First AUD Flashcards

(349 cards)

1
Q

QAGo through AUD CLASSES

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Make notes from BOOK

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

FINAL REVIEW - Becker - Turtly’s account

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

READ A1 and A2 before taking ME1

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Take SE and Make notes from Book accordingly to bridge the gap

A

Redditt - Detection risk, Inherent risk, Control risk

When to increase/decrease substantial and analytical prcedures based on changes in risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

BRUSH UP FAR SKILLS and TOPICS such as RATIOS

A

IT, ECONOMICS, STATS, REGRESSION, SAMPLING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

CHATGPT - Private Companies
Not automatically required by law to undergo audits.

However, audits may still be required if:

Lenders or investors demand audited financials.

The company is preparing for an IPO.

It is part of a corporate group with a public parent company.

Required by contractual obligations (e.g. debt covenants).

📝 Note: Private companies may opt for a review or compilation instead of a full audit, unless an audit is specifically required.

Nonprofits
IRS doesn’t require audits, but:

Federal funding > $1 million /year triggers a Single Audit (formerly A-133 audit).If your organization expends less than $1,000,000 in federal awards: You are not required to undergo a Single Audit.​

If your organization expends $1,000,000 or more in federal awards: You must undergo a Single Audit.

Some state laws or major donors may also require audits.

Financial Institutions
Banks, credit unions, insurance companies, and broker-dealers are heavily regulated.

Subject to mandatory audits under:
FDIC

Federal Reserve

OCC (Office of the Comptroller of the Currency)

FINRA (for broker-dealers)

Government Contractors & Grant Recipients
Entities receiving $750,000+OR $ 1 MILLION in federal funds annually must undergo a Single Audit under the Uniform Guidance.
Applies to businesses, nonprofits, and even local governments.

. Employee Benefit Plans (e.g., 401(k))
Plans with 100+ eligible participants typically must be audited annually under ERISA (Employee Retirement Income Security Act).
Audit must be included in the plan’s Form 5500 filing with the Department of Labor.

A

Public Companies (SEC-Registered)
Legally required to be audited annually.

Must file audited financial statements with the Securities and Exchange Commission (SEC).

Audits must be conducted by PCAOB-registered audit firms.

Examples: Corporations listed on the NYSE or NASDAQ.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Objectives of an Entity
An entity’s goals, often categorized as reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.

Observation
A method of obtaining audit evidence that provides the auditor with direct personal knowledge (e.g., viewing tangible assets, reviewing a process or operating procedure, etc.).

OCBOA (Other Comprehensive Basis of Accounting) Financial Statements- Financial data presented in accordance with a comprehensive basis of accounting other than GAAP.

Occurrence and Rights and Obligations
A financial statement assertion in the “presentation and disclosure” category indicating that disclosed events and transactions have occurred and pertain to the entity.

Operating Effectiveness of Controls
A measure of the extent to which controls achieve their stated goals; evaluated by using tests of controls to address how, by whom, and with what level of consistency control policies and procedures have been applied.

Outside Directors
Members of the board of directors who are neither employees nor part of management and who do not have a material financial interest in the company.

A

Audit- A methodical review and objective examination of an enterprise’s financial statements.

Audit Adjustment- A proposed correction to the financial statements resulting from the auditor’s procedures.

Audit Committee- A committee of the board of directors, generally made up of three to five members of the board who are “outside directors;” responsible for the selection and appointment of the independent external auditor, and for reviewing the nature and scope of the engagement.

Audit Data Analytics
ADAs involve analyzing patterns, identifying anomalies, and extracting other useful information in data underlying or related to the subject matter of an audit through analysis, modeling, and visualization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Read Flashcards from Becker - Ongoing (downloaded all from Becker)

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

nTables from UWorld

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Farhat or i75 lectures

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Adverse Opinion
FS issue (ADF acronym)-Material effect

A

DISCLAIMER of opinion (AD acronym) =CANNOT EXPRESS AN OPINION
Insufficient Evidence =Audit Issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Management could selct FIN REPORTING FRAMEWORK

A
  1. CASH BASIS
  2. TAX BASIS
  3. GAAP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Generally accepted auditing standards (“GAAS”) (GAAS are not rules) are _____________

A

measures of the quality of the auditor’s performance and guide the auditor in the performance of a properly planned and executed audit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The auditor may conduct an audit in accordance with :

A

Both GAAS ad Govt auditing stdnards (GAGAS)

It is acceptable for an auditor to apply both GAAS and auditing standards of another jurisdiction or country.

In certain audit engagements, the auditor may be required to comploy with Intl Stds on Auditing in addition to GAAS even if the audit is conducted in the USA.

The auditor may conduct the audit in accordance with both GAAS and auditing stds issued by the PCAOB. aN ADDITONAL statemet would be added to the BASIS for OPINION paragraph stating that both sets of standards were applied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

An auditor of a non-issuer must conduct the audit in accordance with ASB standards.
The literature pertaining to U.S. GAAP changes over time, and therefore U.S. generally accepted accounting principles is an ACCOUNTING TERM can be said to encompass the conventions, rules, and procedures necessary to define accepted accounting practice _____________

A

at a particular time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ACCOUNTING ESTIMATES

A
  1. Provision for expected credit losses
  2. Employee retirement benefit liabilities
  3. Warranty obligations
  4. Probability of loss and related amounts due to pending litigation
  5. FV os assets or liabilities including goodiwll and intangible assets.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

NONISSUERS - UNMODIFIED

A

ISSUERS-UNQUALIFIED

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SAARS - Prepare, Compile and Review (financial statements)

Prepare FS of non-issuer

A

Reviewing interim financial data required to be filed with the SEC is covered under PCAOB standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The auditor should not accept an engagement if there will be a scope limitation imposed by
management or those charged with governance, prior to engagement acceptance, that will result
in the auditor disclaiming an opinion on the financial statements.

A

Other Preconditions for an ERISA Plan Financial Statement Audit
 When conducting an ERISA Plan financial statement audit, in addition to the preconditions above, the
auditor must also ensure management understands its additional responsibilities, including
maintaining a current plan instrument, administering the plan, presenting transactions in accordance
with the plan’s provisions, and making the appropriate determinations when an ERISA Section
103(a)(3)(C) audit is elected.

 The auditor should also obtain from management, prior to the date of the auditor’s report, a draft of
Form 5500 that is substantially complete, and, when electing an ERISA Section 103(a)(3)(C) audit,
information on how management determined that the entity preparing and certifying the investment
information is a qualified institution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Unmodified (unqualified) opinion states that the financial statements are presented fairly, in all material respects, in accordance with the applicable FIN REPORTING framework.

A

In order to issue an UNMODIFIED (UNQUALIFIED) Opinion, the auditor should take into account:

  1. Whether sufficient appropriate audit evidence was obtained
  2. Whether uncorrected misstatements are material, individually or in the aggregate and
  3. Whether the FS are prepared in accordance with the applicable FIN REPORTING framework.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

3 Types of MODIFIED OPINIONS

A
  1. Qualified opinion (except for) (modification required)
  2. Adverse opinion (modification required)
  3. Disclaimer of opinion (audit is incomplete MEANING an auditor was unable to obtain sufficient appropriate audit evidence to provide a reasonable basis for an opinion, thus no opinion is expressed)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

CHATGPT:

Qualified Opinion: A negative aspect is present (e.g., scope limitation, non-compliance), but the issue does not affect the overall fairness of the financial statements.

A

CHATGPT:

Unqualified Opinion: The auditor finds no issues, and the financial statements are fairly presented with no reservations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Cross-Foot
To verify the mathematical accuracy of a statement or schedule by adding rows of numbers across, from left to right.

