Assessing Risk & Response Flashcards
1
Q
Generally Accepted Auditing Standards (GAAS)
A
Historically, the AICPA identified 10 standards comprising GAAS that used to serve as a framework for U.S. auditing standards. The AICPA replaced these 10 standards with seven principles in connection with its Clarified Auditing Standards.
2
Q
Responsibilities under GAAS
A
Auditors are responsible for having appropriate competence and capabilities to perform the audit; complying with relevant ethical requirements; and maintaining professional skepticism and exercising professional judgment, throughout the planning and performance of the audit.
3
Q
Performance under GAAS
A
To express an opinion, the auditor obtains reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error.
4
Q
Reporting under GAAS
A
Based on an evaluation of the audit evidence obtained, the auditor expresses, in the form of a written report, an opinion in accordance with the auditor’s findings, or states that an opinion cannot be expressed. The opinion states whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.
5
Q
In AICPA professional standards, the word should indicates an (a)
A
Presumptively mandatory requirement from which the CPA may depart in rare circumstances.
6
Q
Statements on Auditing Standards (SASs)
A
Under the clarified auditing standards, any reference to GAAS now specifically means this authoritative body of professional standards (SASs) issued by the Auditing Standards Board.
7
Q
Interpretive Publications
A
Consist of the appendices to the SASs, auditing interpretations of the SASs, auditing guidance included in AICPA Audit and Accounting Guides, and AICPA auditing Statements of Position.
Interpretive publications are not considered to be auditing standards
8
Q
Categories of Professional Requirements
A
- Unconditional requirements—Must comply with the requirement without exception (indicated by “must” in applicable standards);
- Presumptively mandatory requirements—In rare circumstances, the practitioner may depart from such a requirement, but must document the justification
9
Q
Which of the following actions should a CPA firm take to comply with the AICPA’s quality control standards?
A
Establish policies to ensure that the audit work meets applicable professional standards.
The AICPA’s quality control standards are applicable to the CPA firm’s portfolio of audit (and other financial statement related) services
10
Q
A CPA firm would be reasonably assured of meeting its responsibility to provide services that conform with professional standards by
A
Having an appropriate system of quality control.
11
Q
The primary purpose of establishing quality control policies and procedures for deciding whether to accept a new client is to
A
Minimize the likelihood of association with clients whose management lacks integrity.
12
Q
Which of the following activities would be most helpful to a CPA in deciding whether to accept a new audit client?
A
Evaluating the CPA’s ability to properly service the client.
The AICPA’s Statements on Quality Control Standards emphasize four specific issues in making client acceptance/continuance decisions: (1) the integrity of management and those charged with governance; (2) the competence of the engagement team (including time and resources); (3) compliance with relevant ethical requirements (such as independence); and (4) significant issues from prior engagements that affect the continuing relationship. Evaluating the CPA’s ability to properly service the client is associated with the competence of the engagement team, which is identified as an important consideration.
13
Q
How should differences of opinion between the engagement partner and the quality control reviewer be resolved?
A
By following the firm’s policies and procedures.
14
Q
Relationship of GAAS to the SQCS
A
An individual audit engagement is governed by GAAS, whereas a CPA firm’s collective portfolio of accounting and auditing services is governed by the AICPA’s SQCS
15
Q
Six Elements of a Quality Control System
A
- Leadership Responsibilities for Quality
- Relevant Ethical Requirements
- Acceptance and Continuance of Client-Relationships and Engagements
- Human resources
- Engagement performance- compliance with all firm and policy standards
- Monitoring
16
Q
Engagement Quality Control Review
A
A process designed to provide an objective evaluation, before the report is released, of the significant judgments the engagement team made and the conclusions it reached in formulating the auditor’s report.
17
Q
Principles Underlying an Audit Conducted in Accordance with GAAS state that sufficient appropriate audit evidence is to be obtained through designing and implementing appropriate responses, i.e., by performing audit procedures, to afford a reasonable basis for an opinion regarding the financial statements under audit. The substantive evidential matter required by this standard may be obtained, in part, through
A
Substantive evidential matter required by the Principles may include evidence obtained through the performance of substantive analytical procedures (as well as that obtained through inspection, observation, inquiries, and confirmation).
18
Q
The audit work performed by each assistant should be reviewed to determine whether it was adequately performed and to evaluate whether the
A
Results are consistent with the conclusions to be presented in the auditor’s report.
19
Q
GAAS require the auditor’s report to contain either an expression of opinion regarding the financial statements or an assertion to the effect that an opinion cannot be expressed. The objective of this requirement is to prevent
A
Misinterpretations regarding the degree of responsibility the auditor is assuming.
20
Q
An auditor’s responsibility to express an opinion on the financial statements is
A
Explicitly represented in the responsibility paragraphs of the auditor’s unmodified report.
GAAS require an auditor to express an opinion on the financial statements. That responsibility is EXPLICITLY represented in the Auditor’s Responsibility paragraphs of the auditor’s unmodified report which states that the auditor’s responsibility is to express an opinion.
21
Q
Auditor’s report AICPA Clarified Standards
A
- The first section has no label, but it identifies the nature of the engagement and the entity’s financial statements involved (consists of one sentence).
