Assessing Risk and Developing a Planned Response Flashcards
(129 cards)
1
Q
Identify the topics associated with the three general standards formerly known as Generally Accepted Auditing Standards (GAAS), which are still applicable to the PCAOB’s auditing standards.
A
- Training
- Independence
- Due professional care.
2
Q
Identify the topics associated with the four reporting standards for generally accepted auditing standards (GAAS) that are still applicable to the auditing standards of the Public Company Accounting Oversight Board (PCAOB).
A
- Generally accepted accounting principles (GAAP)
- Consistency
- Disclosure
- Opinion
3
Q
Identify the topics associated with each of the AICPA’s seven principles for audit standard setting.
A
- Purpose
- Premise
- Responsibilities
- Reasonable assurance
- Performance requirements to achieve reasonable assurance
- Inherent limitations
- Reporting
4
Q
Identify the four primary themes associated with the AICPA’s seven principles for audit standard setting.
A
1.Purpose/premise
2.Responsibilities
3.Performance
4.Reporting
(PR PR)
5
Q
Identify the topics associated with the three field work standards formerly known as Generally Accepted Auditing Standards (GAAS), which are still applicable to the PCAOB’s auditing standards.
A
- Planning and supervision
- Internal control
- Evidence.
6
Q
What type of professional requirement is indicated by the word “must” in AICPA professional standards?
A
Unconditional requirement
7
Q
What type of professional requirement is indicated by the word “should” in AICPA professional standards?
A
Presumptively mandatory requirement
8
Q
What is meant by the term “interpretive publications”?
A
These consist of the appendices to the Statements on Auditing Standards, auditing interpretations of the Statements on Auditing Standards, the AICPA Audit and Accounting Guides, and AICPA auditing Statements of Position.
9
Q
List the services for which a CPA firm is required to have a sytem of quality control.
A
Audits, attestation, compilation, and review services. (Not applicable to tax or consulting services.)
10
Q
What is meant by the term “engagement quality control review”?
A
A process designed to provide an objective evaluation, before the report is released, of the significant judgments the engagement team made and the conclusions it reached. (Such a process is only for those audit engagements for which the firm has determined that an engagement quality control review is required; it is not applicable to all audits.)
11
Q
List the six elements of a quality control system.
A
- Leadership responsibilities for quality within the firm
- Relevant ethical requirements (especially independence)
- Acceptance and continuance of client relationships
- Human resources
- Engagement performance
- Monitoring
12
Q
Who is responsible for the administration of a quality control system?
A
Authority may be vested in one person but everyone shares responsibility.
13
Q
List the four basic steps in the audit process.
A
- Planning
- Internal control consideration
- Substantive audit procedures
- Reporting
14
Q
What considerations should be given by the auditor regarding internal controls prior to beginning an audit or performing substantive audit procedures?
A
> Obtain the required understanding of the design of internal control for planning purposes.
Perform tests of controls to evaluate operating effectiveness of internal control if contemplating reliance on specific controls
15
Q
What are some considerations that must be given by the auditor during the planning phase of the audit?
A
- Determine whether to accept or continue the audit engagement
- Assess the risk of material misstatement
- Evaluate requirements for staffing and supervision
- Prepare the required written audit program (also called the audit plan).
16
Q
List the two types of substantive audit procedures.
A
- Analytical procedures
2. Tests of details
17
Q
List the two types of test of details.
A
- Tests of ending balances
2. Tests of transactions
18
Q
What type of professional requirement is indicated by the word “must” in AICPA professional standards?
A
Unconditional requirement
19
Q
What type of professional requirement is indicated by the word “should” in AICPA professional standards?
A
Presumptively mandatory requirement
20
Q
What is meant by the term “interpretive publications”?
A
These consist of the appendices to the Statements on Auditing Standards, auditing interpretations of the Statements on Auditing Standards, the AICPA Audit and Accounting Guides, and AICPA auditing Statements of Position.
