A2 - Quality Control, Engagement Acceptance , Planning, and Internal Control Flashcards
(119 cards)
1
Q
What are the six interrelated elements of quality control (HELPME)?
A
H - Human Resources
E - Engagement/client acceptance and continuance
L - Leadership Responsibilities
P - Performance of engagement
M - Monitoring
E - Ethical Requirements
2
Q
What does the supervisor primarily perform to ensure the staff properly completed the audit work?
A
Reviewing the working papers as it allows a supervisor to understand the work performed and the evidence obtained.
3
Q
At the completion of the audit, who owns the audit workpapers?
A
The CPA firm that performed the audit
4
Q
How long does a registered public accounting firm has to retain the audit workpapers to comply with SOX-2002?
A
Audit workpapers have to be retained for 7 years.
5
Q
How many days a nonissuer’s auditor has to assemble the final audit file before report release date?
A
60 days.
6
Q
How many days an issuer auditor has to assemble the final audit file before report release date?
A
45 days
7
Q
What actions should not be taken after the documentation completion date and before the report release date?
A
The auditor is not allowed to make any deletions to audit documentation before the end of the specified retention period
8
Q
What influences the form and extent of the auditor’s documentation of an entity?
A
Complexity and size of an entity
9
Q
What circumstances would permit an independent auditor to accept an engagement after the close of the fiscal year?
A
An independent auditor should accept an engagement after the close of the fiscal year as long as he/she can address any limitations resulting from accepting the engagement at that time (e.g., auditor may not observe end-of-year inventory count, but may be able to perform acceptable alternative procedures).
10
Q
What elements does the auditor should assess as part of the pre-acceptance phase of the engagement (RISIG)?
A
R - Reporting - Firm’s ability to meet reporting deadlines
I - Independence
S - Staff - Firm’s ability to staff the engagement
I - Integrity of Client Management
G - Group Audit
11
Q
What factors would impact the auditor’s determination of the auditability of an entity’s financial statements?
A
Inadequate financial records may preclude the auditor from obtaining sufficient appropriate audit evidence.
12
Q
What are elements of the audit planning process that are agreed before implementation of the audit strategy with the client?
A
The timing for receipt of documentation or observation of inventory counts is scheduled with client before determining the audit strategy.
13
Q
What other content is included in an engagement letter (SITA COMADRE KFA)?
A
S - scope of audit (reference to legislation, regulations, GAAS, or ethical requirements)
I - Information about subsequent events
T - Timely disclosure of relevant info related to F/S
A - Audit planning and performance (composition of audit team)
C - Communications about results of audit engagement
O - Other auditors’ involvement (e.g., specialists, internal auditors, or other staff of the entity (technology)
M - Management’s receipt of engagement letter (management’s signature)
A - Arrangements with predecessor auditor
D - Obligation to provide audit Documentation to other parties
R - Restrictions on the auditor’s liability (when no prohibited)
E - Expectation to receive written representation from management
K - Key audit matters communication
F - Fees and billing arrangements
A - Additional services provided
14
Q
What is the required content in the engagement letter (RORRIS)?
A
R - Reference to the expected form and content of any report, and that these may be subject to change.
O - Objective and scope of the audit
R - Responsibilities of the auditor (including communicating deficiencies to those charged with governance)
R - Responsibility of management
I - Identification of the applicable financial reporting framework.
S - State that there is unavoidable risk that some material misstatements may not be detected.
15
Q
Who is responsible to initiate the communication between the successor and predecessor auditors?
A
The successor auditor has to initiate the communication with the predecessor auditor with the client’s permission.
15
Q
What should the successor auditor do if the predecessor auditor refuses to provide prior-year documentation?
A
successor auditor should review the risk assessment of the opening balances of the financial statements.
16
Q
If an audit engagement is changed to a review due to a scope limitation, what does the auditor should not include in the report?
A
- Should not include reference to the original engagement, and the audit procedures performed
- No scope limitation should be referenced
17
Q
What should the accountant consider before changing from an audit engagement to a review/compilation?
A
- The reasons for the request, especially if there are scope limitations
- The effort required to complete the engagement
- The estimated additional cost to complete the engagement.
18
Q
What are acceptable reasons for changes from an audit engagement to a compilation/review?