- Management’s Responsibility for the Financial Statements—(1 sentence) it states that management is responsible for the fair presentation of the financial statements and the implementation of internal control.
- Auditor’s Responsibility,
- Opinion—(one sentence) it expresses the auditor’s opinion (in the same wording as that used in the previous AICPA standards).
22
Q
Auditor’s Responsibility
A
- The first consists of three sentences:
- Responsibility to express an opinion
- Conducted the audit in accordance with (GAAS)
- Plan and perform the audit to provide reasonable assurance. - The second consists of five sentences:
- Perform procedures to obtain audit evidence about the amounts and disclosures.
- The procedures depend on the auditor’s judgment, including assessment of risks of material misstatement, whether due to fraud or error.
- In making those risk assessments, the auditor considers internal control.
- The auditor expresses no such opinion (on interna l control, when not eng aged to report on inte rnal control in an “integ rated audit” ).
- An audit includes evaluating the appropriateness of accounting policies used and the reasonableness of significant accounting estimates. - The third consists of one sentence—expressing the auditor’s belief that the audit evidence is sufficient and appropriate to provide a basis for the opinion.
23
Q
AICPA’s Statements on Standards for Accounting and Review Services (SSARSs)
A
These are applicable when the CPA is associated with the financial statements of a private company, but that association is something less than a full-scope audit engagement.
Compilation- no assurance, compiles F/S with available information
Review- lower level of assurance than audit
24
Q
AICPA’s Statements on Standards for Attestation Engagements (SSAEs)
A
These are applicable when the CPA provides assurance about written representations or subject matter other than historical financial statements
25
A written engagement letter must be obtained for engagements to audit, review, or compile an entity's financial statements under AICPA Professional Standards.
This should not be surprising, since the “public interest” is associated with such financial statement subject matter.
26
The Sarbanes-Oxley Act of 2002 imposes a mandatory rotation applicable to both the audit engagement partner and the quality control (also called review) partner. How long in total is the partner allowed to serve as the engagement partner or review partner before someone else must serve in that capacity?
5 years
27
The Public Company Accounting Oversight Board (PCAOB) is charged with all of the following responsibilities except:
Establishing accounting standards for public companies.
The FASB establishes accounting standards. PCAOB establishes auditing standards.
28
Public Company Accounting Oversight Board (PCAOB)—Five primary responsibilities
1. Registration of public accounting firms
2. Inspections of registered public accounting firms (annually if audit at least 100 issuers)
3. Standard setting for attestation, quality control and ethics and independence in preparation of audits
4. Enforcement
5. Funding
29
Sarbanes-Oxley Act of 2002
Title I—Established the PCAOB, gave standard-setting authority to the PCAOB
Title II—Established independence requirements for external auditors
Title III—Established requirements related to corporate re sponsibility to make executives take responsibility for the accuracy
30
Which of the following statements is correct regarding characteristics required of an engagement quality reviewer under PCAOB auditing standards?
An individual outside of the registered public accounting firm becomes an "associated person" of the registered public accounting firm when receiving compensation from the firm for performing the engagement quality review.
31
The PCAOB (specifically, AS Section 1220) identifies the following as "significant engagement deficiencies"
(1) the engagement team failed to obtain sufficient appropriate evidence; (2) the engagement team reached an inappropriate overall conclusion; (3) the engagement report is not appropriate; or (4) the firm is not independent of its client.
32
Which of the following is a correct statement regarding differences between PCAOB auditing standards on engagement quality review and AICPA Statements on Quality Control Standards (SQCS)?
PCAOB auditing standards require a concurring approval of issuance before the engagement report is released, whereas the SQCS have no such requirement.
PCAOB auditing standards require a cooling-off period of at least two years before an engagement partner can serve as an engagement quality reviewer, whereas the SQCS have no such requirement.
PCAOB auditing standards require an engagement quality review before an audit report is released, whereas SQCS do not require an engagement quality review.
33
To evaluate the significant judgments and conclusions of the engagement team under PCAOB auditing standards, the engagement quality reviewer should
(1) holding discussions with the engagement partner and other members of the engagement team and (2) reviewing the engagement's audit documentation
34
Engagement Quality Review
Requires an engagement quality review (and concurring approval of issuance) for engagements conducted under PCAOB standards (1) for an audit; (2) for a review of interim financial information; and (3) for an attestation engagement regarding compliance reports of brokers and dealers
35
“Cooling-off” restriction
The person serving as engagement partner during either of the two audits preceding the audit subject to engagement quality review is not permitted to serve as engagement quality reviewer
36
Qualifications of an Engagement Quality Reviewer
(1) Must be an associated person of a registered public accounting firm; and (2) must have competence, independence, integrity, and objectivity
37
PCAOB Standards Have Several Differences Relative to AICPA's Statements on Quality Control Standards (SQCS)
1. Engagement Quality Review—SQCS do not require an engagement quality review for any type of engagement, whereas the PCAOB establishes such a requirement.
