AUD_3 Flashcards
(69 cards)
1
Q
The steps in an Audit…
A
- Prepare for the audit
- Obtain an understanding of Client, its environment, including internal control
- Assess risks of material misstatement and determine nature, timing & extent of further procedures
- Perform test of controls
- Perform substantive procedures
- Formulate an opinion
- Issue audit report
2
Q
AU-C 315, Understanding the Entity and its Environment and Assessing the Risks of Material Misstatements:
A
The objective of AU-C 315 is for the auditor to identify and assess the risks of material misstatement (RMM), whether due to fraud or error. Understanding the entity and its environment, including the entity’s internal control.
3
Q
For issuers, Sarbanes-Oxley, requires issuers to perform…
A
Integrated audit, of both internal control over financial reporting and the financial statements.
4
Q
The three primary objectives of a system of internal control (ACE)…
A
A - Accurate & Reliable Financial Reporting
C - Compliance with applicable laws and regulations
E - Efficient and effective operations
5
Q
The first 5 assertions related to Events and Transactions that occurred during the period of audit, as generally presented on an entity’s income statement (CPA-CO) are…
A
C - Completeness - all events or transactions pertaining to the entity that occurred
P - Period Cutoff - all events and transactions have been reported in the appropriate period
A - Accuracy - events and transactions have been reported in the appropriate amounts
C - Classification - events and transactions are included in appropriate accounts or categories
O - Occurrence - event or transaction did occur
6
Q
Next 4 assertions relate to Account Balances, amounts reported as of the date of the financial statements, as generally reported on the balance sheet (RACE) are…
A
R - Rights and Obligations - entity has rights to those items reported as assets and liabilities are the obligations
A - Allocation and Valuation - assets, liabilities, and equity related items are reported in amounts that are appropriate as of the date of the financial statements (amount is correct)
C - Completeness - assets, liabilities, and equity that should have been reported are included on the financial statement
E - Existence - assets, liabilities, and equity are reported on the financial statements exist as of the F/S date
7
Q
Final 5 assertions relate to the Presentation of the financial statements and disclosures (RACOU-n (Raccoon) are…
A
R - Rights and Obligations - information presented and disclosed is related to events, transactions, and other matters pertain to the entity (all took place)
A - Accuracy and Valuation - financial and non-financial information is fairly presented, properly disclosed, and provides appropriate amounts (all is correct)
C - Completeness - information that should be presented is disclosed (all included)
O - Occurrence - disclosed events, transactions and other matters have occurred and pertain to the entity
U - Understandability and Classification - financial information is appropriately presented and described and disclosures are expressed in a clear manner
8
Q
Useful controls: the strengths in the system. The system is primarily formed by those controls designed by management that relate to the financial statement assertions and which are meant to produce…
A
- Accurate financial records
- Safeguarding of assets
- Adherence to laws and regulations and promote efficiency in the organization are usually not relevant to the financial statement assertions
9
Q
The most commonly used framework to benchmark internal controls in the U.S. is Internal Control - Integrated Framework developed by COSO (Committee of Sponsoring Organizations). As described by COSO…
A
A process, effected by the entity’s board of directors, management, and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the categories of (ACE):
A - Accurate & Reliable Financial Reporting
C - Compliance with applicable laws and regulations
E - Efficient and effective operations
10
Q
The first component of the COSO framework is the control environment, also referred to as the “tone at the top.” Control environment factors include the following (CHOPPER):
A
C - Commitment to competence - effective control requires a sincere interest on the part of the employees performing the good work
H - Human resource policies & practices - company can minimize control difficulties by sound hiring and training policies for employees
O - Organizational structure - company that operates all over the world has different internal control problems than one operating entirely within a single building
P - Participation of those charged with Governance - an audit committee of the board of directors that actively monitors the internal audit function produces a more attentive management on such matters
P - Philosophy of management & management operating style - belief in the importance of internal control by management
E - Ethical values & Integrity - honest employees will be less likely to cause internal control difficulties related to fraud
R - Responsibility assignment - manner in which authority, responsibility and accountability is assigned to different employees determines the controls that will be needed
11
Q
COSO has indicated that there are 5 principles related to the control environment. Management and those charged with governance…
