Surgent Audit Flashcards
Audit Exam
How to prevent Fraudulent sales?
Comparing sales invoices with shipping documents and approved customer orders before invoices are mailed is the best control in preventing invoices from being sent to allies in a fraudulent scheme, and sales from being recorded for fictitious transactions.
Fraudulent sales would not appear with the approved customer orders, but they would have a sales invoice and possibly a shipping document (depending on the scheme). Fictitious sales may have an invoice, but they would not have a shipping document. Comparing these three documents would highlight discrepancies and alert management to the sales schemes. This procedure is an example of authorization and documentation being used as a control.
What factors should the auditor consider when assessing control risks?
In exercising professional judgment about which controls to assess, the auditor should consider factors such as:
a). materiality,
b). the size of the entity,
c). the nature of the entity’s business,
d). the diversity and complexity of the entity’s operations,
e). applicable legal and regulatory requirements, and
e). the nature and complexity of the systems that are part of the
f). entity’s internal control.
An integrated audit is?
An integrated audit is an audit of internal control over financial reporting being integrated with the audit of financial statements.
To determine whether a particular assertion is relevant
To determine whether a particular assertion is relevant to a significant account balance or disclosure, the auditor should evaluate:
a). the nature of the assertion,
b). the volume of transactions or data related to the assertion, and
c). the nature and complexity of the systems, including the use of
information technology, by which the entity processes and
controls information supporting the assertion.
What assertions are about the classes of transactions?
Assertions about classes of transactions, and related disclosures, include the following:
* Occurrence
* Completeness
* Accuracy
* Cutoff
* Classification
* Presentation
What assertions are about account balances and related disclosures?
Assertions about account balances, and related disclosures, at the period-end include the following:
* Existence
* Rights and obligations
* Completeness
* Valuation and allocation
* Classification
* Presentation
Considerations for the auditor regarding plausibility and predictability of data include
Considerations for the auditor regarding plausibility and predictability of data include the following:
a. Sometimes data appear to be related when they are not; the auditor should understand the reasons that make relationships plausible.
b. The presence of an unexpected relationship can provide important evidence when appropriately scrutinized.
c. As higher levels of assurance are desired from analytical procedures, more predictable relationships are required to develop the expectation.
d. Relationships in a stable environment are usually more predictable than relationships in a dynamic or unstable environment.
e. Relationships involving income statement accounts tend to be more predictable than relationships involving only balance sheet accounts. (Income statement accounts represent transactions over a period of time, whereas balance sheet accounts represent amounts as of a point in time.)
f. Relationships involving transactions subject to management discretion are sometimes less predictable
What are assertions?
Assertions are any declaration or set of declarations about whether the underlying subject matter or subject matter information is in accordance with (or based on) the criteria (AT-C 105.10). An assertion is subject matter information. Assertions are representations by management that are embodied in the account balance, transaction class, and disclosure components of the financial statements (AU-C 315.A133).
Audit of internal controls over financial reporting integrated with an audit of financial statements, the auditor uses?
PCAOB Auditing Standard 2201, paragraph 1, states, “This standard establishes requirements and provides direction that applies when an auditor is engaged to perform an audit of management’s assessment of the effectiveness of internal control over financial reporting (‘the audit of internal control over financial reporting’) that is integrated with an audit of the financial statements
What is Internal Control Over Financial Reporting (ICFR)?
Internal control over financial reporting (ICFR) is a process effected by those charged with governance, management, and other personnel, designed to provide reasonable assurance regarding the preparation of reliable financial statements in accordance with the applicable financial reporting framework and includes those policies and procedures that:
* pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the entity;
* provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with the applicable financial reporting framework, and that receipts and expenditures of the entity are being made only in accordance with authorizations of management and those charged with governance; and
* provide reasonable assurance regarding prevention, or timely detection and correction of unauthorized acquisition, use, or disposition of the entity’s assets that could have a material effect on the financial statements.
ICFR has inherent limitations. ICFR is a process that involves human diligence and compliance and is subject to lapses in judgment and breakdowns resulting from human failures. ICFR also can be circumvented by collusion or improper management override. Because of such limitations, there is a risk that material misstatements will not be prevented, or detected and corrected, on a timely basis by ICFR.
The practitioner’s report on agreed-upon procedures on an entity’s compliance with specified requirements should contain?
The practitioner’s report on agreed-upon procedures on an entity’s compliance with specified requirements should contain an identification of the responsible party. The report should not include any form of negative assurance, opinion, or representation regarding the sufficiency of the procedures.
An agreed-upon procedures engagement is an attestation engagement in which a practitioner performs specific procedures on subject matter or an assertion and reports the findings without providing an opinion or a conclusion. (AT-C 105.10)
What are condensed financial statements?
Condensed financial statements are abbreviated, or less detailed than the full financial statements. When issuing an opinion on the condensed financial statements, the auditor should indicate:
* that he has audited the complete financial statements,
* the date of the audit report,
* the opinion expressed, and
* whether the condensed financial statements are fairly stated in all material respects in relation to the complete financial statements.
The assertion of valuation and allocation concerns?
The assertion of valuation and allocation concerns itself with whether asset, liability, revenue, and expense components are stated at appropriate dollar amounts. Examples of audit objectives under the financial statement assertion of valuation and allocation are:
* inventories are properly stated at cost (except when market is
lower),
* slow-moving, excess, defective, and obsolete items included
in
inventories are properly identified, and
* inventories are reduced, when appropriate, to replacement
cost
or net realizable value.
Attribute sampling is used for?
Attribute sampling is used for tests of controls. This type of sampling answers the question of “how many,” and the auditor would be looking for the appearance (or absence) of a specific characteristic. Identifying entries posted to incorrect accounts would be an example.
Reporting on internal control under Government Auditing Standards differs from GAAS in that?
GAS 4.19 states, “When providing an opinion or a disclaimer on financial statements, auditors should also report on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts, or grant agreements that have a material effect on the financial statements.”
The written report should describe each significant deficiency observed, and must include identification of those considered material weaknesses.
General controls are?
Examples of general controls are program change controls, controls that restrict access to programs or data, controls over the implementation of new releases of packaged software applications, and controls over system software that restrict access to or monitor the use of system utilities that could change financial data or records without leaving an audit trail.
What are applications controls?
Input controls, processing controls, and output controls are all examples of application controls.
what is the risk that the audit procedures implemented will not detect a material misstatement of a financial statement?
The assertion is detection risk (DR).
If an auditor selects a balance for testing and the client has a valid reason for its confirmation to not be sent?
The auditor needs to apply alternative procedures to the balance to test management’s assertions regarding that balance. An acceptable alternative procedure would be to confirm that the balance selected for confirmation was paid by the customer.
What is Inherent risk (IR)?
Inherent risk (IR) is the susceptibility of a relevant assertion to a misstatement that could be material, assuming that there are no related controls. The auditor would be looking for situations such as accounts that are more susceptible to misstatement or theft, complex calculations, amounts derived from accounting estimates, and business risks arising from outside the entity.
What is the risk that the internal control system will not detect a material misstatement of a financial statement ?
The assertion is Control Risk (CR).
How do I calculate the average number of days to collect A/R?
Accounts receivable turnover (or receivables turnover) is an activity ratio that measures efficiency of credit and collection policies with respect to trade accounts. It confirms the fairness of the receivable balance and reflects the relationship between trade receivables outstanding and credit sales for the period. (Lenient credit policies and poor collection efforts will decrease this ratio.)
Computation: Net credit sales ÷ Average AR
Average AR used is: (Beginning balance + Ending balance) ÷ 2
Limitations on use of this ratio: It should be computed on credit sales only; if using total sales, a shift in the percentage of credit sales to cash sales will affect the ratio. It can be affected by significant seasonal fluctuations unless the denominator is a weighted average.
What is the Average collection period?
Average collection period is an activity ratio that measures the average number of days needed to collect trade accounts receivable. It measures how rapidly the firm’s credit sales are being collected (the lower the ratio, the more efficient the collection).
Computation:
365 ÷ AR Turnover, or
365 ÷ (Net Credit Sales ÷ Average AR), or
Average AR ÷ Average Daily Sales, or
Average AR ÷ (Net Credit Sales ÷ 365).
Limitations on use of this ratio: The ratio should be computed on credit sales only (otherwise a shift in the percentage of credit sales to cash sales will affect the ratio)—use of total sales will affect the ratio. Average accounts receivable should be used, net of the allowance for doubtful accounts.
What is a Known Misstatement?
AU-C 450.04 defines “misstatement” as “a difference between the reported amount, classification, presentation, or disclosure of a financial statement item and the amount, classification, presentation, or disclosure that is required for the item to be presented fairly in accordance with the applicable financial reporting framework.”
