Chapter 7- Practice (HW, Quiz, Assignments)

Question 1

The following example of a control deficiency that may represent significant deficiencies or material weaknesses. For the control deficiency, indicate whether it is a significant deficiency or material weakness. Justify your decision:
* The entity uses a standard sales contract for most transactions. Individual sales transactions are not material to the entity. Sales personnel are allowed to modify sales contract terms. The entity’s accounting function reviews significant or unusual modifications to the sales contract terms but does not review changes in the standard shipping terms. The changes in the standard shipping terms could require a delay in the timing of revenue recognition.
Management reviews gross margins on a monthly basis and investigates any significant or unusual relationships. In addition, management reviews the reasonableness of inventory levels at the end of each accounting period. The entity has experienced limited situations in which revenue has been inappropriately recorded in advance of shipment, but amounts have not been material.

Answer 1

Based only on these facts, this deficiency represents a significant deficiency for the following reasons: First, the deficiency satisfies Box 1 – it relates to a financial statement assertion.

Second, the controls do not effectively address the detection of misstatements as evidenced by situations in which transactions that were not material were improperly recorded. Therefore, there is a reasonable possibility that a misstatement could occur. Thus, the answer to Box 2 is “yes.”

In addressing Box 3, the magnitude of a financial statement misstatement resulting from this deficiency would reasonably be expected to be significant but not material because individual sales transactions are not material. Furthermore, the risk of material misstatement is limited to revenue recognition errors related to shipping terms as opposed to broader sources of error in revenue recognition. Thus, the answer to Box 3 is “no.”

Because the misstatements that could occur from this deficiency are significant, the answer to Box 4 is “yes.”

However, the possible misstatements are not material so the answer to Box 6 is “no,” leading to a conclusion of a significant deficiency.

It should be noted that there is a compensating detective controls that operates monthly and at the end of each financial reporting period that should reduce the likelihood of a material misstatement going undetected. However, the compensating detective controls are only designed to detect material misstatements.

Question 2

The following example of a control deficiency that may represent significant deficiencies or material weaknesses. For the control deficiency, indicate whether it is a significant deficiency or material weakness. Justify your decision:

The entity has a standard sales contract, but sales personnel frequently modify the terms of the contract. The nature of the modifications can affect the timing and amount of revenue recognized. Individual sales transactions are frequently material to the entity, and the gross margin can vary significantly for each transaction. The entity does not have procedures in place for the accounting function to regularly review modifications to sales contract terms.
Although management reviews gross margins on a monthly basis, the significant differences in gross margins on individual transactions make it difficult for management to identify potential misstatements. Improper revenue recognition has occurred, and the amounts have been material.

Answer 2

Based only on these facts, this deficiency represents a material weakness for the following reasons: First, the deficiency satisfies Box 1 – it relates to a financial statement assertion.

Second, the controls do not effectively address the detection of misstatements as evidenced by improper revenue recognition that has occurred. Therefore, the likelihood of material misstatements occurring is probable. Thus, the answer to Box 2 is “yes.”

The answer to Box 3 is “yes” since the magnitude of a financial statement misstatement resulting from this deficiency would reasonably be expected to be material. Individual sales transactions are frequently material and gross margin can vary significantly with each transaction.

The answer to Box 5 is “no” since the compensating detective controls based on a reasonableness review are ineffective.

Taken together, the magnitude and likelihood of misstatement of the financial statements resulting from this internal control deficiency meet the definition of a material weakness (Box 6).

Question 3

The following example of a control deficiency that may represent significant deficiencies or material weaknesses. For the control deficiency, indicate whether it is a significant deficiency or material weakness. Justify your decision:

The entity has a standard sales contract, but sales personnel frequently modify the terms of the contract. Sales personnel frequently grant unauthorized and unrecorded sales discounts to customers without the knowledge of the accounting department. These amounts are deducted by customers in paying their invoices and are recorded as outstanding balances on the accounts receivable-aging. Although these amounts are individually insignificant, when added up they are material and have occurred regularly over the past few years.

Answer 3

Based on only these facts, this deficiency represents a material weakness for the following reasons: First, the deficiency satisfies Box 1 – it relates to a financial statement assertion.

Second, the likelihood of material misstatement of the financial statements resulting from this internal control deficiency is reasonably possible (even assuming that the amounts were fully reserved for in the company’s allowance for uncollectible accounts) due to the likelihood of material misstatement of the gross accounts receivable balance (Box 2 is answered “yes”).

The magnitude of a financial statement misstatement resulting from this deficiency would reasonably be expected to be material, because the frequency of occurrence allows insignificant amounts to become material in the aggregate (Box 3 is answered “yes”).

The answer to Box 5 is “yes” since there are no compensating controls present. It is concluded that a prudent official would deem this deficiency to be a material weakness (answer to Box 6 is “yes”).