A
- Demonstrate a commitment to integrity and ethical values
- Exercise their oversight responsibility
- Establish structure, authority, and responsibility
- Demonstrate a commitment to competence
- Enforce accountability
12
Q
Risks relevant to financial reporting include external and internal factors, such as…
A
- Changes in the operating environment
- New personnel
- New or revamped information systems
- Rapid growth
- New technology
- New lines of business, products, or activities
- Corporate restructurings
- Foreign operations
- Changes to accounting pronouncements
- Changes to the economic environment
13
Q
COSO has indicated that there are four principles related to risk assessment…
A
- Specify suitable objectives
- Identify and analyze risk
- Assess fraud risk
- Identify and analyze significant change
14
Q
Control activities are policies and procedures that help ensure that management directives are carried out…
A
- Performance reviews - controls involving the evaluation of performance against criteria
- Information processing - controls that prevent the processing of information unless certain criteria are met
- Physical controls - controls that limit access to assets
- Segregation of duties - controls that involve assigning different people responsibilities for authorizing and recording transactions, maintaining custody of assets, performing reconciliations or comparisons
15
Q
Segregation of duties reduce the opportunities to allow a person to be in a position to both perpetrate and conceal errors or fraud (ARCC-s)…
A
A - Authorization of transactions R - Recording (posting) of transactions C - Custody of assets C - Comparisons s - segregation of duties
16
Q
COSO has indicated that there are three principles related to control activities…
A
- Select and develop control activities
- Select and develop general control over technology
- Deploy controls through policies and procedures
17
Q
Information and Communication component of internal control relates to the flow of information to and from the entity as well as within the entity. The auditor should obtain an understanding related to how…
A
- Info system consists of the methods and records used to record, process, summarize and report Co.’s transactions and to maintain accountability for the related accounts
- Communication involves establishing individual duties and responsibilities relating to internal control
- Transactions are initiated, authorized, and processed; and how transactions, events, and conditions are reported
- Accountability is maintained for assets, liability, and equity
- The incorrect processing of transactions is identified and resolved
- Recurring and nonrecurring journal entries, unusual transactions, and other adjustments are identified and prepared
- System overrides or bypasses to controls are processed and accounted for
- Information is transferred from the processing systems to the general ledger
- Events and conditions, other than transactions, that are relevant to financial reporting (dep., amort., collectibility of receivables)
- Financial statements are prepared, including the development of estimates
- Information that is required to be disclosed is identified, accumulated, recorded, processed, summarized, and properly reported
18
Q
COSO has indicated that there are 3 principles related to information and communication…
A
- Use relevant information
- communicate internally
- Communicate externally
19
Q
Monitoring…
A
Monitoring activities are the means by which management determines if internal controls are being followed and if they are effective
20
Q
COSO has indicated that there are 2 principles related to Monitoring…
A
- Conduct ongoing and /or separate evaluations
2. Evaluate and communicate deficiencies
21
Q
The 5 components of internal control is (CRIME)…
A
C - Control activities R - Risk assessment I - Information and communication M - Monitoring E - control Environment
22
Q
The auditor performs the following procedures to obtain and apply an understanding of internal control to an audit:
A
- Obtain an understanding of the design of all 5 components of the entity’s internal control (CRIME)
- Document the understanding of Internal Control
- Assess risk of Material Misstatement (RMM = IR X CR)
- Develop an audit strategy to either:
- Perform test of controls (Rely?); or
- Decide not to test controls and assess CR at max
- Reassess Risk of Material Misstatement
- Document conclusions and determine the effect on the planned substantive procedures
23
Q
Risk assessment procedures included:
A
- Analytical procedures (using high level data)
- Inquiries (management, employees, internal auditors)
- Inspection (docs & records)
- Observation (application of specific controls)
24
Q
The knowledge obtained through risk assessment procedures is used to:
A
- Identify the types of potential misstatements (errors or fraud)
- Consider factors that affect the risk of material misstatements
- Design test of controls and substantive procedures
25
Techniques available to the auditor to gain information about a client's internal control structure include:
- Prior audits
- Reperformance
- Inquiry
- Inspection
- Observation
26
Commonly used techniques that are used for documenting the auditor's understanding of the internal control structure are (FIND)...