An unrecorded liability resulting from a specific activity or invoice would be considered a (known) misstatement.
What is an Auditor’s Specialist?
When performing an audit, an auditor often encounters situations in accumulating evidence concerning account balances in which evidence is from fields beyond his expertise. An example might be evidence collected concerning the inventory valuation of fine jewelry. In such cases, the auditor may use the work of an auditor’s specialist. An auditor’s specialist is thus defined as a person (or firm) possessing knowledge in a particular field other than accounting or auditing. The auditor may use the findings of the auditor’s specialist as part of the audit evidence provided the auditor follows the guidelines set forth in AU-C 620.
If an unmodified opinion is issued, the use of a specialist should not be mentioned. In a qualified or adverse opinion, the use of a specialist should be mentioned only if it will help readers understand the reason of the qualification.
What is a Material Weakness?
A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis.
When the concept is applied to matters of internal control over compliance, a material weakness represents a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A reasonable possibility exists when the likelihood of an event occurring is either reasonably possible or probable as defined as follows:
* Reasonably possible: The chance of the future event
or events occurring is more than remote but less
than likely.
* Probable: The future event or events are likely to
occur.
What is an Integrated Audit?
An integrated audit is an audit of internal control over financial reporting being integrated with the audit of financial statements.
What is an Adverse Opinion?
An adverse opinion is an “overall” audit opinion which states that the financial statements do not present fairly the financial position or the results of operations or cash flows in conformity with an applicable financial reporting framework (AU-C 705.09). Auditors must have as much sufficient appropriate audit evidence to support an adverse opinion as for an unmodified opinion.
An adverse opinion is warranted when the departure from an applicable financial reporting framework or the inconsistency is sufficiently material or sufficiently pervasive as to misrepresent the financial position or results of operations or cash flows or when the auditor believes the entity is not a going concern.
An adverse opinion requires the disclosure of all the substantive reasons for the adverse opinion and the principal effects of the inconsistency on the financial statements, if known, or a statement in a separate emphasis-of-matter or other-matter paragraph preceding the opinion paragraph that the effects are not reasonably determinable.
What is a Deficiency (Internal Control)?
The auditor should evaluate the severity of each identified deficiency to determine whether the deficiency, individually or in combination, is a material weakness as of the date of management’s assertion. In evaluating the magnitude of the potential misstatement, the maximum amount by which an account balance or total of transactions can be overstated is generally the recorded amount, whereas understatements could be larger. If there are deficiencies that, individually or in combination, result in one or more material weaknesses as of the date specified in management’s assertion, the auditor should express an adverse opinion on the entity’s internal control.
What does the AICPA Code of Professional Conduct say impaired independence?
According to the AICPA Code of Professional Conduct, independence will be impaired if, during the period of the professional engagement, a covered member had or was committed to acquire any direct or material indirect financial interest in the client. The ownership of the bonds represents a direct financial interest in the client.
- Independence is not violated if a member is designated to
serve as guardian of a friend’s children if the need arises, and
the friend’s estate, which would be held in trust for the
children because the member is the children’s guardian, but
is not a trustee of the estate held in trust for the children. - Independence is not impaired by membership in a client
credit union. - According to an AICPA ethics ruling, as long as the
membership in the golf club is essentially a social matter, the
covered member’s association with the golf club would not
impair independence because the debt ownership is not
considered to be a direct financial interest.
What are SOC (System and Organization Controls) Reports?
AU-C 402 outlines the two types of SOC (System and Organization Controls) reports. Whereas the SOC® Type 2 engagement is principally focused on whether controls achieve operational effectiveness, the SOC® Type 1 engagement addresses whether controls are suitably designed.
What is require a modification due to Consistency?
A change in accounting estimate (such as a change in the useful life of a depreciable asset) is accounted for prospectively and does not affect the comparability of financial statements between periods. Since the auditor’s standard report implies that consistency exists, no modification to the report is necessary.
A change in the method of accounting for inventories and a change from an accounting principle that is not generally accepted to one that is generally accepted both represent a change in accounting principle, which requires a consistency modification.
If management adopts an accounting principle and has not provided reasonable justification for the change, the auditor should express a qualified opinion or an adverse opinion, depending on the materiality of the item.
What is Scienter?
The U.S. Supreme Court has ruled in Hochfelder that third parties must prove scienter in order to reach the CPA under Rule 10b-5 of the Securities Exchange Act of 1934. Scienter is intent to deceive, manipulate, or defraud on the CPA’s part. Simple negligence is not enough to hold the CPA responsible. Recovery under Rule 10b-5 is limited to the actual losses resulting from the fraud.
What is a Management Rep Letter?
Management must make certain representations to the auditor regarding the financial statements; the completeness of information provided to the auditor; recognition, measurement, and disclosure; and information concerning subsequent events.
The auditor would be looking for management to represent that the entity has complied with contractual agreements that may affect the financial statements.
What does Section 408 of the Sarbanes-Oxley Act (SOX) represent?
Section 408 of the Sarbanes-Oxley Act (SOX) dictates that the SEC will review disclosures made by issuers. Special attention will be paid to the disclosures of issuers:
- Who have issued material restatements of financial
statements, - Who experienced significant volatility in their stock
price, - Have the largest market capitalization,
- Are emerging companies with disparities in price to
earnings ratios, and - With operations that significantly affect any material
sector of the economy
What are Input controls?
Input controls relate most appropriately to rejection, correction, and resubmission of data that was initially incorrect.
There are four basic categories of input to be controlled:
1). transaction entries,
2). file maintenance transactions,
3). inquiry transaction entries, and
4). error correction transactions.
Edit checks on transaction entries are a type of input control. Edit checks test transactions prior to processing and are designed to ensure that invalid inputs are rejected. A file of all rejected sales transactions is output pertaining to input controls.
What are Sampling Risks?
Two types of sampling risk that affect performing tests of controls are:
- The risk of assessing control risk too low
- The risk of assessing control risk too high
If the auditor assesses control risk too high, which would occur if there were deviations from an internal control procedure in the sample, the auditor would then lower detection risk by altering the nature, timing, and extent of substantive audit procedures, reducing the risk that the auditor would not detect a misstatement in the financial statements.
Deviations from specific internal control procedures at a given rate ordinarily result in misstatements at a lower rate.
What is the primary focus in an Auditor’s Examination of Liabilities?
The primary focus of an auditor in the examination of liabilities (e.g., accounts payable) is to verify that all of the entity’s liabilities have been recorded. AU-C 315.A133 notes that assertions about completeness are concerned with whether all accounts that should be presented in the financial statements are recorded.
Completeness thus would be the assertion on which the auditor would concentrate in auditing the liability of accounts payable.
What are Tests of Controls (Information Systems) designed to assess?
Tests of controls are designed to assess the effectiveness of the information system and user control policy or procedure in preventing or detecting material errors or control weaknesses in the information systems and operations. Substantive tests relate to:
(1) analysis of information, such as tape aging analysis in
computer data files and storage media,
(2) computer resource usage statistics in computer
operations, and
(3) security violation exception reporting to detect
abnormalities and major problems in access control
security practice
OMB’s Uniform Guidance Rules Contain a “percentage of coverage” Rule states?
If the auditee meets the criteria for a low-risk auditee, the auditor only needs to audit the major programs that, in aggregate, encompass at least 20% of total federal awards expended. Otherwise (not low-risk), the auditor must audit the major programs that, in aggregate, encompass at least 40% of total federal awards expended.
What is Internal Control Inherent Limitation?
Internal control, even if well designed and operated, can only provide reasonable (not absolute) assurance about achieving objectives. Limitations include that human judgment can be faulty and that human errors or mistakes can cause breakdowns in internal controls. Controls can also be circumvented by management override or by collusion (two or more people working together).
What is gained by Comparing the control amounts posted in A/R?
Comparing the control amounts posted to the accounts receivable ledger with the control totals of invoices is the best procedure for preventing or detecting the generation of an invoice for shipped goods which is recorded in the sales journal but is not posted to any customer account.
The control amount for the accounts receivable ledger would be less than the control total of invoices if the sale were not posted to the customer’s account. This is an example of an independent check being used as a control.
What does Section 102 of the Sarbanes-Oxley Act (SOX) dictate?
Section 102 of the Sarbanes-Oxley Act (SOX) dictates that public accounting firms performing audits on issuers must register with the Public Company Accounting Oversight Board (PCAOB). The registration includes:
- a statement of the firm’s quality control policies,
- a list of the names and license numbers of all
accountants associated with the firm, - information regarding criminal, civil, or
administrative actions or disciplinary proceedings
against the firm (or any person in the firm), and - consent from the firm to cooperate and comply with
any request made by the PCAOB in furtherance of its
authority and responsibilities.
Once registered, the firm must submit annual reports along with registration and annual fees to the PCAOB.