21
Q
Financial Reporting Oversight Role (FROR)
A
A role in which a person is in a position to or does exercise influence over the contents of the F/S or anyone who prepares them. Examples: director, CEO, president, CFO, COO, general counsel, CAO, controller, director of internal audit, director of financial reporting, treasurer, or any equivalent position.
22
Q
Audit and Professional Engagement Period
A
Includes the period covered by any F/S being audited or reviewed (the “audit period”) and the period of the engagement (the “professional engagement period”). The professional engagement period begins at the earlier of when the accountant signs an initial engagement letter or begins the audit and ends when the audit client or the accountant notifies the SEC that the client is no longer the accountant’s audit client.
23
Q
Close Family Member (CFM)
A
A person’s spouse, spousal equivalent, parent, dependent, nondependent child, and sibling.
24
Q
Immediate Family Member (IFM)
A
A person’s spouse, spousal equivalent, and dependents.
25
To what services are Statements on Standards for Accounting and Review Services (SSARs) applicable?
Statements on Standards for Accounting and Review Services (SSARs) are applicable to reviews and compilations of the financial statements of private companies, that is, nonissuers.
26
What is a compilation?
A compilation is an assembly of the financial records of a private company into a financial statement format without expressing any degree of assurance on the reliability of those financial statements.
27
What type of assurance is associated with an "audit" of an entity's financial statements?
Positive assurance, which is considered a high level of assurance
28
What type of assurance is associated with a "review" of an entity's financial statements?
Negative assurance, which is considered a moderate level of assurance
29
What is a review?
This occurs when the CPA is engaged to provide a lower level of assurance (relative to that of an audit) on financial statements of a private company by performing limited procedures, including reading the financial statements, performing analytical procedures, and making appropriate inquiries of client personnel.
30
AICPA's Statements on Standards for Attestation Engagements (SSAEs)
hese are applicable when the CPA provides assurance about written representations or subject matter other than historical financial statements (e.g., management may make representations about its superior product performance that may be made more reliable by the CPA's independent verification and report).
31
Written engagement letters must______.
A written engagement letter must be obtained for engagements to audit, review, or compile an entity's financial statements under AICPA Professional Standards.
32
Levels of Assurance
1. Audit—An audit conveys a high level of assurance about the reliability of the financial statements, and is expressed as positive assurance in the form of an opinion (recall that the SASs apply to audits of “nonissuers”).
2. Review- A review conveys a lower (i.e., “moderate”) level of assurance about financial statements (for a private company under the AICPA's SSARSs).
3. Compilation—A compilation conveys no assurance about the reliability of the financial statements (for a private company under the AICPA's SSARSs).
33
Public Company Accounting Oversight Board (PCAOB)—Five primary responsibilities:
1.Registration of public accounting firms—U.S. and non-U.S. accounting firms that prepare audit reports of any U.S. public company (issuer of securities) must register with the PCAOB. (This includes non-U.S. accounting firms that play a substantial role in the preparation of such audit reports.)
2.Inspections of registered public accounting firms—PCAOB is directed to conduct a continuous program of inspections that assess compliance with SOA, PCAOB rules, SEC rules, and applicable professional standards. (A written report is required for each such inspection.)
Firms that provide audit reports for at least 100 issuers—PCAOB must inspect annually.
Firms that provide audit reports for fewer than 100 issuers—PCAOB must inspect every three years (triennially).
3. Standard setting—PCAOB is directed to establish auditing and related attestation, quality control, ethics and independence standards and rules to be used by registered public accounting firms in the preparation of audit reports for issuers. (The Office of the Chief Auditor and the Standing Advisory Group (SAG) assist PCAOB in establishing such auditing and professional practice standards.)
4. Enforcement—PCAOB has broad authority to investigate registered public accounting firms and persons associated with such firms.
5. Funding—PCAOB's budget is funded by (1) registration and annual fees from public accounting firms and (2) an annual accounting support fee assessed on issuers (based on their relative monthly market capitalization).