Question 4

The following example of a control deficiency that may represent significant deficiencies or material weaknesses. For the following scenario, indicate whether the deficiency is a significant deficiency or material weakness. Justify your decision:

During its assessment of ICFR, the management of Lorenz Corporation and its auditors identified the following control deficiencies that individually represent significant deficiencies:
* Inadequate segregation of duties over certain information system access controls.
* Several instances of transactions that were not properly recorded in subsidiary ledgers. While the transactions that weren’t recorded properly were not material, the gross amount of the transactions of that type totaled up to an amount several times materiality.
*A lack of timelv reconciliations of the account balances affected by the improperly recorded transactions.

Answer 4

Based only on these facts, the combination of these significant deficiencies represents a material weakness for the following reasons:

First, the deficiency satisfies Box 1 – it relates to a financial statement assertion.

Second, the combination of these deficiencies was evaluated as representing a reasonably possible likelihood that a misstatement could occur (Box 2 is answered “yes”).

Third, the gross amount of the transactions totaled an amount greater than materiality, so Box 3 is answered “yes.”

Fourth, there are no effective compensating controls, i.e., no timely reconciliations (Box 5 is answered “no”).

Finally, it is likely that a prudent official would conclude that these deficiencies represent a material weakness (answer to Box 6 is “yes”).

Question 5

The following example of a control deficiency that may represent significant deficiencies or material weaknesses. For the following scenario, indicate whether the deficiency is a significant deficiency or material weakness. Justify your decision:

During its assessment of ICFR, management of First Coast BankCorp and its auditors identified the following deficiencies that individually represent significant deficiencies: the design of controls over the estimation of credit losses (a critical accounting estimate); the operating effectiveness of controls for initiating, processing, and reviewing adiustments to the allowance for credit losses; and the operating effectiveness of controls designed to prevent and detect the improper recognition of interest income. In addition, during the past year, First Coast experienced a significant level of growth in the loan balances that were subjected to the controls governing credit loss estimation and revenue recognition, and further growth is expected in the upcoming year.

Answer 5

Based only on these facts, the auditor should determine that the combination of these significant deficiencies represents a material weakness for the following reasons:

First, the deficiency satisfies Box 1 – it relates to a financial statement assertion.

Second, the combination of these deficiencies was evaluated as representing a reasonably possible likelihood that a misstatement could occur (Box 2 is answered “yes”).

Third, the balances of the loan accounts affected by these deficiencies have increased over the past year and are expected to increase in the future. In addition, the growth in loan balances, coupled with the combined effect of the deficiencies described, results in a reasonably possible likelihood that a material misstatement of the allowance for credit losses or interest income could occur. Thus, Box 3 is answered “yes.”

Fourth, there are no effective compensating controls (Box 5 is answered “no”).

Finally, it is likely that a prudent official would conclude that these deficiencies represent a material weakness (answer to Box 6 is “yes”).

Question 6

For the following case, indicate why management and the auditors determined that the control deficiency was a material weakness:

In our assessment of the effectiveness of internal control over financial reporting as of December 31, 2021, we identified a material weakness over the accounting for and disclosure of derivatives associated with warrant instruments primarily because we lacked technical expertise and adequate procedures to develop and document our common stock warrant analysis on the applicability of ASC 815 “Derivatives and Hedging-Contracts in Entity’s Own Equity” to our warrant instruments. Because of the lack of technical expertise and adequate procedures to develop and document our analysis of the applicability of ASC 815, which was characterized as a material weakness with regard to accounting for warrants, management has concluded that we did not maintain effective ilternal control over financial reporting as of December 31, 2021, based on the criteria in Internal Control-Integrated Framework.

Answer 6

Case 1 would be deemed a material weakness because the company did not have proper controls over the accounting for and disclosure of derivatives that were associated with warrants.

The company’s management acknowledged that it did not have the expertise within the company to properly evaluate the analysis of the warrants under ASC 815.

The inability to perform such analysis by entity personnel would suggest that there is a high likelihood that a material misstatement could occur since we can assume that this financial statement account (and it related disclosures) are highly material.

Question 7

For the following case, indicate why management and the auditors determined that the control deficiency was a material weakness:

In the course of making our assessment of the effectiveness of internal control over financial reporting, we identified a material weakness in our internal control over financial reporting. The preparation and review process for the calculation of the tax provision was inadequate, which led to errors in the computation of deferred tax assets and related income tax benefit.

Answer 7

Case 2 is a material weakness because management acknowledges that its controls over the preparation of the tax provision was not adequate, and resulted in what can be assumed to be material errors.

Without proper controls, there is a high likelihood that a misstatement can occur.

It is also likely that the tax provision and related accounts are material to the financial statements.

Question 8

For the following case, indicate why management and the auditors determined that the control deficiency was a material weakness:

Management identified a material weakness in First Bank Company’s system of internal control over financial reporting with respect to ensuring the appropriate calculation of its allowance for loan losses. Specifically, during a process enhancement to the model that calculates the allowance for loan losses, the quarterly average loss rate was not annualized due to a computational error. Control procedures in place for reviewing the quantitative model for calculating the allowance for loan losses did not identify this error in a timely manner, and, as such, the company did not have adequately designed procedures.

Answer 8

Case 3 is a material weakness for a number of reasons.

First, there was a computational error in the update of the calculation of the allowance for loan losses.