Statistical Sampling?
Statistical Sampling uses the laws of probability to make statements about a population. It allows the auditor to calculate the risk of reliance on the sample to assess control risk, and enables the auditor to make objective statements about the population on the basis of the sample. Because the auditor is able to measure and control the sampling risk, the auditor is able to measure the sufficiency of the audit evidence obtained.
What does the Auditor’s Report (Performance Audit - Governmental Entity contain?
The auditor’s report for a performance audit of a governmental entity in accordance with Government Auditing Standards should contain:
- the objectives, scope, and methodology of the audit,
- the audit results, including findings, conclusions, and
recommendations, as appropriate, - a reference to compliance with generally accepted
government auditing standards, - the views of responsible officials, and
- if applicable, the nature of any privileged and
confidential information omitted.
A concurrent opinion on the historical financial statements is not the objective of the performance audit and is not required.
Who Accounting and Review Services Statements (AR) Committee?
The preface to the Accounting and Review Services Statements (AR) notes that the Accounting and Review Services Committee is the committee designated by the AICPA Council to promulgate standards in connection with unaudited financial statements of nonpublic entities. A nonpublic entity is any entity other than one whose securities trade on a stock exchange or over-the-counter market or that makes a filing with a regulatory agency in preparation for sale of securities (i.e., a nonpublic entity is not required to file financial statements with an agency regulating the issuance of the entity’s securities).
What is the purpose of a confirmation?
The purpose of a confirmation is to help the auditor verify client financial statement assertions. Confirmation requests can be prepared in two ways.
1). With a positive confirmation, third parties are either
asked to fill in amounts from their records regarding
transactions with the audit client, or
2). requested to indicate whether they agree with
information already stated in the confirmation. The
positive type of confirmation is a very strong form of
audit evidence.
With a negative confirmation, the third party usually responds only when the information provided by the auditor from the client’s records does not agree with the third party’s records. Negative confirmations are considered to be a weak form of evidence.
Therefore, if the combined assessed level of inherent risk and control risk relative to accounts receivable is low, the auditor is not relying heavily on the negative confirmation evidence due to the low levels of inherent risk and control risk already measured in the audit process.
What is the Completeness Assertion?
The completeness assertion deals with whether or not all of the transactions and events that should have been recorded have been recorded, and all related disclosures that should have been included in the financial statements have been included. If an order was shipped, were the corresponding revenue and receivable recorded? In order to determine that the control is in place, the auditor would make sure that an invoice has been prepared for each shipping document.
What are Fraud Risk Factors (Management)?
Unusual lines of authority may be a red flag because they may indicate undue influence on an operating unit from the corporate headquarters. Some of the fraud risk factors relating to management’s characteristics include the following (AU-C 240.A76):
- Domination of management by a single person or
small group without compensating controls - Management failure to correct known significant
deficiencies or material weaknesses in internal
control on a timely basis - Management’s excessive interest in maintaining or
increasing the entity’s stock price or earnings trend - Nonfinancial management’s excessive participation
in the selection of accounting principles.
What are Analytical procedures?
Analytical procedures used in planning the audit may be helpful in identifying the existence of unusual transactions or events, and amounts, ratios, and trends that might indicate matters that have financial statement and audit implications. These procedures are usually performed at a high level; for example, comparing current-year to prior-year sales volumes.
Ratio analysis, such as comparing the current-year ratio of aggregate salaries paid to the number of employees to the prior year’s ratio, would be an example of an analytical procedure used as a substantive test (not one used during the planning phase of an audit). Analytical procedures rely on comparisons of recorded amounts, or ratios developed from recorded amounts, to expectations developed by the auditor.
Material misstatements due to fraudulent financial reporting?
Material misstatements due to fraudulent financial reporting often result from an overstatement of revenues (for example, through premature revenue recognition or recording fictitious revenues) or an understatement of revenues (for example, through improperly shifting revenues to a later period). Therefore, the auditor should ordinarily presume that there is a risk of material misstatement due to fraud relating to revenue recognition.
The two accounts that relate to revenue recognition are cash (money received from customers for valid sales should be reflected in cash) and accounts receivable (sales made on account would be recorded in accounts receivable). The sales income account would also relate to revenue recognition.
What do Analytical procedures entail?
Analytical procedures entail the study of relationships between financial and nonfinancial data sets. While these procedures may be applied to data contained on supporting documentation, these physical artifacts do not represent an analytical technique in and of themselves.
The evaluation of the operating effectiveness of an internal control is concerned with?
The evaluation of the operating effectiveness of an internal control is concerned with how the control was applied (whether manual or automated), the consistency with which it was applied, and by whom it was applied. Inspection of documents and reports, and observation and inquiry of client personnel would assist with evaluating operating effectiveness.
Preparation of system flowcharts, however, assists the auditor with understanding the design of the internal control, not the operating effectiveness. Flowcharts would provide the least assurance about the operating effectiveness of an internal control.
Applying substantive tests at an interim date would?
Applying substantive tests at an interim date, rather than at the balance sheet date, increases audit risk that a misstatement may occur between the interim and year-end dates and exist at the balance sheet date. This increase in risk is the incremental audit risk. Therefore, before auditing asset accounts at an interim date, an auditor should assess the difficulty in controlling the incremental audit risk (i.e., extending the audit conclusion over the remaining period from the interim date to the balance sheet date).
The risk of incorrect rejection is part of sampling risk, and it is present whether the tests of details are performed at an interim date or as of the balance sheet date. Likewise, sampling risk (the risk that the auditor’s conclusion based on a sample might be different from the conclusion that would be reached by examining every item in the entire population) is not dependent upon when the tests are applied. Materiality considerations are not linked to the timing of audit procedures.
The risk of incorrect rejection is?
The risk of incorrect rejection is part of sampling risk, and it is present whether the tests of details are performed at an interim date or as of the balance sheet date. Likewise, sampling risk (the risk that the auditor’s conclusion based on a sample might be different from the conclusion that would be reached by examining every item in the entire population) is not dependent upon when the tests are applied. Materiality considerations are not linked to the timing of audit procedures.
The direct communication with external legal counsel should?
The direct communication with external legal counsel should obtain evidence about any litigation, claims, assessments, and unasserted claims that counsel is aware of, together with an assessment of the outcome and an estimate of the financial implications. Given that a lawyer may limit a response to matters to which the lawyer has given substantive attention and to matters which individually or collectively are material to the financial statements, the choice which requires further investigation would be the comment about the company being able to assert meritorious defenses.
What is a Meritorious defense?
Meritorious defense addresses the substance or essentials of a case rather than technical objections or delaying tactics. It can be a defense that is based on evidence sufficient to warrant setting aside a default judgment against the defendant in civil litigation. It can also refer to a defense that appears likely to succeed or has already succeeded. The auditor would need to determine if the outcome is probable, reasonably possible, or remote, and then determine if a loss accrual is required under the circumstances.
Payroll control objectives include
Payroll control objectives include:
- proper authorization of new employees,
- no fictitious employees included in the payroll,
- all terminated employees removed from payroll,
- employees paid authorized amounts,
- all transactions recorded correctly,
- detailed records maintained, and
- government regulations complied with.
Having salary rates and total hours to be paid approved by the payroll supervisor and having unclaimed checks forwarded to absent employee’s supervisors all contribute to undermining the payroll control objectives of payment of authorized amounts and no payments to fictitious employees.
The written communication regarding significant deficiencies and material weaknesses identified during the audit should?
The written communication regarding significant deficiencies and material weaknesses identified during the audit of financial statements should:
- include a statement that indicates the purpose of the
auditor’s consideration of internal control was to
express an opinion on the financial statements, but
not to express an opinion on the effectiveness of the
entity’s internal control over financial reporting. - include a statement that indicates the auditor is not
expressing an opinion on the effectiveness of internal
control. - include a statement that indicates that the auditor’s
consideration of internal control was not designed to
identify all deficiencies in internal control that might
be significant deficiencies or material weaknesses. - include the definition of the term “material
weakness” and, where relevant, the definition of the
term “significant deficiency.” - identify the matters that are considered to be
significant deficiencies and, if applicable, those that
are considered to be material weaknesses. - include a statement that indicates the
communication is intended solely for the information
and use of management, those charged with
governance, and others within the organization and
is not intended to be and should not be used by
anyone other than these specified parties. If an entity
is required to furnish such auditor communications to
a governmental authority, specific reference to such
governmental authorities may be made.
What factors do auditor’s consider regarding the reliability of the data?