34
List the standard-setting responsibilities of the Public Company Accounting Oversight Board (PCAOB).
- Auditing and related attestation
- Quality control
- Ethics and independence standards
35
A PCAOB engagement that focuses on the sufficiency of a CPA firm's quality control system is most likely to be referred to as a(n)
Inspection-Section 104 of the Sarbanes-Oxley requires that the PCAOBs evaluate the sufficiency of a CPA firm's quality control system as a part of an inspection.
36
List the five primary responsibilities of the PCAOB.
1. Registration of public accounting firms
2. Inspection of registered public accounting firms
3. Standard setting
4. Enforcement
5. Funding
37
What is the purpose of the Sarbanes-Oxley Act of 2002?
To address a series of perceived corporate misconduct and alleged audit failures (including Enron, Tyco, and WorldCom, etc.) and to strengthen investor confidence in the integrity of the U.S. capital markets
38
List the two primary revenue sources through which the PCAOB's budget is funded.
1. Registration and annual fees from public accounting firms
| 2. An annual "accounting support fee" assessed on issuers based on their relative monthly market capitalization
39
What are the requirements regarding concurring approval of issuance of an engagement report as prescribed by Public Company Accounting Oversight Board (PCAOB) auditing standards?
- The firm cannot give permission to the client to use the engagement report until the engagement quality reviewer provides concurring approval of issuance.
- The engagement quality reviewer cannot express such approval if there is any "significant engagement deficiency."
40
List the qualifications required of an engagement quality reviewer under Public Company Accounting Oversight Board (PCAOB) auditing standards.
- Must be an "associated person" of a registered public accounting firm
- Must have competence, independence, integrity, and objectivity
41
Under Public Company Accounting Oversight Board (PCAOB) auditing standards, what should the engagement quality reviewer do to evaluate the significant judgments and conclusions of the engagement team?
- Hold discussions with the engagement partner and other members of the engagement team.
- Review the audit documentation.
42
Describe the basic requirements associated with Public Company Accounting Oversight Board (PCAOB) auditing standards dealing with “engagement quality review.”
PCAOB auditing standards require an engagement quality review and concurring approval before issuing the report for audit (or review) engagements conducted under PCAOB standards.
43
What is the purpose of the engagement quality reviewer under Public Company Accounting Oversight Board (PCAOB) auditing standards?
To perform an evaluation of the significant judgments made by the engagement team and the related conclusions reached and in preparing any engagement report(s)
44
Describe the engagement quality review "cooling off" restriction in Public Company Accounting Oversight Board (PCAOB) auditing standards.
The person serving as engagement partner during either of the two audits preceding the audit subject to engagement quality review is not permitted to serve as engagement quality reviewer, unless the registered firm qualifies for a specific exemption to this requirement.
45
Identify the differences in the Statements on Quality Control Standards (SQCS) of the American Institute of Certified Public Accountants (AICPA) relative to Public Company Accounting Oversight Board (PCAOB) auditing standards.
SQCS do not:
- Require an "engagement quality review" for any type of engagement.
- Impose a "cooling-off" restriction or a requirement that the reviewer must be an "associated person" of a registered public accounting firm.
- Require a "concurring approval of issuance" before issuing a report.
- Specifically require that engagement quality review documentation must be retained with other documentation.
46
A CPA firm evaluates its personnel advancement experience to ascertain whether individuals meeting stated criteria are assigned increased degrees of responsibility.
This is evidence of the firm's adherence to which of the following prescribed standards
Quality control.
47
After field work audit procedures are completed, a partner of the CPA firm who has not been involved in the audit performs a second or wrap-up working paper review. This second review usually focuses on
The fair presentation of the financial statements in conformity with GAAP.
48
What if the successor believes that the financial statements covered by the predecessor's report require revision?
Try to arrange a meeting with the three parties (i.e., the successor, predecessor, and client management). If the client refuses to meet to discuss issues reflecting on the appropriateness of the previously issued financial statements, the successor should consider the risks of being the entity's auditor.