2. Cooling-off Restriction—SQCS do not impose a “cooling-off” restriction or a requirement that the reviewer must be an associated person of a registered public accounting firm.
3. Concurring Approval of Issuance —SQCS require any engagement quality review performed be completed before the engagement report is released without requiring a concurring approval of issuance.
4. Documentation Retention and Changes—SQCS do not specifically require that engagement quality review documentation must be retained with other engagement documentation and be subject to specific policies regarding retention and changes.
38
The GAAS requirement states that due care is to be exercised in the performance of an audit is ordinarily interpreted to require
Critical review of the judgment exercised at every level of supervision.
While due care imposes the general responsibility of following the applicable GAAS standards, the professional standards specifically address the need for critical review.
39
A CPA firm evaluates its personnel advancement experience to ascertain whether individuals meeting stated criteria are assigned increased degrees of responsibility.
This is evidence of the firm's adherence to which of the following prescribed standards
Professional standards on quality control (not supervision and review) require that a firm establish policies and procedures to ensure that personnel selected for advancement have the qualifications necessary for the work they will be required to perform.
40
Would the following factors ordinarily be considered in planning an audit engagement's personnel requirements?
Opportunities for on-the-job training
| Continuity and periodic rotation of personnel
41
After field work audit procedures are completed, a partner of the CPA firm who has not been involved in the audit performs a second or wrap-up working paper review. This second review usually focuses on
The fair presentation of the financial statements in conformity with GAAP.
42
The auditor's standard report on financial statements should refer to generally accepted auditing standards (GAAS) and generally accepted accounting principles (GAAP).
Explicitly for BOTH
43
Before accepting an audit engagement, a successor auditor should make specific inquiries of the predecessor auditor regarding the predecessor's
A successor auditor should communicate with the predecessor auditor about matters that will assist the successor auditor in deciding whether to accept the engagement. These would include the integrity of management, disagreements with management, and the predecessor's understanding of the reason for the change in auditors.
44
Hill, CPA, has been retained to audit the financial statements of Monday Co. Monday's predecessor auditor was Post, CPA, who has been notified by Monday that Post's services have been terminated.
Under these circumstances, which party should initiate the communications between Hill and Post?
Hill, the successor auditor.
45
Ordinarily, the predecessor auditor permits the successor auditor to review the predecessor's working paper analyses relating to
The successor auditor normally reviews the predecessor's audit documentation relating to planning, internal control, audit results, balance sheet accounts, and contingencies.
46
An auditor is required to establish an understanding with a client regarding the services to be performed for each engagement. This understanding generally includes
- the objective of the audit;
- management's responsibilities with regard to the financial statements, internal control, compliance with laws and regulations, availability of records, and the management representation letter;
- the auditor's responsibilities for GAAS and reportable conditions;
- a description of an audit; and
- management's responsibilities regarding correction of material misstatements and evaluation of immaterial adjustments.
47
In assessing whether to accept a client for an audit engagement, a CPA should consider the
Client's business risk
CPA's business risk
The client's business risk is the risk that the client will fail to meet its objectives, particularly with regard to survival and profitability. The CPA's business risk is the risk that the CPA's business will suffer due to association with the client.
48
Which of the following factors most likely would cause a CPA to not accept a new audit engagement?
The prospective client is unwilling to make all financial records available to the CPA.
Access to all financial records would be a minimum requirement for the audit, and management is required to state in the management representation letter that all financial records and data have been made available to the auditors.
49
Which of the following matters does an auditor usually include in the engagement letter?
Arrangements regarding fees and billing.
The engagement letter identifies the respective responsibilities of the entity and the auditor, and essentially constitutes the contract between the parties.
50
Before accepting an engagement to audit a new client, a CPA is required to obtain
The prospective client's consent to make inquiries of the predecessor, if any.
AICPA standards addressing required communications between successor and predecessor auditors state that an auditor should not accept an engagement until the successor auditor's required communications with the predecessor auditor have been evaluated.
51
An auditor's engagement letter most likely would include
- "The objective and scope of the audit of the financial statements.
- The responsibilities of the auditor.
- The responsibilities of management. ("for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error")
- A statement that because of the inherent limitations of an audit, together with the inherent limitations of internal control, an unavoidable risk exists that some material misstatements may not be detected, even though the audit is properly planned and performed in accordance with GAAS.
- Identification of the applicable financial reporting framework for the preparation of the financial statements.
- Reference to the expected form and content of any reports to be issued by the auditor and a statement that circumstances may arise in which a report may differ from its expected form and content."
52
Which of the following could be difficult to determine because electronic evidence may not be retrievable after a specific period?
The timing of control and substantive tests.
When it might be best (or even possible) to perform tests of control and substantive tests could be affected by the availability of underlying evidence.
53
The audit plan usually cannot be finalized until the
Consideration of the entity's internal control structure has been completed.
The audit plan (sometimes referred to as the "audit program") documents the auditing procedures to be performed. It cannot be finalized until consideration of the entity and its environment, including internal control, has been completed.
54
Which of the following factors is most likely to affect the extent of the documentation of the auditor's understanding of a client's system of internal controls?