A

Discovery of an actual material mistatement requires test of details.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
PERVASIVE meaning (pervasive effects on the FS)_____ CHATGPT: In the context of an auditor's opinion, "pervasive" refers to the extent or severity of an issue found in the financial statements. Specifically, if an issue is described as "pervasive," it means that the problem or misstatement is widespread and significantly impacts the overall reliability and presentation of the financial statements. Pervasive Issues: Affecting multiple areas: The issue is not isolated to just one aspect of the financial statements, but instead, it has a broad or significant effect on various parts. Materially impacts the financial statements: The issue is so significant that it would affect users' understanding of the company's financial position and results. Not easily corrected: The effect of the issue is difficult to overcome through additional explanations, disclosures, or adjustments.
1. Far reaching effects(wide-spread) across several accounts e.g. 70% of assets is inventory 2. If specific to only one account, it -represents a significant portion of the FS -Has issues with disclosues that are fundamental to the users understanding.
26
AUDITORS ISSUE a Disclaimer of Opinion if they___
1. conclude that the possible effect is material and pervasive 2. Deny rendering an opinion as they: are unable to gather sufficient appropriate audit evidence
27
ADVERSE = Material and pervasive
QUALIFIED = Material but NOT PERVASIVE
28
AUDITORS issue an ADVERSE OPINION if they conclude that the financial statements:
1. HAVE MISTATEMENTS that are material and pervasive 2. DO NOT present fairly e.g. Inadequate disclosure of a material related party transaction would result in a qualified or adverse opinion. Inadequate disclosure of material information is a departure from GAAP and may result in either a qualified or adverse opinion, depending on materiality.
29
NONISSUER (Unmodified audit opinion), required SECTIONS in the report (OBRA):
SECTIONS: 1. OPINION - Framework reference (i.e. GAAP) 2. BASIS for OPINIONS (GAAS referenced) 3. Responsibilities of Mgt for the FS (Framework reference ie. GAAP) 4. AUDITOR's responsibilities for the AUDIT of the FS (GAAS referenced)
30
The auditor may use 2 sets of stds for auditing when: 1. It is required for e.g. when auditing a govt. entity, the auditors use both GAAS and govt auditing standards. 2. The auditors are engaged by the client to do so.
The auditor references both auditing standards in the: 1. Basis for opinion section 2. Auditor's responsibilities for the audit of the FS section
31
CHATGPT: Qualified Opinion: If the issue is not pervasive (limited in scope or impact), the auditor may issue a qualified opinion, stating that, except for the specified issue, the financial statements present fairly.
CHATGPT: Adverse Opinion: If the issue is pervasive (widespread) and significantly affects the financial statements as a whole, the auditor issues an adverse opinion, stating that the financial statements do not present a fair and accurate picture of the company. Disclaimer of Opinion: If there is a pervasive scope limitation (e.g., insufficient evidence), the auditor may disclaim an opinion, meaning they cannot form any opinion about the financial statements. Example: Non-pervasive Issue: A company fails to report a small number of transactions, but the rest of the financial statements are unaffected. This may lead to a qualified opinion. Pervasive Issue: A company fails to follow accounting standards across multiple areas of their financial statements, resulting in a major misrepresentation of the financial position. This may lead to an adverse opinion because the issues are widespread and significantly impact the financial statements as a whole.
32
KAMs section (KEY AUDIT MATTERS) Section: NON-ISSUER REPORT 1. May be added to the nonissuer report (optional section) 2. Is added when the client engages the auditor to communicate KAMs 3. Provides visibility into the more complex areas or areas that require judgement in the audit
KEY AUDIT MATTERS are those matters that were communicated with those charged with governance and, in our professional judgment, were of most significance in our audit of the FS of the current period. These matters were adressed in the context of our audit of the FS as a whole, and in forming our opinion thereon, and we do not provide a separate opinion on these matters. E.g. KAMr are complex issues, judmentally difficult, required audit attention. ORDER OF KAMs listed is a JUDGEMENT DECISION. KAMs section can be added anywhere in the report after the 2nd section. (OPINION section and BASIS for OPINION SECTION) KAMs should NOT include the matters giving rise to: 1. A QUALIFIED OPINION - should be referenced in the BASIS for OPINION section for further explanation 2. SUBSTANTIAL DOUBT existing about an entity's ability to continue as a going concern *Should be referenced elsewhere in the report.
33
Communicating KAMs is PROHIBITED when the auditor expresses an ADVERSE OPINION or DISCLAIMS an OPINION (red zones).
Audit Documentation (Working Papers) The principal record of procedures performed, evidence obtained, and conclusions reached; also called "working papers" or "workpapers." Audit Evidence The underlying information used by the auditor in reaching audit conclusions. The information corroborates or contradicts assertions in the financial statements. Audit Objectives Goals of audit testing, developed in light of financial statement assertions. Audit Plan A listing of audit procedures necessary to accomplish the objectives of the audit; required for every audit. Audit Risk The risk that an auditor may unknowingly fail to modify appropriately the opinion on financial statements that are materially misstated. Audit Risk of Noncompliance The risk that the auditor may unknowingly fail to appropriately modify the opinion on compliance in a compliance audit. It comprises the risk of material noncompliance and detection risk of noncompliance.
34
ISSUER - just 2 sections in the report which are _________
OPINION and BASIS FOR OPINION
35
Audit issues ONLY - Disclaimer of opinion (An audit can disclaim the opinion in AUDIT issues only)
FS or GAAP issues = Adverse opinion
36
Critical Audit Matters Those matters arising from the current period audit of the financial statements that are communicated or required to be communicated to the audit committee and that relate to accounts or disclosures that are material to the financial statements and involve especially challenging, subjective, or complex auditor judgment. TO BE considered as a CAM, matter must meet all 3 criteria: 1. Be a matter that was communicated or is required to be communicated to the audit committee 2. RELATE to accounts or disclosures material to the FS 3. Involve challenging, subjective, or complex auditor judgement For each critical audit matter identified, the auditor should include a description of the principal considerations that led the auditor to determine that the matter was a critical audit matter. For each critical audit matter identified, the auditor should include a description of how the critical audit matter was addressed in the audit. For each critical audit matter identified, the auditor should reference relevant financial statement accounts that relate to the critical audit matter.
IDENTIFICATION OF CAMs (IPAD): 1. Identify each CAM in the audit report 2. Describe the PRINCIPAL CONSIDERATIONS that led the audiot to determine a CAM 3. Describe how the CAM was ADDRESSED in the AUDIT 4. Refer to the relevant FS accounts and disclosures A critical audit matter is a matter that was communicated or is required to be communicated to the audit committee and involves an especially challenging judgment made by the auditor.
37
KEY AUDIT MATTERS (Becker) Key Audit Matters Matters that, in the auditor's professional judgment, were of most significance in the audit of the financial statements of the current period.
38
NON-ISSUER: KAMs are OPTIONAL for a NON-ISSUER
ISSUER: (CRITICAL AUDIT MATTERS) CAMS are REQUIRED for an ISSUER (when an unqualified/qualified opinion is issued): 1. Opinion on the FS 2. Basis for OPINION 3. CRITICAL AUDIT MATTERS The auditor's report must include any CAMs arising from the current period's audit of the financial stateemnts. Report wording in opinion section and basis for opinin section is often boiler plate and does not provide much visibility into the audit. The CAM section provides more visibility into the more challenging areas of the audit.
39
CIRCUMSTANCE - FS ISSUES QUALIFIED (material) or ADVERSE (material and pervasive) EXAMPLES - (1) Don't follow GAAP (2) Inappropriate accounting principles (3) Unreasonable estimates (4) Inadequate disclosures (5) Incorrect numbers (6) No reasonable justification for change in accounting principles
The following non-issuer headings will change when modified opinions are isued: 1. OPINION 2. BASIS FOR OPINION
40
Examination- An engagement that provides positive assurance (an opinion) based on procedures such as search, verification, inquiry, and analysis.
41
NO MATERIAL ISSUES
Unmodified/Unqualified (CLEAN=FS free from material misstatements in all respects) opinion 1. Sufficient evidence 2. Follows GAAP 3. Immaterial or no issues
42
GENERAL Guidance provided by a Statement on Auditing STDs is the MOST AUTHORITATIVE of level of auditing guidance for audits of nonissuers.
Supplementary information is outside the basic financial statements, so problems with this information do not prevent the issuance of an unmodified opinion on the basic financial statements. The situation should result in a modified opinion on the supplementary information as expressed in a separate section of the auditor's report with the heading "Supplementary Information." Since supplementary information is outside the basic financial statements, an unmodified opinion on the basic financial statements is still appropriate.
43
AUDITOR RESPONSIBILITIES 1. aUDITOR Must plan the work and properly supervise any assistants 2. Determine and apply appropriate materiality levels 3. Identify and assess risks of material misstatement, whether due to error or fraud and 4. Obtain sufficient appropriate audit evidence The auditor obtains reasonable assurance NOT ABSOLUTE assurance. REASONABLE ASSURANCE is a high level of assurance. The auditor is unable to obtain ABSOLUTE assurance because of the INHERENT LIMITATIONS of an AUDIT. Examination of ALL EVIDENCE would NOT BE FEASIBLE.
MANAGEMENT RESPONSIBILITES: 1. Determine the applicable FIN REPORTING framework and prepare an adequate description of the framework for inclusion in the FS 2. Designing and Implementing programs and controls to prevent, deter and detect fraud. INTERNAL CONTROL helps in Preventing, detecting and correcting MISTATEMENTS on a timely basis.
44
AUDITORS RESPONSIBILITY
The auditor has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the FS are free of material misstatement whether caused by error or fraud.
45
SUFFICIENT, APPROPRIATE AUDIT evidence to afford a RESONABLE basis for the opinion.
In the FS, including accompanying notes fail to disclose info that is required by GAAP, the auditor should express a QUALIFIED OR ADVERSE OPINION, depending on PERVASIVENESS. An auditor of a nonissuer concludes that a client's illegal act, which has a material effect on the FS, has not
46
NO ISSUE
Unqualified, Unmodified.
47
AUDIT ISSUES Qualified (material) or disclaimer (material and pervasive) 1. Time constraints 2. Inability to obtain sufficient appropriate audit evidence, such as: (a) inability to confirm receivables (b) Inability to observe inventory (c) Inability to obtain audited financial statements of a consolidated investee (d) Restrictions on the use of auditing procedures (e) Inadequacy of accounting records' (f) refusal of client's attorney to respond to inquiry (g) Auditor is unable to determine the amounts associated with an employee fraud scheme
RESULTS IN DISCLAIMER ______________________________ 1. Not independent 2. Unaudited FS 3. Refusal of management to provide written representation and/or to acknowledge its responsibility for the fair presentation of the FS in conformity with GAAP (may also withdraw) A critical audit matter is a matter that was communicated or is required to be communicated to the audit committee and relates to accounts or disclosures that are material (not immaterial) to the financial statements. A critical audit matter is a matter that was communicated or is required to be communicated to the audit committee and involves a particularly complex judgment made by the auditor (not a complex transaction made by management.)
48
The scope limitation is not mentioned in the management's responsibility paragraph. The management's responsibility section remains unchanged when a qualified opinion is issued, but the BASIS for qualified opinion section should describe the reasons for the qualification.
The REASONS for the inability to obtain sufficient appropriate audit evidence should only be described in the Basis for Qualified Opinion section of the auditor's report and the Management's Responsibility section should remain unchanged. The reasons for the inability to obtain sufficient appropriate audit evidence should be described in the BASIS for Qualified Opinion section of the auditor's report.
49
DISCLAIMER OF OPINION - Unable to obtain sufficient appropriate audit evidence to provide a reasonable basis for an opinion, thus, no opinion is expressed.