49
What if the auditor is unable to observe the beginning inventory?
If unable to verify the beginning inventory, the auditor may be unable to reach a conclusion about the cost of goods sold and, hence, the net income. As a result, the auditor may not be able to express an opinion on the fairness of the income statement, statement of cash flows, or statement of retained earnings. However, the auditor could still express an opinion on the balance sheet itself.
50
Preconditions for an Audit:
The use by management of an acceptable financial reporting framework in the preparation of the financial statements and the agreement of management to the premise on which an audit is conducted.
51
What matters should be covered in the (successor) auditor's inquiry of the predecessor auditor?
- Facts related to management's integrity
- Significant accounting or auditing disagreements
- Any communications with the audit committee (or others charged with governance) about fraud, illegal acts, and significant deficiencies in internal control matters
- Predecessor's understanding of the reason(s) for the client's change in auditors
52
What is meant by the term “initial audit”?
The prior year's financial statements have been audited by a predecessor auditor.
53
Who initiates the communications between the predecessor auditor and successor auditor?
The successor auditor initiates the communication with the predecessor by requesting that the client authorize the predecessor auditor to allow the successor auditor to review the predecessor auditor's working papers.
54
What matters are typically addressed in an engagement letter?
1. The objective and scope of the audit
2. The auditor's responsibilities
3. Management's responsibilities
4. A statement about the inherent limitations of an audit
5. A statement identifying the applicable financial reporting framework
6. Reference to the expected content of any reports to be issued
7. Other matters, as warranted (e.g., fees, etc.)
55
Identify three planning-related issues that should be included in the auditor's documentation.
1. The overall audit strategy
2. The audit plan
3. Any significant changes made to the audit strategy or the audit plan during the engagement, along with the reasons for any such changes
56
List several circumstances that impact the extent of planning activities.
- Size and complexity of the entity
- Auditor's experience with that entity
- Auditor's understanding of the entity and its environment, including its internal control
57
What is the difference between an overall audit strategy and an audit plan?
An audit strategy deals with higher-level issues, such as allocating audit resources, whereas an audit plan is more detailed and deals more specifically with the nature, timing, and extent of audit procedures to be performed.
58
List the audit procedures that should occur during the planning phase of an audit.
1. Review client records.
2. Make inquires of client personnel.
3. Coordinate client assistance.
4. Determine if specialists are needed.
5. Coordinate staffing requirements.
59
Identify some activities associated with pre-engagement activities.
1. Perform appropriate procedures to address the quality control issues associated with the acceptance/continuance of the audit engagement.
2. Evaluate the audit team's compliance with relevant ethical requirements (especially independence issues).
3. Establish an understanding in writing of the terms of the engagement.
60
Identify factors relevant to establishing an overall audit strategy.
- Identify characteristics of the engagement affecting its scope.
- Identify the reporting objective of the engagement and required communications.
- Consider the factors relevant to utilizing the audit team.
- Consider the results of preliminary engagement planning activities.
- Determine the nature, timing, and extent of necessary resources for the engagement.
61
What is the auditor's basic audit planning responsibility?
The auditor should plan the audit (and design the required written audit program or plan) to be responsive to the auditor's assessment of the risk of material misstatement.
62
The auditor should address the following matters in the audit documentation:
(1) the overall audit strategy; (2) the audit plan; and (3) any significant changes made to the audit strategy or the audit plan during the audit engagement, along with the reasons for any such changes
63
To what services are Statements on Standards for Accounting and Review Services (SSARs) applicable?
Statements on Standards for Accounting and Review Services (SSARs) are applicable to reviews and compilations of the financial statements of private companies, that is, nonissuers.
64
What is a compilation?
A compilation is an assembly of the financial records of a private company into a financial statement format without expressing any degree of assurance on the reliability of those financial statements.
65
What type of assurance is associated with an "audit" of an entity's financial statements?