Second, the monitoring controls for reviewing the calculation did not identify the error in a timely manner.

Finally, an error did occur and the allowance for loan losses account for a bank would be highly material.

Question 9

For the following independent situation, indicate the type of report on ICFR you would issue. Justify your report choice:

Hansen, Inc., has restated previously issued financial statements to reflect the correction of a misstatement.

Answer 9

If the misstatement resulted in a restatement of the financial statements, the misstatement would likely be considered material. Material misstatements are strong indicators of material weaknesses, thus necessitating an adverse opinion.

Question 10

For the following independent situation, indicate the type of report on ICFR you would issue. Justify your report choice:

Shu & Han Engineering does not have effective oversight of the entity’s external financial reporting.

Answer 10

If other controls over financial reporting are present, the auditor may issue an unqualified opinion. However, in most cases when oversight is considered seriously deficient, an adverse opinion would be issued.

Question 11

For the following independent situation, indicate the type of report on ICFR you would issue. Justify your report choice:

Kim Semiconductor has an ineffective audit committee.

Answer 11

The auditor would most likely issue an adverse opinion because of the importance of the audit committee in the control process.

Question 12

For the following independent situation, indicate the type of report on ICFR you would issue. Justify your report choice:

The internal audit function at Smith Components, a very large manufacturing company, was ineffective. The entity’s auditor has determined that the internal audit function needed to be effective in order for the entity to have an effective monitoring component.

Answer 12

If the ineffective monitoring component is a material weakness, then an adverse opinion should be issued. Because the auditor determined that an effective internal audit function was critical to effective monitoring, an adverse opinion would most likely be considered appropriate.

Question 13

For the following independent situation, indicate the type of report on ICFR you would issue. Justify your report choice:

The auditors of Benron identified significant financial statement fraud by the entity’s chief financial officer.

Answer 13

The significance of financial fraud by the CFO is a material weakness and an adverse opinion should be issued.

Question 14

For the following independent situation, indicate the type of report on ICFR you would issue. Justify your report choice:

Conroy Trucking Company has an ineffective control environment.

Answer 14

Depending on the amount of risk of material misstatement due to the ineffective control environment, the auditor will issue an adverse opinion or an unqualified opinion.

In most cases, an ineffective control environment will result in an adverse opinion because it is considered a pervasive entity-level control.

Question 15

For the following independent situation, indicate the type of report on ICFR you would issue. Justify your report choice:

Edwards & Eddins, CPAs, communicated significant deficiencies to Waste Disposal’s management and the audit committee for the last two years. At the end of the current year, these significant deficiencies remain uncorrected.

Answer 15

Given the lack of management’s concern for internal control, which can be considered a control environment issue, an adverse opinion would most likely be issued, depending on the nature and severity and the combined effect of the significant deficiencies that were left uncorrected.

Question 16

For the following independent situation relating to the audit of ICFR, indicate the reason for and the type of audit report you would issue:

During the audit of Wood Pharmaceuticals, you are surprised to find several control deficiencies in the entity’s internal control. You determine that there is a reasonable possibility that any one of them could result in a misstatement that is significant. Although the odds are extremely low that the deficiencies, singly or taken together, will result in a material misstatement of the entity’s financial statements, the large number of problems causes you concern. Management’s written assessment concludes that the entity’s ICFR was effective as of the report date.

Answer 16

The auditor would most likely issue an unqualified opinion on the effectiveness of internal control. Significant deficiencies do not necessitate an adverse opinion. In this case, the likelihood is extremely low that the deficiencies taken individually or together will result in a material misstatement, meaning that there is no material weakness.

If the significant deficiencies remain uncorrected in future years, the auditor may conclude that management’s attitude toward internal control reflects a poor control environment and may issue an adverse opinion in that future period.

Question 17

For the following independent situation relating to the audit of ICFR, indicate the reason for and the type of audit report you would issue:

You agreed to perform an audit for Rodriguez & Co., after the entity’s year-end. Due to time constraints, your audit firm could not complete a full audit of ICFR. However, the evidence you did collect suggests that the entity has exceptionally strong ICFR. You seriously doubt that a material weakness would have been found if time had permitted a more thorough audit. Management’s written assessment concludes that the entity’s ICFR was effective as of the report date.

Answer 17

A disclaimer of opinion on the effectiveness of internal control because the auditor has a scope limitation.

The auditor must have sufficient appropriate evidence to conclude that the entity’s ICFR is effective—surmising based on partial results does not constitute a high level of assurance.

Question 18

For the following independent situation relating to the audit of ICFR, indicate the reason for and the type of audit report you would issue:

George & Diana Company’s internal audit function identified a material weakness in the entity’s ICFR. The entity corrected this weakness about four months prior to the end of the annual reporting period. Management reassessed controls in the area and found them effective. After reevaluating and retesting the relevant controls, you believe the controls to have been effective for a sufficient period of time to provide adequate evidence that they were designed and operating effectively as of the end of the entity’s reporting period. Management’s written assessment concludes that the entity’s internal control was effective as of the report date.