A
- Change in client requirements (e.g., creditors no longer require audited F/S)
- Misunderstanding as to the nature of the service to be rendered.
18
Q
What are unacceptable reasons for changes from an audit engagement to a compilation/review?
A
- The engagement will uncover errors or fraud
- The client refuses to provide a signed representation letter.
19
Q
What are the elements that support the nature, extent, and timing of supervision during the planning phase of the audit?
A
- The size and complexity of the entity
- The nature of the work assigned
- The assessed risk of material misstatement
- The qualifications of the assistants
20
Q
What are the resources needed to help develop the audit strategy?
A
- The involvement of other auditors, specialists, and the client’s internal auditors
- The assignment of staff to specific audit areas, including the assignment of more experienced staff to higher risk areas.
- The timing of testing (interim vs. year-end) and audit team meetings
- The budget hours to assign to specific audit areas.
- The extent, location, and timing of audit work.
21
Q
Factors that determine the focus of the audit team’s effort include?
A
- Preliminary evaluations of materiality, audit risk, and internal control
- Material locations and account balances
- Areas with higher risk of material misstatement, including disclosure.
- Significant accounting changes.
- Significant business and industry developments, including any legal and regulatory matters of which the company is aware.
- Management’s commitment to the design and operation of internal control.
22
Q
What are the financial statement assertions (COVERUP)?
A
C - Completeness
O - Cutoff
V - Valuation, allocation, and accuracy
E - Existence and Occurrence
R - Rights and Obligations
UP - Understandability of Presentation and Classification
23
What would the auditor do if there is a decrease in the amount of misstatements that the auditor can tolerate?
The auditor can modify planned procedures closer to the balance sheet date (timing modification to address risk).
24
When would the independent auditor (CPA) does not rely on the internal auditor's work?
An independent auditor may not share responsibility with the internal auditor for assertions related to material financial statement amounts with a high risk of material misstatement or a high risk of subjectivity (e.g., evaluation of significant accounting estimates and materiality of misstatements). The external auditor remains solely responsible for the report on the financial statements.
25
How does the external auditor evaluates the objectivity of the internal auditor?
the external CPA auditor considers:
1. information obtained from previous experience
2. Discussion with management
3. external quality reviews (if performed)
4. professional internal auditing standards (such as those developed by the Institute of Internal Auditors)
5. Determine the organizational level to which the internal auditor reports.
6. Policies that prohibit the internal auditor to audit areas they were recently assigned.
26
How does the external auditor evaluates the competence of the internal auditor?
The external CPA auditor evaluates:
1. Education
2. Professional certifications
3. experience
4. Performance evaluation
5. the audit plan
6. audit procedures
7. quality of internal audit documentation
27
When would the auditor refer to the work of the specialist in the audit report?
If, as a result of the work performed by the specialist, the auditor decides to express a modified opinion or add explanatory language, the auditor may refer to the specialist in the report and should indicate that the reference to the specialist does not reduce the auditor's responsibility for the audit opinion
28
When is the auditor not referencing the specialist in the report?
when the auditor express an unmodified opinion, no reference should be made to the work of the specialist.
29
What are materiality levels?
Materiality levels are generally considered in terms of smallest level of misstatement that could be material to any one of the financial statements.
30
What is the formula to compute the overall materiality?
Overall materiality = Applicable benchmark (materiality) * Applicable Percentage
31
What is the formula to compute the performance materiality?
Performance materiality = overall benchmark * Applicable Percentage
32
Why are analytical procedures required to be performed during planning?
Analytical procedures during planning consist of a review of data aggregated at a high level, such as comparing financial statements to budgeted or anticipated results. Involve comparison of recorded amounts to independent expectations developed by the auditor (e.g., internal monthly or quarterly reports).
33
What is the purpose of applying analytical procedures during planning?
The purpose is to assist in panning the nature, timing, and extent of auditing procedures that will be used to obtain audit evidence for specific account balances or classes of transactions.
34
What is the focus of the analytical procedures used in planning the audit?
1. Enhancing the auditor's understanding of the client's business and the transactions and events that have occurred since the last audit date
2. Identifying areas that may represent specific risks relevant to the audit.
35
What are examples of nonfinancial data considered in performing analytical procedures during planning?