The use of information technology in the accounting system greatly impacts the auditor's documentation of that system. For example, a highly automated system will result in very different documentation than a manual system.
55
In planning a new engagement, which of the following is a factor that affects the auditor's judgment as to the quantity, type, and content of audit documentation?
- the nature of the engagement;
- the type of report to be issued;
- the nature of the financial statements, schedules, or other information on which the auditor is reporting;
- the nature and condition of the client's records;
- the assessed level of control risk (including the estimated occurrence rate of attributes); and
- the needs in the particular circumstances for supervision and review of the work.
56
Because of the risk of material misstatement, an audit of financial statements in accordance with generally accepted auditing standards should be planned and performed with an attitude of
Professional skepticism.
57
In planning an audit, an auditor would
- coordinate client assistance to be rendered
- discuss matters that may affect the audit with consulting and tax staff
- read the current year's interim financial statements
58
The in-charge auditor most likely would have a supervisory responsibility to explain to the staff assistants
How the results of various auditing procedures performed by the assistants should be evaluated.
59
To obtain an understanding of a continuing client's business in planning an audit, an auditor most likely would
Review prior-year audit documentation and the permanent file for the client.
Knowledge of a client's business is generally obtained though experience with the client or the industry and inquiry of client personnel.
60
When issuing an unqualified opinion, the auditor who evaluates the audit findings should be satisfied that the
Estimate of the total likely misstatement is less than a material amount.
In order to issue an unqualified opinion, the auditor must be confident that no material misstatements exist in the financial statements. While misstatements may exist, in total they must be believed to be less than a material amount.
61
When planning a sample for a substantive test of details, an auditor should consider tolerable misstatement for the sample. This consideration should
Be related to preliminary judgments about materiality levels.
62
Based on new information gained during an audit of a nonissuer, an auditor determines that it is necessary to modify materiality for the financial statements as a whole. In this circumstance, which of the following statements is accurate?
Materiality levels for particular classes of transactions, account balances, or disclosures might also need to be revised.
63
Materiality
The magnitude of an omission or misstatement of accounting information that, in the light of surrounding circumstances, makes it probable that the judgment of a reasonable person relying on the information would have been changed or influenced by the omission or misstatement.
64
Performance Materiality:
The amount(s) set by the auditor at less than materiality for the financial statements as a whole to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole
65
Tolerable Misstatement:
The application of performance materiality to a particular sampling procedure.
This term refers to the maximum error in a population that the auditor is willing to accept.
66
In planning the audit
The auditor should determine performance materiality in connection with assessing the risks of material misstatement and determining the nature, timing, and extent of further audit procedures at the relevant assertion level.
67
Documentation
- Materiality for the financial statements as a whole
- Materiality level(s) for particular classes of transactions, account balances, or disclosures, as applicable
- Performance materiality
- Any revision of those considerations during the audit engagement
68
Quantitative guidelines for Materiality
In practice, auditors frequently apply a variety of “benchmarks” as a starting point in determining the appropriate materiality levels.
69
Qualitative matters
1. Public vs. private (lower materiality threshold for public due to litigation concerns)
2. Unstable versus stable industry
70
As a result of control testing, a CPA has decided to reduce control risk. What is the impact on substantive testing sample size if all other factors remain constant?
The sample size would be lower.
Lowering the assessment of control risk would permit a somewhat higher level of detection risk. Taking a smaller sample size would be associated with a higher level of detection risk, which would be appropriate in view of the reduced control risk. Higher DR means there is more trust in internal controls.
71
The acceptable level of detection risk is inversely related to the
Assurance provided by substantive tests.
Detection risk is inversely related to the assurance provided by substantive tests. The lower the detection risk, the more assurance needed from substantive testing.
72
The risk that an auditor will conclude, based on substantive tests, that a material error does not exist in an account balance when, in fact, such error does exist is referred to as
Detection risk.
73
Inherent risk and control risk differ from detection risk in that inherent risk and control risk are
Functions of the client and its environment while detection risk is not.
74
When an auditor increases the assessed level of control risk because certain control procedures were determined to be ineffective, the auditor would most likely increase the
Extent of tests of details.
An increase in the assessed level of control risk means that the risk of a material misstatement occurring and not being detected has increased. To offset that increased risk, the auditor should make decisions that decrease the level of detection risk. Increasing the emphasis on tests of details would decrease detection risk.
75
Holding other planning considerations equal, a decrease in the number of misstatements in a class of transactions that an auditor could tolerate most likely would cause the auditor to
Perform the planned auditing procedures closer to the balance sheet date.
Performing the planned auditing procedures closer to the balance sheet date increases the effectiveness of substantive procedures and thus increases substantive testing.
76
Definition of Audit Risk
The risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. Audit risk is a function of the risks of material misstatement and detection risk.
AR = RMM × DR
77
Risk of Material Misstatement
The risk that the financial statements are materially misstated prior to the audit.
RMM at the Overall Financial Statement Level— This refers to risks that are “pervasive” to the financial statements and that potentially affect many assertions.