Positive assurance, which is considered a high level of assurance
66
What type of assurance is associated with a "review" of an entity's financial statements?
Negative assurance, which is considered a moderate level of assurance
67
When is a written engagement letter required?
A written engagement letter must be obtained for engagements to audit, review, or compile an entity's financial statements under AICPA Professional Standards.
68
Define "control risk."
The probability that a material misstatement, which occurred in the first place, would not be detected by applicable internal controls
69
What audit risk model is applicable to classes of transactions or to account balances?
Audit risk = Inherent risk × Control risk × Detection risk
70
List the variables of planned audit procedures that can be adjusted to change detection risk.
Nature
Timing
Extent of substantive testing
71
Define "audit risk."
The probability that the auditor fails to modify the opinion on financial statements that contain a material misstatement
72
Define "risk of material misstatement."
The risk that the financial statements contain one or more material misstatements prior to the audit. (Note: RMM = IR × CR)
73
Define "inherent risk."
The probability that a material misstatement would occur in the particular audit area in the absence of any internal control policies and procedures
74
Define "detection risk."
The probability that a material misstatement, which was not prevented or detected by internal control, was not detected by the auditor's substantive audit procedures
75
Basic Auditor Responsibility
The auditor should properly plan and perform the audit to obtain reasonable assurance that material misstatements, whether caused by errors or fraud, are detected.
76
Define "analytical procedures."
Evaluations of financial information through analysis of plausible relationships among both financial and nonfinancial data
77
What three purposes might analytical procedures serve?
1. Required during planning
2. May be used as substantive evidence (not required)
3. Required during final review
78
What matters must be documented in connection with analytical procedures?
- The auditor's expectation and the factors considered in developing it
- The results of the comparison of the recorded amounts (or ratios) with the expectations
- Any additional auditing procedures performed to investigate significant differences identified by that comparison
79
List the four factors that affect the efficiency and effectiveness of analytical procedures for substantive purposes.
1. Nature of assertion
2. Plausibility and predictability of relationship
3. Availability and reliability of data
4. Precision of expectation
80
What is the purpose of analytical procedures in the overall review?
To verify the conclusions reached in the audit
81
What is the purpose of analytical procedures in audit planning?
To aid in understanding client activities and in targeting risky areas where material misstatements are more likely to occur
82
List the two types of financial statement-related frauds.
1. Fraudulent financial reporting (sometimes called "cooking the books")
2. Misappropriation of assets (covering up theft by false journal entries)
83
What definition of fraud is relevant to the auditor?
An intentional act by one or more individuals among management, those charged with governance, employees, or third parties, involving the use of deception that results in a misstatement in the financial statements
84
Identify the auditor's responsibility for detecting fraud in a financial statement audit.
Auditors must:
1. Design audit to provide reasonable assurance of detecting material misstatements whether due to fraud or error.
2. Specifically assess the risk of material misstatement due to fraud.
3. Document the assessment of the risk of material misstatement due to fraud and the resulting response(s) associated with any risk factors identified.
85
What are the three categories of fraud-related risk factors that should be considered by the auditor?
1. Incentives/Pressures (the motivation for committing fraud)
2. Opportunities (the ability to commit fraud)
3. Attitudes/Rationalizations (the justification or excuse for committing fraud)
86
Does failure to detect a material misstatement imply a substandard audit?
No! An auditor may be unable to detect a material misstatement owing to forgery, collusion, or upper management involvement, etc.
87
Who should be informed when the auditor has identified fraud, but that fraud is not material and does not involve senior management?
The appropriate level of management should be notified (defined to be at least one level above the level where the fraud occurred).
88
When might an auditor have a duty to inform others outside of the audited entity of fraud-related matters?
- In response to a valid subpoena
- To comply with applicable legal and regulatory requirements
- To respond appropriately to successor auditor's inquiries when the former client has given permission to the predecessor
- To report fraud to the applicable funding agency under the requirements of government auditing standards
89
What are the auditor's responsibilities to communicate fraud identified by the auditor?