Answer 18

Unqualified opinion on the effectiveness of internal control. The audit of internal control is “as of” the report date.

In other words, so long as the auditor has sufficient evidence that the entity’s internal control was operating effectively as of the end of the reporting period, an unqualified opinion can be expressed.

This gives management an opportunity to remediate weaknesses and avoid an adverse opinion so long as enough time is left for management to reassess and for the auditor to retest controls and obtain sufficient competent evidence that controls were effective as of the report date.

Question 19

For the following independent situation relating to the audit of ICFR, indicate the reason for and the type of audit report you would issue:

Reynolds’ Distilleries identified what you agree is a material weakness and made an adverse assessment in its report on ICFR. The entity had not corrected the material weakness as of the end of the reporting period.

Answer 19

An adverse opinion with respect to effectiveness of ICFR. The presence of a material weakness as of the report date necessitates an adverse opinion with respect to internal control.

Question 20

For the following independent situation relating to the audit of ICFR, indicate the reason for and the type of audit report you would issue:

Cindy & David Company’s management identified a material weakness in the entity’s ICFR during its assessment process. The entity corrected this weakness about a month prior to the end of the annual reporting period.
Management reassessed controls in the area and believes they were effective as of the end of the reporting period.
After reevaluating and retesting the relevant controls, you agree that the new controls are well designed, but since the controls over this particular area are applied only once at the end of each month (i.e., the controls have only operated two times since being corrected), you do not believe you have sufficient audit evidence to assess their operating effectiveness. Management’s written assessment concludes that the entity’s internal control was effective as of the report date.

Answer 20

The auditor would most likely issue a disclaimer on the effectiveness of internal control due to a scope limitation.

The auditor’s inability to collect sufficient data to assess the operating effectiveness of the control constitutes a scope limitation, and the opinion should be modified accordingly.

However, after the auditor completes testing in the following year and if controls were found to be operating effectively, an interim report on the effectiveness of internal controls could be issued.

Question 21

For the following independent situation relating to the audit of ICFR, indicate the reason for and the type of audit report you would issue:

During the audit of ICFR for Big Al & Larry Industries, you discover several control deficiencies. You determine that there is more than a reasonable possibility that any one of them could result in a financial statement misstatement. Although you do not believe that any of the deficiencies taken individually will result in a material misstatement, you believe there is a moderately low likelihood that, taken together, the deficiencies could produce a material misstatement. Management’s written assessment concludes that the entity’s internal control was effective as of the report date.

Answer 21

Adverse opinion on the effectiveness of internal control. Because the significant deficiencies identified, taken together, produce a “moderately low” risk of material misstatement in the financial statements, this likelihood assessment is within the range of “reasonably possible,” and thus, this combination of deficiencies is considered a material weakness.

Question 22

Read the following scenario and answer the questions below:

The company processes a significant number of routine intercompany transactions monthly. Individual intercompany transactions are not material and primarily relate to balance sheet activity, for example, cash transfers between business units to finance normal operations. A formal management policy requires monthly reconciliation of intercompany accounts and confirmation of balances between business units. However, there is not a process in place to ensure performance of these procedures. As a result, detailed reconciliations of intercompany accounts are not performed on a timely basis. Management does perform monthly procedures to investigate selected large-dollar intercompany account differences. In addition, management prepares a detailed monthly variance analysis of operating expenses to assess their reasonableness.

Part A) Evaluate the deficiency in internal control above. (1) Explain what type of deficiency is presented, and (2) include an explanation of how you arrived at your answer.

Part B) What type of audit report would be issued if the item above is the only deficiency in internal control identified?

Answer 22

Part B) SIGNIFICANT DEFICIENCY -> Magnitude: Amounts more than inconsequential but less than material because individual intercompany transactions are not material, and the compensating controls operating monthly should detect a material misstatement. Controls do not detect misstatements more than inconsequential but less than material, so likelihood is more than remote.

Part B) Unqualified

Question 23

Read the following scenario and answer the questions below:

Sir Big Spur, LLC processes a significant number of intercompany transactions monthly. Intercompany transactions relate to a wide range of activities, including transfers of inventory with intercompany profit between business units, allocation of research and development costs to business units and corporate charges. Individual intercompany transactions are frequently material. A formal management policy requires monthly reconciliation of intercompany accounts and confirmation of balances between business units. However, there is not a process in place to ensure that these procedures are performed on a consistent basis. As a result, reconciliations of intercompany accounts are not performed on a timely basis, and differences in intercompany accounts are frequent and significant. Management does not perform any alternative controls to investigate significant intercompany account differences.

Part A) Evaluate the deficiency in internal control above. (1) Explain what type of deficiency is presented, and (2) include an explanation of how you arrived at your answer.

Part B) What type of audit report would be issued if the item above is the only deficiency in internal control identified?

Answer 23

Part A) MATERIAL WEAKNESS -> Magnitude: Material because individual intercompany transactions are frequently material. The likelihood of such a misstatement is more than remote because such misstatements have frequently occurred and compensating controls are not effective, either because they are not properly designed or not operating effectively.

