Exam 1 Auditing

Auditing

Step by step process of collecting evidence and looking at them fairly (w/o taking sides) regarding assertions about economic actions & events to check whether what they said matches the rules (like GAAP) and disclosing what you found to people who care (investors)

Why does the principal-agent relationship create demand for auditing?

Managers (agents) have more information than owners (principals), creating information asymmetry and incentives to act in self‑interest. Auditing reduces information risk by providing independent verification.

Information Risk

The risk that financial information provided by management is materially false or misleading

Who selects & hires the external auditor?

The audit committee of the board of directors (for public companies).

List the Assertions Related to Classes of Transactions

- Occurrence

- Completeness

- Authorization

- Accuracy

- Cutoff

- Presentation

List the Assertions Related to Account Balances

- Existence

- Rights & Obligations

- Completeness

- Accuracy/Valuation/Allocation

- Classification

- Presentation

Occurrence vs. Existence

Occurrence: Did the recorded transaction actually happen?

Existence: Do the recorded assets/liabilities actually exist at period end?

Completeness vs. Accuracy

Completeness: Everything that should be recorded IS recorded

Accuracy: Recorded amounts are correct

Types of Auditors

External Auditors

Internal Auditors

Government Auditors

Fraud Auditors

Assurance vs. Attest vs. Audit

Assurance: Service improves information quality but does NOT require a formal written opinion

Attest: CPA issues a written conclusion about someone else's assertion

Audit: engagement involves financial statements, GAAS, and reasonable assurance

Non-Audit Services

Tax prep/planning, management advisory services, bookkeeping, compilations

Materiality

A misstatement is material if it would influence the judgment of a reasonable user

Audit Risk

Risk the auditor issues an inappropriate opinion when financial statements are materially misstated

What makes audit evidence "sufficient" and "appropriate"?

Sufficient: Quantity of evidence

Appropriate: Quality (relevance & reliability)

Corporate Governance

Systems of people, processes, and activities ensuring proper stewardship over an entity's assets

What does Sarbanes-Oxley Act (SOX) require for audit committees?

- Entirely independent members

- No consulting/advisory fees

- Not affiliated persons

- Must appoint/oversee external auditor

- Must preapprove audit/nonaudit services

- Must include at least one financial expert

- Must maintain whistleblower procedures

Why do auditors care about governance quality?

Good governance reduces risk of manipulation, strengthens internal controls, improves tone at the top, and makes audit less risky

5 Primary Business Cycles

- Financing

- Purchasing

- HR/Payroll

- Inventory Management

- Revenue

What does the SEC do?

Oversees PCAOB and FASB; enforces securities laws; requires 10‑K, 10‑Q, 8‑K filings

What are PCAOB's responsibilities?

- Register audit firms

- Set auditing standards for public companies

- Inspect audit firms

- Enforce disciplinary actions

How often are audit firms inspected?

100 public clients → annual

≤100 public clients → every 3 years

What does American Institute of Certified Public Accountants AICPA do?

Sets ethical standards, administers CPA exam, sets private‑company auditing standards (via ASB)

Auditing Standard Board vs. Public Company Accounting Oversight Board

ASB: Auditing standards for private companies

PCAOB: Auditing standards for public companies

What is the purpose & premise of an audit under Generally Accepted Auditing Standards (GAAS)?

Purpose: provide an opinion on fair presentation of financial statements

Premise: Management is responsible for FS, internal control, and providing evidence access

What are auditor responsibilities under Generally Accepted Auditing Standards (GAAS)?

- Competence & Capabilities

- Ethical Requirements (INDEPENDENCE)

- Professional Skepticism

- Professional Judgment

What does performance under Generally Accepted Auditing Standards (GAAS) require?

- Reasonable assurance

- Planning & supervision

- Materiality determination

- Risk assessment

- Sufficient appropriate evidence

- Recognition of inherent limitaitons

What is the reporting requirement?

Express a written opinion or state that an opinion cannot be expressed

What do "must/shall," "should," and "may/might/could" mean in standards?

Must/shall: Unconditional requirement

Should: Presumptively mandatory

May/might/could: Explanatory or optional guidance

What nonaudit services are prohibited for audit clients?

Bookkeeping, systems design, valuation, actuarial, internal audit outsourcing, HR, legal services, investment banking.

What is the partner rotation requirement?

Lead and review partners must rotate off every 5 years.

What does SOX require regarding internal controls?

Management must assess/report on Internal Control over Financial Reporting (ICFR); external auditors must audit and opine on Internal Control over Financial Reporting (ICFR) effectiveness.

What must the new auditor ask the predecessor auditor?

Management integrity, fraud/illegal acts, disagreements, internal control issues, reason for auditor change, related parties

What is an engagement letter?

A contract that explains what the auditor will do, what management must do, and the limits of the audit

When can external auditors rely on internal audit?

When internal audit is objective (unbiased mental attitude), competent and uses a disciplined approach. External auditors must supervise and test IA's work

What's the difference between direct and indirect illegal acts?

Direct: Affect financial numbers (tax laws). Auditor must detect like errors/fraud

Indirect: Don't directly affect numbers (environmental laws) Auditor only investigates if something suspicious appears

What are the 4 types of audit procedures?