78
RMM at the Assertion Level
The auditor assesses RMM at the assertion level for the purpose of determining the nature, timing, and extent of further audit procedures to obtain sufficient appropriate audit evidence. RMM at the assertion level consists of two components: (1) inherent risk; and (2) control risk
79
Inherent Risk (IR):
The probability that a material misstatement would occur in the particular audit area in the absence of any internal control policies and procedures.
80
Control Risk (CR):
The probability that a material misstatement that occurred in the first place would not be detected and corrected by internal controls that are applicable.
81
“Detection risk” is the only component risk that is specifically the auditor's responsibility
- If IR and CR are seen by the auditor as too high, the auditor must compensate by decreasing DR.
- If IR and CR are perceived as low, the auditor may consider accepting a higher DR.
82
Increasing or decreasing DR is accomplished by adjusting the nature, timing, and/or extent of the auditor's substantive audit procedures.
Nature- “soft evidence” analytical procedures versus the “hard evidence” tests of details
Timing - At an “interim” date (prior to year-end) or at “final” (after year-end when the books have been closed) and the auditor is actually auditing the numbers that the entity intends to report in its financial statements)?
Extent- larger sample sizes
83
The auditor should consider certain factors in assessing the efficiency and effectiveness of analytical procedures as compared to tests of details. In determining whether and to what extent analytical procedures should be used, which of the following should the auditor consider?
The nature of the assertion tested.
AICPA Professional Standards (specifically, AU-C 520.A8) list 4 factors that determine the effectiveness and efficiency of analytical procedures used for substantive purposes: (1) the nature of the assertion, (2) the plausibility and predictability of the relationship, (3) the availability and reliability of the data used to develop the expectation, and (4) the precision of the expectation.
84
Which of the following most likely would cause an auditor to consider whether a client's financial statements contain material misstatements?
The results of an analytical procedure disclose unexpected differences.
Analytical procedures are a category of "substantive" audit procedures, and unexpected differences relative to the auditor's expectations may direct the auditor's attention to the possibility of a material misstatement.
85
Which of the following is an analytical procedure that an auditor most likely would perform when planning an audit?
Comparing current-year balances to budgeted balances
86
Which of the following statements is correct concerning analytical procedures used in planning an audit engagement?
They usually use financial and nonfinancial data aggregated at a high level.
87
Which of the following would not be considered an analytical procedure?
Projecting a deviation rate by comparing the results of a statistical sample with the actual population characteristics
This would more likely be a test of controls.
88
Analytical procedures used in planning an audit should focus on identifying
Areas that may represent specific risks relevant to the audit.
Analytical procedures enable the auditor to gain an understanding of the client's business and raise questions when current balances differ from expected balances. In this manner, the auditor is able to identify specific areas of risk that will need to be addressed during the audit.
89
An auditor's decision either to apply analytical procedures as substantive tests or to perform tests of transactions and account balances usually is determined by the
Relative effectiveness and efficiency of the tests.
Evidence may be gathered by means of analytical tests (performed as substantive tests), tests of transactions, and tests of details of balances.
90
What is the definition of fraud in an audit of financial statements?
An intentional act that results in a material misstatement in financial statements that are the subject of an audit.
91
Which of the following factors would be most likely to heighten an auditor's concern about the risk of fraudulent financial reporting?
An overly complex organizational structure involving unusual lines of authority.
This type of structure would make it easier to override internal controls to materially misstate the financial statements.
92
Which of the following situations most likely represents the highest risk of a misstatement arising from misappropriations of assets?
Risk factors associated with opportunities to misappropriate assets include easily convertible assets, such as bearer bonds.
93
Which of the following statements reflects an auditor's responsibility for detecting errors and irregularities?
An auditor should design the audit to provide reasonable assurance of detecting errors and irregularities that are material to the financial statements.
94
Which of the following statements is correct with respect to fraud encountered during an audit engagement of a nonissuer?
It is often difficult to detect fraudulent intent in matters involving accounting estimates and the application of accounting principles.
95
There are two different types of misstatements that are relevant to the auditor's consideration of fraud:
1. Fraudulent financial reporting—This type of fraud involves misstatements that are intended to deceive financial statement users
2. Misappropriation of assets—This type of fraud involves theft of assets causing the financial statements to be misstated owing to false entries intended to conceal the theft.
96
Inquiry and Analytical Procedures
To obtain information needed to identify the risks of material fraud the auditor emphasizes “inquiry” and “analytical procedures.” (The auditor's important inquiries should be documented in the Management Representations Letter at the end of fieldwork!)
97
Fraud Risk Factors
(1) incentive/pressure
(2) opportunity
(3) attitude/rationalization
98
Responses to Risk Assessment
The auditor might make some “overall responses” (at the financial statement level, such as assigning more experienced staff to the engagement) and make other responses “at the assertion level” (by designing audit procedures for which the nature, timing, and extent of those procedures are responsive to the assessed risks of fraud).
99
Management Override
Management override means that upper management may not be affected by controls that are imposed on subordinates throughout the organization.