Part B) Adverse

Question 24

List the 3 classifications of deficiencies in internal control identified by the PCOAB in AS 2201, and state to whom the auditor must report each of the classifications of deficiencies:

Answer 24

1) CONTROL DEFICIENCY -> MANAGEMENT
2) SIGNIFICANT DEFICIENCY -> MANAGEMENT + AUDIT COMMITTEE
3) MATERIAL WEAKNESS -> MANAGEMENT + AUDIT COMMITTEE + PUBLIC/EXTERNAL

Question 25

An “integrated audit” as stated in Section 404 of the Sarbanes- Oxley Act means:
a) the auditor must consider the integrated thoughts and ideas of everyone on the audit staff.
b) the auditor must conduct two audits, one on the effectiveness of internal control and one on the financial statements, in an integrated way.
c) the auditor must integrate the same objectives whether auditing internal control or auditing the financial statements.
d) two independent CPA firms must work together on the audit.

Answer 25

b) the auditor must conduct two audits, one on the effectiveness of internal control and one on the financial statements, in an integrated way.

Question 26

Which of the following controls would most likely be tested
during an interim period?
A. controls over transactions that involve a high degree of subjectivity
B. controls over the period-end financial reporting process
C. controls over nonroutine transactions
D. controls that operate on a continuous basis

Answer 26

D. controls that operate on a continuous basis

Question 27

Which of the following statements concerning control deficiencies is true?
a) Auditors are required to report all control deficiencies to the audit committee.
b) The two dimensions of control deficiencies are likelihood of occurrence and magnitude.
c) A control deficiency is a type of significant deficiency.
d) Significant deficiencies are a subset of material weaknesses that must be reported to the public.

Answer 27

b) The two dimensions of control deficiencies are likelihood of occurrence and magnitude.

Question 28

2 Dimensions to determine what type of deficiency?

Answer 28

1) Magnitude
2) Likelihood

Question 29

What are the public companies 2 audit reports?

Answer 29

1) financial statement
2) effectiveness of IC (ICFR)

Question 30

More than minor effect of Scope Limitation = what type of audit report?

Answer 30

Disclaim opinion or withdraw

Question 31

Minor Effect of Scope Limitation = what type of audit report?

Answer 31

unqualified opinion

Question 32

Material Weakness = what type of audit report?

Answer 32

adverse opinion

Question 33

Control Deficiency or Significant Deficiency = what type of audit report?

Answer 33

unqualified opinion

Question 34

Control Deficiency

Answer 34

When the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

(Broadest out of the deficiencies)

• not material or significant
• likelihood = Reasonable possible / probable -> report to management
• likelihood = remote -> N/A

Question 35

Significant Dificiency

Answer 35

A control deficiency, or combination of control deficiencies, in ICFR that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.

(part of control deficiency but not part of material weakness)

• not material but significant
• likelihood = Reasonable possible / probable-> report to audit committee & to management
• likelihood = remote -> N/A

Question 36

Material Weakness

Answer 36

A deficiency, or combination of deficiencies, in ICFR, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis

(narrowest -> part of control deficiency & significant deficiency)

• material
• likelihood = Reasonable possible / probable -> report externally to audit committee & to management
• likelihood = remote -> N/A

Question 37

Under what circumstances would an auditor disclaim an opinion on the effectiveness of an entity’s ICFR?

Answer 37

If the scope of the auditor’s work is limited, the auditor may disclaim an opinion, depending on the severity of the limitation and whether or not management intentionally imposes it.

Question 38

Under what circumstances would an auditor give an adverse opinion on the effectiveness of an entity’s ICFR?

Answer 38

The auditor will issue an adverse opinion on the effectiveness of internal control if a material weakness is identified.

Question 39

What are the types of reports that an auditor can issue for an audit of ICFR? Briefly identify the circumstances justifying each type of report.

Answer 39

The auditor’s unqualified opinion on the effectiveness of an entity’s internal control signifies that the entity’s internal control is designed and operating effectively in all material respects.

Significant deficiencies relate to possible financial statement errors that are less than material, and therefore do not require a departure from an unqualified opinion.

A serious scope limitation requires the auditor to disclaim an opinion.

An adverse opinion is required if a material weakness is identified.

Question 40

Describe what is meant when management remediates a material weakness. If a material weakness is remediated and sufficiently tested before the “as of” date, what can management assert about ICFR?
Explain why.

Answer 40

Remediation is when an entity determines that it has a material weakness and takes steps to correct it.

If management corrects a material weakness before the “as of” date, and both management and the auditor can adequately test the operating effectiveness of the control, management can assert that ICFR is effective because it will be effective as of the financial reporting date.

Question 41

AS 2201 indicates that certain circumstances are indicators of a material weakness. What are these circumstances, and why do you think the PCAOB assessed them as being of such importance?

Answer 41

1) Identification of fraud, whether or not material, on the part of senior management.
2) Restatement of previously issued financial statements to reflect the correction of a material
misstatement.
3) Identification by the auditor of a material misstatement of financial statements in the current period in circumstances that indicate that the misstatement would not have been detected by the entity’s
internal control over financial reporting.
4) Ineffective oversight of the entity’s external financial reporting and internal control over financial
reporting by the entity’s audit committee.