1. Risk assessment (learn the client)

2. Test of controls (see if controls work)

3. Substantive tests (find misstatements)

4. Dual-Purpose tests (both at once)

What are the 3 materiality steps?

1. Set overall materiality (PM)

2. Set tolerable misstatement (TM)

3. Evaluate misstatements at the end

What is tolerable misstatement?

The amount allowed for each account, subset of planning materiality. Usually 50-75% of PM

What is the audit risk formula?

AR = IR x CR x DR

What is inherent risk?

The natural level of risk present in a process, activity, or business before any controls or safety measures are applied

"it is what it is"

What is control risk?

the chance that a company's internal rules and security checks will fail to prevent or catch material misstatements

What is detection risk?

Risk the auditor's procedures fail to catch a misstatement

What happens when RMM is high?

DR must be low --> More testing, better evidence, bigger samples

What is engagement risk?

Risk the auditor gets sued or their reputation is harmed

What are the types of misstatements?

Factual (definitely wrong)

Judgmental (bad estimates)

Projected (sample errors projected to population)

What are the 3 fraud triangle elements?

Pressure

Opportunity

Rationalization

What are the six principles?

Responsibilities

Public Interest

Integrity

Objectivity & Independence

Due Care

Scope & Nature of Services

Difference between independence in fact vs. appearance

Fact: Truly unbiased

Appearance: Looks unbiased to outsiders

Who must be independent?

Engagement team

People who influence the audit

Partners giving > 10 hours of non-audit services

Partners in the lead partner's office

The firm

Controlled entities

What's the difference between direct vs. indirect financial interest?

Direct: You own it --> independence ALWAYS impaired

Indirect: Through something like a mutual fund --> impaired only if material

How do family members affect independence?

Immediate family: Same rules as auditor

Close relatives: Only impair independence if they have a key role or material interest

What nonaudit services are banned for public clients?

Bookkeeping

Systems design

Valuation

Actuarial

Internal audit outsourcing

HR

Legal

Investment banking

Expert services

What is the cooling-off rule?

A former audit partner/team member must wait 1 year before taking a financial reporting oversight role at the client

Unqualified (Public) / Unmodified (Private) Opinion

“Clean” Opinion and the outcome every company wants

• Auditor obtained sufficient appropriate evidence to conclude there are no material misstatements and no pervasive scope limitations

Modified Opinions

The auditor must issue this opinion when the financial statements contain material misstatements or the auditor cannot obtain sufficient evidence

• Nature of the matter: Is it a material misstatement (GAAP issue) or a scope limitation (GAAS/evidence issue)

• Pervasiveness: Is the issue isolated to specific items, or does it affect the financial statement as a whole

Material Misstatement: Material but NOT Pervasive (isolated to specific account)

Qualified Opinion (“Except for…”)

Scope Limitation: Material but NOT Pervasive

Qualified Opinion (“Except for…”)

Material Misstatement: Material AND Pervasive

Adverse Opinion

Scope Limitation: Material AND Pervasive

Disclaimer of Opinion

“A company misstated its inventory valuation by a material amount, but all other accounts, assets, liabilities, and revenues are completely accurate.”

Qualified Opinion "(“Except For”)

“A company fails to consolidate several major subsidiaries, records fictitious revenue across multiple divisions, and omits essential financial disclosures”

Adverse Opinion

The financial statements do not present fairly in accordance with GAAP. They are fundamentally misleading or unreliable.

“A fire destroys a company's main headquarters and accounting servers prior to the audit, leaving no backup records, physical documentation, or alternative procedures available to verify major account balances”

Disclaimer of Opinion

The auditor does not express an opinion on the financial statements.

Overall Audit Strategy

Set the scope, timing, and direction of the audit, and guides the development of the detailed audit plan

Audit Plan

A detailed document listing the specific Nature, Timing, and Extent of audit procedures to be performed by engagement team members

Auditor procedures to identify related party transactions

Identify if transactions are at “arms length”

• Inquire of management

• Review SEC filings

• Examine significant non-routine or unusual transactions

• Inspect Board of Directors minutes

Communication protocol for inconsequential fraud

Communicate the matter to an appropriate level of management, which must be at least one level above those involved in the fraud

Communication protocol for material fraud or fraud involving senior management

Report the matter directly to the Audit Committee of the Board of Directors

Objectives, strategies and Related Business Risks:

• Industry developments

• New products/services

• Expansion of business

• Regulatory requirements

• Use of IT

Inherent Risk

Entity Performance Measures:

• Budgets

• Variance Analysis

• Performance Report

• Comparison to competitors in industry

Inherent Risk

Internal Control:

• Active and qualified board of directors and independent audit committee members

• Effective risk assessment process

• Competent and objective internal audit function

• Controls related to proper authorization of transactions

Control Risk

Exceptions of Confidential Client Information:

(1) GAAP/GAAS compliance (If management leaves out a required disclosure from the footnotes, you do not write the footnote for them—instead, you modify your audit opinion (e.g., issue a qualified or adverse opinion) and explain the missing information in your audit report)

(2) Valid subpoena or summons (You hand over audit workpapers directly to a judge or court)

(3) Peer Review or Quality Management Review

(4) Disciplinary Investigations (You show evidence to the State Board of Accountancy or AICPA Ethics Committee to defend your audit work)

(5) Sale/merger of practice (You allow a prospective CPA buyer to review client files)