Audit Exam 3

SOX 404

Management and auditors to evaluate and report on the effectiveness of internal controls over financial reporting

Integrated Audit

An audit that includes both:
- The financial statements, and
- The company's internal control over financial reporting (ICFR)

Who "Certifies" ICFR?

Management is responsible for establishing and maintaining ICFR

What level of assurance does an audit provide?

The auditor provides reasonable assurance on:
- The financial statements
- ICFR
Reasonable assurance is not absolute assurance

Cost vs. Benefit Constraint

Internal controls should only be implemented if:
Benefit ≥ Cost

Control Deficiency

A control is missing or not working properly
- Low risk of material misstatement

Significant Deficiency

More serious than a control deficiency
- Important enough to bring to attention of those overseeing financial reporting
- Could lead to problems, but not likely material

Material Weakness

A deficiency that creates a reasonable possibility of a material misstatement
- High risk
- Indicates controls are NOT effective

Who do you report to if you have a deficiency?

Control Deficiency --> Management
Significant Deficiency --> Audit Committee & Management
Material Weakness --> Externally, Audit Committee, and Management

What are the key special considerations in an audit?

1. Multi-location businesses
2. Safeguarding assets

The difference between Generalized and Specialized audit software?

Generalized audit software is flexible and used across many systems for data analysis, while specialized audit software is designed for specific tasks or systems and is less flexible

What is Written Representation?

A written representation letter is a document where management confirms certain responsibilities and assertions to the auditor in writing

What is Sampling Risk?

Sampling risk is the chance that conclusions from the sample differ from the population reality

What are the two sides of Sampling Risk?

Incorrect Acceptance: Conclude control works when it doesn't

Incorrect Rejection: Conclude control fails when it works

What is a Type I Error?

Rejecting a control or account that's actually fine.

What is the risk associated with a Type I Error?

Risk of incorrect rejection.

What is a Type II Error?

Accepting a control or account that's flawed.

What is the risk associated with a Type II Error?

Risk of incorrect acceptance.

Attribute Sampling

Used to test whether a control is working; measures rate of deviations

Variable Sampling

Used to test financial statement balances by estimating misstatements.

What is Tolerable Deviation Rate?

The maximum error rate (failure rate) the auditor is willing to accept in a control and still rely on it

What is Confidence Level?

The probability the auditor's conclusion is correct and is inversely related to sampling risk; higher confidence requires a larger sample size.

What is Acceptable Audit Risk?

The risk the auditor is willing to accept that they may issue an unqualified (clean) opinion when the financial statements are actually materially misstated

When is Sampling NOT appropriate?

When populations are small, risk is high, items are individually significant, or when 100% examination is required.

5 Steps of Revenue Recognition

1. Identify the contract
2. Identify the performance obligations
3. Determine the transaction price
4. Allocate the transaction price
5. Recognize revenue when (or as) each performance obligation is satisfied

Channel Stuffing

When management pushes excessive products to distributors near period-end to inflate revenue

Why is Channel Stuffing an Audit Risk?

- Overstates revenue
- Violates revenue recognition rules
Often involves:
- Side agreements
- Easy return policies
Assertion violated:
- Occurrence (sales may not be real)
- Cutoff (recorded in wrong period)

Vouching

Start with accounting records → go to source docs

Tracing

Start with source docs → go to records

Why are Credit Approvals important?

Evaluates the customer's ability to pay and helps reduce bad-debt risk and sales to weak or unauthorized customers

How can revenue be used to test going concern?

Revenue is a key indicator of whether a company can continue operating (going concern)