F - Flowchart - visual depiction of the internal control structure that shows a process from beginning to end (uses symbols)
I - Internal Control Questionnaire - yes (strong) / no (weak). This is the most structured of the approaches and is the easiest for inexperienced staff
N - Narrative or Memorandum - like a flowchart, but uses words instead of symbols. Not commonly used
D - Decision table / tree - requires a client employee to choose from several alternative actions depending on conditions faced (yes / no). Rarely used
27
Test of controls generally consist of 4 types of procedures (RIIO). You will be testing the the cycles for "ARCC's" by doing "RIIO."
```
ARCC's: (Segregation of Duties)
A - Authorization of transactions
R - Recording (posting) of transactions
C - Custody of assets
C - Comparisons
s - segregation of duties
```
Testing ARCC's by doing RIIO:
R - Reperformance
I - Inspection - examination of controls, documents and reports
I - Inquiry
O - Observation (The most effective type of test!)
28
If the auditor plans to use audit evidence about the operating effectiveness of controls obtained in prior audits and the controls have not changed since they were last tested, the auditor should test the operating effectiveness of such controls at least...
once in every 3 years.
29
Even a strong control environment combined with excellent control activities is subject to certain "inherent limitations" (COCO):
C - Collusion
O - Override by management
C - Competence/Human error
O - Obsolescence
30
Controls have a function of either...
- Preventing misstatements before they occur (most effective) or;
- Detecting and Correcting misstatements that have already occurred (less expensive to implement, but could detect too late)
31
In obtaining an understanding of an entity's internal control, the auditor will identify the different "types of transactions or events" that occur on an ongoing basis. the auditor will then obtain an understanding of various components in particular (SACRED):
S - initation (Start) - what event initiates the transaction
A - Authorization
C - Completion or execution
R - Recording
E & D - Verifications (Evaluate Defenses)
32
Some controls are considered...
- Preventative - designed to minimize the possibility that misstatements will occur (typically most effective)
- Corrective - designed to identify misstatements that may occur due to errors or fraud and establish a means of correcting them on a timely basis.
33
A key aspect of segregation of duties is that...
an employee who is responsible for one of the three functions (authorization, recording, custody) should "not" be involved in either of the two.
34
Assertions frequently tested in discussing the revenue cycle. Examples related to each assertion follow (U-PERCV):
```
U - Understandability & Classification
P - Presentation & Disclosure
E - Existence or Occurrence (Vouching)
R - Rights & Obligations
C - Completeness (Tracing) & Cutoff
V - Valuation, Allocation & Accuracy
```
35
Assertions in relation to sales (CPA-CO):
```
C - Completeness
P - Period Cutoff
A - Accuracy
C - Classification
O - Occurrence
```
36
Assertions in relation to accounts receivable balances (RACE):
R - Rights and Obligations
A - Allocation and Valuation
C - Completeness
E - Existence
37
Revenue Cycle (sales/receivables/cash receipts): Sales documents mentioned on the exam...
- Sales order - list of goods ordered by the customer with prices; prenumbered
- Bill of lading - shipping document signed by the carrier
- Sales invoice - bill that is prepared and sent to the customer after shipment to request payment
- Sales register (journal) - book in which sales invoice information is posted
- Subsidiary receivables ledger - book that lists the outstanding receivables for each customer
- Remittance listing - summary of the money received that day
- Cash receipts journal - book in which the remittance listings are posted
- Deposit slip - document signed or stamped by the bank to acknowledge receipt of checks and periodically reconciled to postings into the cash receipts journal
- Bank reconciliation - cash balance to book balance
38
Spending Cycle (purchases/payables/cash disbursements): Purchases documents mentioned on the exam...
