Types of services a CPA can provide:
Assurance Services
Attestation
Auditing
Assurance services include:
Attestation and Audit
What is assurance service? Are accountants required to be independent?
To improve info for decision making. Info can be financial or nonfinancial.
Examples: Information systems, security review, accounts receivable review.
Yes, accountants are required to be independent.
What is an attestation service?
To affirm something to be correct/ true. More assurance than assurance services.
Examples: agreed upon procedures, reporting on pro forma financial info, a compliance attestation.
What is an agreed upon procedure?
In which a practitioner is engaged to issue a report on finding on a subject matter. Does not provide examination or review. Does not provide an opinion or negative assurance. Report will only include the procedures performed and the findings.
What is the applicable pronouncement for attestation services?
SSAE (statements on standards for attestation engagement)
What are the two levels of attest assurance?
Positive (high level) assurance based on an examination
Limited (moderate level) assurance based on a review.
BUT these do not apply to the agreed upon procedure.
Are accountants required to be independent for attestation services?
YES
What is an audit?
Providing attestation service on historical financial statements, attest to the assertions made by management.
Express an opinion on financial statements.
Provide a reasonable (high, but not absolute level of) assurance.
Are accountants required to be independent for audits?
YES
Differentiate between issuers and nonissuers?
Isssuers: entities who issue stocks to the public and are required to register with SEC
Nonissuers: entities that are privately held, therefore are not required to register with the SEC
AICPA vs PCAOB
AICPA standards promulgated by the Auditing Standards Board (ASB), followed by auditors when audit nonissuers.
PCAOB standards: promulgated by the Public Company Accounting Oversight Board, followed by auditors when auditing issuers.
For issuers or nonissuers does a CPA need to issue a report on FS and IC?
For issuers.
For non issuers just a report on FS
For issuers or nonissuers does a CPA need to test test of controls?
For issuers.
Not required for nonissuers.
Is partner rotation manadoty for issuers or nonissuers?
Mandatory for issuers and optional for nonissuers.
What is a concurring partner?
The partner who reviews the audit work to ensure that the quality of audit work and reporting is in keeping with the firms quality standards.
Nonissuers can follow what standards to prepare their F/S?
GAAP
OCBOA (income tax basis, cash basis, or regulatory basis)
IFRS.
Can issuers use OCBOA?
No, only nonissuers. Issuers might have a choice between GAAP or IFRS. US companies usually have to use GAAP and foreign companies can choose either.
The purpose of the audit is to express an opinion on whether the FS are in accordance with GAAS? true?
False, the purpose of an audit is to express an opinion on whether the financial statements are in accordance with GAAP, not GAAS.
Assertions relating to the FS are set forth by the auditor. T or F?
False, assertions relating to the FS are set forth by management.
In what situations are auditors not required to be independent?
Compilations
Taxes
Consultations
Other non attest services (bookkeeping/payroll)
compilation is a little different, why?
Compilation is an attest service, but not an assurance service. Compilation does not require accountants to be independent. if you are asked if a compilation is an attest engagement, answer yes.
What is the public accounting firm structure?
Staff accountants, Senior accountants, managers, partners.
What are the GAAS General Standards?
Tim Is Poor
GENERAL STANDARDS:
- The auditor must have adequate technical TRAINING and proficiency to perform the audit.
- The auditor must maintain INDEPENDENCE in mental attitude in all matters relating to the audit.
- The auditor must exercise due PROFESSIONAL CARE in the performance of the audit and the preparation of the report.
What are the GAAS field work standards?
Poor Is Evil
FIELD WORK:
- The auditor must adequately PLAN the work and must property supervise and any assistants.
- The auditor must obtain a sufficient understanding of the entity and its environment, including its INTERNAL CONTROL, to assess the risk of material misstatement of the FSs whether due to error or fraud, and to design the nature, timing, and extent of further audit procedures.
- The auditor must obtain sufficient appropriate audit EVIDENCE by performing audit procedures to afford a reasonable basis for an opinion regarding the FSs under audit.