Management’s refusal to provide written representations (a type of audit evidence) is a significant client-imposed restriction on the audit, which may result in a disclaimer of opinion. If the auditor is unable to obtain the audited financial statements of a consolidated investee, a qualified opinion or a disclaimer of opinion would be issued, depending on materiality. An auditor may issue a qualified or disclaimer of opinion when an auditor is unable to obtain sufficient appropriate audit evidence. For example, when an auditor is unable to determine the extent of or the amounts associated with a pervasive employee fraud scheme, there is not sufficient appropriate audit evidence, and a qualified or disclaimer of opinion may be appropriate
50
Assuming the effect is material, a change in accounting principle results in the addition of an emphasis of matter paragraph in the auditor's report. An emphasis of matter paragraph is required even if the previous accounting principle was not GAAP and even if management lacks reasonable justification for the change. (Note: A lack of reasonable justification for the change may also give rise to a report modification based on material misstatement of the FS) Emphasis-of-Matter Paragraph (for matter already part of FS) A paragraph included in the auditor's report when required by GAAS or at the auditor's discretion when referring to a matter that is appropriately presented or disclosed in the financial statements and is of such importance that it is fundamental to the users' understanding of the financial statements. Emphasis-of-matter paragraphs are used by nonissuers only. Other matter paragraph - for matters not included in FS
A justified departure from GAAP results in the addition of an emphasis-of-matter paragraph to the unmodified opinion. Engagement Completion Document- A document identifying all significant audit findings and issues; required by PCAOB standards for audits of issuers. Applicable for ISSUERS only Engagement Letter A written communication documenting the understanding between an accountant and a client. Engagement Partner The partner responsible for the overall quality of the engagement. Engagement Quality Review A review required by PCAOB standards that is performed by a partner who is not otherwise associated with an issuer audit engagement. The engagement quality reviewer evaluates the significant judgments made by the engagement team and the overall conclusion reached on the engagement. Entity-Level Controls Controls related to the control environment, management override of controls, the company's risk assessment process, centralized processing, monitoring the results of operations, monitoring other controls, period-end financial reporting, and policies that address significant business controls and risk management practices. Error An unintentional misstatement or omission of an amount or disclosure in the financial statements.
51
UPDATING (CHANGING) PRIOR OPINIONS: FORMAT The auditor should include an emphasis of matter or other matter paragraph (nonissuer) or explanatory paragraph (issuer) disclosing the following: DORCS D-Date of the auditor's previous report O-Opinion type previously issued R - Reason for the prior opinion C -Changes that have occurred S- statement that the opinion is different. REMEMBER - only DORCS change their mind
Explanatory Paragraph An explanatory paragraph is included in the auditor's report when required by PCAOB auditing standards or at the auditor's discretion whenever the auditor wishes to emphasize a matter regarding the financial statements. Explanatory paragraphs are used for issuers only.
52
REPORT OF PREDECESSOR AUDITOR PRESENTED 1. Prior auditor's report is presented - PY auditor's report is issued 2. In determining if previously presented FS are still appropriate as issued, the predecessor auditor should: (a) read the statements for the current period. (b) Compare the audited statements with the current period statements (c) Obtain a letter of representation from the successor auditor stating whether the successor auditor's audit revealed any matters that may have a material effect on the statements reported on by the predecessor auditor. (d) Obtain a letter of representation from mgt stating whether any previous mgt representations have changed or whether subsequent events have occurred that may require adjustment or disclosure in the reissued FS.
PRIOR YEAR FS REVIEWED OR COMPILED 1. When the current period FS were reviewed or compiled and the report of the PRIOR PERIOD is not reissued, the auditor should include an other-matter paragraph (non-issuer) or explanatory paragraph (issuer) that includes: (a) The service (review or compilation) performed in the prior period (b) The date of the prior period report (c) a description of any material modifications described in the report. (d) A statements that the service was less in scope than an audit and does not provide the basis for expressing an opinion on the FS as a whole (review) or (d) A statement that no opinion or other form of assurance is expressed (compilation)
53
When FS contain a departure from U.S. GAAP because due to unusual circumstances, the statements would otherwise be misleading, the auditor be misleading, the auditor should express an opinion that is __________
UNMODIFIED (a DEPARTURE from US GAAP is permissible when circumstances indicate that a financial presentation in accordance with US GAAP would be misleading.
54
The opinion para in an auditor;s report should indicate a statement regarding the auditor's opinion and an indication of the applicable FIN reporting framework and its origin. The auditor's opinion section indicates the nature of the engagement (i.e. audit), the financial statements covered in the audit engagement, NAME of the entity whose FS have been audited and the dates covered by each FS. BASIS for OPINION section references GAAS, auditor independence, and states whether or not the auditor believes sufficient appropriate evidence was obtained to provide a basis for the auditor's opinion.
The word INDEPENDENT should be included in the report TITLE and not the OPINION PARAGRAPH in an auditor's report. A description of the auditor's responsibility would be included in a SEPARATE PARA stating the auditor's responsibility rather than in the opinion paragraph. An indication of mgt's responsibility for the fair presentation of the FS should be included in a separate PARA explaining mgt's responsibility rather than in the opinion para. Emphasis of matter paragraphs are used when required by SAS or when the auditor believes they are necessary. They are used when referring to a matter that is appropriately presented or disclosed in the financial statements and is of such importance that it is fundamental to the users' understanding of the FS. This para does not affect the auditor's opinion.
55
An auditor's responsbility to express an opinion on the FS of a nonissuer under US auditing stds is __________
explicitly represented in the Auditor's responsibility section of the nonissuer audit report.
56
Consistency is implicit in the auditor's report and will be explicitly mentioned in an emphasis of a matter paragraph only if there are issues with consistency.
Within the Auditor's Responsibility section of the report, the following statement is explicitly made: "Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements." The consistency of the application of accounting principles is implicit while the examination of EVIDENCE on a test basis is explicitly stated in the Auditor's Responsibility section.
57
The auditor's report should be dated no earlier than the date on which the auditor has obtained sufficient appropriate audit evidence to support the opinion. The earliest an audit report may be dated is when the auditor has obtained sufficient appropriate evidence to support an opinion
The auditor's report should be dated no earlier than the date on which the auditor has obtained sufficient appropriate audit evidence to support the opinion. The auditor may not have received sufficient appropriate evidence by the last day of fieldwork. For example, the partner's review of the audit evidence may take place after the last day of fieldwork. The final assembly of the audit file often occurs after the date of the audit report. This assembly may occur up to 45 or 60 days following the report release date for issuers and nonissuers, respectively. Audit documentation may be completed after the date of the audit report. Generally, changes to audit documentation after the date of the audit report are administrative in nature. For example, the auditor may sort and cross-reference workpapers.
58
The CPA's report on audited financial statements includes an explanation that management is responsible for the preparation and fair presentation of the financial statements The CPA's audit includes evaluating the appropriateness of the accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluating the overall presentation of the financial statements. This is mentioned in the auditor's responsibility paragraph.
The CPA's report on audited financial statements does not include matters related to the auditor's assessment of specific risk factors.
59
Under U.S. auditing standards, the auditor's audit report includes a statement that: "In performing an audit in accordance with GAAS, we evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management..."
The audit report does not state that disclosures provide reasonable assurance that the financial statements are free of material misstatement. The correct statement is: "Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement.. The audit report does not state that the auditor evaluated the overall internal control. The correct statement is "In performing an audit in accordance with GAAS, we obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstance..." The audit report does not state "The financial statements are consistent with those of the prior period." Consistency is implicitly reported; only if there is an inconsistency is an explicit statement included
60
The responsibility of the auditor and the responsibility of management are stated explicitly in the auditor's report of a non-issuer. There is a Management's Responsibility section and an Auditor's Responsibility section.
In an auditor's report, there is a section for explicitly stating both management and the auditor's responsibilities related to the audit.
61
GAAP = Under U.S. auditing standards, the auditor expresses an opinion on the financial statements' conformity with GAAP in the Opinion section and the Management's Responsibility section that the management is responsible for the preparation and fair presentation of the financial statements in accordance with GAAP.
GAAS = The Basis for Opinion section would refer to GAAS rather than GAAP. GAAS = The Auditor's Responsibility section of the report would refer to GAAS rather than GAAP. GAAS = . The Auditor's Responsibility section would refer to GAAS rather than GAAP, which the Management's Responsibility section would include a reference to GAAP.
62
The auditor's responsibility paragraph of the unmodified opinion audit report explicitly states that an audit includes identifying and assessing the risks of material misstatement and designing and performing audit procedures responsive to those risks.
Audit procedures to identify illegal acts 1. Read the minutes 2. Inquire of management, in-house counsel and external legal counsel concerning litigations, claims and assessments 3. Perform substantive tests of details of classes of transactions, account balances, or disclosures 4. Examine large or unsual transactions When mgt or those charged with governance are involved, the auditor should communicate to the next higher level of authority. If no higher level of authority exists, the auditor should consider obtaining legal advice.
63
ISSUER = PCAOB and GAAP (no need for GAAS) An auditor reporting on the audit of financial statements of an issuer should indicate in the Basis for Opinion section that the engagement was conducted in accordance with PCAOB standards, and should refer to GAAP in the Opinion on the Financial Statements section.
An auditor reporting on the audit of financial statements of an issuer is required to refer to PCAOB standards. There is no requirement to reference GAAS. An auditor reporting on the audit of financial statements of an issuer should indicate in the audit report that the engagement was conducted in accordance with PCAOB standards. This is an explicit statement in the report; it is not implied or assumed.
64
OPINION ____________________ QUALIFIED = MATERIAL
OPINION ______________________________ DISCLAIMER = MATERIAL AND PERVASIVE
65
AUDIT ISSUES ____________________ Qualified (Material) or Disclaimer (Material and Pervasive)
1. Time constraints 2. Inability to obtain sufficient appropriate audit evidence, such as: (a) inability to observe inventory (b) inability to confirm receivables (c) inability to obtain audited FS of a consolidated investee (d) Restrictions on the use of auditing procedures (e) Inadequacy of accounting records (f) Refusal of client's attorney to respond to inquiry
66
AUDIT ISSUES ________________ Results in Disclaimer
1. Not independent 2. Unaudited F/S 3. Refusal of mgt to provide written representation and/or to acknowledge its responsibility for the fair presentation of the FS in conformity with GAAP (may also withdrawal) 4. Audit/Evidence issue - CEO is unwilling to sign the mgt representation letter. 5. Audit/EVIDENCE issue - The client refuses to permit the auditor to confirm certain AR or apply alternative procedures to verify their balances.
67
FS ISSUES Qualified(Material) or Adverse (Material and Pervasive)
1. Don't follow GAAP 2. Inappropriate accounting principles 3. Unreasonable estimates 4. Inadequate disclosure 5. Incorrect numbers 6. No reasonable justification for change in accounting principles 7. GAAP issues
68
NO MATERIAL ISSUES Unmodified/unqualified
1. Sufficient evidence 2. Follows GAAP 3. Immaterial or no issues
69
The statement "do not present fairly" would be used in an adverse opinion.