1. Number of employees
2. Square footage of selling space
3. Volume of goods produced
4. Relationship with related financial data
36
What should the auditor do during planning when considering the results of analytical procedures?
Identify the risk of material misstatement due to error or fraud.
37
What are the three categories of entity objectives?
1. Reliability of financial reporting
2. Effectiveness and efficiency of operations
3. Compliance with laws and regulations
38
What is the purpose of the control environment component from the COSO internal control framework?
It is the tone at the top. It includes the processes, structures, and standards, that provide the foundation for an entity to establish a system of internal controls.
39
How does the auditor interpret "substance over form" in a control environment?
The auditor focus must be on the substance of the control environment rather than the form, because appropriate procedures may be established but not enforced.
40
What is the primary criterion considered when designing internal controls?
The cost-benefit relationship. The cost of an entity's internal control should not exceed the benefits that are expected to be derived.
41
What are the 5 components of the COSO internal control framework (CRIME)?
C - Control environment
R - Risk Assessment
I - Information and Communication
M - Monitoring
E - Existent Control Activities
42
What are the control activities that are relevant to an audit (PAID TIPS)?
P - Prenumbering of documents
A - Authorization of Transactions
I - Independent checks to maintain asset accountability
D - Documentation
T - Timely and appropriate financial performance reviews (comparison of budget vs. actual)
I - Information Processing Controls
P - Physical controls for safeguarding assets
S - Segregation of duties
43
What is the purpose of the prenumbering of documents from the control activities?
P - Prenumbering of documents
A
I
D
T
I
P
S
Prenumbering helps to assure that
1. All transactions are recorded (completeness)
2. No transactions are recorded more than once (existence)
44
What is the purpose of authorization of transactions from the control activities?
P
A - Authorization of transactions
I
D
T
I
P
S
Authorization of transactions should occur before commitment of resources.
45
What is the purpose of independent checks to maintain asset accountability from the control activities?
P
A
I - Independent checks to maintain asset accountability
D
T
I
P
S
Independent checks involve the verification of work previously performed by others. Examples include:
1. Review of bank reconciliations
2. Comparison of subsidiary records to control accounts.
3. Comparison of physical counts of inventory to perpetual records
46
What is the purpose of documentation from the control activities?
P
A
I
D - Documentation
T
I
P
S
Documentation provides evidence of the underlying transactions and is a basis for establishing responsibility for the execution and recording of transactions.
47
What is the purpose of timely and appropriate financial performance review from the control activities?
P
A
I
D
T - Timely and appropriate financial performance review
I
P
S
1. Comparison of actual performance to budgeted, forecasts, and prior periods.
2. comparison of financial and nonfinancial information
3. Review and evaluation of functions or activities (e.g., sales reports and receivable reports used to evaluate performance and identify errors)
48
What is the purpose of Information Processing controls from the control activities?
P
A
I
D
T
I - Information Processing Controls
P
S
Include general and application controls. These controls ensure that transactions are valid, properly authorized, and completely and accurately recorded.
49
What is the purpose of physical controls for safeguarding assets from the control activities?
P
A
I
D
T
I
P - Physical controls for safeguarding assets
S
Involve security devices and limited access to programs and restricted areas, including computer facilities. Physical controls include:
1. Physical segregation and security of assets, protective devices, and bonded or independent custodians (e.g., banks, safe deposit boxes, lock boxes, and independent warehouses)
2. Authorized access to assets and records (use of computer access codes, prenumbered forms, and required signatures on documents for the removal or disposition of assets)
3. Periodic counting and comparison of actual assets with amounts shown in accounting records (e.g., physical counts and inspections of assets)
50
What is the purpose of segregation of duties from the control activities?
P
A
I
D
T
I
P
S - Segregation of duties
1. Segregation of duties involves that individuals do not perform incompatible duties.
2. Duties should be segregated such that the work of one individual provides a cross-check on the work of another individual.
3. Segregation of duties reduces opportunities for any individual to both perpetrate and conceal errors or fraud in the normal course of duties.
51
What functions are covered under segregation of duties? (ARC)
A - Authorization
R - Record keeping
C - Custody of related assets
52
What is the purpose of the existing control activities component from the COSO internal control framework?