AU-C 520.A17 identifies four(4) factors relating to the auditor’s consideration of the reliability of the data for purposes of achieving audit objectives:
- The source of the information available: Whether the
sources within the entity were independent of those
who are responsible for the amount being audited - The comparability of the information available:
Whether the data is comparable to broad industry
data - The nature and relevance of the information
available: Whether budgets have been established as
results to be expected rather than as goals to be
achieved - Controls over the preparation of the information that
are designed to ensure its completeness, accuracy,
and validity: Whether the data was developed under
a reliable system with adequate controlsWhile processing data in an EDP system may be more reliable than manual systems, manual systems have been shown to be effective in terms of reliability of data. Thus, processing data in an EDP system or in a manual system would least influence the auditor's consideration.
Which of the following does an auditor usually confirm on one form?
Since both cash in bank and collateral for loans are amounts that can be verified by the entity’s bank, auditors usually use one form to ask for confirmation of both of these balances.
Quality control standards?
Quality control (QC) standards are a CPA firm’s system of specified standards that are required to be developed to assure that firm is in compliance with professional standards for the services it provides. Services included are:
- Auditing, Accounting, and Review,
- Consulting Practices, and
- Tax Practices.
Quality control standards relate to the conduct of a firm’s attestation practice as a whole, Accounting firms and individual practitioners have an obligation to establish and maintain a system of quality control to provide reasonable assurance that the firm/practitioner complies with professional standards and applicable legal and regulatory requirements. Within the context of the system of quality control, engagement teams have a responsibility to implement quality control procedures that are applicable to the attestation engagement and provide the firm with relevant information to enable the functioning of that part of the firm’s quality control relating to independence.
Attestation standards relate to?
Attestation standards relate to the conduct of individual attestation engagements.
The GAO (U.S. Government Accountability Office) Yellow Book, requires auditors to document?
The GAO (U.S. Government Accountability Office) Yellow Book, containing the generally accepted government auditing standards, requires auditors to document justification of deviations from presumptively mandatory procedures.
The additional items and responsibilities required by Government Auditing Standards are?
The additional items and responsibilities required by Government Auditing Standards relate to the following:
a. Reporting auditor compliance with GAGAS
b. Reporting on internal control and compliance with provisions
of laws, regulations, contracts, and grant agreements. Some
governmental audit requirements specifically identify the
applicable compliance requirements.
c. Communicating deficiencies in internal control, fraud,
noncompliance with provisions of laws, regulations, contracts,
and grant agreements, and abuse. For instance, government
audits require tests of the operating effectiveness of controls.
d. Materiality is generally in relation to the government as a
whole; however, the government audit requirement may
specify a different level of materiality at one or more levels,
such as by major program.
e. In identifying and assessing the risks of material
noncompliance, the auditor may evaluate inherent risk of
noncompliance and control risk of noncompliance
individually or in combination.
f. Reporting views of responsible officials
g. Reporting confidential or sensitive information
h. The auditor’s report must include a schedule of
findings and questioned costs.
i. Documenting justification of deviations from
presumptively mandatory procedures
j. Distributing reports
The SSARS list two(2) categories of professional requirements?
Defining professional responsibilities: The SSARS list two(2) categories of professional requirements:
1). Unconditional requirements: indicated by the use of
the word “must”
2). Presumptively mandatory requirements: indicated by
the use of the word “should”
Based on Rule 3521 of the Public Company Accounting Oversight Board, contingent fees and commission will?
Based on Rule 3521 of the Public Company Accounting Oversight Board, contingent fees and commission will result in a lack of independence for the registered public accounting firm.
Ethical principles that guide the work of auditors who conduct audits in accordance with generally accepted government auditing standards (GAGAS) ?
According to GAS (Government Auditing Standards) 1.14, the ethical principles that guide the work of auditors who conduct audits in accordance with generally accepted government auditing standards (GAGAS) are:
1). the public interest;
2). integrity;
3). objectivity;
4). proper use of government information, resources, and
positions; and
5). professional behavior.
The “public interest” is defined in the government standards as “the collective well-being of the community of people and the entities the auditors serve” (GAS 1.15). Integrity includes “auditors conducting their work with an attitude that is objective, fact-based, nonpartisan, and nonideological with regard to audited entities and users of the auditors’ reports” (GAS 1.17). Government information is “to be used for official purposes and not inappropriately for the auditor’s personal gain or in a manner contrary to law or detrimental to the legitimate interests of the audited entity or the audit organization” (GAS 1.20).
Materiality in GAGAS financial audits is considered an “additional consideration” in GAGAS audits (GAS 4.46).
The risk of assessing control risk too high is?
The risk of assessing control risk too high is the risk that the assessed level of control risk based on the sample is greater than the true operating effectiveness of the control. In other words, the sample tested by the auditor has a higher rate of deviation than the full population does. Based on the testing, the auditor assesses control risk higher than he or she would if the auditor had tested the whole population.
The auditor is concerned with two aspects of sampling risk in performing tests of controls:
- The risk of assessing control risk too low (also called
beta risk) - The risk of assessing control risk too high (also called
alpha risk)
The risk of assessing control risk too high is the risk that the assessed level of control risk based on the sample is greater than the true operating effectiveness of the control.
Test of Controls Reliable Unreliable
Sample: Clients Internal Control Structure is:
Accept Correct decision Risk to low
Reject Risk Too High Correct decision
The risk of assessing control risk too low is the risk that the assessed level of control risk based on the sample is less than the true operating effectiveness of the control.
The risk of assessing control risk too low is the risk that the assessed level of control risk based on the sample is less than the true operating effectiveness of the control.
Preparation and fair presentation of accounting estimates?
AU-C 540.A15 states, “The preparation and fair presentation of the financial statements requires management to determine whether a transaction, an event, or a condition gives rise to the need to make an accounting estimate and that all necessary accounting estimates have been recognized, measured, and disclosed in the financial statements in accordance with the applicable financial reporting framework.”
AU-C 540.A21 states: “The preparation and fair presentation of the financial statements also requires management to establish financial reporting processes for making accounting estimates, including adequate internal control. Such processes include the following:
- “Selecting appropriate accounting policies and
prescribing estimation processes, including
appropriate estimation or valuation techniques,
including, when applicable, the appropriate models - “Developing or identifying relevant data and
assumptions that affect accounting estimates - “Periodically reviewing the circumstances that give
rise to the accounting estimates and reestimating the
accounting estimates as necessary”
The auditor should read a report on the controls at the service organization when?
AU-C 402.16 indicates that if a user auditor’s risk assessment includes an expectation that controls at the service organization are operating effectively, the user auditor’s procedures should include one or more of the following: obtaining and reading a type 2 report, if available; performing appropriate tests of controls at the service organization; or using another auditor to perform tests of controls at the service organization on behalf of the user auditor.
What would likely prevent the auditor from relying on the prior year’s assessment of the operating effectiveness of controls?
A change to the system that enables the creation of new reports would not prevent the auditor from relying on the prior year’s assessment of the operating effectiveness of controls. Changing the system to provide new reports would not fundamentally change the risks or operation of an entity’s system. Therefore, the prior-year testing could provide the auditor with confidence surrounding the effectiveness of controls.
A change to how the data is processed could impact both the accuracy and completeness of the data. Therefore, an auditor would not be able to rely on the effectiveness of controls based on prior-year testing. Changes to the accounting system programs could result in new risks due to new software. These new risks could affect the effectiveness of controls that were tested in the prior year. Changes made to the client’s control environment would also prevent the auditor from relying on prior-year testing as a change in the control environment indicates a pervasive change.
A CPA in public practice is required to comply with the provisions of the Statements on Standards for Accounting and Review Services (SSARS) when?
Advising a client regarding the selection of computer software is a consulting service engagement, which should be performed in accordance with the Statements on Standards for Consulting Services (SSCS). Advocating a client’s position before the IRS is a tax advisory service, which should be performed in accordance with the Statements on Standards for Tax Services (SSTS). Neither such engagement is performed in accordance with Statements on Standards for Accounting and Review Services (SSARS).
If management is required to report on the company’s internal control over financial reporting (ICFR) , the auditor is required to?
In some circumstances, management is required to report on the company’s internal control over financial reporting (ICFR) but such report is not required to be audited and the auditor is not engaged to perform an audit of management’s assessment of the effectiveness of ICFR. In such cases, under PCAOB AS 3105.59, the auditor is required to include explanatory language to that effect in the “Basis for Opinion” section.
Alternatively, if the auditor issues separate reports on ICFR and the financial statements, under PCAOB AS 2201.88 the required paragraph referencing the separate report should appear in the “Opinion on the Financial Statements” section, immediately following the opinion paragraph. If an auditor is issuing an integrated report, then the reporting requirements of PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements, should be followed.
An Emphasis-of-Matter (and Other-Matter) Paragraph is?
An emphasis-of-matter or other-matter paragraph is an additional paragraph(s) added to the standard auditor’s report to fulfill the need to add explanatory language to the report. The need for an emphasis-of-matter or other-matter paragraph may or may not affect the unmodified opinion.