When inadequate disclosure has a material but not pervasive effect on the financial statements, the auditor's opinion should state "In our opinion, except for the omission of the information described in the basis for qualified opinion section of our report . . ."
70
An immaterial unjustified departure from GAAP would not affect the unmodified opinion. Note that if the effect were material, a qualified or adverse opinion would be appropriate.
A material change in accounting principle would result in the addition of an emphasis-of-matter paragraph to the unmodified opinion.
71
If internal control is so poor that it cannot be relied upon, the auditor must consider the effect on the audit procedures and subsequent report, but would not issue an adverse opinion. An adverse opinion is issued when the financial statements are not presented in accordance with GAAP.
Substantial doubt with regard to the entity's ability to continue as a going concern should be disclosed in either an emphasis-of-matter paragraph (optional when doubt is alleviated) or a separate section of the auditor's report (doubt remains) appended to an otherwise unmodified (unqualified) opinion. The client's refusal to provide access to the minutes of the Board of Directors' meetings would result in a disclaimer of opinion.
72
Requirements of due care
1. Observe technical stds 2. Observe ethical stds (e.g. Code of professional conduct) 3. Strive to improve competence (professional education) 4. Perform duties diligently
73
The auditor's opinion may differ with respect to different peiods.
e.g. 2011 - qualified opinion 2010 - unmodified opinion
74
UNREVISED - use original report date when reissuing previous report REVISED - dual date is used in the event that the predecessor auditor revises the report.
Reporting with predecessor auditors In determining if previously presented financial statements are still appropriate as issued, the predecessor auditor should: 1. Read the statements for the current period 2. Compare the audited statements with the current period statements 3. Obtain a letter of representation from the successor auditor stating whether the successor auditor's audi revealed any matters that may have a materal effect on the statements reportedon by the predecessor auditor. 4. OBTAIN a letter of representaton from management stating whethr ny previous management representations have change or whether any subsequent events have occurred that may require adustment or disclosure in the reissued FS
75
Prior period FS was not audited or not reissued but just REVIEWED OR COMPILED: CY auditor should include an OTHER-MATTER PARAGRAPH (nonissuer) or explanatory paragraph (issuer) that includes: 1. The service (review or compilation) performed in the prior period 2. The date o the prior period report 3. A description of any material modifications described in the report 4. A statement that the service was less in scope than an audit and does not provide the basis for expressing an opinion on the FS as a whole (review) 5. A statement that no opinion or other form of assurance is expressed (compilation).
It is not appropriate for the auditor to request a review of the predecessor auditor's engagement letter. This is a business matter between the client and the predecessor auditor that has no impact on the current period audit. Conversely, review of the predecessor auditor's working papers (audit documentation) is appropriate and customary to facilitate the auditor's audit. If the predecessor auditor refuses to give the current auditor of a nonissuer access to the documentation, the current auditor should review the risk assessment of the opening balances of the financial statements.
76
AICPA - Group Engagement Partner PCAOB calls it Principal Auditor - The partner or other person in the firm who is RESPONSIBLE for the group audit engagement and the auditor's report on the group FS GROUP FS - FS that iclude the financial info of more than one component (i.e. subsidiaries) GROUP ENGAGEMENT TEAM: includes the group engagement partner, other partners, and staff who establish the overall audit strategy, communicate with component auditors, perform work on the consolidation process, and evaluate the conclusions drawn from the audit evidence as the basis for forming an opinion on the group FS
COMPONENT - An entity or business activity that prepares Financial info that is included in the group FS COMPNENT AUDITOR: An auditor who performs work on the financial information of a component that will be used as audit evidence for the group audit.
77
WHen the GROUP ENGAGEMENT team relies on the work of the component auditor, the group engagement team has 2 alternatives: OPTION 1 - Group engagement team takes full resposibility for the audit of the component - do not reference the component auditor Option 2 - Group engagement team and component auditor divide responsibility - reference the component auditor.
If control risk is assessed at a low level, the auditor is likely to focus more on tests of controls and less on substantive audit procedures. The firm name is generally not included in the Auditor's Responsibility section. The Opinion section includes a reference to generally accepted accounting (not auditing) principles. A Basis for Opinion section including a reference to generally accepted auditing standards is a required component of the auditor’s unmodified opinion.
78
UPDATING PRIOR OPINIONS If during the current audit, the auditor becomes aware of evidence that affects the prior statements and the opinion that was expressed, the auditor should update the opinion in the CY's report.
E.g. PY FS are restated to conform with GAAP e.g. a previous report that was qualified or adverse due to a departure from GAAP would no longer be appropriate in the event of the restatement of the PY's FS to be in conformity wit GAAP.
79
REPORT OF THE PREDECESSOR AUDITOR NOT REISSUED THE succesor auditor should express an opinon on the CURRENT PERIOD FS only and indicate in an OTHER MATTER PARAGRAPH (non-issuer) or EXPLANATORY para (ISSUER): 1. That the FS of the prior period were audited by a predecessor auditor. The predecessor auditors should not be named unless the practice of the predecessors was acquired by or merged with that of the sucessor 2. The type of the opinion expressed by the predecessor auditor and if the opinion was modified, the reasons for the modification. 3. The nature of any emphasis of matter, other matter or explanatory para included in the predecessor's auditor's report.
ADVERSE OPINION = GAAP ISSUE
80
MANAGEMENT'S RESPONSIBILITIES 1. The preparation and FAIR presentation (requires IDENTIFICATION of the applicable FIN REPORTING Framework, inclusion of an adequate description of the framework in the FS)) of the FS in accordance with the applicable FIN REPORTING Framework 2. The design, implementation and maintenance of internal control relevant to the prep and fair presentation of FS that are free of material misstatement due to error or fraud and 3. Providing the auditor with access to info and persons within the entity needed to complete the audit.
AUDITOR'S RESPONSIBILITIES 1. Maintaining PROFESSIONAL SKEPTICISM 2. Complying with relevant ethical requirements 3. Exercising professional judgment throughout the planning and performance of the audit 4. Obtaining sufficient appropriate audit evidence 5. Complying with GAAS (AUDITING STANDARDS) The auditor should neither assume that mgt is DISHONEST nor assume UNQUESTIONED HONESTY. A belief that management is honest and has INTEGRITY does not relieve the auditor of the need to maintain professional skepticism or allow the auditor to be satisfied with less than persuasive evidence. Example of impediments 1. Unconscious human bias 2. DEV of inappropriate level of trust or confidence in mgt, which may result in the auditor not taking as questioning a stance as needed. 3. Pressure to avoid potential negative interactions with or consequences to individuals whom auditors know (e.g. mgt ) instead of representing the int of investors. 4. scheduling and workload demands, which may result in auditors making shortcuts in judgement, such as seeking audit evidence that is easier to obtain rather than evidence that is more reliable and relevant or giving more weight to supporting evidence without considering contrary evidence.
81
REPSONSIBILITIES OF BOTH AUDITOR AND MANAGEMENT
82
ELEMENTS OF QUALITY CONTROL HELP ME HUMAN RESources Engagement or client acceptance and continuance Leadership responsibilities Performance of the engagement Monitoring Ethical requirements
MONITORING The monitoring component or function of the internal control framework is designed to ensure that controls continue to operate effectively. Monitoring of internal control effectiveness is done to provide an assessment of the performance of the system of internal control over time. Monitoring is designed to ensure that controls operate effectively. . Periodically comparing and updating the mission vision and values of a not-for-profit could best be classified as a monitoring activity. Monitoring is the process that assesses the quality of control performance over time. Monitoring may include, among other things, the evaluation of communications from external parties such as customers, regulatory agencies, and external auditors.
83
CHATGPT Unqualified Opinion (Clean Opinion): Financial statements are fairly presented. Qualified Opinion: Financial statements are fairly presented, except for a specified issue. Adverse Opinion: Financial statements are not fairly presented. Disclaimer of Opinion: The auditor cannot provide an opinion due to scope limitations or other issues.
A management letter is a formal document that auditors provide to a company’s management at the end of a financial audit. It includes observations and recommendations about internal controls, accounting practices, and operational efficiencies that were noted during the audit but are not serious enough to be included in the auditor’s main opinion or report. Key points about a management letter: Not part of the official audit report: It's a supplementary document. Focuses on improvements: It often suggests ways to improve internal controls, compliance, efficiency, or accuracy in financial reporting. Addresses weaknesses or risks: It highlights things like lack of segregation of duties, outdated policies, or minor errors that could become issues if not addressed. Management response may be included: Management might respond to each point with corrective actions or explanations. Helps governance: It’s useful for boards, audit committees, and senior management to monitor risk and performance. Example observations in a management letter: Inventory reconciliation not done monthly. Employees with access to both cash handling and recording. Lack of documented IT backup procedures.
84
Substantive procedures are used to detect ___________
material misstatements
85
Inventory Tags Tags that are attached to inventory items to aid in the counting of inventory. Issuers Entities subject to the rules of the PCAOB (primarily public companies). IT Auditor Someone possessing specialized knowledge in information technology (IT) participating in the audit.
Major Programs Generally speaking, programs that expend $750,000 or more in federal financial assistance (specific guidelines are based on formulas prescribed in federal regulations and the Single Audit Act). Management Override of Controls The circumvention of established controls by executives of a company. (CO-PILOT - Management override of controls refers to situations where senior management bypasses or manipulates established internal controls within an organization. While internal controls are designed to safeguard assets, ensure accurate financial reporting, and maintain compliance, management override can undermine these objectives. The term circumvention refers to the act of overcoming a problem or difficulty, often in a clever or indirect way. For example, it can involve finding a way around rules or obstacles without directly confronting them. It's like taking a detour to avoid a roadblock! This can happen for legitimate reasons, such as addressing urgent business needs, but it often poses significant risks, including fraud, financial misreporting, or operational inefficiencies. For example, management might override controls to record revenues prematurely or inflate profits, which can lead to financial statement fraud2. To mitigate these risks, organizations can: Establish clear policies on when and how overrides are allowed. Implement a formal approval and documentation process for overrides. Regularly monitor and audit override activities to identify patterns or misuse)
86
Smaller reporting company____
less than $100 million in annual revenue
87
Form AP/ Audit participants - who the engagement partner was , date of audit report , if other audit firms participated
To be filed within 35 days AFTER THE AUDIT REPORT If incuded with reg statemnt - muat
88
If as an auditor we are changing the opinion, we also need to change the basis of opinion.
MODIFY auditor's responsibility section in the case of DISCLAIMER , since there are lot of things that we could not do or complete due to incomplete info?
89
AUDIT PROCESS 1. General Principles - Overall objectives, documentation, communication, quality control-firm 2. Engagement acceptance - Ethics and Independence and terms of engagement 3. Assess Risk and Plan Response (a) Audit planning, including audit strategy materiality (b) Risk assessment procedures- Understand the entity and its environment (c) Identify and assess risk (d) Respond to risk 4. Perform PROCEDURES and OBTAIN SUFFICIENT EVIDENCE Test of controls, if applicable Substantive testing 5. FORM CONCLUSIONS (a) Subsequent events (b) MAnagement representation (c) Evaluate audit results (d) QUality control - engagement 6. REPORTING report on audited FS Other reporting considerations