To establish policies and procedures to ensure that management objectives are carried out.
53
What are the key points of the control environment component of the COSO internal control framework (MCCHAPO)?
M - Management philosophy
C -Communication and enforcement of integrity and ethical values
C - Commitment to competence
H - HR policies and procedures
A - Assignment of authority
P - Participation of those charged with governance
O - Organizational structure
54
What is the purpose of the monitoring component of the COSO internal control framework?
Assesses the quality of internal control performance over time, by assessing the design and operation of controls on timely basis and taking the necessary corrective actions. Management is responsible for monitoring controls and ensuring they're working effectively.
55
What are key points of the monitoring component of the COSO internal control framework?
1. Internal Audit functions (provides evaluation of internal controls and recommendations)
2. Including activities of IT compliance and regular management and supervisory activities.
3. Other procedures such as mailing customer statements.
4. Evaluation of communications from external parties (e.g., through pmts or questioning of invoices), regulatory agencies, and independent external auditors
56
What is considered relevance of the audit to the auditor?
1. Internal control is relevant to the entire entity or to any of the entity's operating units or business functions
2. 5 components of internal control are applicable to the audit of every entity
3. Each of the 5 components affect any of the 3 entity objectives.
57
What would the auditor do to obtain an initial understanding of internal controls?
The auditor would perform risk-assessment procedures to evaluate the design of relevant controls
58
How is the auditor's knowledge about the design of internal controls help?
The knowledge of the auditor's design of internal controls helps identify the types of potential misstatements that could occur.
59
What is a reason as to why a properly designed system of internal control may fail to prevent or detect fraud?
Inadequate segregation of duties implies that the system of internal control may not properly be designed.
60
What are the three inherent limitations of internal controls (ECO)?
E - Error, Human error (errors in design or use of automated controls (e.g., faulty decision making by employees)
C - Collusion - circumvention of controls by collusion of two or more people.
O - Override - Management override of internal controls
61
What are IT general controls?
General controls are policies and procedures that relate to many applications and support the effective functioning and proper operation of the information system.
Apply to the information processing throughout the company
62
How are IT general controls categorized?
1. controls over data center and network operations
2. system software acquisition; change and maintenance controls
3. Access security controls
4. Application system acquisition; development and maintenance controls
63
What are examples of IT general controls?
1. Passwords
2. change management procedures
3. backup/recovery systems
4. administrative rights to the network.
64
What are IT application controls?
Apply to the processing of individual transactions and help to ensure that transactions occurred, are authorized, and are completely and accurately processed and reported. These are controls over inputs, processing, and output.
65
What are examples of IT application controls?
1. Administrative access rights
2. Controls over interfaces, integrations, and e-commerce
3. Checking the mathematical accuracy of records
4. Maintaining and reviewing accounts and trial balances
5. Automated edit checks of input data
6. Manual follow-ups of exception reports
66
What are automated controls?
Automated controls are internal controls performed using IT and are more suitable for:
1. high volume or recurring transactions
2. Control activities that can be adequately designed and automated.
Apply to the processing of individual transactions
67
What are manual controls?
Internal controls performed by people and are more suitable when judgement and discretion is required
68
What are examples of manual controls?
1. large, unusual, or nonrecurring transactions
2. potential misstatements are difficult to define or predict
3. Change in circumstances that require changes in controls.
69
When does a deficiency in operation exist?
A deficiency in operation exist when a properly designed control does not operate as designed or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.
70
How are the material levels of materiality determined?
When assessing materiality, the auditor should use the smallest level of misstatement that could be material to any one of the financial statements.
71
How is materiality assessed?
Materiality is based on professional judgement. Materiality depends on the nature AND dollar amount of an item.
72
What are examples of specialists the external auditor can rely on?
Specialists may be used to:
1. value restricted security and work of art
2. determine physical characteristics (e.g., related to mineral reserves or large quantities of fungible goods)
3. Determine specialized estimates (e.g., actuary, appraiser)
4. Interpret technical standards or legal documents (e.g., engineer)
73
Who are responsible for establishing timeliness related to the audit engagement?
Both management and the auditor will come to an agreement as to the timing of the audit engagement and will include it the engagement letter.
74
What are permanent files?
