountants.

What is control risk (CR)?

The likelihood that the client’s internal control policies and procedures fail to prevent or detect a material misstatement?

What factors affect control risk?

Control environment, effectiveness of control activities, and monitoring activities such as audit committee oversight.

What is detection risk (DR)?

The likelihood that the auditors’ substantive procedures will fail to detect a material misstatement that exists within an account balance or class of transactions.

What is the Audit Risk Model?

Audit Risk = Inherent Risk x Control Risk x Detection Risk (AR = IR x CR x DR).

How does strong internal control affect detection risk?

Lower IR and CR allow auditors to accept a higher level of detection risk.

Why is risk assessment important?

It underlies the entire audit process and guides the nature, timing, and extent of audit procedures.

Which assertion is violated when invalid transactions are recorded?

Occurrence.

Which assertion is violated when valid transactions or disclosures are ommitted from the financial statements?

Completeness.

Which assertion is violated when transaction or disclosure amounts are inaccurate?

Accuracy.

Which assertion is violated when transactions are classified in the wrong accounts.

Classification.

Which assertion is violated when transactions are inappropriately aggregated or disaggregated and are not clearly described?

Presentation.

Which assertion is violated when transactions are recorded in the wrong period?

Cutoff.

What account characteristics increase inherent risk?

Large dollar balances, liquidity, high transaction volume, complex transactions, and subjective estimates.

What must auditors identify after determining significant accounts?

Relevant financial statement assertions.

What does the auditor ask when evaluating each assertion?

“What can go wrong?”

What are common risks related to cash?

Nonexistence of cash, improper foreign currency translation, and inadequate disclosure of restrictions.

What are common risks related to accounts receivable?

Fictitious receivables, omitted receivables, and improper valuation.

What is fraud?

Intentional material misrepresentation designed to induce reliance and cause loss or damage.

What is the key difference between fraud and error?

Intent.

What are the two primary categories of fraud?

Fraudulent financial reporting and misappropriation of assets.

What is fraudulent financial reporting?

Intentional misstatements or omissions of amounts or disclosures intended to deceive financial statement users.

What is embezzlement?

Type of fraud involving employees or non-employees wrongly misappropriating funds or property entrusted to their care, custody, and control often accompanied by false accounting entries and other forms of deception and coverup.

What is larceny?

Theft of assets not entrusted to the employee.

What three categories of fraud risk factors should auditors evaluate?

Management characteristics, industry conditions, and operating characteristics/financial stability.

What are Significant Risks?

Risks that require special audit consideration because of the nature of the risk or the likelihood and potential magnitude of misstatement.

Presume that improper revenue recognition is a fraud risk. What are the proper auditing procedures to follow?

• Identify risk of management override of controls.

• Examine journal entries and other adjustments.

• Review accounting estimates for biases.

• Evaluate business rationale for significant unusual transactions.

• Identify Significant Risks.

How should management fraud be communicated?

It is always considered material and should be reported to those charged with governance, usually the audit committee.

What areas must auditors understand about a client?

Industry, regulations, company nature, related parties, IT systems, accounting principles, objectives, and performance measures.

What is the purpose of audit brainstorming sessions?

To discuss fraud possibilities, audit responses, and prior experiences with the client.

What is the purpose of an audit strategy memorandum?

To establish audit scope, timing, direction, and planning.

What is audit strategy memorandum?

The basis for preparing the audit plan that lists the audit procedures to be completed for each relevant assertion related to each significant account and disclosure.

What is internal control?

A process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives.

What are the three objectives of internal control?

Reliable financial reporting, effective operations, and compliance with laws and regulations.

What serves as the foundation of internal control?

The control environment.

What are three limitations of internal control?

Human error, deliberate circumvention, and collusion.

Who is responsible for establishing internal controls?

Management.

What additional responsibility do auditors have for public companies?

Must audit and issue an opinion about the effectiveness of the internal control over financial reporting (ICFR).