An “emphasis of matter” paragraph is included in the auditor’s report that is required by GAAS, or is included at the auditor’s discretion, and refers to a matter appropriately presented or disclosed in the financial statements that, in the auditor’s professional judgment, is of such importance that it is fundamental to the users’ understanding of the financial statements.
An “other matter” paragraph is included in the auditor’s report that is required by GAAS, or is included at the auditor’s discretion, and refers to a matter other than those presented or disclosed in the financial statements that, in the auditor’s professional judgment, is relevant to the users’ understanding of the audit, the auditor’s responsibilities, or the auditor’s report.
A benefit of using electronic funds transfer for international cash transactions is?
IT provides potential benefits in an entity’s internal control by enabling an entity to:
- consistently apply predefined business rules and
perform complex calculations in processing large
volumes of transactions, - enhance timeliness, availability, and accuracy of
information, - facilitate additional analysis of information,
- enhance the ability to monitor performance of
policies and procedures, - reduce the risk of controls being circumvented, and
- enhance the ability to achieve effective segregation
of duties.
The reduction of the frequency of data entries is a benefit similar to enhancing the accuracy of information.
An organizational structure refers to?
An organizational structure refers to how divisions, departments, and positions link together in authority, responsibility, and communication.
“The suitability of the client’s lines of reporting.” It is important that employees “understand how their activities in the financial reporting information system relate to the work of others and the means of reporting exceptions to an appropriate higher level within the entity” (AU-C 315.A100).
Clear lines of authority and responsibility are also very important in an EDP (electronic data processing) environment due to the potential access of data by multiple users. The auditor is looking for information on how the entity’s activities for achieving its objectives are planned, executed, controlled, and reviewed.
The completeness assertion involves?
The completeness assertion involves determining whether all transactions that should be recorded are actually recorded. When examining cash sales, the auditor is concerned that all such sales are recorded and that employees are not simply pocketing the cash without recording the sale. The consistent use of cash registers and tapes discourages this type of theft.
Circumstances that most likely would cause an auditor to consider whether material misstatements exist is?
There are several conditions or circumstances that would cause the auditor to consider whether material misstatements exist in an entity’s financial statements (because the auditor’s professional skepticism would sound a warning alarm). One of these conditions is when transactions selected for testing are not supported by proper documentation.
The previously communicated material weaknesses that are not corrected may be an example of a conscious business decision made by the client—the cost to correct the condition may exceed the benefits. As long as management acknowledges the existence of the weakness and accepts the risk, the auditor need only compensate for the weakness when planning the audit.
Audit procedures that would respond to the audit objective for accounts receivable that accounts receivable are properly described and presented in the financial statements?
The audit procedure, “Review the accounts receivable trial balance for amounts due from officers and employees,” is used to satisfy the audit objective that accounts receivable are properly described and presented in the financial statements (which supports the assertion about presentation) because it provides evidence about transactions with related parties, which must be separately disclosed.
Audit Objective?
Another name for the goal of the audit procedures used to obtain evidence about the dollar amounts and disclosures presented in the financial statements is the audit objective. The primary, overriding audit objective is to express an opinion on the fairness, in all material respects, with which the financial statements present the financial position, results of operations, and cash flows in conformity with an applicable financial reporting framework.
Practical or specific audit objectives relate to and are developed in light of the assertions of management embodied in the financial statements. These specific objectives are to obtain and evaluate sufficient appropriate audit evidence regarding the assertions.
Example: An audit objective regarding the completeness assertion for inventory would be to obtain reasonable assurance that the inventory quantities include all products, materials, and supplies on hand.
Reasonable Assurance
In the context of an audit of financial statements, reasonable assurance is a high, but not absolute, level of assurance. Because of the nature of audit evidence and the characteristics of fraud, the auditor is able to obtain reasonable, but not absolute, assurance that material misstatements are detected.
In the context of an audit of financial statements, reasonable assurance is a high, but not absolute, level of assurance. Because of the nature of audit evidence and the characteristics of fraud, the auditor is able to obtain reasonable, but not absolute, assurance that material misstatements are detected.
Reasonable assurance is obtained when the auditor has sufficient appropriate audit evidence to reduce audit risk to an acceptably low level; reasonable assurance is not an absolute level of assurance. The likelihood that those objectives will be achieved is affected by limitations inherent to internal control. These limitations include the following:
- Human judgment in decision making can be faulty.
- Breakdowns in internal control can occur because of
human failures such as simple errors or mistakes. - Errors may occur in the use of information produced by
IT. Individuals may not understand the purpose of
automated controls or the use of information produced
by IT.
Integrity
Integrity (ET 0.300.040): “To maintain and broaden public confidence, members should perform all professional responsibilities with the highest sense of integrity.”
a. Integrity is an element of character fundamental to
professional recognition. It is the quality from which the
public trust derives and the benchmark against which a
member must ultimately test all decisions.
b. Integrity requires a member to be honest and candid
within the constraints of client confidentiality. Service
and the public trust should not be subordinated to
personal gain and advantage. Integrity can
accommodate the inadvertent error and the honest
difference of opinion; it cannot accommodate deceit or
subordination of principle.
c. Integrity is measured in terms of what is right and just.
In the absence of specific rules, standards, or guidance,
or in the face of conflicting opinions, a member should
test decisions and deeds by asking: “Am I doing what a
person of integrity would do? Have I retained my
integrity?” Integrity requires a member to observe both
the form and the spirit of technical and ethical
standards; circumvention of those standards
constitutes subordination of judgment.
d. Integrity also requires a member to observe the
principles of objectivity and independence and of due
care.
Due Care
To act with due care is to act with competence and diligence. It is the obligation to perform professional services with concern for the best interest of the recipient of the service and in a manner consistent with the profession’s responsibility to the public. Due care is the duty to perform each audit as a professional possessing the degree of skill commonly possessed by others in the field.
Due care is the subject of ET 0.300.060 and the General Standards Rule of the AICPA Code of Professional Conduct:
“A member should observe the profession’s technical and ethical standards, strive continually to improve competence and the quality of services, and discharge professional responsibility to the best of the member’s ability.”
“General Standards Rule: A member shall comply with the following standards and with any interpretations thereof by bodies designated by Council:
A. “Professional Competence…
B. “Due Professional Care…
C. “Planning and Supervision…
D. “Sufficient Relevant Data…”
ET 0.300.060.01 and 1.300.001.01
The concept of due professional care
Due care means acting with competence and diligence. Competence is derived from a synthesis of education, experience and professional judgment. Diligence implies a prompt, careful, thorough rendering of service in accordance with applicable technical standards. Because the acceptance of a professional engagement implies that a CPA has the necessary level of skills to complete the professional service according to the professional standards, a CPA must undertake only those professional engagements that he or she can reasonably expect to complete with professional competence.
ET 0.300.060 states that due care requires a member to plan and supervise adequately any professional activity undertaken. The exercise of due care requires critical review at every level of supervision of the work done and the judgment exercised by those assisting in the audit.
Relevant assertions
The auditor should determine whether the identified risks of material misstatement relate to specific relevant assertions related to classes of transactions, account balances, and disclosures, or whether they relate more pervasively to the financial statements taken as a whole and potentially affect many relevant assertions. The latter risks (risks at the financial statement level) may derive in particular from a weak control environment.
Expressing the risk of material misstatement at the relevant assertion level (e.g., valuation of accounts receivable, existence of accounts payable) provides a basis for the auditor to determine the audit procedures that must be performed in order to lower audit risk.
Rights and obligations
An organization follows up on errors to the monthly statements to determine the accounts receivable dollar amount that the organization has the right to receive. The presentation assertion deals with whether components of the financial statements are properly listed and disclosed. The presentation would not be affected by management’s following-up on errors reported by customers.
When an auditor tests the system of internal controls?
When an auditor tests the system of internal controls, the concern is that he or she does not over-rely on the internal controls if they do not sufficiently prevent, detect, or correct errors. The stronger he perceives the internal controls to be, the smaller the sample size that is necessary for testing the controls. The higher the likely rate of deviations, the larger the sample size. If an auditor is not concerned with assessing control risk too high, but rather too low. Assessing control risk too low means that the auditor will falsely place too much reliance on the internal controls and will not collect enough evidence.
Risk of Assessing Control Risk Too High
The risk of assessing control risk too high is the risk that the assessed level of control risk based on the sample is greater than the true operating effectiveness of the control.
The risk relates to the efficiency of the audit. If the auditor’s evaluation of a sample leads him to unnecessarily assess control risk too high for an assertion, he would ordinarily increase the scope of substantive tests to compensate for the perceived ineffectiveness of the controls.
To determine the number of items to be selected for a particular sample for a test of controls?