The auditor's report gives credibility to the FS. The auditor's as a group independent of mgt, have an objective view and can report on a company's activities without bias or conflict of interest. FS of an enterprise are prepared by the mgt of the enterprise NOT the independent auditor.
90
In certain audit engagements, the auditor may be required to COMPLY with OTHER AUDITING requirements in addition to GAAS. GAAS do not override laws or regulations that govern an audit of FS. The auditor may conduct the audit in accordance with both GAAS and: 1. Auditing standards issued by the PCAOB 2. Requirements of the ERISA (Employee Retirement Income Security Act of 1974) 3. International Standards on Auditing (ISAs) 4. Govt auditing standards (GAGAS) 5. Auditing standards of a specific jurisdiction or country
THe overall objectives of the auditor when conducting an ERISA plan FIN STATEMENT Audit are: 1. Accept an ERISA plan audit engagement when the basis upon which it is to be performed has been agreed upon through establishing whether the preconditions for the audit are present.
91
A "compilation report" refers to a report related to a ____________.
non-public entity
92
A division of responsibility affects the opinion section of the report, but does not impact any other report section.
Involvement of another auditor does not prevent the issuance of an unmodified opinion. Other Auditor-An auditor who examines a portion of the financial statements but is not deemed to be the principal or lead auditor.
93
Those charged with governance are __________
BOD or Audit Committee (may also refer to members of the entity's legal structure, external parties such as legal committees)
94
The auditor may reference in the engagement letter the involvement of internal auditors. However, internal auditors may _________________ such as determining materiality.
not make significant audit decisions,
95
______________ is responsible for providing a representation letter to the auditor at the conclusion of the audit. Management Representation Letter - A letter the auditor is required to obtain from management AT THE END or at the conclusion of fieldwork, confirming representations explicitly or implicitly given to the auditor, indicating and documenting the continuing appropriateness of such representations, and reducing the possibility of misunderstanding regarding the representations.
management
96
Management's Discussion and Analysis (MD&A) The section of a public company's annual report that comprises management's comments regarding performance during the most recent period, background information on the company, etc. The requirements for MD&A are established by the SEC. Modified Opinion An auditor's opinion issued when the auditor concludes that the financial statements are materially misstated or the auditor is unable to obtain sufficient appropriate audit evidence to conclude that the financial statements are free from material misstatement. The three types of modified opinions are the qualified opinion, the adverse opinion, and the disclaimer of opinion. Monitoring The process of assessing the quality of control performance over time. More Than Remote Likelihood - At least reasonably possible to occur.
Material Concentrations - Volumes of business, revenues, available sources of supply, or markets or geographic areas for which events could occur that would significantly disrupt normal finances within the next year. Material Weakness - A deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis. Materiality - Misstatements, including omissions, are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements. Mean-Per-Unit (MPU) Estimation - A sampling plan that uses the average value of the items in the sample to estimate the true population value. Misappropriation of Assets (Defalcation) Theft of an entity's assets, when the effect of that theft causes the financial statements not to be presented in conformity with GAAP.
97
An auditor may not be paid in stock of the entity because this would impair the auditor's independence.
The engagement letter would include the scope of the audit and the scope of any additional services to be provided by the auditor to the entity. The engagement letter is a means by which the parties agree to the terms of the engagement.
98
A successor auditor most likely would make specific inquiries of the predecessor auditor regarding: A. Disagreements with management as to auditing procedures.
Chatgpt Audit = Reasonable assurance, detailed testing, auditor opinion. Review = Limited assurance, analytical procedures, no opinion, just a statement of no material misstatements.
99
Regulatory Requirements: In certain jurisdictions, publicly traded companies or companies of a certain size may legally be required to undergo a full audit (i.e., an audit opinion) regardless of whether the company prefers a review. For example, in the U.S., public companies must have an audit of their financial statements performed by an independent auditor under the Sarbanes-Oxley Act. In many countries, smaller private companies may have the option to choose between an audit or a review, depending on their size, industry, and local regulations.
Management Decision: In cases where a full audit isn’t required by law (for example, smaller private companies or certain non-public organizations), the company’s management and board can choose to have a review done instead of an audit. They might make this decision to save costs, simplify the process, or for other business reasons. However, they must still ensure that their financial statements comply with relevant accounting standards and regulations.
100
Contact with the predecessor auditor before client acceptance is mandatory, but client permission is required.
If the predecessor auditor refuses to give the current auditor of a nonissuer access to the documentation, the current auditor should review the risk assessment of the opening balances of the financial statements.
101
An auditor is performing an audit for a company and has a close family member working as a senior executive at that company. While the auditor may be independent in fact (i.e., they do not let this relationship influence their judgment), the appearance of independence may be compromised. Investors or other stakeholders might perceive that the auditor could be biased because of this familial connection, even though the auditor’s decisions are unaffected by it.
102
AUDITOR SPECIALIST - Assist auditor in obtaining audit evidence expertise other than accounting or auditing. Expertise other than accounting or auditing.
MANAGEMENT SPECIALIST- Hired by client to assist entity in preparing the FS
103
CONSOLIDATION SIM -
It came in Trupti's exam
104
The COSO Cube links all five components with all three objectives categories and all levels of the organizational structure; everything is interrelated, which is illustrated by the cube itself.
105
According to COSO, an executive’s deliberate misrepresentation to a banker who is considering whether to make a loan to an enterprise is an example of which of the following internal control limitations?
Management override
106
INTERNAL CONTROL includes 1. Control Environment 2. Monitoring 3. Information and Communication Systems 4. Risk Assessment 5. Existing control activities
Internal Audit function is part of MONITORING
107
Establishing a control baseline needs to be the first monitoring step in evaluating the effectiveness of an internal control system. Without a baseline for comparison, there is nothing to compare against when the evaluation is performed.
The control environment component of the internal control integrated framework includes such principles as commitment to competency, accountability, and organizational structure, etc. The risk assessment component of the internal control integrated framework includes such principles as specify objectives, identify/analyze risks, and consider fraud and control changes. The risk assessment component of the COSO framework includes principles associated with management's consideration of the risk of material misstatement, not the assurance that controls continue to operate effectively. The control activities component of the internal control integrated framework includes such principles as deployment of policies and procedures and the selection and development of controls around information technology. The information and communication components of the COSO framework consider those systems that identify, capture, process, and distribute information supporting the accomplishment of financial reporting objectives, not the assurance that controls operate effectively. The information and communication component of the internal control integrated framework includes such principles as internal and external communication as well as obtaining and using information
108
The control environment sets the overall tone of the organization and is considered the foundation for the other components of internal control. The other components of internal control are risk assessment, information and communication, control activities, and monitoring. The control environment is sometimes referred to as the "tone at the top." The control environment is the framework upon which all other principles are built. It is not as specifically designed to ensure that controls continue to operate effectively as is monitoring
The "tone at the top" represents the culture of an organization in terms of the standards related to controls and conduct that senior management and the board of directors set for an entity. When employees are focused on doing the right thing, when management quickly addresses and resolves issues, and when fairness and honesty prevail in dealings with internal and external people, a positive tone for the organization is established.
109
Logical controls use software and data to monitor and control access to information and computing systems.Logical Control -A control that addresses the authorization for access to computer programs and data files. An uninterrupted power supply is considered a physical control. Physical controls monitor and control the environment of the workplace and computing facilities. They also monitor and control access to and from such facilities.
General controls are designed to ensure that an organization's control environment is stable and well-managed. Information-processing controls can be automated or manual, and apply to the processing of information and transactions to help ensure transactions occurred, are authorized, and are completely and accurately processed and reported.
110
Communication of control deficiencies in INTERNAL CONTROL - FS AUDIT ONLY, NONISSUER - CONTROL DEFICIENCY, SIGNIFICANT DEFICIENCY, MATERIAL WEAKNESS.
Communication should be made within 60 days (FOR NON ISSUER) of the report release date. (14 DAYS FOR ISSUER)
111
INTERNAL FACTORS - Mgt performance based compensation, financing methods.
EXTERNAL FACTORS - Business cycles, regulatory factors, industry factors
112
113
Identify and assess risk of material misstatement at the financial statement level =
Respond with financial level response (i.e. increase level of supervision)
114
Identify and assess risk of material misstatement at assertion level =Respond at assertion level by changing NET
Inherent risk * Control risk Assertion - COVERUP
115
Relationship between RMM and NET
Drafting the audit plan 1. OBJECTIVE - All AR exist 2. ASSERTION - Existence 3. AUDIT PROCEDURE - Confirm(NATURE) 25 (EXTENT) AR as of 12/31/year 1 (TIMING)
116
Susbstantive procedures
1. Used to detect material misstatements to transaction classes, account balances, and disclosures. 2. Includes other audit procedures required by GAAS (i.e. letter of lawyer inquiry) Test of Details - Applied to transaction classes, account balances and disclosures. Consist of audit procedures used to gather evidence to support the account balances as reflected in the financial statements. SUBSTANTIVE ANALYTICAL PROCEDURES 1. Evaluations of Fin Information made by a study of plausible relationships among both Financial and nonfinancial data 2. Generally involve comparisons of recorded amounts to independent expectations developed by the auditor.
117
ELEMENTS OF QUALITY CONTROL
1. HUMAN resources 2. Engagement/Client Acceptance and Continuance 3. Leadership Responsibilities 4. Performance of the engagement 5. Monitoring 6. Ethical Requirements
118
Inherent rrisk factors may be qualitative or quantitative and include factors such as:
1. Complexity 2. Subjectivity 3. Change 4. Uncertainty 5. Mgt bias or fraud risk 6. Significance 7. Volume or lack of uniformity
119
Fraud Risk Factors - Three conditions that generally are present when fraud occurs: 1. incentives/pressures (a reason to commit fraud); 2. opportunity (a lack of effective controls); and 3. rationalization/attitude (an attempt to justify fraudulent behavior).
Fraudulent Financial Reporting- Intentional misstatements or omissions of amounts or disclosures in the financial statements that are designed to deceive financial statement users.
120
AUDIT objectives are the same in both __________
computerized and manual environments
121
General IT Controls- Controls that relate to many applications and support the effective functioning and proper operation of the information system and the integrity of the information within the system (e.g., access controls, controls related to software/hardware acquisition and maintenance, and controls over data center/network operations). General Purpose Framework A financial reporting framework designed to meet the needs of a wide range of users, such as U.S. GAAP or IFRS. General Use Report A report that is not restricted to specified parties. Generally Accepted Accounting Principles (GAAP) The set of accounting rules established by the Financial Accounting Standards Board(FASB). Generally Accepted Auditing Standards (GAAS) Qualitative standards that provide a measure of audit quality and of the objectives to be achieved in an audit. Generally Accepted Government Auditing Standards (GAGAS) Standards for audits of government organizations, and audits of government assistance received by nongovernmental and government organizations.