What are the GAAS Reporting standards?
Go Count Dime Ok
REPORTING STANDARDS:
- The auditor must state in the auditor’s report whether the FSs are presented in accordance with GENERALLY ACCEPTED ACCOUNTING PRINCIPLES>
- The auditor must identify the auditor’s report those circumstances in which such principles have not been CONSISTENTLY OBSERVED in the current period in relation to the preceding period.
- When the auditor determines that informative DISCLOSURES are not reasonably adequate, the auditor must so state in the auditor’s report.
- The auditor must either express an opinion regarding the FSs, taken as a whole, or state that an OPINION cannot be expressed, in the auditor’s report.
What is GAAS?
GAAS provides a measure of audit quality and the objectives to be achieved in an audit.
how are auditing standards different from auditing procedures?
Auditing procedures are acts that the auditor performs during the course of an audit to comply with auditing standards.
An auditor has to be independent in what ways?
Independent in fact AND in appearance.
What is professional skepticism?
An attitude that includes a questioning mind and a critical assessment of audit evidence. The auditor neither assumes that management is dishonest nor assumes unquestioned honesty.
Why might a properly planned and performed audit may not detect a material misstatement?
Due to inherent limitation s of an audit.
is an auditor responsible for finding fraud?
No, it is not an auditor’s job.
What should an assistant do when the assistant and an in charge has different opinions?
Each assistant has a professional responsibility to bring to the attention of appropriate individuals in the firm disagreements or concerns with respect to the accounting and auditing issues that the assistant believes are of significance to the FSs or auditor’s report.
What are the assistants responsibilities if he disagrees with an in charge?
Document his or her disagreement in the working papers
Disassociate himself or herself from the resolution of the matter.
What are the 2 categories of professional requirements and describe them.
Unconditional requirements: the auditor is required to comply with an unconditional requirement in all cases in which the circumstances exist to which the unconditional requirement applies. Words used: MUST, is required.
Presumptively mandatory requirements: the auditor is also required to comply with a presumptively mandatory requirement in all cases. In rare circumstances, the auditor may depart from a presumptively mandatory requirement provided the auditor documents his or her justification for the departure and how the alternative procedures performed in the circumstances were sufficient to achieve the objectives of the presumptively mandatory requirement. Words used: SHOULD. (if immaterial or ineffective)
What is managements responsibility for an audit?
Identification of the applicable financial reporting framework
F/S
-Adopting sound accounting policies
Establishing and maintaining IC
Providing the auditor with:
-Access to all info that is relevant to the FS
-Additional info that the auditor may request
-Unrestricted access to person within the entity.
What is auditors responsibility for an audit?
Providing an opinion on client’s FS.
What are the types of opinion auditors issue?
An UNMODIFIED (unqualified) opinion
Modified opinions:
A QUALIFIED opinion- issued when the FSs present the financial condition, results of operations, and cash flows in conformity with GAAP, with the EXCEPTION of one or more issues.
An ADVERSE opinion-the FSs do not present the financial condition, results of operations, and cash flows in conformity with GAAP
A DISCLAIMER of opinion- auditors DO NOT EXPRESS an opinion on the fairness of the entity’s FSs
For PCAOB and auditor is required to issue an opinion on the FSs and IC, what options does the auditor have in regards to issuing a report?
May choose a combined report (1 report on the FSs and another on IC)
Separate reports.
What kind of responsibility does the management have with IC? DIM
Design, implementation and maintenance of IC.
What are the rules for communicating with predecessor auditor?
The auditor should communicate with the predecessor auditor BEFORE accepting the engagement. However, an auditor MAY make a PROPOSAL for an audit engagement before communicating with the predecessor auditor.
Who is considered a predecessor auditor?
The predecessor auditor refers to an auditor who has reported on the most recent audited FSs or was engaged to perform but did not complete an audit of FS and has resigned, declined to stand for reappointment, or been notified that his or her services have been, or may be, terminated.