To determine the number of items to be selected for a particular sample for a test of controls, the auditor should consider the:
a. tolerable rate of deviation from the controls being
tested,
b. likely rate of deviations, and
c. allowable risk of assessing control risk too low.
The auditor applies professional judgment to relate these factors in determining the appropriate sample size.
When planning a particular audit sample for a test of controls, the auditor should consider?
When planning a particular audit sample for a test of controls, the auditor should consider the following:
a. The relationship of the sample to the objective of the
test
b. The maximum rate of deviations from prescribed
control procedures that would support the planned
reliance (the tolerable rate)
c. The auditor’s allowable risk of assessing control risk too
low
d. Characteristics of items comprising the accounting
balance or class of transactions to be sampled.
Special Purpose Framework
An entity’s compliance with aspects of contractual agreements or regulatory requirements related to audited financial statements is specifically listed as a special report in AU-C 800.04 and .07. If the financial statements were audited in accordance with generally accepted auditing standards and concluded that the financial statements were fairly presented on the prescribed basis, a qualified opinion, an unmodified opinion with reference to footnote disclosure, or a disclaimer of opinion would not be appropriate.
A special-purpose framework (commonly referred to as other comprehensive bases of accounting)
A special-purpose framework (commonly referred to as other comprehensive bases of accounting) is a financial reporting framework other than GAAP. Financial statements prepared in accordance with this framework may be the only financial statements an entity prepares. As a precondition for an audit under a special-purpose framework, the auditor must obtain an understanding of the purpose for which the financial statements were prepared, the intended users of the special-purpose financial statements, and the steps taken by management to determine the acceptability of the financial reporting framework. Special-purpose frameworks may include one of the following bases of accounting:
a. Contractual basis: A basis of accounting that the entity
uses to comply with an agreement between the entity
and one or more third parties other than the auditor
b. Regulatory basis: A basis of accounting that the entity
uses to comply with the requirements or financial
reporting provisions of a regulatory agency to whose
jurisdiction the entity is subject (for example, a basis of
accounting that insurance companies use pursuant to
the accounting practices prescribed or permitted by a
state insurance commission)
c. Tax basis: A basis of accounting that the reporting
entity uses or expects to use to file its income tax return
for the period covered by the financial statements. A tax
basis is not regulatory bases of accounting.
d. Cash basis: A basis of accounting that the entity uses to
record cash receipts and disbursements and
modifications of the cash basis having substantial
support (for example, recording depreciation on fixed
assets). A cash basis is not regulatory bases of
accounting.
e. Other basis: Another basis of accounting that uses a
definite set of logical, reasonable criteria that is applied
to all material items appearing in financial statements
According to the special-purpose framework in effect,
the auditor’s report will be modified.
Special-Purpose Financial Statements
If the special-purpose financial statements are prepared in accordance with a regulatory basis of accounting, and the special-purpose financial statements together with the auditor’s report are intended for general use, the auditor should not include the emphasis-of-matter or other-matter paragraphs (sections 3456.07 and 3456.08).
a. The auditor should express an opinion about
whether the special-purpose financial statements are
presented fairly, in all material respects, in accordance
with GAAP.
b. The auditor should also, in a separate paragraph,
express an opinion about whether the financial
statements are prepared in accordance with the
special-purpose framework. There should also be a
statement that the special-purpose framework is a
basis of accounting other than GAAP.
The auditor must assess whether, based on available evidence, substantial doubt about the entity’s ability to continue as a going concern exists and whether disclosure is warranted.
Standard Report on a Compilation
The practitioner’s standard report on a compilation on a financial projection should include the following:
a. An identification of the prospective financial statements
presented by the responsible party
b. A statement that the practitioner has compiled the
prospective financial statements in accordance with
standards established by the American Institute of
Certified Public Accountants
c. A statement that a compilation is limited in scope and
does not enable the practitioner to express an opinion
or any other form of assurance on the prospective
financial statements or the assumptions
d. A caveat that the prospective results may not be
achieved
e. A statement that the practitioner assumes no
responsibility to update the report for events and
circumstances occurring after the date of the report
f. A statement describing the special purpose for which
the projection was prepared
g. A separate paragraph that restricts the use of the
report because it is intended to be used solely by the
specified parties
h. The manual or printed signature of the practitioner’s
firm
i. The date of the compilation report
j. If the projection does not contain a range, the report
should also include:
o. a statement that there will usually be differences
between the projected and actual results, because
events and circumstances frequently do not occur as
expected, and those differences may be material.
o a statement that the practitioner has no responsibility
to update the report for events and circumstances
occurring after the date of the report.
Prospective Financial Statement
Prospective financial statements are either financial forecasts or financial projections, including the summaries of significant assumptions and accounting policies. Although prospective financial statements may cover a period that has partially expired, statements for periods that have completely expired are not considered to be prospective financial statements. Pro forma financial statements and partial presentations are not considered to be prospective financial statements. (AT-C 305.09)
Objectivity
Although a CPA not in public practice does not have to maintain independence, the CPA does have to maintain objectivity. Objectivity is defined in the AICPA Code of Professional Conduct as “a state of mind, a quality that lends value to a member’s services. It is a distinguishing feature of the profession. The principle of objectivity imposes the obligation to be impartial, intellectually honest, and free of conflicts of interest.” (ET 0.300.050.02)
The traits of the individual that the sufficiency of documentation should be directed towards?
The auditor should prepare audit documentation that is sufficient to enable an experienced auditor, who has no previous experience with the specific audit, to understand the nature, timing, and extent of the audit procedures performed; the results of the procedures performed and evidence obtained; and significant findings or issues arising during the audit, conclusions reached, and any significant professional judgments made in reaching those conclusions.
Audit documentation provides
Audit documentation provides evidence of the auditor’s basis for a conclusion about the achievement of the overall objectives of the audit, and evidence that the audit was planned and performed in accordance with relevant audit standards and applicable legal and regulatory requirements. The auditor should prepare audit documentation that is sufficient to enable an experienced auditor, who has no previous experience with the specific audit, to understand the nature, timing, and extent of the audit procedures performed; the results of the procedures performed and evidence obtained; and significant findings or issues arising during the audit (including any findings that could result in a modification of the auditor’s report), conclusions reached, and any significant professional judgments made in reaching those conclusions.
A Firm’s System of Quality Control
Statement on Quality Control Standards (SQCS) 8, A Firm’s System of Quality Control, states that the quality control policies and procedures applicable to a firm’s accounting and auditing practice (i.e., audit, attestation, compilation, and reviews) should encompass the following elements:
a. Leadership responsibilities for quality within the firm
b. Relevant ethical requirements
c. Acceptance and continuance of client relationships and
specific engagements
d. Human resources
e. Engagement performance
f. Monitoring
Conditions for accepting an engagement to be performed in accordance with SSARS?
As a condition for accepting an engagement to be performed in accordance with SSARS, the accountant should:
a. determine whether preliminary knowledge of the
engagement circumstances indicate that ethical
requirements regarding professional competence will
be satisfied.
b. determine whether the financial reporting framework
selected by management to be applied in the
preparation of the financial statements is acceptable.
c. obtain the agreement of management that it
acknowledges and understands its responsibility:
1. for the selection of the financial reporting framework to
be applied in the preparation of financial statements.
2. for the design, implementation, and maintenance of
internal control relevant to the preparation and fair
presentation of the financial statements that are free
from material misstatement, whether due to fraud or
error (unless the accountant decides to accept
responsibility for the entity’s internal control, which
would preclude the accountant from providing services
requiring independence).
3. for the preparation and fair presentation of financial
statements in accordance with the applicable financial
reporting framework, and the inclusion of all
informative disclosures that are appropriate for the
applicable framework.
4. for preventing and detecting fraud.
5. for ensuring that the entity complies with laws and
regulations applicable to its activities.
6. for the accuracy and completeness of the records,
documents, explanations, and other information,
including significant judgments provided by
management for the preparation of financial
statements.
7. to provide the accountant with:
i. access to all information of which management is
aware that is relevant to the preparation and fair
presentation of the financial statements, such as
records, documentation, and other matters.
ii. additional information that the accountant may request
from management for the purpose of the engagement.
iii. unrestricted access to persons within the entity of
whom the accountant determines it necessary to make
inquiries.
SSARS 23 revises the requirement detailed in c.(2) above so that the requirement does not apply if the accountant decides to accept responsibility for such internal control.
The auditor develops an audit plan to?
The auditor develops an audit plan to reduce audit risk to an acceptably low level. The audit plan should include a description of the nature, extent, and timing of planned risk assessment procedures sufficient to assess the risks of material misstatement, including performance materiality; the nature, extent, and timing of planned further audit procedures at the relevant assertion level for each material class of transactions, account balance, and disclosure; and all other audit procedures to be carried out for the engagement in order to comply with GAAS (generally accepted auditing standards).