1. Examine adjusting journal entries—The auditor should be especially attentive to nonstandard journal entries
2. Evaluate accounting estimates for bias—The auditor should consider performing a “retrospective review,” which means evaluating prior years’ estimates for reasonableness
3. Evaluate the business rationale for any unusual transactions—The auditor should look for appropriate authorization of any unusual transaction
100
During the course of an audit, an auditor finds evidence that an officer has entered fraudulent transactions in the financial statements. The fraudulent transactions can be adjusted so the statements are not materially misstated. What should the auditor do?
Any fraud involving senior management, whether material or not, should be reported to those charged with governance.
If not senior management, report to next level manager in organization.
101
Disclosure of irregularities to parties other than a client's senior management and its audit committee or board of directors ordinarily is not part of an auditor's responsibility.
However, to which of the following outside parties may a duty to disclose irregularities exist?
To the SEC when the client reports an auditor change
To a successor auditor when the successor makes appropriate inquiries
To a government funding agency from which the client receives financial assistance
102
Which of the following information discovered during an audit most likely would raise a question concerning possible illegal acts?
The entity prepared several large checks payable to cash during the year.
103
An auditor who uses the work of a specialist may refer to the specialist in the auditor's report if the
Auditor modifies the report because of the difference between the client's and the specialist's valuations of an asset.
AICPA Professional Standards indicate that reference to the work of a specialist may be made in the auditor's report if the auditor believes such reference will facilitate an understanding of the reason for a modified opinion.
104
Which of the following statements concerning the auditor's use of the work of a specialist is correct?
The specialist is not required to be independent. The auditor, however, must evaluate the nature of the relationship of the specialist to the client and assess the specialist's ability to be objective.
105
Auditor's Specialist:
An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist the auditor
106
Management's Specialist:
An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the entity to assist the entity
107
Basic Requirements of the Auditor with Respect to Using an Auditor's Specialist
1. Determine the need
2. Competence, Capabilities, and Objectivity of the Specialist
3. Obtaining an Understanding of the Field of Expertise
4. Agreement with the Auditor's Specialist
5. Evaluating the Adequacy of the Work
Note that the auditor is still responsible for the expressed opinion, so the auditor's responsibility is not reduced by using the work of an auditor's specialist.
108
Which of the following matters is an auditor required to communicate to an entity's audit committee (or those charged with governance)?
Significant audit adjustments
Changes in significant accounting policies
Management's consultation with other accountants about significant accounting matters
All uncorrected misstatements
If errors are discovered and corrected by management, such matters would not need to be communicated, unless determined to be significant.
109
Which of the following matters is an auditor required to communicate to an entity's audit committee (or those charged with governance)?
I. Disagreements with management about matters significant to the entity's financial statements that have been satisfactorily resolved.
II. The auditor's views about qualitative aspects of the entity's significant accounting practices, including accounting policies, accounting estimates, and financial statement disclosures.
BOTH
110
During the planning phase of an audit, an auditor is identifying matters for communication to the entity's audit committee (or those charged with governance) .
The auditor most likely would ask management whether
The auditor is required to communicate with the audit committee about changes in the application of significant accounting principles.
111
Matters Required to Be Communicated with Those Charged with Governance
1. The Auditor's Responsibilities under GAAS
2. The Planned Scope and Timing of the Audit
3. Significant Findings from the Audit (including disagreements with management, uncorrected misstatements)
4. Going-Concern Issues
112
The objectives of Auditing Standard No. 16, "Communications with Audit Committees," include all of the following:
Obtaining information from the audit committee that is relevant to the audit.
Providing the audit committee with timely information about significant audit issues.
Communicating to the audit committee the auditor's responsibilities and establish an understanding of the terms of the engagement.
113
Under PCAOB auditing standards, the auditor should communicate all of the following matters to an issuer's audit committee at the beginning of the audit engagement
Significant issues that the auditor discussed with management in connection with the auditor's appointment/retention.
The terms of the engagement, including the objectives of the audit and the parties' respective responsibilities.
An overview of the audit strategy and timing of the audit, along with any significant risks identified by the auditor.
114
Which of the following factors would a CPA ordinarily consider in the planning stage of an audit engagement?
I. Financial statement accounts likely to contain a misstatement.
II. Conditions that require extension of audit tests.
BOTH
115
An auditor's analytical procedures most likely would be facilitated if the entity
Uses a standard cost system that produces variance reports.
This is the only answer that would enable an auditor to compare actual results to a prediction - use of a standard cost system (producing the estimate) and production of variance reports (giving the comparison to actual).
116
Which of the following would be considered an analytical procedure?
Comparing inventory balances to recent sales activities.
Analytical procedures are defined as "evaluations of financial information through analysis of plausible relationships among both financial and nonfinancial data."
117
An auditor is concerned about a policy of management override as a limitation of internal control. Which of the following tests would best assess the validity of the auditor's concern?
Verifying that approved spending limits are not exceeded.
118
An auditor's flowchart of a client's accounting system is a diagrammatic representation that depicts the auditor's
Understanding of the system.
119
Decision tables differ from program flowcharts in that decision tables emphasize
Logical relationships (decision rules) among conditions and actions.