Going Concern Assumption The belief that an entity will continue to operate into the foreseeable future. Government Audit An engagement that provides an opinion on financial statements as well as testing and reporting on compliance with the laws and regulations that authorize the spending of public funds. Group Engagement Partner The partner or other person in the firm who is responsible for the group audit engagement and for the auditor's report on the group financial statements. Group Engagement Team The team, which includes the group engagement partner, other partners, and staff, that establishes the overall audit strategy, communicates with component auditors, performs work on the consolidation process, and evaluates the conclusions drawn from the audit evidence as the basis for forming an opinion on the group financial statements. Group Financial Statements Financial statements that include the financial information of more than one component.
122
CHATGPT - Assertion level ASSERTIONS- Audit assertions are claims or statements made by management regarding the financial statements of an organization. These assertions form the basis of an audit, guiding auditors in determining whether the financial statements are accurate and complete. The auditor tests these assertions to gather evidence and express an opinion on the financial statements.
Assertion level in the context of auditing refers to the specific representations made by management in the financial statements regarding the accuracy and completeness of the financial information. These assertions are made about individual transactions, account balances, and disclosures in the financial statements. When auditors perform their work, they need to test these assertions to determine whether the financial statements are fairly presented in accordance with the applicable accounting framework (e.g., GAAP or IFRS). These assertions help auditors identify areas where misstatements might occur and guide the audit process. The key assertions typically covered during an audit include: Existence (or Occurrence) Meaning: The items or events actually exist or have occurred. Example: The company’s reported assets, like inventory, actually exist at the balance sheet date. Completeness Meaning: All transactions, balances, and disclosures that should have been included are indeed included. Example: All liabilities are reported and none are left out. Rights and Obligations Meaning: The entity has the legal rights to the reported assets, and it is obligated for the reported liabilities. Example: A company reports ownership of its property and has responsibility for any reported debts. Valuation or Allocation Meaning: The amounts are properly valued and recorded in the correct accounting period. Example: Inventory is valued correctly based on its cost or market value, and no overstatements are made. Presentation and Disclosure Meaning: The financial statements are properly classified, described, and disclosed in accordance with the applicable financial reporting framework. Example: The financial statements clearly present the entity’s activities, and all required disclosures are made, such as contingent liabilities or related-party transactions. Accuracy Meaning: Transactions and events have been recorded at the correct amounts. Example: The sales figures recorded reflect the accurate amount billed to customers. By evaluating these assertions, auditors assess whether the financial statements present a true and fair view of the company's financial performance and position. The assertion level is crucial for auditors to focus their testing on areas of high risk or potential misstatements.
123
ASSERTIONS Financial Statement Assertions - Representations made implicitly or explicitly by management about the recognition, measurement, presentation, and disclosure of information in the financial statements.
1. CUTOFF - Cutoff A financial statement assertion in the "transactions and events" category indicating that transactions and events have been recorded in the correct accounting period. 2. Occurrence A financial statement assertion in the "transactions and events" category indicating that transactions and events that have been recorded have occurred and pertain to the entity. 3. Rights and Obligations A financial statement assertion in the "account balances" category indicating that the entity holds or controls the rights to assets, and that liabilities are the obligations of the entity.
124
Audit documentation supports the ______
Opinion
125
Identified Controls- Controls for which the auditor is required to evaluate the design and determine implementation (also referred to as a key control or relevant control). Independence- The quality of being without bias and free from any obligation to or interest in the client, its management, or its owners. Indirect Controls - Controls that are not sufficiently precise to prevent, or detect and correct, misstatements on their own but support direct controls and are foundational to the effective operation of the system of internal control. Information and Communication Systems- A component of a system of internal control that deals with the identification, capture, and exchange of information in a timely and useful manner (information) and with an understanding of individual roles and responsibilities (communication). Information Processing Controls Controls that apply to the input, processing, and output of information and transactions within the information system. Information Technology (IT) Automated means of originating, processing, storing, and communicating information.
Inherent Limitations of an Audit The provision that the auditor is unable to obtain absolute assurance that the financial statements are free from material misstatement because of the nature of financial reporting, the nature of audit procedures, the timeliness of financial reporting, and the balance between cost and benefit. Inherent Limitations of Internal Control The provision of only reasonable (as opposed to absolute) assurance regarding the achievement of internal control objectives. Inherent limitations arise due to human error, deliberate circumvention of controls by collusion, management override, and the difficulty of achieving appropriate segregation of duties in smaller entities. Inherent Limitations Paragraph A paragraph included in a report on an entity's internal control indicating that undetected misstatements may occur, and that projections of the evaluation to future periods are subject to the risk that conditions may change. Inherent Risk The susceptibility of a relevant assertion to a material misstatement, assuming that there are no related controls. Inherent Risk Factors Characteristics of circumstances that affect the susceptibility of an assertion about a class of transactions, account balance, or disclosure to misstatement (e.g., complexity, subjectivity, or uncertainty). Inherent Risk of Noncompliance The susceptibility of a compliance requirement to noncompliance that could be material, assuming that there are no related controls.
126
Mgt representation letter
All material matters have been adequately disclosed to the AUDITOR
127
A written audit program is required for every audit
engagement letter - mandatory
128
Hospitals - less affected by business cycles
Cutoff Bank Statement A bank statement sent directly to the auditor, usually shortly after period end. Cutoff Testing An examination of transactions occurring several days before and several days after year-end, to ensure that they were recorded in the proper accounting period. Defalcation (Misappropriation of Assets) Theft of an entity's assets when the effect of the theft causes the financial statements not to be presented in conformity with GAAP. Walk-Throughs Procedures performed by the auditor around the flow of data from origination to final disposition to obtain an understanding of the system and controls. Working Papers (Audit Documentation) The principal record of procedures performed, evidence obtained, and conclusions reached; also called "workpapers" or "audit documentation." Yellow Book A publication of the U.S. Government Accountability Office (GAO), entitled "Government Auditing Standards," which represents the source of GAGAS.
129
Initial Audit- An engagement in which the financial statements of the prior period were not audited or were audited by a predecessor auditor. Integrated Audit - A concurrent audit of both the financial statements and internal control over financial reporting(ICFR). PCAOB standards require an integrated audit for all issuers. Integrated audits can also be performed for nonissuers under the SSAE. Internal Evidence- Information generated within the enterprise.
Interim Audit Work The performance of auditing procedures before year-end. Interim Financial Information Financial information covering a period less than a full year or a 12-month period ending on a date other than the entity's fiscal year-end. Internal Auditor A company employee who performs auditing functions for use by management and the board of directors. Internal Control Questionnaire - A list of questions, typically answered by a yes or no response, addressing relevant control procedures.
130
Documentation may include any item the AUDITOR can (Acronym -FIND): 1. F - Flowchart 2. I - Internal control questionnaire or checklists 3. N - Narrative 4. D - Documentation from the client, including copies of the entity's procedures manuals and org charts.
Flowchart- A symbolic diagram representing the sequential flow of authority, processes, and documents. Narrative- A written version of a flowchart describing the auditor's understanding of the system of internal control. Nature (of an Audit Test) The quality of an audit test as measured in terms of the relevance and reliability of the evidence it provides. The nature of an audit procedure includes both its purpose and its type. Negative Assurance- A statement indicating that, as a result of performing certain procedures, nothing came to the accountant's attention indicating that the subject matter in question did not meet a specified standard. Negative Confirmations A confirmation in which a response is requested only if the amount stated is incorrect.
131
The determination of whether a risk is a significant risk should ignore the effects of controls related to the risk and should be based entirely on inherent risk. A significant risk exists when inherent risk is higher on the spectrum of inherent risk.
Foot-To verify the mathematical accuracy of a statement or schedule by adding columns of numbers from top to bottom. Form AP- A form that auditors of issuers are required to file with the PCAOB for each audit report issued and which includes information about the audit. COPILOT - Form AP is a document used by registered audit firms to disclose the names of engagement partners and other accounting firms involved in audits of public companies. This form is required under PCAOB Rule 3211 to enhance transparency in the auditing process. It allows investors and others to identify who is leading and participating in these audits.
132
Testing of Design and Operating Effectiveness Procedures to test design effectiveness: 1. INQUIRIES 2. OBSERVATION 3. INSPECTION Walkthroughs that include these procedures are sufficient to test design effectiveness.
Procedures to test OPERATING effectiveness: 1. INQUIRIES 2. OBSERVATION 3. INSPECTION 4. REPERFORMANCE Used exclusively for testing operating effectiveness.
133
Controls that are tested only during an interim period should be supplemented by additional evidence for the remaining period. Also known as rollforward procedures for remainder year
E.g. Interim testing period
134
Even if controls have not changed, operating effectiveness must be tested at least once ___________
every third year
135
IR = RMM (Risk of Material Misstatement)
IR*CR=RMM
136
Susbtantive procedures are used to detect material misstatements to transaction classes, account balances and disclosures at the relevant assertion level. Includes other audit procedures required by GAAS (i.e. letter of lawyer inquiry) 2 types
1. Test of details - Applied to transaction classes, account balances, and disclosures Consist of audit procedures used to gather evidence to support the account balances as reflected in FS. 2. Substantive Analytical procedures - Evaluations of FI made by a study of plausible relationships among both financial and nonfinancial data. Generally involve comparisons of recorded amounts to independent expectations developed by the auditor.
137
Ratios and Subsequent events and Consolidation sim to be revised from FAR
138
Planning stage - auditor should make a preliminary judgement of ________
materiality
139
More complex indicators 1. Several business lines 2. Many levels of mgt 3. Complex transactions
Less complex indicators" 1. Fewer business lines 2. More centralized accounting functions 3. Few levels of management
140
Audit procedures - 2 categories
1. Risk assessment Procedures 2. Further Audit procedures - further into 2 categories - A. TEST OF CONTROLS (if applicable) and B. SUBSTANTIVE PROCEDURES (required)
141
AUDIT PLAN should include info related to NATURE, EXTENT AND TIMING of audit procedures: NET
1. Nature refers to the type of procedure that's going to be performed 2. Extent refers to number of items 3. Timing refers to the testing period or testing as of date.
142
Performance MATERIALITY (Nonissuer)
Tolerable Misstatement (Issuer) Tolerable Misstatement In sampling, the maximum monetary misstatement in an account balance or class of transactions that may exist without causing the financial statements to be materially misstated. Tolerable misstatement is the application of performance materiality to a particular sampling procedure.