- Purchase requisition - internal request by the department in need for goods to be ordered by the purchasing department
- Purchase order - external form mailed to the vendor to request that goods be delivered to the company
- Receiving report - doc prepared in receiving department and signed by the carrier
- Purchase (vendor) invoice - doc received from the vendor indicating the goods the vendor claims to have shipped
- Invoice register - book listing invoices received from vendors
- Payment voucher - doc prepared by the payables clerk to request payment to vendor
- Purchase journal (or voucher register) - book listing all of the payment vouchers generated by the company
39
The auditor should look for specific applications of the different control activities to the spending cycle. Procedures used to understand the internal control structure related to spending include (PRAISE):
P - Physical controls - verify all goods are received by the receiving department, and returns shipped out
R - Recording - verify that receiving reports are prepared for all goods received, and debit memos are prepared for goods returned
A - Authorization - select individual cancelled checks and vouch them to the purchase orders, receiving reports, vendor invoices, and payment vouchers
I - Independent checks - verify that the client periodically performs inventory counts and reconciles amounts on hand to inventory records
S - Segregation of duties - inquiry and observation to determine that there is a separation of functions of (1) authorization of purchases and payments, (2) recording of purchase orders and posting to the purchase journal, and (3) custody of inventory and checks for payment
E - Evaluate performance - determine if the client uses a standard costing system that generates variances, enabling them to identify actual cost numbers that may be incorrect
40
Tracing through the system...
is an attempt to verify Completeness. Tracing is from source documents to postings in books and records.
41
Vouching in reverse order...
is an attempt to verify the existence or occurrence of transactions. Vouching from books and records back to the source documents.
42
Personnel & Payroll Cycle normally segregated between different departments...
Personnel - this is the "authorization" department that is responsible for hiring of new employees, approval of changes in pay rates, and termination of employees
Payroll - this is the "recording" department that performs the calculation of payroll amounts. The will examine and update records based on authorization from the personnel department
Treasurer - this is the "custody" department that is responsible for the signing and distribution of pay checks to employees
Controller - bank reconciliation
43
Key documents in the Personnel & Payroll Cycle...
- Personnel records
- Hiring and deduction authorization forms (W-4)
- Time cards
- Payroll register
- Paychecks
- Payroll cost allocation
- Bank reconciliations
44
There are 2 reports that the auditor of a service organization may issue:
- Type 1 report is a report on management's description of the service organization's system of controls and the suitability of the design of the controls
- Type 2 report is a report on management's description of the service organization's system of controls and the suitability of the design of and the operating effectiveness of the controls
45
There are 2 reports that the auditor of a service organization may issue:
- Type 1 report is a report on management's description of the service organization's system of controls and the suitability of the design of the controls. Auditor expresses opinion in relation to management's written assertions
- Type 2 report is a report on management's description of the service organization's system of controls and the suitability of the design of and the operating effectiveness of the controls. Auditor expresses opinion in relation to management's assertions and tests of controls performed and the results
46
There are 2 reports that the auditor of a service organization may issue:
- Type 1 report is a report on management's description of the service organization's system of controls and the suitability of the design of the controls. Service auditor expresses opinion in relation to management's written assertions
- Type 2 report is a report on management's description of the service organization's system of controls and the suitability of the design of and the operating effectiveness of the controls. Service auditor expresses opinion in relation to management's assertions and tests of controls performed and the results
47
Investing & Finance Cycle deals with transactions involving acquisition and disposal of assets other inventory. Usually very few transactions, the auditor will find it most efficient to...
- Not test controls
- Assess RMM at the same level of IR
- Reduce DR by performing extensive substantive tests
48
Examples of controls that support the assertions with regard to investments include (PERCV):
P - Presentation & Disclosure - securities are classified in the records correctly
E - Existence or Occurrence - treasurer vouches the agreement of broker advices on purchases with cancelled checks
R - Rights & Obligations - securities on hand are registered with the company
C - Completeness & Cutoff - IA makes a list of securities in bank safe deposit boxes and compares them with the securities listed in the records
V - Valuation, Allocation & Accuracy - controller compares current market prices with the listed values of securities
49
Applying the "RACE" mnemonic for account balances in regards to investments:
R - Rights and Obligations - mgmt examines investment securities to verify registered name or confirms such with custodians of the investments
A - Allocation and Valuation - recorded values of investments are periodically compared to market prices
C - Completeness - investments on hand are periodically reconciled to their recorded amounts
E - Existence - maintains physical custody of investments in a secure physical location
50
Examples of controls in regards to investments...