120
In planning an audit of certain accounts, an auditor may conclude that specific procedures used to obtain an understanding of an entity's internal control structure need not be included because of the auditor's judgments about materiality and assessments of
Inherent Risk
If the auditor has concluded that an account is immaterial and that inherent risk is low, the auditor might decide to skip the procedures used to obtain an understanding of the related internal controls because the risk of a material misstatement occurring is low.
121
An advantage of using systems flowcharts to document information about internal control, instead of using internal control questionnaires, is that systems flowcharts
Provide a visual depiction of clients' activities.
122
Which of the following most accurately describes the process of a walkthrough?
Following a transaction from its origination until it is reflected in the financial statements
123
Document the Auditor's Understanding of Internal controls:
1. Flow charts of transaction cycles
2. Internal control questionnaires (ICQs)
3. Narrative write-ups
124
Assessing control risk at below the maximum level most likely would involve
Identifying specific internal control structure policies and procedures relevant to specific assertions.
125
Control risk should be assessed in terms of
Financial statement assertions.
126
After obtaining an understanding of the internal control structure and assessing control risk of an entity, an auditor decided not to perform tests of controls.
The auditor most likely decided that
It would be inefficient to perform tests of controls that would result in a reduction in planned substantive tests
If testing controls won't reduce substantive testing sufficiently (i.e., enough to offset the cost of testing controls), the auditor will opt not to test controls. In other words, it would be inefficient to perform the tests of controls.
127
Which of the following statements about internal control structure is correct?
A primary criterion of any system of internal control is the cost-benefit relationship.
128
When assessing control risk at below the maximum level, an auditor is required to document the auditor's understanding of the
I. Entity's control activities that help ensure management directives are carried out.
II. Entity's control environment factors that help the auditor plan the engagement.
BOTH
129
Perform Tests of Controls
If reliance is planned (regarding operating effectiveness)—Reliance means the same thing as to assess control risk at less than the maximum level for purposes of accepting a somewhat higher level of detection risk.
Perform tests of controls—but only for those specific control policies and procedures (strengths that justify accepting a somewhat higher level of detection risk) on which reliance is planned.
The purpose of performing tests of control is to verify that the controls that looked good on paper (design effectiveness) were actually working as intended throughout the period (operating effectiveness).
130
Which of the following elements of an entity's internal control structure includes the development of personnel manuals documenting employee promotion and training policies?
Control environment.
131
COSO's Internal Control Integrated Framework identifies five components of an internal control system:
(1) control environment
(2) risk assessment
(3) control activities- segregation of duties, performance reviews, authorization, policies that ensure mgmt directives are carried out
(4) information and communication system- policies related to identification, capture and exchange of information
(5) monitoring
132
An auditor should obtain sufficient knowledge of an entity's accounting system to understand the
Process used to prepare significant accounting estimates.
Accounting estimates are an area of concern to the auditors because of the amount of judgment and discretion they entail.
133
Which of the following audit techniques most likely would provide an auditor with the most assurance about the effectiveness of the operation of an internal control procedure?
Observation of client personnel.
134
Risk Assessment Procedures to assess control risk
1. Inquiries of Management and Others
2. Observation and Inspection
3. Analytical Procedures
4. Review Information
5. Discussion among Audit Team Members
135
Standard of Fieldwork of GAAS
The auditor must obtain a sufficient understanding of the entity and its environment, including its internal control, to assess the risk of material misstatement of the financial statements whether due to fraud or error, and to design the nature, timing, and extent of further audit procedures.
136
Understanding the Entity and Its Environment
1. Industry, regulatory, and other external factors
2. Nature of the entity-may help the auditor understand the classes of transactions, account balances, and disclosures that are relevant to the financial statements
3. Objectives and strategies
4. Measurement and review of the entity's financial performance-aspects of the entity's performance that management considers important
5. Obtain a sufficient understanding of internal control
137
Internal Control:
A process—effected by those charged with governance, management, and other personnel—that is designed to provide reasonable assurance about the achievement of the entity's objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations
138
When companies use information technology (IT) extensively, evidence may be available only in electronic form. What is an auditor's best course of action in such situations?
Use generalized audit software to extract evidence from client databases.
139
The objective of tests of details of transactions performed as tests of controls is to
Evaluate whether an internal control structure policy or procedure operated effectively.
140
Overall Responses to the Risks of Material Misstatement at the Financial Statement Level
- As the risk of material misstatement increases, the auditor may assign more experienced staff to the engagement; provide closer supervision; use specialists; use more unpredictable audit procedures; and/or make appropriate changes in the nature, timing, or extent of further audit procedures.
- The assessment of the risk of material misstatement may influence the auditor's strategy in using a substantive approach or a combined approach that uses both tests of controls and substantive procedures
141
Responses to the Risks of Material Misstatement at the Relevant Assertion Level
- Substantive procedures must be performed to some degree for all relevant assertions related to each material class of transactions, account balance, or disclosure (i.e., the auditor cannot rely totally on the effectiveness of the entity's internal controls).
- Nature— purpose of further audit procedures (tests of controls or substantive procedures) and their type (inspection, observation, inquiry, confirmation, recalculation, or analytical procedures).
- Timing—when the further audit procedures are performed; performing substantive procedures at year-end is usually more effective with a higher risk of material misstatement.