143
MISSTATEMENTS include:
1. Inaccuracies in the collection of processing of data 2. Departures from GAAP 3. Omissions 4. Inappropriate selection or application of accounting policies 5. Inappropriate classification, aggregation, or disaggregation of information
144
TYPES of MISSTATEMENTS
1. FACTUAL (about which there are no doubt) 2. JUDGEMENTAL (differences arising from the judgments of mgt, including those concerning recognition, measurement, presentation, and disclosure in the FS(including the selection or application of accounting policies that auditor considers unreasonable or inappropriate) 3. PROJECTED (These are the auditor's best estimate of misstatements identified in audit samples to the entire population from which the samples were drawn.)
145
AUDIT RISK (should be low) = Risk of Material Misstatement (Assessed by Auditor)* Detection Risk (controlled by auditor) Audit risk = RMM*DR RMM = IR*CR The auditor must perform a separate assessment of INHERENT RISK (IR) and CONTROL RISK (CR).
The components of audit risk may be assessed either: 1. Quantitatively (e.g. as a %); or 2. Nonquantitatively (e.g. High, medium, low, etc.)
146
Audit risk equation AR = RMM*DR = IR*CR*DR or DR = AR/RMM or DR = AR/ IR*CR
147
Types of Fraud 1. Fraudulent Financial Reporting 2. Misappropriation of Assets
Fraud Triangle 1. Incentives/Pressures - a reason to commit fraud. e.g. excessive pressure for mgt to meet aggressive goals 2. Opportunity - a lack of effective controls. Example -weak controls over cash (no locks on cash register) 3. Rationalization/Attitude - an attempt to justify fraudulent behavior. Example includes: Disregard for authority (i.e. known history of violations of securities law)
148
Confirmation of accounts payable is a test of details, not an analytical procedure. Scanning payroll files for terminated employees is a test of details, not an analytical procedure. Recalculating interest expense based on notes payable balances is a test of details, not an analytical procedure.
Total transactions = Total revenue
149
Something not in FS, e.g. Compliance (never part of FS)
Report in Other Matter Paragraph Other-Matter Paragraph A paragraph included in the auditor's report, when required by GAAS or at the auditor's discretion, that refers to matters other than those presented or disclosed in the financial statements that are relevant to the users' understanding of the audit, the auditor's responsibilities, or the auditor's report. Other‑matter paragraphs are used by nonissuers only.
150
Examination engagement - Opinion report Review - Conclusion Agreed-upon Porcedures - Findings
Examination can be an assertion based examination or a direct examination
151
ASSERTIONS - MNEMONIC COVER UP Valuation and Allocation A financial statement assertion in the "account balances" category indicating that assets, liabilities, and equity interests are included in the financial statements at appropriate amounts and any resulting valuation or allocation adjustments are appropriately recorded.
1. COMPLETENESS - all account balances, transactions, and disclosures that should have been recorded and included in the FS. 2. CUTOFF- Transactions - Transactions have been recorded in the correct accounting period. 3. VALUATION, ALLOCATION AND ACCURACY - Account balances, transactions and disclosures are recorded and described fairly and measured at appropriate amounts, and any resulting valuation or allocation adjustments are appropriately recorded. 4. EXISTENCE AND OCCURRENCE - Account balances exist, and transactions that have been recorded and disclosed have occurred and pertain to the entity. (Existence A financial statement assertion in the "account balances" category indicating that assets, liabilities, and equity interests exist.) 5. RIGHTS AND OBLIGATIONS - The entity holds or controls the rights to assets and liabilities are the obligations of the entity. Account balances and disclosures. 6. UNDERSTANDIBLITY OF PRESENTATION AND CLASSIFICATION- Transactions have been recorded in the proper accounts and appropriately aggregated or disaggregated. Fin Information is appropriately presented and descibed and disclosures are clearly expressed and understandable in the context of the applicable financial reporting framework.
152
Control and Detection
Inverse relation
153
Test of controls cannot detect misstatements but can only be used to assess the risk of material misstatements
Inherent risk is a component of audit risk and not of detection risk. Detection risk is a component of audit risk and not vice versa.
154
Compilation Agreement
The effect that independent impairments if present will have on the expected form of the accountant's report.
155
Issuer = 14 or 45? days after re[prt release date, retained for 7 yrsrd
Non issuers = 60 days after report release date, 5 years
156
AUDIT REQUIREMENTS WHEN USING A SPECIALITIST
1. Evaluate his competence and objectivity 2. Assess the risk of material misstatement with the subject matter 3. Understand and evaluate the external IT auditor's or specialist's work 4. Verify any relationships with the client are appropriate
157
158
MONITORING sequence of activities 1. cconduct ongoing and/or separate evaluations to determine if IC are in place and functionning 2. EValuate and control IC deficiencies
1. CONTROL baseline - Understand internal controls (I/C) system and develop baseline 2. Change IDENTIFICATION - identify changes in I/C effectiveness through ongoing and/or separate evaluations 3. Change management - Implement I/C Changes are needed. 4. Control revalidation/update Develop new baseline after I/C revisions
159
To what degree, is a significant deficiency related to a material weakness
IT Is LESS SEVERE than a MATERIAL WEAKNESS.
160
Disclaimer of opinion
Auditors cannot/do not express an opinion
161
KEY POSITION- Any position that gives the ability to exercise influence over financial statements.
CEO, CFO, Controller, Director of internal audit
162
LEADING INDICATIORS
LAGGING INDICATORS - inventories to sales ratios, prime rate charged by banks
163
Shortgaes may occur during a PEAK TROUGH - Profit at lowest, firms have excess capacity and must reduce COSTS and their WORKFORCES. RECOVERY -
Contraction - Decrease in economic activity, when the economy is contracting
164
Periodic reconciliation of changes to the data is considered a detective control because it reviews changes. This control helps to verify that any changes made to the data follow the established policies and procedures, including appropriate review and approval.
. In every audit, the auditor should obtain a sufficient understanding of the design of relevant controls pertaining to financial reporting in each of the five internal control components.
165
AR = RMM *DR= IR*CR*DR
166
ATTEST = Examination, Review and Agreed-upon procedures (ERA)
167
Vulnerability controls identify and prevent security issues for newly installed applications and post-installation applications on an ongoing basis. This control is not related to job role duties. Authentication controls validate a user's identity for system access, ensuring that only the appropriately designated person accesses a system. This control is not violated because Computing Corp. granted system access for Janice for both job roles, so she would be the proper person to allow access during the authentication process. Access control lists are a type of authentication control that governs the level of access that a user has, such as the ability to create content, read it only, or remove data. There is no mention of the type of access Janice has been given in her two job roles, which means there is no indication that this type of access control was violated.
Computing Corp. violated the preventive control of segregation of duties. To implement this control, organizations identify job role functions that have conflicts of interest or functions that should otherwise not be performed by the same person because that could lead to fraudulent behavior or errors. If Janice is both a security administrator and a programmer, she would have the ability to create an application that circumvents network security protocols, violating the control of segregation of duties.
168
Substantive testing is typically not utilized to identify relevant controls. Substantive testing is an audit procedure designed to detect material misstatements. Auditors typically will assess the risk of material misstatement, which includes obtaining an understanding of controls, and then will determine the nature, extent, and timing of substantive procedures.
An auditor is not required to evaluate operating effectiveness as part of understanding the system of internal control. Tests of controls are performed when the auditor's risk assessment is based on the assumption that controls are operating effectively or when substantive procedures alone are insufficient (e.g., when the entity makes extensive use of information technology).
169
3 impairments
PERSONAL, ORGANIZATIONAL and EXTERNAL
170
GAGAS
Yellow book
171
Auditors of public companies of any size are not covered by ________
GAO rules (Govt Accountability office)
172
Detection risk
A risk that a misstatement can go undetected
173
Professional judgement is based on
Training, knowledge and experience
174
On the job training does not qualify as CPE under GAO rules and over a 2 year period. ABC will need 80 hours of CPE of which at least ______should cover subject matter that deals directly with auditing in the govt. environment.
24 hours
175
GAO's conceptural framework includes a unique ___________that derives from an auditing organization's placement within a government entity which might, in combination with the structure of the entity being audited, impact the auditor's ability to work and report results objectively.
STRUCTURAL THREAT - GAO
176
THREATS
1. Familiarity Threat- The threat that aspects of a relationship with management or personnel of an audited entity, such as a close or long relationship, or that of an immediate or close family member, will lead an auditor to take a position that is not objective. 2. Management Participation Threat The threat that results from an auditor's taking on the role of management or otherwise performing management functions on behalf of the entity undergoing an audit. 3. Self-Review Threat The threat than an auditor or audit organization that has provided non‑audit services will not appropriately evaluate the results of previous judgments made or services performed as part of the non-audit services when forming a judgment significant to an audit. 4. Self-interest threat - The self-interest threat is the threat that a financial or other interest will inappropriately influence an auditor’s judgment or behavior. 5. Bias threat is the threat that an auditor will, as a result of political, ideological, social, or other convictions, take a position that is not objective. 6. Management participation threat is the threat that results from an auditor’s taking on the role of management or otherwise performing management functions on behalf of the entity undergoing an audit.
177
Testing at interim is often performed when the ___________________
risk of material misstatement is low
178
Attestation services are non-audit services.
e.g. assertions/ claims made by another party. examination/forecasts 1. examination 2. reviews 3. agreed upon procedures
179
Disposes off shares within 30 days - does not create AUD problem
True
180
Financial Forecast - A financial statement that reflects the expected financial results of a future period based on expected conditions and expected courses of action. Financial Projection-A financial statement that reflects the financial results of a future period based on hypothetical ("what if") assumptions.
181
1. Other partner in the office even if he is not providing service to the client 2.DHG firm providing audit services
COVERED member
182
If loan payments are uptodate and terms are completely normal, no problem arises if staff took bank from the loan staff is auditing.
True
183
Blank confirmations provide the most assurance because they require that the 3rd party writes down the amount they believe they owe the client. The auditor can then compare what the 3rd party wrote down to what the client has reported.
Blank confirmations require the customer to input the amount that they owe the company (your audit client). Blank forms will often provide a greater amount of assurance; however, they will often result in lower responses as people are less likely to make the effort to fill them out. Blank confirmations provide the highest level of assurance.
184
Motivation, Rationalization and Opportunity
Fraud Triangle
185
COMPILATIONS do not require independence but lack of independence should be ____________
DISCLOSED.
186
what is scope limitation in Audit ChatGPT said: In auditing, scope limitation refers to a situation where the auditor is unable to obtain sufficient appropriate audit evidence to form an opinion on the financial statements due to restrictions imposed by the client or other circumstances. These limitations prevent the auditor from fully assessing the financial records, transactions, or internal controls of the entity being audited. Scope limitations can arise in various ways, such as: Client-imposed limitations: The client may refuse to provide access to certain records or documents, restrict access to key personnel, or limit the auditor’s ability to perform certain audit procedures. Inability to perform necessary audit procedures: Sometimes, due to time constraints, lack of cooperation, or inability to access certain information (such as records from a third party), the auditor cannot complete the audit process as planned. Circumstances beyond the auditor’s control: There may be instances where natural disasters, fire, or theft result in the destruction of accounting records, or where legal restrictions prevent certain information from being reviewed. Types of Scope Limitations: Complete scope limitation: When the auditor is unable to perform any of the planned audit procedures. Partial scope limitation: When the auditor cannot perform specific procedures in some areas, but the audit can still proceed in other areas. Impact on the Audit Opinion: If a scope limitation is significant and cannot be resolved, the auditor may issue a qualified opinion, indicating that they were unable to obtain sufficient evidence to form an opinion on certain aspects of the financial statements. In extreme cases, if the scope limitation is pervasive and affects the entire audit, the auditor might issue a disclaimer of opinion, stating that they cannot express an opinion on the financial statements due to the lack of sufficient evidence. Scope limitations are taken very seriously in audits, as they could signal potential issues or risks with the entity’s financial reporting.