Procedures performed to assess independence and the ability to perform the engagement, the understanding of the terms of the engagement, and issues with management integrity that could affect the decision to continue the audit engagement are all items that should be documented, but not in the audit plan itself.
An audit procedure
An audit procedure is a series of specific and specialized steps or actions auditors take to meet audit objectives. Audit procedures may vary for different audit engagements, depending on the complexity of the activity under review, the type of company, and other factors unique to the engagement. Audit procedures are to be tailored to the engagement as compared to audit standards, which do not change. Audit procedures are used for tests of controls and substantive testing.
The seven basic audit procedures are:
(1) inspection,
(2) observation,
(3) inquiry,
(4) confirmation,
(5) recalculation,
(6) reperformance, and
(7) analytical procedures.
Example: Select a sample of 10 receiving reports and vouch to the related purchase order.
Performance Materiality
Performance materiality is defined in AU-C 320 as follows:
“The amount or amounts set by the auditor at less than materiality for the financial statements as a whole to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole. If applicable, performance materiality also refers to the amount or amounts set by the auditor at less than the materiality level or levels for particular classes of transactions, account balances, or disclosures. Performance materiality is to be distinguished from tolerable misstatement.”
Develop an audit plan?
The auditor must develop an audit plan for the audit in order to reduce audit risk to an acceptably low level. The audit plan is more detailed than the audit strategy and includes the nature, extent, and timing of audit procedures to be performed by audit team members. Procedures that an auditor may consider in planning the audit usually involve review of his or her records relating to the entity and discussion with other firm personnel and personnel of the entity:
a. Reviewing correspondence files, prior year’s working
papers, permanent files, financial statements, and
auditor’s reports
b. Discussing matters that may affect the audit with firm
personnel responsible for nonaudit services to the
entity
c. Inquiring about current business developments
affecting the entity
d. Reading the current year’s interim financial statements
e. Discussing the type, scope, and timing of the audit with
management of the entity, the board of directors, or its
audit committee
f. Considering the effects of applicable accounting and
auditing pronouncements, particularly new ones
g. Coordinating the assistance of entity personnel in data
preparation
h. Determining the extent of involvement, if any, of
consultants, specialists, and internal auditors
i. Establishing the timing of the audit work
j. Establishing and coordinating staffing requirements
Comprehensive Basis of Accounting (Other Than Generally Accepted Accounting Principles)
Financial records are maintained and reported according to a basis other than GAAP. A comprehensive basis of accounting other than GAAP is one of the following:
* A basis of accounting that the entity used to comply with the requirements or financial reporting provisions of a governmental regulatory agency to whose jurisdiction the entity is subject (e.g., pursuant to the rules of a state insurance commission)
* A basis of accounting used to file income tax returns for the period covered by the financial statements
* The cash receipts and disbursements basis of accounting, and modifications of the cash basis when such modifications are substantially supported, such as recording depreciation on fixed assets or accruing income taxes
* A definite set of criteria having substantial support that is applied to all items appearing in financial statements, such as the price level basis of accounting
See AU-C 800, AU-C 805, and AU-C 806 for examples of the special report used in each instance.
Compilation
Compilation is a service, the objective of which is to assist management in presenting financial information in the form of financial statements without undertaking to obtain or provide any assurance that there are no material modifications that should be made to the financial statements in order for the statements to be in conformity with the applicable financial reporting framework. Although a compilation is not an assurance engagement, it is an engagement where the accountant must determine whether he or she is independent of the entity.
AR-C 80.04, .17
Review Engagement
A review engagement is an attestation engagement in which the practitioner obtains limited assurance by obtaining sufficient appropriate review evidence about the measurement or evaluation of subject matter against criteria in order to express a conclusion about whether any material modification should be made to the subject matter in order for it be in accordance with (or based on) the criteria or to the assertion in order for it to be fairly stated. (AT-C 105.10)
Disclaimer of Opinion
A disclaimer of opinion is an expression of no opinion. (AU-C 700.03)
A disclaimer of opinion is warranted when restrictions on the scope of the audit are so severe, whether client imposed or due to other reasons, that the auditors are unable to obtain sufficient appropriate audit evidence to enable them to form an opinion.
Example: Instances of limitations on scope include the client’s refusal to allow the confirmation of receivables or the lack of a beginning inventory physical count (i.e., when the auditor is hired after the beginning of the fiscal year).
It is only when the auditors are unable to overcome these limitations by other audit procedures that a disclaimer of opinion is warranted.
A disclaimer of opinion because of a scope limitation requires modification of the standard auditor’s responsibility paragraph and, in all cases, the substantive reasons for the disclaimer should be explained in a separate emphasis-of-matter or other-matter paragraph.
Analytical Procedures
Analytical procedures are a set of audit procedures that examine the relationships between financial and nonfinancial data. Analytical procedures encompass such investigation of identified fluctuations or relationships that are inconsistent with other relevant information or that differ from expected values by a significant amount.
These procedures are used in the planning stage, as a substantive test about particular assertions, and as an overall review of the financial information in the final review stage of the audit.
Analytical procedures include ratio analyses (comparison of ratios to prior years and to industry averages) and reasonableness tests (e.g., comparison of aggregate salaries paid with the number of employees).
Adverse Opinion
An adverse opinion is an “overall” audit opinion which states that the financial statements do not present fairly the financial position or the results of operations or cash flows in conformity with an applicable financial reporting framework (AU-C 705.09). Auditors must have as much sufficient appropriate audit evidence to support an adverse opinion as for an unmodified opinion.
An adverse opinion is warranted when the departure from an applicable financial reporting framework or the inconsistency is sufficiently material or sufficiently pervasive as to misrepresent the financial position or results of operations or cash flows or when the auditor believes the entity is not a going concern.
An adverse opinion requires the disclosure of all the substantive reasons for the adverse opinion and the principal effects of the inconsistency on the financial statements, if known, or a statement in a separate emphasis-of-matter or other-matter paragraph preceding the opinion paragraph that the effects are not reasonably determinable.
Assumptions
Prospective financial statements are either financial forecasts or financial projections, including the summaries of significant assumptions and accounting policies, and are for either general use or limited use. Assumptions are used to present a condition or course of action that is not necessarily expected to occur but is consistent with the purpose of the projection. As a result of an assertion-based examination, the practitioner has a basis for reporting on whether, in his or her opinion, the prospective financial statements are presented in conformity with AICPA guidelines, and the assumptions provide a reasonable basis for the responsible party’s forecast, or whether the assumptions provide a reasonable basis for the responsible party’s projection given the hypothetical assumptions.
Control Risk
Control risk is the risk that a material misstatement that could occur in an assertion about a class of transaction, account balance, or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control. Control risk should be assessed in terms of the financial statement assertion.
Assessing control risk is the process of evaluating the effectiveness of an entity’s internal control in preventing or detecting material misstatements in the financial statements. The auditor uses the knowledge provided by the understanding of internal control and the assessed level of control risk in determining the nature, extent, and timing of substantive tests for financial statement assertions.
Detection Risk
Detection risk (DR) is the risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists and that could be material, either individually or when aggregated with other misstatements (AU-C Glossary).
Detection risk is a function of the effectiveness of an audit procedure and its application by the auditor. Detection risk consists of two component risks:
1. The risk that analytical procedures and other relevant substantive tests would fail to detect misstatements (AP)
2. The allowable risk of incorrect acceptance (TD) for the substantive test of details
DR = AP × TD
Detection risk can never be reduced to 0 because the auditor cannot test 100% of the account balances and transactions.
Substantive Procedures
Substantive procedures are tests of transaction details and account balances and analytical procedures performed to detect material misstatements in the account balances, transaction class, and disclosure components of the financial statements. These tests are used to test financial statement assertions.
Examples of substantive audit procedures include testing the fair presentation of an account balance or transactions by confirmation, recalculation, observation and examination (e.g., physical inventory), examination of documents, vouching and tracing, scanning, and analytical procedures.
Uncertainties involved in substantive testing constitute detection risk. Detection risk (DR) is composed of two other risks—analytical procedure risk (AP) and tests-of-detail risk (TD).
DR = AP × TD
Reissued Report
A reissued report is issued subsequent to the date of the original report. A reissued report may need to be revised for the effects of specific events; in these circumstances, the report should be dual-dated with the original date and a separate date that applies to the effects of such events.
Attribute
An attribute is any characteristic that is either present or absent. In tests of controls, the presence or absence of evidence of the application of a specified control is sometimes referred to as an attribute (e.g., in a credit sale, credit approval before the sale is initiated is the attribute, or control condition, of the credit sale). Absence of, or rate of occurrence of deviation from, the attribute is measured in tests of controls and used to determine whether a control is reliable.