- Monitoring of investment activities
- Senior mgmt approval of transactions
- Accurate risk measurement systems for investments and derivatives
- Regular reconciliations to control account balances
- Definitions and regular reviews of limits and constraints on investment activities
- Regular reviews of controls by sr mgmt
51
Substantive Procedures in regards to derivatives (should be reported at fair value) should be designed to test mgmt's assertions with regard to (PERCV):
P - Presentation & Disclosure - reading disclosures for compliance with GAAP through inquiries and inspection of documents, and appropriate classification
E - Existence - inspection of securities on hand; confirmations with brokers holding securities
R - Rights & Obligations - review of documents and confirmations with counter parties
C - Completeness - review of minutes of the BOD; test of subsequent transactions; confirmations; evaluating beginning amounts
V - Valuation - inspection of docs, confirmations, reading F/S; quoted market prices; estimates using black-scholes
52
Fair Value Hedge:
Entering into an interest rate swap in which they will pay out interest at a fixed rate, to offset the interest received, and receive interest from the counterparty at a variable rate. Paying the market rate of interest and changes in the fair value of the note will be offset by changes in the fair value of the derivative used as a hedge
-auditor should obtain evidence to support the recorded change in the hedged item that is attributable to the hedged risk.
53
Cash Flow Hedge:
Entering into an interest rate swap in which they will pay out interest at a variable rate, to offset the interest received, and receive interest from the counterparty at a fixed rate. Regardless of changes in the market interest rate, the entity will receive a steady and predictable stream of interest cash inflows.
-auditor should obtain evidence that supports mgmt's determination that the forecasted transaction will probably occur.
54
Property, Plant, and Equipment, objectives are...
- Verifying the existence of recorded assets by vouching from records to the physical assets
- Verifying the completeness of acquisitions by tracing from the physical assets to the records
55
Production and Conversion Cycle deals with manufacturing operations (similar to purchasing and spending cycle). (PECV):
P - Presentation & Disclosure - direct labor charged to individual time tickets is compared to the total direct labor charged to work-in-process, in order to ensure direct labor costs have not been charged to manufacturing overhead
E - Existence or Occurrence - perpetual inventory records are compared with goods on hand
C - Completeness & Cutoff - forms used for material requisitions are prenumbered and periodically accounted for
V - Valuation, Allocation & Accuracy - subsidiary records are periodically reconciled to inventory control accounts
56
Production and Conversion Cycle using the mnemonic "RACE" for account balances...
R - Rights and Obligation- terms of notes, lines of credit, other debt instruments are evaluated to determine if inventories have been pledged as collateral
A - Allocation and Valuation - allocations of salaries and wages to inventory are reviewed to make certain appropriate amounts are included
C - Completeness - forms used for the acquisition of raw materials and other items are prenumbered and all numbers are accounted for
E - Existence - perpetual inventory records are regularly reconciled to goods in inventory
57
Internal Control Questionnaire either yes or no. Helps the auditor on finding strengths in the system to rely on. Should include questions related to each of the different types of control activities (PRAISE):
P - Physical controls - proper security maintained over valuable department assets?
R - Recording - are transactions documented as to all relevant terms and descriptions?
A - Authorization - are transactions authorized by personnel at least one level above the request level?
I - Independent checks - are documents compared to verify their agreement before transactions are executed?
S - Segregation of duties - is the principal function of the department (authorization, recording, or custody) independent of each of the other two functions?
E - Evaluate performance - are there written department policies and procedures?
58
To prepare ICQ/Narrative...
- What cycle are you in?
- Key controls (ARCCS)
- For each document, preprinted, prenumbered, numerical sequence? Information on the document? Send copies to whom?
59
Advantages/Disadvantages of the narrative:
- easy to understand and provides users a clear view of the flow of a system and interaction among participants.
- often difficult to identify whether responsibilities are properly segregated
60
Advantages/Disadvantages of flowcharts:
- immediately clear whether there is appropriate segregation of duties.