• These circumstances are “red flags” for potential problems in the control environment.
• Because the nature of the audit report depends on the significance of such weaknesses, the PCAOB does not want them to be overlooked.

Question 42

Describe how the terms likelihood and magnitude play a role in evaluating the significance of a control deficiency.

Answer 42

“Likelihood” refers to the probability that a misstatement will not be prevented or detected.
- For a control deficiency, significant deficiency, or a material weakness to exist, the likelihood of such an occurrence must be either “reasonably possible” or “probable.”

“Magnitude” refers to the amount of a potential misstatement that could result from the control deficiency according to the judgment of a prudent official who considers the possibility of further, undetected, misstatements.
- If the auditor’s likelihood assessment is at least “reasonably possible”, the magnitude of the deficiency determines the classification as either a control deficiency, significant deficiency, or material weakness.

Question 43

What should the auditor do when a significant period of time has elapsed between the service organization auditor’s report and the date of management’s assessment?

Answer 43

When a significant period of time has elapsed between the time period covered by the tests of controls in the service auditor’s report and the date of management’s assessment, additional procedures should be performed.

The auditor should consider the results of relevant procedures performed by management or the auditor, how much time has passed since the service auditor’s report, the significance of the activities of the service organization, whether errors have been identified in the service organization’s processing, and the nature and significance of any changes in the service organization’s controls.

As these factors increase in significance, the need for the auditor to obtain additional evidence increases.

Question 44

What are the auditor’s documentation requirements for an audit of ICFR?

Answer 44

AS 2201 requires that the auditor appropriately document the processes, procedures, judgments, and results relating to the audit of internal control.

The auditor’s documentation must include the auditor’s understanding and evaluation of the design of each of the components of the entity’s ICFR.

The auditor also documents the process used to determine, and the points at which misstatements could occur within, significant accounts, disclosures, and major classes of transactions.

The auditor must justify and document the extent to which he or she relied upon work performed by others.

Finally, the auditor must describe the evaluation of any deficiencies discovered as well as any other findings that could result in a modification to the auditor’s report.

Question 45

A walkthrough involves tracing a transaction through the information system. What types of evidence can an auditor obtain by performing a walkthrough?

Answer 45

Walkthroughs help the auditor to confirm his or her understanding of control design and transaction process flow, to determine whether all points at which misstatements could occur have been identified, to evaluate the effectiveness of the design of controls, and to confirm whether controls have been placed in operation.

Walkthroughs typically do not provide evidence of the operating effectiveness of controls.

A typical walkthrough involves observation, inquiry, and inspection of documents.

Question 46

The period-end financial reporting process controls are always important. What are those controls, why are they important, and what should the auditor’s evaluation of those controls include?

Answer 46

The period-end financial reporting process controls include procedures used to enter transaction totals into the general ledger; initiate, authorize, record, and process journal entries in the general ledger; record recurring and nonrecurring adjustments to the annual and quarterly financial statements; and draft annual and quarterly financial statements and related disclosures.

The auditor’s evaluation of the period-end financial reporting process includes the inputs, procedures performed, and outputs of the processes the company uses to produce its annual and quarterly financial statements.

The auditor should also consider the extent of IT involvement in each period-end financial reporting process element, who participates from management, the number of locations involved, types of adjusting entries, and the nature and extent of the oversight of the process by appropriate parties, including management, the board of directors, and the audit committee.

Question 47

Describe the steps auditors take when identifying the controls to test using a top-down, risk-based approach.

Answer 47

1) Identify entity-level controls
2) Identify significant accounts and disclosures and their relevant assertions
3) Understand likely sources of misstatement
4) Select controls to test

Question 48

How does the auditor evaluate the competence of others who perform work for management?

Answer 48

1) Whether the IAF is adequately and appropriately resourced relative to the size of the entity and the nature of its operations.
2) Whether established policies for hiring, training, and assigning internal auditors to internal audit engagements exist.
3) Whether the internal auditors have adequate technical training and proficiency in auditing.
4) Whether the internal auditors possess the required knowledge relating to the entity’s financial reporting and the applicable financial reporting framework and whether the IAF possesses the necessary skills to perform work related to the entity’s financial statements.
4) Whether the internal auditors are members of relevant professional bodies that oblige them to
comply with the relevant professional standards, including continuing professional development requirements.

Question 49

How does the auditor evaluate the objectivity of others who perform work for management?

Answer 49

1) Whether the organizational status of the IAF, including the function’s authority and accountability, supports the ability of the function to be free from bias, conflict of interest, or undue influence of others to override professional judgments.
2) Whether the IAF is free of any conflicting responsibilities
3) Whether audit committee oversees employment decisions related to the IAF.
4) Whether any constraints or restrictions placed on the IAF by management or audit committee exist
5) Whether the internal auditors are members of relevant professional bodies and their memberships
obligate their compliance with relevant professional standards relating to objectivity or whether their internal policies achieve the same objectives.

Question 50

List the steps in the auditor’s process for an audit of ICFR.