This file will hold documentation that has continuity interest every year.
75
What are examples of permanent (continuous) files?
1. Pension plans
2. stock options
3. Contracts
4. Leases
5. Articles of incorporation
6. Loan agreements
7. Bylaws
8. minutes of meetings
9. bond indentures
9. Internal information (e.g., flowchart of internal controls)
76
What are current files?
This file will hold documentation from an audit that is only for the current year under audit.
77
What are examples of current files?
1. Financial statements
2. Audit reports
3. The audit plan
4. significant audit findings
5. Audit procedures (substantive tests applied and test of internal controls).
78
What are the benefits from implementing IT?
1. Major reduction of IT risks
2. Reduction in cost
3. Fewer surprises and frustration in projects
4. Increase in quality of product for a company
79
What is an engagement attribute for an audit of an entity that process its financial data in electronic form without any paper documentation?
Continuous performance of audit test is required when financial data is processed electronically, without provision of paper documentation.
80
How would a supervisor review the work of a staff assistant, when using computers, if audit documentation may not contain readily observable details ?
The supervisor may have to review the formulas used on the computer rather than simply examining the audit documentation.
81
What are the requirements to have an efficient and effective system usage in a computer audit application?
1. Identification of the appropriate audit tasks
2. Appropriate software to perform the selected audit tasks.
82
What is a computer-assisted audit techniques (CAATs)?
CAATs are computer programs that allow auditors to test computer files and databases during an audit. CAATs are best to use when there is a need to examine a lot of data (e.g., "all").
83
When is the auditor least likely to use computer softwares?
When the assessment of control risk is based on auditor's judgement.
84
What are embedded audit modules?
Sections of an application program code that collects transaction data for the auditor. These are usually built into the application program when the program is developed, and it would require the auditor to be involved in the design of the application.
85
What does the test data technique refers to?
Refers to a technique which the client's application program is used to process a set of test data, the results which are already known by the auditor. If the client's program is operating effectively, it will generate the same results as the auditor.
86
What is an Integrated Test Facility (ITF)?
An ITF uses test data commingled with actual data to test transactions.
87
What is Parallel Simulation?
A technique in which the auditor reprocess the client's data using the auditor's own software. The auditor then compares his or her results to those obtained by the client.
88
What is the benefit of using computer assisted audit techniques?
Allows a greater number of items to be tested at relatively little additional cost.
89
What is earnings management?
Earnings management is about fraudulent financial reporting. That's about recognizing revenue prematurely.
90
How do bearer bonds represent a high risk of misappropriation of assets?
Company holds assets (such as bearer bonds) that can be easily converted to cash. The bonds have been used to facilitate money laundering, tax evasion, and to conceal business transactions.
91
MCCHAPO = 7 Control Environment Factors
M - Management's philosophy and operating style
C - Communication and enforcement of integrity and ethical values
C - Commitment to competence
H - HR policies and practices
A - Assignment of authority
P - Participation of those charged with governance
O - Org structure
92
When does the auditor refers to the specialist work?
When the auditor renders a modified opinion. Auditor adds an explanatory language to refer to the specialist's work performed
93
What are Generalized Audit Software Packages (GASPs)?
Allow the auditor to perform tests of controls and substantive test directly on the client's system without having a detail understanding of the client's hardware and software features.
94
What are tasks typically performed by GASPs?
1. Examine transactions for control compliance
2. Selecting items meeting specified criteria
3. Recalculating amounts and totals
4. Reconciling data from two separate files
5. Performing statistical analysis on transactions
95
What would raise an auditor's question concerning possible illegal acts?
The entity prepared several large checks payable to cash during the year. The checks should be written to the 3rd party vendor directly.
96
What is the purpose of a peer review?
Determine and report whether the CPA being reviewed has developed adequate policies and procedures for the elements of quality control and these are followed.
97
How often is a peer review required?
Every 3 years.
98
What is the purpose of the information and communication component of the COSO framework?
Auditor wants to know whether information produced by the accounting systems is reliable for financial reporting purposes and reaches the correct party timely to make appropriate decisions.
99
What understanding should the auditor obtain to comply with the information and communication component of the COSO framework?