- since most flowcharts are organized by department, the flow of a transaction may not be readily determinable
61
-Internal Control Reports for F/S under GAAS:
A deficiency internal control exists (Control deficiency) when the design operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements on a timely basis. A deficiency may be in "design" or "operation"...
- Deficiency in "design" occurs when either a needed control has not been put into place, or a control that has been put into place is not designed to mitigate the risk it was intended to address
- Deficiency in "operation" occurs when either a well-designed control is not operating as designed or the individual responsible for performing the control lacks authority or ability to perform it effectively
62
When an auditor become aware of deficiencies in internal control, the auditor will evaluate them to determine if they amount to "material weaknesses" or "significant deficiencies"...
- Material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis
- Significant deficiency is a deficiency or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance
63
When evaluating a control deficiency as either a significant deficiency or material weakness, the auditor assesses the "probability and magnitude"...
-Remote
-Reasonably Possible
-Probable
... and is it immaterial or material
64
Material weaknesses are indicated by...
- Ineffective oversight by those charged with governance
- Restatements of prior years' financial statements due to material misstatements due to error or fraud
- Material misstatements that would not have been detected by the company's internal control, but were identified by the auditor
- Fraud by senior management, whether material or immaterial
65
Communication of significant deficiencies and material weaknesses must be communicated to those charged with governance no later than...
60 days after the report release date and is required to be in writing. The written communication should include:
- State the purpose of the audit was to report on F/S and not to provide assurance on the effectiveness of internal control
- Indicate that the auditor is not expressing an opinion on the effectiveness of internal control
- Include a statement that the auditor's consideration of internal control was not designed to identify all significant deficiencies or material weaknesses
- Include the definition of "material weakness" and, if applicable, "significant deficiencies"
- Identify which matters are significant and or material
- State that the communication is intended solely for management, those charged with governance, and others within the organization and not intended for any others (limited use statement)
66
Engagement to Examine Internal Control Integrated with an Audit of Financial Statements under GAAS:
In both the audit of the financial statements and the examination of internal control, the auditor uses a "top-down approach"...
- First, the auditor assess risk at the financial statement level and incorporates use of their overall understanding of internal control. Auditor concentrates on "entity level controls"... The control environment; Management override; Company's risk assessment process; Monitoring results; Assessing business risk; Monitoring the activities of the audit committee; The period-end financial reporting process
- Next, the auditor directs attention to significant accounts and disclosures and their relevant assertions; attention is directed to accounts, disclosures, and assertions that present a greater than remote possibility of material misstatement; understanding of risks in the entity's processes is verified, often through the performance of walkthroughs - (RIIO) recalculation, inquiry, inspection, observation
- Auditor identifies potential deficiencies in design or operation. Controls that address RMM in each of the relevant assertions is selected for testing... auditor performs tests of the effectiveness of both the design and the operation of controls; testing designed to provide evidence appropriately based for the degree of risk represented by a potential deficiency
- Auditor evaluates the severity of identified deficiencies, which consist of their magnitude and their probability
67
Report modifications: Material Weakness...
Unless their is a limitation on the scope of the engagement, when material weaknesses are identified, the auditor will express an "adverse opinion" on the effectiveness of ICFR... the auditor will also determine the impact, if any, on the opinion on the F/S and should disclose whether or not the opinion has been affected, this may be disclosed in an "other-matters" paragraph or it may be disclosed in the paragraph identifying the material weakness that was omitted from management's assessment
68
Audit of Internal Controls that is Integrated with an Audit of Financial Statements - PCAOB
-Greater responsibility of communication...
- Material weaknesses must be communicated to management and the audit committee in writing prior to the issuance of the auditor's report on internal control over financial reporting
- Significant deficiencies must also be communicated in writing to the audit committee prior to the issuance of the auditor's report on internal control
- the auditor should also communicate control deficiencies that are not significant deficiencies or material weaknesses to management in writing on a timely basis
69
Definition of control deficiencies and material weaknesses are slightly different from (PCAOB issuer) and (AICPA non-issuer; GAAS)...
- issuer: to prevent or detect misstatements on a timely basis.
- non-issuer: to prevent, or detect and correct, misstatements on a timely basis
