Audit c7

Management's responsibility for internal control

Establish and maintain internal controls over financial reporting

Auditor's responsibility for internal control

Test internal controls and express an opinion on their effectiveness

Integrated audit

An audit of both internal control over financial reporting (ICFR) and the financial statements; the annual report must contain a report on each

Four management requirements under Section 404

1) Accept responsibility for ICFR effectiveness 2) Evaluate ICFR using suitable control criteria 3) Support the evaluation with sufficient evidence, including documentation 4) Present a written assessment of ICFR effectiveness as of the end of the most recent fiscal year

Internal control over financial reporting (ICFR)

A process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP

Three types of ICFR procedures

1) Maintain records that accurately and fairly reflect transactions and asset dispositions 2) Provide reasonable assurance that transactions are properly authorized and recorded per GAAP 3) Provide reasonable assurance of prevention or timely detection of unauthorized acquisition, use, or disposition of assets

Who designs and carries out ICFR?

Designed by or under the supervision of the principal executive and financial officers, and effected by the board of directors, management, and other personnel

Control deficiency

Exists when the design or operation of a control does not allow management or employees, in the normal course of their assigned functions, to prevent or detect misstatements on a timely basis

Significant deficiency

A control deficiency, or combination of deficiencies, in ICFR that is less severe than a material weakness, yet important enough to merit attention by those overseeing the company's financial reporting

Material weakness

A deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis

Two dimensions the auditor considers when evaluating a control deficiency

Likelihood (reasonably possible) and magnitude (material, significant, or insignificant)

What makes a deficiency a material weakness?

Material in magnitude AND reasonably possible or probable in likelihood

What makes a deficiency a significant deficiency?

Not material in magnitude but significant, and reasonably possible or probable in likelihood

What makes a deficiency just a control deficiency?

Not material or significant in magnitude, but reasonably possible or probable in likelihood

To whom are control deficiencies reported?

Management

To whom are significant deficiencies reported?

The audit committee and management, in writing

To whom are material weaknesses reported?

Disclosed in the internal control audit opinion and reported to the audit committee and management (externally, audit committee, and management)

Documentation requirements emphasized by SOX and the PCAOB

Management must document internal controls; the auditor must document their understanding and testing of internal controls

Can inadequate documentation be a deficiency?

Yes, inadequate documentation can be a significant deficiency or a material weakness

How do control testing and substantive procedures interact in an integrated audit?

Control testing impacts the planned substantive procedures, and the results of substantive procedures are considered when evaluating internal control

Whose work can the auditor rely on when testing internal controls?

Internal audit, company management, the audit committee, and consultants hired by management

What must the auditor assess before relying on internal audit or management's consultants?

Their competence and objectivity

Top-down approach to auditing internal controls (order of steps)

1) Understand and evaluate company-level (entity-level) controls 2) Evaluate effectiveness of the audit committee 3) Determine significant accounts 4) Determine relevant assertions 5) Identify significant processes and classes of transactions 6) Gain understanding of internal controls, including year-end reporting 7) Assess control risk 8) Test design and operating effectiveness (including walkthroughs) 9) Evaluate identified control deficiencies 10) Update control risk assessment 11) Form an opinion on ICFR

Risk factors for identifying significant accounts and disclosures (first five)

1) Size and composition of the account 2) Susceptibility to misstatement due to errors or fraud 3) Volume of activity, complexity, and homogeneity of transactions 4) Nature of the account or disclosure 5) Accounting and reporting complexities

Risk factors for identifying significant accounts and disclosures (last four)

6) Exposure to losses in the account 7) Possibility of significant contingent liabilities 8) Existence of related party transactions 9) Changes from the prior period in account or disclosure characteristics

Factors to consider when testing controls

Nature (manual vs. automated controls), timing, and extent

Timing of control testing

ICFR assessment is as of a point in time (the balance sheet date); testing during the year allows time to correct problems, but the auditor must then be comfortable with the controls over the information for the whole year

Extent of control testing

Depends on the frequency and importance of the control

Nature of control testing

Testing of manual vs. automated controls

Two audit opinions in an integrated audit

1) Opinion on the effectiveness of internal control 2) Opinion on the financial statements

Why must both opinions be issued by the same audit firm?

Because the audits are integrated: a single top-down, risk-based approach where control testing and substantive testing inform each other

Unqualified opinion on internal control

The company maintained, in all material respects, effective internal control over financial reporting

Adverse opinion on internal control

The company has not maintained effective ICFR; at least one material weakness exists

Disclaimer of opinion on internal control

The auditor does not express an opinion, due to a severe scope limitation

The Sarbanes-Oxley Act of 2002 requires management to include a report on the effectiveness of ICFR in the entity’s annual report. It also requires auditors to report on the effectiveness of ICFR for large public companies. Which of the following statements concerning these requirements is false?

The auditor should provide recommendations for improving internal control in the audit report

A control deviation caused by an employee performing a control procedure that he or she is not authorized to perform is always considered a

Deficiency in operation

Which of the following is not a factor that might affect the likelihood that a control deficiency could result in a misstatement in an account balance?

The financial statement amounts exposed to the deficiency.

Entity-level controls can have a pervasive effect on the entity’s ability to meet the control criteria. Which one of the following is not an entity-level control?

Controls to require authorization of inventory purchases.

Which of the following controls would most likely be tested during an interim period?

Controls that operate on a continuous basis.

If the financial reporting risks for a location are low and the entity has good entity-level controls, management may rely on which of the following for its assessment?

Self-assessment processes in conjunction with entity-level controls.

A walkthrough is one procedure used by an auditor as part of the internal control audit. A walkthrough requires an auditor to

Trace a transaction from each major class of transactions from origination through the entity’s information system until it is reflected in the entity’s financial reports.

When auditors report on the effectiveness of internal control “as of” a specific date and obtain evidence about the operating effectiveness of controls at an interim date, which of the following items would be the least helpful in evaluating the additional evidence to gather for the remaining period?

The walkthrough of the control system conducted at interim.

AnnaLisa, an auditor for N. M. Neal & Associates, is prevented by the management of Lileah Company from auditing controls over inventory... What kind of report should AnnaLisa issue on the effectiveness of Lileah’s internal control?

A disclaimer of opinion.

In auditing a public company, Natalie, an auditor for N. M. Neal & Associates, identifies four deficiencies in ICFR... One of the deficiencies is reasonably likely to result in misstatements that are not material but significant. What type of audit report should Natalie issue?

An unqualified report.

In auditing ICFR for a public company, Emily finds that the entity has a significant subsidiary located in a foreign country... The other auditor’s report indicates that there are no material weaknesses... What should Emily do?

Accept the other auditor’s opinion after evaluating the auditor’s work and make reference to the other auditor’s report in her audit opinion.

Which of the following statements concerning control deficiencies is true?

The auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit.

Significant deficiencies and material weaknesses must be communicated to an entity’s audit committee because they represent

Significant deficiencies in the design or operation of internal control.

Which of the following most likely represents a weakness in internal control of an IT system?

The systems analyst reviews output and controls the distribution of output from the IT department.

A primary advantage of using generalized audit software packages to audit the financial statements of an entity that uses an IT system is that the auditor may

Access information stored on computer files while having a limited understanding of the entity’s hardware and software features.