1. classes of transactions significant to the F/S
2. Accounting processing (both automated and manual) from initiation to inclusion into the F/S
3. The accounting records (both electronic and manual)
4. Significant events captured by the system
5. Financial reporting process (e.g., development of accounting estimates and disclosures)
6. Controls around journal entries
7. whether related accounts involve accounting estimates.
8. Centralized processing and controls (includes shared-service environments)
100
What is the purpose of the engagement/client acceptance and continuance element of quality control?
H
E - Engagement/client acceptance and continuance
L
P
M
E
Policies and procedures should be established for deciding whether to accept or continue a client relationship and whether to perform specific engagement.
101
What are the primary factors in the engagement/client acceptance element of quality control?
1. Minimize the likelihood of associating with a client that lacks integrity
2. Determine whether the audit firm can perform the engagement.
3. Comply with legal and ethical requirements (e.g., firm should maintain independence)
102
What is the purpose of the performance of engagement element of quality control?
H
E
L
P - Performance of engagement
M
E
Ensure that engagement personnel work is properly supervised and work is adequately reviewed. This ensures higher level of performance and work product.
103
What are the primary factors in the performance of engagement element of quality control?
1. proper supervision of assurance engagement
2. proper review of employee work product
3. firm emphasizes quality in an engagement
4. controls are in place to ensure the team is knowledgeable
5. Provides solutions for conflicts of interest
6. provides solutions for differences in opinion.
7. Enables consultations with experts for certain situations.
104
What is the purpose of the Leadership Responsibilities element of quality control?
H
E
L - Leadership Responsibilities
P
M
E
Firm sustains the decisive responsibility for the firm's control systems. Firm has a solid control environment.
105
What are the primary factors of the leadership responsibility element of quality control?
1. Firm commits a budget for the development and deployment of quality control systems.
2. Emphasis on firmwide quality
3. Emphasis on competence for those responsible for the quality control system.
106
What is the purpose of the Ethical requirement element of quality control?
H
E
L
P
M
E - Ethical requirement
All personnel on engagements should maintain independence of mind and in appearance, perform professional responsibilities with integrity, and be objective.
107
What are the primary factors of the ethical responsibility element of quality control?
1. Independence requirements should be communicated to staff members
2. independence include freedom from any obligations or conflict of interest with client
3. Threats to independence should be identified and evaluated
4. Audit firm should take subsequent action if threat to independence.
5. Independence issues should be reviewed (confirmation should be at least annually).
108
What should the auditor do when determining a tolerable misstatement threshold to measure materiality?
The auditor should take into account the amount of misstatement that were accumulated in prior periods.
109
What is the purpose of the Human Resources element of quality control?
H - Human Resources
E
L
P
M
E
Encompasses the criteria for recruitment and hiring, determining capabilities and competencies, assigning personnel to engagements, professional development, and performance evaluation, compensation and advancement.
110
What are the primary factors of Human Resource policies and procedures?
1. Employees hired have the appropriate characteristics to enable them to perform competently.
2. Engagement partners have the competencies necessary to fulfill engagement responsibilities.
3. Work assigned to personnel having the technical training and proficiency
4. Continuous professional education and other professional development activities.
5. Personnel selected for advancement have the qualification necessary to fulfill the responsibilities to be assumed.
111
How does the external auditor takes responsibility for using the audit work of other firm, internal auditor, or specialist?
The external auditor performs the following:
1. Review the other's firms workpapers
2. Reperform a subset of audit testing to validate the firm's conclusions.
112
Who is considered "those charged with governance"?
The audit committee which is composed by members of the board of directors.
113
Why is important for the auditor to obtain an understanding of the new client's business and the industry?
to understand the events and transactions that may have an effect on the client's financial statements.
114
What are reason's to not accept an audit in the pre-planning phase?
1. Management does not provide the financial statements (high risk)
2. Management disregards its responsibility to maintain an adequate internal control environment (high risk of F/S misstatement)
115
How should the auditor test computer processed data if it only exist briefly in the system (short period of time)?
1.The auditor should consider performing tests several times during the year.
2. Schedule audit procedures to coincide with the availability of information.
116
What should the auditor consider If materiality of the F/S as whole need to be revised during the audit?
The auditor should also consider revise the materiality levels for particular classes of transactions, account balances, or disclosures may also need to be revised.
117