Who initiates the communication with the predecessor auditor?
The successor auditor, with the permission from the client. Communication may be either written or oral.
What are the inquires the successor auditor must make of the predecessor auditor?
RID-C Reason for the change Integrity of management Disagreements Communication to those charge with governance.
What should the engagement letter include?
- The objectives and scope of the engagement
- Management’s responsibilities
- The auditor’s responsibilities
- Limitations of the engagement
- Identification of the applicable financial reporting framework
- Reference to the expected form and content of any reports to be issued by the auditor and a statement that circumstances may arise in which a report may differ from its expected form and content.
Express an opinion on the effectiveness of the IC process over financial reporting is a requirement for:
PCAOB only
Audit plan should include:
- A description of the nature, timing and extent of planned risk assessment procedures sufficient to assess the risks of material misstatement.
- A description of the nature, timing, and extent of planned further audit procedures at the relevant assertion level for each material class of transactions, account balance, and disclosure.
- A description of other audit procedures to be carried out for the engagement in order to comply with GAAS
Planning for the audit procedures takes place ____________________ as the audit plan for the engagement develops. The auditor should _______________.
over the course of the audit
document changes to the original audit plan.
Audit procedures: Risk assessment procedures:
Obtain an understanding of the client and the risks associated with the client.
Audit procedures: What do risk assessment procedures include?
Inquiry
Inspection and observation
Analytical procedures.
Audit Procedures: What are test of controls?
Test the operating effectiveness of client IC activities. Required for PCAOB audits. For AICPA audits, perform test of controls when the auditor plans to assess control risk below maximum.
Audit Procedures: What are substantive procedures?
Produce evidence about management’s assertions.
Two types of substantive tests: substantive analytical procedures (optional) AND test of details (required)
Revenue is always a…
high risk account.
What are management’s assertions?
Presentation and Disclosure Existence/Occurrence Rights and Obligations Completeness Valuation and Allocation
The auditor should obtain an understanding of the following:
Relevant industry, regulatory, and other external factors, including the applicable financial reporting framework.
The nature of the entity.
The entity’s selection and application of accounting policies
Entity’s objectives and strategies.
The entity’s financial performance.
Components of internal control.
What are the entity’s objectives?
Accurate and reliable financial reporting
Compliance with applicable laws and regulations.
Effective and efficient operations
Test of control are performed to:
obtain assurance about the operating effectiveness of controls. tests of controls do not verify the accuracy of account balances. TofC are required for PCAOB. For AICPA audit, performing test of control is required only if the auditor plans to assess control risk below maximum.
What are the 2 types of substantive tests?
Tests of details: audit the $$ amount of an account balance. Examples: confirm AR, observe inventory counts, recalculate the computation of standard OH rates.
Substantive analytical procedures: test the overall reasonableness of a dollar account balance. Account balance reasonable or not.. Example: ratios.
Analytical procedures are used for:
-To assist the auditor in planning the nature, timing and extent of other auditing procedures.
-As substantive test to obtain audit evidence about particular assertions related to account balances or classes of transactions.
-As an overall review of the financial info in the final review stage of the audit.
1st and 3rd are required by AICPA audits and PCAOB audits.
Relationships involving ___________ accounts tend to be more predictable than relationships involving only ______________ accounts.
Relationships involving IS accounts tend to be more predictable than relationships involving only BS accounts.
What is Audit Risk?
Audit Risk is the risk that the auditor may unknowingly fail to appropriatley modify his or her opinion on FSs that are materially misstated.
what are the 3 components of audit risk? Can they be assessed quantitatively or qualitatively.
Inherent risk
Control Risk
Detection Risk
Yes, can be assessed quantitatively or qualitatively.
What is inherent risk:
the risk that a material misstatement may occur in an account, assuming no related ICs. Accounts that are derived from accounting estimates have a higher inherent risk.
What is control risk?