- If the fraud is not material, the auditor should inform the appropriate level of management.
- If the fraud is material (or if senior management is involved, even if the fraud is not material), the auditor should inform those charged with governance.
90
What is the required form of the auditor's communications about fraud-related issues?
Communications may be either written or oral but should be timely
91
Who should be informed when material fraud has occurred (whether senior management is involved in the fraud or not).
The auditor should inform those charged with governance.
92
What procedure can an auditor undertake to help detect illegal acts?
Make inquiries of management about the entity's compliance with applicable laws
93
What matters should the auditor document with respect to the entity's compliance with applicable laws and regulations?
- The results of the discussion with management, those charged with governance, and others, as applicable
- Any identified or suspected noncompliance with applicable laws and regulations
94
What is the auditor's responsibility to detect illegal acts?
The auditor should design the audit to provide reasonable assurance of detecting illegal acts having a direct and material effect on the financial statements.
95
Identify three audit procedures that bring to the auditor's attention noncompliance with laws and regulations that do not have a direct effect on the entity's financial statements.
1. Inquiry of management and those charged with governance about noncompliance with applicable laws and regulations
2. Inspection of correspondence with regulatory authorities
3. Reading the minutes of meetings of those charged with governance
96
What is meant by the term “legal and regulatory framework”?
Those laws and regulations to which an entity is subject; noncompliance may result in fines, litigation, or other consequences that may have a material effect on the financial statements
97
When might an auditor have a duty to inform others outside of the audited entity of illegal acts known to the auditor?
- In response to a valid subpoena
- To comply with applicable legal and regulatory requirements
- To respond appropriately to the successor auditor's inquiries when the former client has given permission to the predecessor
- To report illegal acts to the applicable funding agency under the requirements of government auditing standards
98
What actions should an auditor consider when an illegal act has been detected?
- Gather additional evidence to determine relevant facts.
- Discuss the matter with the appropriate level of management.
- Consider consulting with the entity's attorney and/or relevant specialists.
- Consider the implications to other audit areas.
99
Identify three inherent limitations of internal controls.
1. Cost of controls should not exceed expected benefits.
2. Mistakes may occur due to carelessness, fatigue, misjudgments, and so on.
3. Segregation of duties may break down due to collusion or management override of internal controls.
100
Identify two reasons for assessing control risk at the maximum level.
1. The auditor believes that the design of internal control is ineffective.
2. The auditor believes that reliance on internal control (and performing applicable tests of control) is not an efficient audit strategy compared to a wholly substantive audit approach.
101
When should the auditor assess the design effectiveness of internal control?
In planning every audit under generally accepted accounting standards (GAAS), as a basis for determining the nature, timing, and extent of further audit procedures
102
When should the auditor assess the operating effectiveness of internal control?
Whenever the auditor contemplates a reliance strategy (which means the same thing as "assessing control risk at less than the maximum level") and only after performing the appropriate tests of control
103
Why must auditors consider an entity's internal control in planning the audit engagement?
In order to plan an effective and efficient audit, auditors must assess control risk as a basis for setting the appropriate level of detection risk related to their substantive auditing procedures (specifically, to determine the nature, timing, and extent of those substantive procedures).
104
What is meant by the term “monitoring” (as it relates to internal controls)?
The policies and procedures involving the ongoing assessment of the effectiveness of internal controls over time
105
What is meant by the term “control activities”?
The policies and procedures that help ensure that management directives are carried out, especially those related to (1) segregation of duties, (2) physical controls, (3) authorization of transactions, (4) performance reviews, and (5) information processing
106
Identify three risk assessment procedures that an auditor might used to obtain an understanding of the entity and its environment, including its internal control.
1. Inquiries of management and others
2. Observation and inspection
3. Analytical procedures
107
Define "internal control."
A process—effected by those charged with governance, by management, and by other personnel—designed to provide reasonable assurance about the achievement of the entity's objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.