- Extent— quantity of an audit procedure to be performed (such as sample size) based on the auditor's judgment;
142
Documentation—The auditor should document the following for risk assessment:
- The overall responses to address the assessed risk of misstatement at the financial statement level;
- The nature, timing, and extent of the further audit procedures;
- The linkage of those procedures with the assessed risks at the relevant assertion level;
- The results of the audit procedures; and
- The conclusions reached in the current audit about the operating effectiveness of controls tested in a prior audit.
143
Significant deficiencies are matters that come to an auditor's attention that should be communicated to an entity's audit committee (or those charged with governance) because they represent
Significant deficiencies in the design or operation of internal control.
144
Which of the following factors should an auditor consider in making a judgment about whether an internal control deficiency is so significant that it is a significant deficiency?
Factors to be considered in evaluating deficiencies include the entity's size, its complexity, and the nature and diversity of its business activities.
145
Which of the following representations should not be included in a report on internal control related matters noted in an audit?
An auditor is not allowed to issue a report indicating that no significant deficiencies were found. Such a report might be misinterpreted.
146
Which of the following statements is correct concerning significant deficiencies noted in an audit?
The auditor should separately identify and communicate significant deficiencies and material weaknesses.
147
Significant Deficiency:
A deficiency (or combination of deficiencies) in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.
148
Material Weakness:
A deficiency (or combination of deficiencies) in internal control such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented or detected and corrected on a timely basis.
149
Communicating Identified Control Deficiencies
Form of Communication—Identified significant deficiencies and material weaknesses must be communicated in writing to management and those charged with governance.
Timing—The required communication is best made by the “report release date” and should be made no later than 60 days following the report release date. The “report release date” is the date that the auditor grants the entity permission to use the auditor's report (AICPA). The PCAOB requires such matters be communicated prior to the release of the auditor's report.
150
The written communication about significant deficiencies and material weaknesses should:
- State that the purpose of the audit was to express an opinion on the financial statements, not to express an opinion on the effectiveness of internal control
- State that the auditor is not expressing an opinion on the effectiveness of internal control
- State that the auditor's consideration of internal control was not designed to identify all significant deficiencies or material weaknesses.
- Include the definition of the terms material weakness and significant deficiency
- Identify the matters that are considered to be material weaknesses and significant deficiencies
- State that the communication is intended solely for the use of management, those charged with governance, and others within the organization
151
An auditor may decide to assess control risk at the maximum level for certain assertions because the auditor believes
Control risk is assessed in terms of the financial statement assertions. The auditor may assess control risk at maximum because the controls do not pertain to the assertions, or are ineffective, or because testing such controls would not result in a reduction in substantive testing (would be inefficient).
152
The work of internal auditors may affect the independent auditor's
I. Procedures performed in obtaining an understanding of the internal control structure.
II. Procedures performed in assessing the risk of material misstatement.
III. Substantive procedures performed in gathering direct evidence.
153
Which of the following factors should an external auditor obtain updated information about when assessing an internal auditor's competence?
The auditor should obtain (or update) information about: educational level and professional experience; professional certification and continuing education; policies related to assignment of internal auditors; policies related to supervision and review; quality of work products; and performance evaluations.
154
When assessing internal auditors' objectivity, an independent auditor should
When assessing the internal auditor's objectivity, the auditor should consider (1) the organizational status of the internal audit function; and (2) the policies affecting the internal auditor's objectivity about areas audited.
155
For which of the following judgments may an independent auditor share responsibility with an entity's internal auditor who is assessed to be both competent and objective?
Materiality of misstatements
Evaluation of accounting estimates
NO for both
An independent auditor may NOT share responsibility with an internal auditor in any audit judgment area
156
Two Ways to Use the Work of an Internal Audit Function
1. Using the internal audit function to obtain audit evidence means, in effect, substituting the internal auditors' work (related to tests of controls and/or substantive procedures) in place of work that would otherwise be performed by the external auditor.
2. Using the internal audit function to provide direct assistance means using internal auditors to perform audit procedures subject to the external auditor's direction, supervision, and review.
157
There are three necessary conditions before the external auditor may use the internal audit function to obtain audit evidence
- Objectivity—The internal audit function's organizational status (dealing with the level to whom the function reports, such as those charged with governance, rather than middle management) and relevant policies and procedures must support the objectivity of the internal auditors.
- Competence—The internal auditors must be competent (related to their education, experience, certification, etc.) to perform reliable work.
- Systematic and disciplined approach (not needed when used for direct assistance)
158
The external auditor should perform more of the work directly when
(a) the degree of judgment involved increase
(b) the assessed risk of material misstatement increases, (c) the organizational status and objectivity of the internal auditors decreases
(d) the competence of the internal auditors decreases.
159
When using the internal audit function to obtain audit evidence, the external auditor should document the following:
- The evaluation of the internal audit function's organizational status and objectivity of the internal auditors, the function's competence, and the application of a systematic and disciplined approach;
- The nature and extent of the work used and the basis for that decision
- The external auditor's procedures performed to evaluate the work of the internal audit function.