The risk that IC will not prevent or detect on a timely basis a material misstatement.
What is detection risk?
The risk that the auditor will not detect a material misstatement. It relates to the nature, timing, and extent of the auditor’s procedures that are determined by the auditor to reduce audit risk to an acceptably low level.
Which risk can an auditor control?
only Detection Risk.
What is RMM?
The risk that the financial statements are materially misstated. It consists of IR and CR.
What is the Audit risk model?
AR=IRxCRxDR.
What is materiality?
The magnitude of an omission or misstatement of accounting info that, in the light of surrounding circumstances, makes it probable that the judgment of a reasonable person relying on the info would have been changed or influenced by the omission or mistreatment.
The auditor’s consideration of materiality is a matter of:
Professional judgment.
When considering the risk of material misstatement at the FS level or the assertion level, auditors set materiality at the
smallest misstatement.
What is tolerable misstatement:
the max error in a population that the auditor is willing to accept.
what are the 3 types of misstatements?
Factual - no doubt that there is a misstatement.
Judgmental- arising from differences bw mgmt. and the auditor’s judgments concerning accounting estimates that the auditor considers unreasonable or inappropriate.
Projected misstatements-the auditor’s best estimate of misstatements in populations, involving the projection of misstatements identified in audit samples to the entire population from which the samples were drawn.
The auditor should include ALL MISSTATEMENTS when considering misstatements and timely communicate them to the:
appropriate level of management.
What should the auditor due if he finds material misstatements or immaterial misstatements?
Material: Request mgmt. to correct the misstatement.
Immaterial misstatements: the auditor MAY request the client to adjust for the immaterial factual misstatements.
Materiality Documentation: The auditor should document:
The amount below which misstatements would be regarded as clearly trivial.
All misstatements accumulated during the audit and whether they have been corrected or not.
The auditor’s conclusion about whether uncorrected misstatements are material, individually or in the aggregate, and the basis for the conclusion.
What is the difference between error and fraud?
Error is unintentional
Fraud is intentional.
why is the risk of not detecting a material misstatement resulting from fraud is higher than the risk of not detecting one resulting from error?
Fraud is usually concealed.
What is fraudulent financial reporting?
Intentional misstatemetns or omission of amounts or disclosures in FSs designed to deceive FS users. Examples: manipulation, falsification, or alteration of accounting records or supporting documents from which FSs are prepared. Misrepresentation in or intentional omission from the FSs of event, transactions, or other significant info. Intentional misapplication of accounting principles relating to amounts, classification, manner of presentation, or disclosure.
What is misappropriation of assets:
the theft of an entity’s assets where the effect of the theft causes the FSs not to be presented, in all material respects, in conformity with GAAP. Examples: embezzling receipts, stealing assets or causing an entity to pay for goods or services that have not been received.
What are the 3 conditions in the fraud triangle?
Incentive/pressure
Opportunity
Rationalization/attitude
Communicating about fraud: if there is evidence that fraud may exist, the matter should be brought to?
- An appropriate level of management.
- To those charged with governance (audit committee) when there is fraud involving management, employees who have significant roles in IC or others, when the fraud results in a material misstatement in the FSs.
Disclosure of fraud beyond senior management and its audit committee is not ordinarily a part of the auditor’s responsibility, unless:
Required by specific legal and regulatory requirements
To a successor auditor
In response to a subpoena
To a funding agency or other specified agency in accordance with requirements of audits of entities that receive governmental financial assistance.
Under what circumstances that auditor may be unable to continue the engagement?
The entity does not take the appropriate action regarding fraud
Significant risk of material and pervasive fraud
The auditor has significant concern about the competence or integrity of management or those charged with governance.
A peer review is required as part of the practice monitoring requirement for AICPA membership. It is required to be done once every
3 years
Firms that audit issuers are not peer reviewed, they are inspected by the PCAOB. For audit firms that audit more than 100 issuers a year, are subject to PCAOB inspections how often? What about if less than 100 audits?