Answer 50

1) Plan the audit of ICFR.
2) Identify controls to test using a top-down, risk-based approach.
3) Test the design and operating effectiveness of selected controls.
4) Evaluate identified control deficiencies.
5) Form an opinion on the effectiveness of ICFR.

Question 51

Describe what factors management and the auditor consider when determining which locations or business units to test.

Answer 51

Management and the auditor make similar decisions deciding which locations or business units to include for testing.

Thus, the choice of which locations to include in the assessment of internal control is based on the presence of entity-level controls and the financial reporting risk at each individual location or business unit.

Question 52

The first element in management’s process for assessing the effectiveness of internal control is determining which controls should be tested. Describe what controls management would likely decide to test as part of their assessment of ICFR.

Answer 52

1) Entity-level controls
2) Controls over initiating, authorizing, recording, processing, and reporting significant accounts and
disclosures and related assertions embodied in the financial statements.
3) Controls over the selection and application of accounting policies that are in conformity with GAAP.
4) Antifraud programs and controls.
5) Controls, including IT general controls, on which other controls are dependent.
6) Controls over significant nonroutine and nonsystematic transactions, such as accounts involving judgments and estimates.

Question 53

Briefly summarize the auditor’s basic responsibilities under Section 404 of the Sarbanes-Oxley Act of 2002.

Answer 53

Auditor’s Responsibilities
1) For large publicly traded companies, the auditor must plan and perform the audit to obtain reasonable assurance about whether the entity maintained, in all material respects, effective internal control as of the date specified in management’s assessment.

2) The audit of internal control should be “integrated” with the financial statement audit, and should express an opinion on the effectiveness of the entity’s ICFR.

Question 54

Briefly summarize management’s responsibilities under Section 404 of the Sarbanes-Oxley Act of 2002.

Answer 54

1) Accept responsibility for the effectiveness of the entity’s ICFR.
2) Evaluate the effectiveness of the entity’s ICFR using suitable control criteria.
3) Support its evaluation with sufficient evidence, including documentation.
4) Present a written assessment of the effectiveness of the entity’s ICFR as of the end of the entity’s most recent fiscal year.

Question 55

A primary advantage of using generalized audit software packages to audit the financial statements of an entity that uses an IT system is that the auditor may:
a) Consider increasing the use of substantive tests of transactions in place of analytical procedures.
b) Substantiate the accuracy of data through self-checking digits and hash totals.
c) Reduce the level of required tests of controls to a relatively small amount.
d) Access information stored on computer files while having a limited understanding of the entity’s hardware and software features.

Answer 55

d) Access information stored on computer files while having a limited understanding of the entity’s hardware and software features.

Question 56

Which of the following most likely represents a weakness in internal control of an IT system?
a) The systems analyst reviews output and controls the distribution of output from the IT department.
b) The accounts payable clerk prepares data for computer processing and enters the data into the computer.
c) The systems programmer designs the operating and control functions of programs and participates in testing operating systems.
d) The control clerk establishes control over data received by the IT department and reconciles control totals after processing.

Answer 56

a) The systems analyst reviews output and controls the distribution of output from the IT department.

Question 57

Significant deficiencies and material weaknesses must be communicated to an entity’s audit committee because they represent:
a) Material fraud or illegal acts perpetrated by high-level management.
b) Disclosures of information that significantly contradict the auditor’s going concern assumption.
c) Significant deficiencies in the design or operation of internal control.
d) Potential manipulation or falsification of accounting records.

Answer 57

c) Significant deficiencies in the design or operation of internal control.

Question 58

Which of the following statements concerning control deficiencies is true?
a) The auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit.
b) All significant deficiencies are material weaknesses.
c) All control deficiencies are significant deficiencies.
d) An auditor must immediately report material weaknesses and significant deficiencies discovered during an audit to the PCAOB.

Answer 58

a) The auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit.

Question 59

In auditing ICFR for a public company, Emily finds that the entity has a significant subsidiary located in a foreign country. Emily’s accounting firm has no offices in that country, and the entity has thus engaged another reputable firm to conduct the audit of internal control for that subsidiary. The other auditor’s report indicates that there are no material weaknesses in the foreign subsidiary’s ICFR. What should Emilv do?
a) Disclaim an opinion because she cannot rely on the opinion of another auditor in dealing with a significant subsidiary.
b) Accept the other auditor’s opinion and express an unqualified opinion, making no reference to the other auditor’s report in her audit opinion.
c) Accept the other auditor’s opinion after evaluating the auditor’s work and make reference to the other auditor’s report in her audit opinion.
d) Qualify the opinion because she is unable to conduct the testing herself, and this constitutes a significant scope limitation.

Answer 59

c) Accept the other auditor’s opinion after evaluating the auditor’s work and make reference to the other auditor’s report in her audit opinion.

Question 60

In auditing a public company, Natalie, an auditor for N. M. Neal & Associates, identifies four deficiencies in ICFR. Three of the deficiencies are unlikely to result in financial misstatements that are material. One of the deficiencies is reasonably likely to result in misstatements that are not material but significant. What type of audit report should Natalie issue?
a) An unqualified report.
b) An adverse report.
c) A disclaimer of opinion.
d) An exculpatory opinion.