Attribute Sampling
Attribute Sampling is used in tests of controls, where the auditor is looking for a specific characteristic (or the absence of a specific characteristic, such as evidence of approval).
The sample size for tests of controls takes into account the tolerable rate of deviation, the likely rate of deviation, and the risk of assessing control risk too low (the reliability level). The number of items in the population is not as important as the number of deviations (based on the attribute defined) expected and likely.
The Government Accountability Office (GAO)
The Government Accountability Office (GAO) requires auditors who spend 20% or more of their time performing government audits to have 80 hours of CPE every two years directly related to government auditing (also called “Yellow Book” hours). Adding, on top of that requirement, state requirements for tax and ethics hours, government auditors have a heavy education requirement.
A firm that performs government audits must have a system of quality control in place to assure compliance with professional standards and legal and ethical requirements. The quality control system should address, among other areas, human resources policies and procedures.
An external peer review is required at least once every three years.
The completeness Assertion
The completeness assertion for inventory states that recorded inventory quantities include all products, materials, and supplies owned by the entity (i.e., goods on hand, in transit, stored, or on consignment at some other location). The control which would most directly address this assertion would assure that all goods received are recorded.
Receiving reports provide evidence that merchandise has been received and has become part of inventory. Thus, prenumbering receiving reports and periodically reconciling these reports to recorded inventory would directly address the completeness assertion for inventory. “Receiving reports are prenumbered and periodically reconciled” is the best answer.
Artificial Intelligence
Artificial intelligence (AI) is the science and engineering of simulating human intelligence processes (e.g., learning, reasoning, self-correction) by machines (i.e., making intelligent machines), especially intelligent computer programs.
Therefore, the analytical procedures used in planning an audit should focus on enhancing the audit.
Machine learning is one application of artificial intelligence (AI) (not vice versa), based on the idea that we should be able to give machines access to data and let them learn for themselves.
Artificial intelligence is generally classified as either narrow/weak or general/strong.
The ARSC is the Accounting and Review Services Committee
Accounting and Review Services Committee (ARSC)’s
The ARSC is the Accounting and Review Services Committee. This committee issues the Statements on Standards for Accounting and Review Services (SSARSs), which govern the performance of compilation and review engagements.
In addition, AICPA members who perform compilation and review engagements are governed by the AICPA’s Code of Professional Conduct and the Statements of Quality Control Standards (SQCSs), which establish standards and provide guidance on a firm’s system of quality control.
Therefore, the analytical procedures used in planning an audit should focus on
Section 102 of the Sarbanes-Oxley Act
As set forth by Section 102 of the Sarbanes-Oxley Act, public accounting firms performing audits for issuers must register with the PCAOB. The registration includes:
* the names of all issuers for which the firm prepared or issued audit reports during the immediately preceding calendar year, and for which the firm expects to prepare or issue audit reports during the current calendar year;
* the annual fees received by the firm from each issuer for audit services, other accounting services, and nonaudit services;
* other current financial information for the most recently completed fiscal year of the firm that the PCAOB may request;
* statement of the firm’s quality control policies for its accounting and auditing practices;
* a list of the names and license numbers of all accountants associated with the firm who participate in or contribute to the preparation of audit reports;
* information regarding criminal, civil, or administrative actions or disciplinary proceedings against the firm (or any person in the firm) connected with an audit report;
* copies of any periodic or annual disclosure filed by an issuer with the SEC during the immediately preceding calendar year which discloses accounting disagreements between the issuer and the firm in connection with an audit report furnished or prepared by the firm for the issuer;
* consents from the firm to cooperate and comply with any request made by the PCAOB in furtherance of its authority and responsibilities; and
* any other information that the PCAOB requests.
Once registered, the firm must submit annual reports along with registration and annual fees to the PCAOB.
Likely misstatements
Likely misstatements represent the auditor’s best estimate of the total misstatements in the account balances. These include management judgmental misstatements concerning accounting estimates that the auditor considers unreasonable or the selection or application of accounting policies that the auditor considers inappropriate.
Fair Value Measurements
AU-C 540.A15 states, “The preparation and fair presentation of the financial statements requires management to determine whether a transaction, an event, or a condition gives rise to the need to make an accounting estimate and that all necessary accounting estimates have been recognized, measured, and disclosed in the financial statements in accordance with the applicable financial reporting framework.”
AU-C 540.A21 states: “The preparation and fair presentation of the financial statements also requires management to establish financial reporting processes for making accounting estimates, including adequate internal control. Such processes include the following:
* “Selecting appropriate accounting policies and prescribing estimation processes, including appropriate estimation or valuation techniques, including, when applicable, the appropriate models
* “Developing or identifying relevant data and assumptions that affect accounting estimates
* “Periodically reviewing the circumstances that give rise to the accounting estimates and reestimating the accounting estimates as necessary”
Financial Expert
“Financial expert” is defined in SOX Title IV as whether a person has, through education and experience as a public accountant or auditor or a principal financial officer, comptroller, or principal accounting officer of an issuer:
* an understanding of GAAP and financial statements;
* experience in:
o the preparation or auditing of financial statements of
generally comparable issuers and
o the application of such principles in connection with
the accounting for estimates, accruals, and reserves;
* experience with internal accounting controls; and
* an understanding of audit committee functions.
There is no requirement that the financial expert had to obtain this experience by serving on a prior audit committee or board of directors.
Financial Reporting Framework (other country)
Financial Reporting Framework (other country)
If an auditor is reporting on financial statements prepared under a financial reporting framework of another country and those financial statements are only for use outside of the United States, the auditor should comply with the reporting standards of the other country only and identify the other country in the report.
The auditor could use a U.S. form report, but it would not be limited to only those parties specified by the client. They need not indicate reference to the differences between the United States and the other country or obtain regulatory approval. The auditor is permitted to issue an audit report for financial statements prepared under another reporting framework.
Levels of Risk Assessment
The auditor should determine whether the identified risks of material misstatement relate to specific relevant assertions related to classes of transactions, account balances, and disclosures, or whether they relate more pervasively to the financial statements taken as a whole and potentially affect many relevant assertions.
Expressing the risk of material misstatement at the relevant assertion level (e.g., valuation of accounts receivable, existence of accounts payable) provides a basis for the auditor to determine the audit procedures that must be performed in order to lower audit risk
A Qualified Opinion
A qualified opinion states that, except for the effects of a certain matter, the financial statements are presented fairly in all material respects, in conformity with GAAP. The qualification can result from a lack of sufficient appropriate audit evidence, a scope limitation, a material departure from GAAP (due to inadequate disclosure, inappropriate accounting principles, or unreasonable accounting estimates), or if one of the required financial statements were missing. The inability to obtain the audited financial statements of a significant subsidiary would be a matter that would cause the auditor to issue a qualified opinion.
When the entity has prepared its financial statements on the income tax basis (an other comprehensive basis of accounting or special-purpose framework), the auditor must change the wording of the standard auditor’s report. An unmodified opinion is still possible in this circumstance.
Significant deficiencies discovered during the course of the audit will affect the auditor’s risk assessment as well as the nature, timing, and extent of further audit procedures. These deficiencies would need to be reported to those charged with governance, but they would not require a qualified opinion.
Analytical procedures used in the planning of an audit that highlight areas of audit concern (higher risk of material misstatement) would also affect further audit procedures. They will not, in and of themselves, cause the auditor to qualify the audit opinion.
Control Activities
For an auditor to determine whether control activities are operating as designed, the auditor would need to examine records documenting the use of those internal controls. Gross margin information and comparisons to budgets or forecasts may show the auditor the relative health of the organization or may highlight areas of concern, but they will do nothing to tell the auditor whether or not control activities are operating as designed. Confirmation of receivables verifying account balances may or may not tell an auditor whether control activities are effective. Of all the possible responses provided, only the examination of client records documenting the use of EDP programs is an example of examining records that could provide the auditor information to determine if control activities are operating as designed.
Pro forma Financial Statements
Pro forma financial statements show what the significant effects on historical financial information might have been had a consummated or proposed transaction (or event) occurred at an earlier date.
The auditor must apply the following procedures when performing an examination of pro forma financial statements:
* Obtain an understanding of the underlying transaction or event
* Obtain knowledge regarding each constituent of a combined entity in a business combination
* Discuss with management their assumptions regarding the transaction or event
* Evaluate whether adjustments are included for all the effects of the transaction or event
* Obtain sufficient evidence in support of the adjustments (such as contracts, agreements, and decisions by the board of directors)
* Evaluate whether management has clearly and comprehensively presented their assumptions and if the adjustments are consistent with the data used to develop them
* Determine that computations of pro forma adjustments are mathematically correct and that the adjustments have been properly applied to the historical financial statements
* Obtain written representation from management
The CPA is not required to reevaluate the entity’s internal control over financial reporting.