What does COSO stand for?

Committee of Sponsoring Organizations of the National Commission on Fraudulent Financial Reporting.

What are the five COSO components?

Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring.

How many principles are included in the COSO 2013 framework?

17 principles.

What characteristics define a strong control environment?

Integrity and ethical values, board oversight, management philosophy and operating style, organizational structure, and commitment to competence.

What are the key responsibilities of an audit committee?

Financial Oversight, Risk Management, Compliance & Governance, and Independence & Objectivity.

How does an audit committee contribute to risk management?

By monitoring operational, cybersecurity, and emerging risks.

Who hires and oversees the external auditor?

The audit committee.

What are control activities?

Policies and procedures that ensure management directives are carried out.

Give examples of control activities.

Management review controls, information processing, physical controls over the security of assets, separation of duties, approvals and authorization, and verifications and reconciliations.

Accounts Receivable Aging Report

Generated on a monthly basis by the information system. The report is reviewed by the chief financial officer to evaluate the adequacy of the allowance for doubtful accounts.

Three-Way Match Exception Report

Refers to the process where a vendor invoice is compared to an approved purchase order and a receiving report to make sure that a payable is valid before payment is made.

Generated on a weekly basis by the information system to determine if any exceptions exist. The report is reviewed by the accounts payable clerk and all exceptions are followed up on an resolved by the clerk.

New-Hires Report

Generated on a quarterly basis by the information system. The report is reviewed by the payroll clerk to ensure that all new employees are reflected in payroll expense.

What four responsibilities should be segregated?

Authorization to execute transactions, recording transactions, custody of assets involved in the transactions, and periodic reconciliation of existing assets to recorded amounts.

Why is segregation of duties important?

It makes fraud more difficult by requiring collusion between individuals.

What are the three phases of internal control evaluation?

(1) Understand & Document the client’s internal controls, (2) Assess control risk, (3) Identify controls to test and perform test of controls.

What are common methods for documenting internal controls?

Narratives, questionnaires, and flowcharts.

Why might auditors choose not to test controls?

Controls are ineffective or testing them is less efficient than substantive testing.

What are the two common approaches to testing controls?

Exception testing and audit sampling.

Rank control-testing evidence from least to most persuasive.

Inquiry of client personnel, Observation of the control activity being performed, Inspection of relevant documentation, and Re-performance of the control activity.

What is an internal control deficiency?

A control design or operation problem that prevents timely detection or prevention of misstatements.

What is the difference between a design deficiency and an operating deficiency?

Design deficiencies involve flawed controls; operating deficiencies involve controls not functioning as designed.

What are the two most serious control deficiencies?

Significant deficiency and material weakness.

What are the six AICPA ethical principles?

Responsibilities, Public Interest, Integrity, Objectivity & Independence, Due Care, and Scope & Nature of Services.

What is the AICPA Independence Rule?

A member in public practice shall be independent in the performance of professional services as required by standards promulgated by bodies designated by Council.

What are the three steps in the AICPA conceptual framework for independence?

Identify threats, evaluate safeguards, determine whether independence is impaired.

Name the seven primary threats to auditor independence?

Adverse interest, undue influence, advocacy, management participation, familiarity, self-interest, and self-review.

What does the Integrity and Objectivity Rule require?

CPAs must avoid conflicts of interest, remain objective, and not misrepresent facts.

What does the General Standards Rule require?

Professional competence, due care, adequate planning/supervision, and sufficient relevant data.

If control risk increases, what happens to detection risk?

Detection risk must decrease.

If auditors rely less on controls, what happens to substantive testing?

More substantive testing is required, usually with larger sample sizes and year-end testing.

Which COSO component is considered the foundation of all other controls?

Control Environment.

What assertion is most concerned with fictitious sales?

Occurrence.

What assertion is most concerned with unrecorded sales?

Completeness.

What form of evidence is strongest when testing controls?

Re-performance