Answer 60

a) An unqualified report.

Question 61

AnnaLisa, an auditor for N. M. Neal & Associates, is prevented by the management of Lileah Company from auditing controls over inventory. Lileah is a public company. Management explains that controls over inventory were recently implemented by a highly regarded public accounting firm that the entity hired as a consultant and insists that it is a waste of time for AnnaLisa to evaluate these controls. Inventory is a material account, but procedures performed as part of the financial statement audit indicate the account is fairly stated. AnnaLisa found no material weaknesses in any other area of the entity’s internal control relating to financial reporting. What kind of report should AnnaLisa issue on the effectiveness of Lileah’s internal control?
a) An unqualified report.
b) An adverse report.
c) A disclaimer of opinion.
d) An exculpatory opinion.

Answer 61

c) A disclaimer of opinion.

Question 62

When auditors report on the effectiveness of internal control “as of” a specific date and obtain evidence about the operating effectiveness of controls at an interim date, which of the following items would be the least helpful in evaluating the additional evidence to gather for the remaining period?
a) Any significant changes that occurred in internal control subsequent to the interim date.
b) The length of the remaining period.
c) The specific controls tested prior to the “as of” date and the results of those tests.
d) The walkthrough of the control system conducted at interim.

Answer 62

d) The walkthrough of the control system conducted at interim.

Question 63

A walkthrough is one procedure used by an auditor as part of the internal control audit. A walkthrough requires an auditor to
a) Tour the organization’s facilities and locations before beginning any audit work.
b) Trace a transaction from every class of transactions from origination through the entity’s information system.
c) Trace a transaction from each major class of transactions from origination through the entity’s information system.
d) Trace a transaction from each major class of transactions from origination through the entity’s information system until it is reflected in the entity’s financial reports.

Answer 63

d) Trace a transaction from each major class of transactions from origination through the entity’s information system until it is reflected in the entity’s financial reports.

Question 64

If the financial reporting risks for a location are low and the entity has good entity-level controls, management may rely on which of the following for its assessment?
a) Document and test controls over specific risks.
b) Self-assessment processes in conjunction with entity-level controls.
c) Document and test entity-level controls over the entire entity.
d) Selective control test at that location.

Answer 64

b) Self-assessment processes in conjunction with entity-level controls.

Question 65

Which of the following controls would most likely be tested during an interim period?
a) Controls over nonroutine transactions.
b) Controls over the period-end financial reporting process.
c) Controls that operate on a continuous basis.
d) Controls over transactions that involve a high degree of subjectivity.

Answer 65

c) Controls that operate on a continuous basis.

Question 66

Entity-level controls can have a pervasive effect on the entity’s ability to meet the control criteria. Which one of the following is not an entity-level control?
a) Controls to monitor results of operations.
b) Management’s risk assessment process.
c) Controls to monitor the inventory taking process.
d) The period-end financial reporting process.

Answer 66

c) Controls to monitor the inventory taking process.

Question 67

Which of the following is not a factor that might affect the likelihood that a control deficiency could result in a misstatement in an account balance?
a) The susceptibility of the related assets or liability to loss or fraud.
b) The interaction or relationship of the control with other controls.
c) The financial statement amounts exposed to the deficiency.
d) The nature of the financial statement accounts, disclosures, and assertions involved.

Answer 67

c) The financial statement amounts exposed to the deficiency.

Question 68

A control deviation caused by an employee performing a control procedure that he or she is not authorized to perform is always considered a:
a) Deficiency in design.
b) Deficiency in operation.
c) Significant deficiency.
d) Material weakness.

Answer 68

b) Deficiency in operation.

Question 69

The Sarbanes-Oxley Act of 2002 requires management to include a report on the effectiveness of ICFR in the entity’s annual report. It also requires auditors to report on the effectiveness of ICFR for large public companies. Which of the following statements concerning these requirements is false?
a) The auditor should evaluate whether internal controls over financial reporting are designed and operating effectively.
b) Management’s report should state its responsibility for establishing and maintaining an adequate internal control system.
c) Management should identify material weaknesses in its report.
d) The auditor should provide recommendations for improving internal control in the audit report.

Answer 69

d) The auditor should provide recommendations for improving internal control in the audit report.

Question 70

Distinguish between generalized and custom audit software.

Answer 70

Generalized audit software (GAS) is generic software available for purchase by the general public and includes programs that allow the auditor to perform tests on computer files and databases.

GAS enables auditors to conduct similar computer-assisted audit techniques in different IT environments.

Alternatively, custom audit software is generally written by auditors for specific audit tasks.

Such programs are necessary when the entity’s computer system is not compatible with the auditor’s GAS or when the auditor wants to conduct some testing that may not be possible with the GAS.

Question 71

List the functions that can be performed by generalized audit software.

Answer 71

(1) file or database access
(2) selection of transactions that meet certain criteria
(3) arithmetic functions
(4) statistical analyses
(5) data integrity analyses
(6) report generation.