108
Identify the five interrelated components of internal controls.
1. Control environment
2. Risk assessment
3. Control activities
4. Information and communication systems
5. Monitoring
109
What is meant by the term “control environment”?
The policies and procedures that determine the overall control consciousness of the entity, sometimes called "the tone at the top"
110
What is meant by the term “information and communication systems”?
The policies and procedures related to the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities
111
Define the term “risk assessment procedures.”
Procedures performed to obtain an understanding of the entity and its environment, including its internal control
112
What is meant by the term “risk assessment”?
The policies and procedures involving the identification, prioritization, and analysis of relevant risks as a basis for managing those risks
113
What are the three objectives of internal control as identified in the definition of internal control?
1. Reliability of financial reporting
2. Effectiveness and efficiency of operations
3. Compliance with applicable laws and regulations
114
What duties need to be kept separate?
C-A-R
Custody
Authorization
Recording & reconcilliation
115
What is the auditor's responsibility for assessing the risk of material misstatement?
The auditor should identify and assess the risks of material misstatement (1) at the financial statement level and (2) at the relevant assertion level related to classes of transactions, account balances, and disclosures.
116
When must tests of control be performed?
When the auditor's risk assessment includes an "expectation of the operating effectiveness of controls." Note that this is frequently referred to as "relying" on internal control as a partial basis for the auditor's conclusions, or "assessing control risk at less than the maximum level."
117
Define the term “significant risks.”
Risks that the auditor believes require special audit consideration
118
List some examples of appropriate responses by the auditor to risks of material misstatement at the financial statement level.
- Assign more experienced staff to the engagement.
- Provide closer supervision.
- Use specialists.
- Use more unpredictable audit procedures.
119
What specific matters should the auditor document regarding the auditor's assessment of the risks of material misstatement?
- The discussion with key members of the audit team about the risks of material fraud and errors
- The major elements of the understanding of the five components of internal control
- The assessment of the risks of material misstatement (at the financial statement and relevant assertion levels) and the basis for that assessment
- The risks identified and the related controls the auditor evaluated
120
Define “material weakness.”
A deficiency (or combination of deficiencies) in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented or detected and corrected on a timely basis
121
Describe the auditor's requirements for communicating deficiencies in an entity's internal controls.
- The auditor must communicate in writing the significant deficiencies (including material weaknesses) identified in the audit.
- The auditor may choose to communicate lesser matters, too as well.
122
Describe the timing of the required communication of significant deficiencies in internal control.
Under AICPA professional standards, written communication is required no later than 60 days after the audit report release date (including matters communicated orally during the audit).
123
Define "significant deficiency."
A deficiency (or combination of deficiencies) in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance
124
What is meant by the term “deficiency in design”?
There is a deficiency in design when a control necessary to meet the control objective is missing, or when the control objective is not always met, even if the control operates as designed
125
What is meant by the term “deficiency in operation”?
There is a deficiency in operation when a properly designed control does not operate as designed, or when the person performing the control does not have the authority or competence to effectively perform the control.
126
When using the internal audit function to provide direct assistance, what two matters should the external auditor evaluate?
1. Objectivity—the internal audit function's organizational status and the objectivity of the internal auditors
2. Competence of the internal auditor
127
Why isn't a "systematic and disciplined approach, including quality control" a relevant consideration when the external auditor uses an internal audit function to provide direct assistance?
Because the work performed by the internal audit function is subject to the external auditor's direction, supervision, and review
128
What are the two ways the external auditor might use the work of an internal audit function?
1. To obtain audit evidence
| 2. To provide direct assistance
129
When using the work of the internal audit function to obtain audit evidence, what three matters should the external auditor evaluate?
1. Objectivity—the internal audit function's organizational status and the objectivity of the internal auditors
2. Competence of the internal auditors
2. Whether the internal audit function applies a "systematic and disciplined approach, including quality control"
