COSO Framework, Internal Controls, and Audit Procedures for Students

What are the five components of the COSO framework (CRIME)?

Control Activities; Risk Assessment; Information and Communication; Monitoring; Control Environment.

What are control activities?

Systematic policies and procedures that help employees ensure reliable financial reporting.

What is an example of a control activity?

A manager reviews a journal entry before the accounting clerk records it.

What three responsibilities should be segregated under segregation of duties?

Custody; recording/reporting; authorization/approval.

What is risk assessment in the COSO framework?

Mechanisms the company uses to identify and think about risks.

What does information and communication include?

Tools such as software, resources such as budgets and training, and people in accounting and other departments who communicate accurate information.

What is the financial-reporting purpose of information and communication?

To help ensure the company's financial reporting is consistent with the five main assertions.

What is monitoring in the COSO framework?

Evaluating the system of internal controls to decide whether controls should be added, changed, or removed.

Who should be responsible for each control in ICFR?

Every control should have a designated person responsible for it.

What is the control environment?

The organization's culture of integrity and ethical behavior, including management's tone at the top and code of conduct.

How does the control environment affect COSO?

It affects all other parts of the framework and includes attracting, developing, and retaining good employees.

What are the eight steps of an audit in order?

1. Sign the engagement letter; 2. Understand the client and its business; 3. Plan the audit work; 4. Test operating effectiveness of controls, when applicable; 5. Perform substantive testing at interim; 6. Perform substantive testing at final; 7. Perform concluding audit procedures; 8. Issue the audit report(s).

What is step 1 of an audit?

Sign the engagement letter.

What is step 2 of an audit?

Understand the client and its business.

What is step 3 of an audit?

Plan the audit work.

What is step 4 of an audit?

Test the operating effectiveness of controls, when applicable.

What is step 5 of an audit?

Perform substantive testing at interim.

What is step 6 of an audit?

Perform substantive testing at final.

What is step 7 of an audit?

Perform concluding audit procedures.

What is step 8 of an audit?

Issue the audit report or reports.

When do auditors test the design and implementation of controls?

Always, whether the company is public or private.

When do auditors test the operating effectiveness of controls?

Always for a public company; sometimes for a private company.

Which organization sets auditing standards for private-company audits?

The AICPA.

Which organization oversees audits of public companies?

The PCAOB.

What additional audit is generally required for public companies?

An audit of internal control over financial reporting (ICFR), in addition to the financial-statement audit.

What is the audit-risk formula?

Audit Risk = Inherent Risk x Control Risk x Detection Risk.

What is a component auditor?

An auditor at another location who performs work on a group audit.

At what two levels must auditor independence be considered?

The individual auditor and the audit firm.

In what two ways must an auditor be independent?

Independent in fact and independent in appearance.

What is independence in fact?

A state of mind free from bias while performing the audit.

What is independence in appearance?

Avoiding circumstances that a reasonable person could view as compromising the auditor's independence.

What is a covered member?

A person who can influence an audit engagement or its outcome during the engagement period.

Which four groups are generally considered covered members?

1. Individuals on the audit engagement team; 2. individuals able to influence the audit; 3. partners or managers providing 10 or more hours of nonattest services to the audit client; 4. partners in the office where the lead audit partner practices in connection with the engagement.

What is the 10-hour covered-member rule?

A partner or manager who provides 10 or more hours of nonattest services to an audit client is generally a covered member.

Can auditors perform non-audit services for audit clients?

Yes, certain services are generally allowed, including tax services, debt-covenant compliance letters, and statutory audits.

What does in pari delicto mean?

A wrongdoer cannot recover damages from another party for failing to prevent the wrongdoing.

What four main things does the PCAOB do?

1. Registers accounting firms; 2. sets auditing and quality-control standards; 3. inspects registered firms; 4. conducts enforcement.

What is the main role of the PCAOB?

To establish auditing and quality-control standards for registered CPA firms that audit publicly traded companies.

What is the basic difference between the PCAOB and AICPA in the notes?

The PCAOB oversees public-company audits, while the AICPA governs private-company audit standards and practice.

How is the PCAOB board structured?

It has five members serving staggered five-year terms, with no more than two practicing CPAs.

Why can no more than two PCAOB board members be practicing CPAs?

To keep the board from being too closely tied to large accounting firms.

What three professional factors affect audit quality?

Competence, availability, and focus.

What five process factors affect audit quality?

Tone at the top and leadership; incentives; independence; infrastructure; monitoring and remediation.

What five result areas indicate audit quality?

Financial statements; internal control; going concern; auditor-audit committee communications; enforcement and litigation.

What does going concern evaluate?

Whether the company is expected to remain in business for the next 12 months.

Why can a financial-statement restatement signal an audit-quality problem?

A restatement may indicate that the auditor missed a material issue in the original financial statements.

What communication relationship is an audit-quality result indicator?

Communications between the auditors and the audit committee.