Over 100, annually
100 or less, every 3 years
Management has a unique ability to perpetrate fraud because his or her ability to:
Override the controls.
What is professional skepticism?
Auditors are required to exercise professional skepticism (due professional care). It is an attitude that includes a questioning mind and a critical assessment of audit evidence.
Who are those charged with governance?
audit committee
Quality control standards: The first has an obligation to establish and maintain a system of quality control to provide it with reasonable assurance that:
the firm and its personnel comply with professional standards and applicable legal and regulatory requirements and reports issued by the firm are appropriate in the circumstances.
The engagement partner should:
Take responsibility for the overall quality on each audit engagement to which that partner is assigned. The engagement partner may rely upon the firm’s system of quality control.
What are the 6 elements of a system of quality control:
Leadership responsibilities for quality within the firm (tone at the top)
Relevant ethical requirements.
Acceptance and continuance of client relationships and specific engagements.
Human Resources
Engagement performance
Monitoring
Upon discovering fraudulent data in a client’s tax return that the client would not correct, a CPA withdraws from the engagement. How should the CPA respond if asked by the successor CPA why the relationship was terminated?
“I suggest you get the client’s permission for us to discuss all matters freely.” The predecessor CPA should inform the successor CPA that (s)he must obtain the client’s permission before they may discuss the reasons for termination of the previous relationship.
Why is early appointment of the auditor advantageous to the auditor and the client?
Early appointment of the auditor is advantageous to both the auditor and the client. Early appointment aids the auditor in planning the work, especially that to be done before the end of the year. The client benefits from more efficient scheduling of the audit and an early completion of the work after the end of the fiscal year.
An auditor should request the new client to authorize the predecessor auditor to allow a review of the predecessor’s: engagement letter? Audit Documentation?
Only Audit Documentation. Predecessor’s engagement letter is not useful for the auditor in evaluating whether to accept a new client.
The auditors request written representations from management. These include disclosures of fraud or suspected fraud affecting the entity involving:
(1) management,
(2) employees who participate significantly in internal control, and
(3) others if the fraud is material.
If management fails to provide written representations about such matters, the auditor should
(1) reevaluate management’s integrity,
(2) determine the possible effect on the opinion, and
(3) withdraw from the engagement in appropriate circumstances (AU-C 580).
The terms of the engagement should be documented in an engagement letter that states the following:
(1) objective and scope of the audit,
(2) responsibilities of the auditor and management,
(3) inherent limitations of the audit and internal control, (4) the financial reporting framework, and
(5) the expected form and content of audit reports. The engagement letter would disclaim liability for detecting fraud but disclose it if discovered.
An auditor is required to attempt communication with the predecessor auditor prior to
Accepting the engagement.
Before final engagement acceptance, the auditor should communicate with the predecessor auditor. A predecessor auditor includes an auditor engaged to audit the client, regardless of whether the audit was performed. Communication should be made only after obtaining the prospective client’s permission, and the auditor should request that the prospective client authorize the predecessor to respond fully to the auditor’s inquiries (AU-C 210).
Before accepting an engagement to audit a new client, an auditor is required to
Make inquiries of the predecessor auditor after obtaining the consent of the prospective client.
As the acceptable level of detection risk decreases, an auditor may:
postpone the planned timing of substantive tests from interim dates to the year-end. When the acceptable level of detection risk decrease, auditors need to perform more substantive tests and perform them closer to the balance sheet date.
After fieldwork audit procedures are completed, a partner of the CPA firm who has not been involved in the audit performs a second or wrap-up working paper review. This second review usually focuses on:
the fair presentation of the financial statements in conformity with GAAP.
If there is no cash flows statement, what kind of opinion would you issue?
Qualified opinion.
An accountant who accepts an engagement to compile a financial projection most likely would make the client aware that the:
engagement does not include an evaluation of the support for the assumptions underlying the projection.
The exercise of due professional care requires that an auditor:
critically review the judgment exercised at every level of supervision.