Voucher Packets A group of matched documents related to a particular purchase (i.e., a requisition, purchase order, receiving report, and vendor invoice)
187
Vouching- Directional testing in which the auditor examines support for what has been recorded, going from the financial statements back to supporting documentation (i.e., testing existence). Note that the term "vouching" is sometimes used generically to mean comparing one item to another, without indication of direction. Tracing- Directional testing that starts with source documents and traces forward to provide assurance that an event is being given proper recognition in the financial statements (i.e., testing completeness). Note that the term "tracing" is sometimes used generically to mean comparing one item to another, without indication of direction. Piecemeal Opinions Expressions of opinion as to certain identified line items in the financial statements, when those items constitute a major portion of the financial statements. Planning The development of an overall strategy for the audit. Point Estimate In sampling, an approximation of the true balance of an account, determined by applying the projected misstatement to the recorded balance. Population In sampling, the entire group under consideration; a sample is used to estimate population characteristics. Positive Assurance An affirmative statement or opinion given by the auditor, generally based on a high level of work performed. Positive Confirmations A confirmation in which the recipient is requested to respond regardless of whether the information included (if any) is accurate. Practicable Information can be reasonably obtained from management's accounts and records, and providing that the information in the auditor's report does not require the auditor to assume the position of a preparer of financial information.
Partial Presentation- A presentation of prospective financial information that excludes one of the following essential elements: sales, gross profit (or cost of sales), unusual or infrequent items, income tax expense, discontinued operations, income from continuing operations, net income, earnings per share, or significant changes in financial position. Payroll Register- An accounting journal containing a record for each employee, with each record including data such as name, identification number, gross pay (regular and overtime), income taxes withheld, other deductions, and net pay. Performance Audits A range of engagements with specific governing standards from the Yellow Book that may embrace one of four objectives: effectiveness, economy, and efficiency; internal control; compliance; or prospective analysis. Performance Materiality The amount or amounts set by the auditor at less than materiality for the financial statements as a whole to reduce to an appropriately low level the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality for the financial statements as a whole. Permanent File A collection of audit documentation that has a continuing interest from year to year. Pervasive Effects on the financial statements that, in the auditor's professional judgment, are not confined to specific elements, accounts, or items of the financial statements, or, if so confined, represent a substantial portion of the financial statements, or are disclosures fundamental to the users' understanding of the financial statements. Physical Controls Controls used to safeguard assets (e.g., security devices, limited access to restricted areas, periodic counting and comparison, etc.).
188
ChatGPT A Financial Reporting Framework Audit is an examination of an entity's financial statements to ensure they comply with the applicable financial reporting framework (FRF) in place. These frameworks provide the guidelines for how financial statements should be prepared and presented. The audit ensures that the financial statements are accurate, complete, and fairly represent the financial position of the company or entity in accordance with the chosen framework. Key Financial Reporting Frameworks (FRFs) Generally Accepted Accounting Principles (GAAP) – Widely used in the United States, it outlines the rules and procedures for accounting in various industries. International Financial Reporting Standards (IFRS) – Used globally, IFRS is a set of standards set by the International Accounting Standards Board (IASB). Other FRFs – Some organizations may follow specialized frameworks such as the cash basis, tax basis, or regulatory basis depending on their specific needs and jurisdiction. Steps in a Financial Reporting Framework Audit Understanding the Entity: The auditor will review the company’s business model, operations, and the regulatory environment to determine the most relevant financial reporting framework. Evaluating Internal Controls: The auditor evaluates the effectiveness of internal controls over financial reporting to assess how accurately the financial information is compiled. Testing Financial Statements: The auditor tests the financial statements against the selected framework (e.g., GAAP or IFRS) to ensure compliance. This includes: Verifying the accuracy of financial data Ensuring correct classification of assets, liabilities, revenues, and expenses Assessing the adequacy of disclosures required by the chosen framework Identifying Material Misstatements: The auditor looks for any material misstatements or deviations from the framework and evaluates whether these issues are significant enough to impact the overall reliability of the financial statements. Forming an Opinion: After assessing the financial statements, the auditor forms an opinion on whether the financial statements are prepared in accordance with the financial reporting framework, offering one of the following opinions: Unqualified Opinion: The financial statements are presented fairly in accordance with the applicable framework. Qualified Opinion: The financial statements are mostly compliant with the framework, but there are exceptions. Adverse Opinion: The financial statements do not conform to the framework. Disclaimer of Opinion: The auditor is unable to form an opinion due to significant limitations in the scope of the audit. Importance of a Financial Reporting Framework Audit Transparency: It ensures that the company is transparent in its financial reporting, providing stakeholders with reliable and consistent information. Compliance: Ensures the entity adheres to relevant legal and regulatory requirements. Investor Confidence: Proper audits enhance the credibility of financial statements, reassuring investors, creditors, and other stakeholders. Financial Decision-Making: Accurate and reliable financial information is crucial for internal management decisions and external investments.
Undue Influence Threat The threat that external influences or pressures will affect an auditor's ability to make independent and objective judgments. Unmodified Opinion - MN An auditor's report for a nonissuer stating that the financial statements are presented fairly in all material respects in accordance with the applicable financial reporting framework. Unqualified Opinion - IQ An auditor's report for an issuer stating that the financial statements are presented fairly in all material respects in accordance with the applicable financial reporting framework. Updated Report A report on previously issued financial statements that takes into consideration information that the accountant has become aware of during the current engagement, and includes any necessary revisions to the original report. Upper (Maximum) Deviation Rate In sampling, the sum of the sample deviation rate and the allowance for sampling risk. User Auditor The auditor of a company that makes use of an outside service organization. Qualified Opinion An auditor's report stating that "except for" the effects of the matter(s) to which the qualification relates, the financial statements are presented fairly, in all material respects. Quality Control System - 5 ELEMENTS A system designed to ensure that services are competently delivered and adequately supervised. A firm's quality control system is composed of five elements of engagement quality: acceptance and continuance of clients and engagements; independence, integrity, and objectivity; monitoring; personnel management; and engagement performance. Questioned Costs Expenditures deemed to be non-allowable, undocumented, or unreasonable for reimbursement under a grant.
189
Material effect
add EMPHASIS MATTER para
190
Anything that's not disclosed in FS
Other matter PARA
191
Omits one of the financial statements
Qualified opinion e.g. GAAP DEPARTURE Does not issue/omit cash flow statement
192
Reviewing confirmations of loans receivable and payable is useful for determining the existence of related party transactions because guarantees are commonly provided by or for related parties.
Recurring transactions after year-end are a usual business occurrence. Related party transactions would most likely be nonrecurring.
193
The auditor would generally rely on persuasive evidence rather than conclusive evidence.
To be assured beyond a reasonable doubt would require that the auditor test near or at 100% of the items in the population for a given audit procedure. This is not practical in many cases.
194
Transaction Tagging A technique used by the auditor to electronically mark (or "tag") specific transactions and follow them through the client's system. Transactions and Events One of three categories of financial statement assertions, relating primarily to the recording of items affecting the financial statements. Treasury Stock Stock issued by a company that is subsequently reacquired from shareholders, so that it is no longer considered "outstanding."
Type 1 Report- DESIGN AND IMPLEMENTATION - A report on management's description of the service organization's system and the design and implementation of a service organization's controls as of a specified date. It does not provide assurance on the operating effectiveness of controls. Coverage - Single point in time - Are the controls properly designed - focus. Lower assurance Type 2 Report - OPERATING EFFECTIVENESS THROUGHOUT A SPECIFIED PERIOD A report on management's description of the service organization's system and the design, implementation, and operating effectiveness of a service organization's controls throughout a specified period. coverage - period of time (6 to 12 months). FOCUS - Are the controls properly designed and operating effectively? Higher assurance.
195
Attribute sampling is also known as _________ Attribute Sampling A statistical sampling method used to estimate the rate of occurrence of a specific characteristic or attribute in a population.
Sampling internal control
196
Audit Sampling- The testing of less than 100 percent of the items within an account balance or class of transactions in order to evaluate some characteristic of the balance or class. Block (Cluster) Sampling- In sampling, the selection of groups of adjacent items. Discovery Sampling-A special type of attribute sampling appropriate when the auditor believes that the population deviation rate is zero or near zero. Nonsampling Risk All aspects of audit risk that are not due to sampling (e.g., selecting inappropriate audit procedures, failing to recognize a misstatement in documents examined, etc.). Nonstatistical Sampling=JUDGMENT rather than Maths formulae A method of sampling in which auditors use their judgment (rather than mathematical formulae) to estimate risk, determine sample size, and evaluate sample results. Probability-Proportional-to-Size (PPS) Sampling A sampling technique in which the sampling unit is defined as an individual dollar in a population. Once a dollar is selected, the entire account (containing that dollar) is audited. Sampling Interval In PPS sampling, a range of dollars from which each sampling unit will be selected (e.g., in a population of $500,000 with a sampling interval of $5,000, there would be 100 sampling intervals; the sample would consist of 100 items, with one item being selected from each of the 100 intervals). Sampling Risk In sampling, the risk that the sample is not representative of the population, and that the auditor's conclusion therefore will be different from the conclusion that would have been reached had the tests been applied to all items in the population. Sampling Unit In sampling, an item selected from the population for testing. Statistical Sampling = MATHS FORMULAE being used A method of sampling in which auditors use mathematical formulae (rather than simply using judgment) to quantify risk, determine sample size, and evaluate sample results. Stop-or-Go Sampling (Sequential Sampling) In sampling, a method designed to avoid oversampling for attributes by allowing the auditor to stop an audit test before completing all steps, if the results have become clear. Variables Sampling - e.g. AR balance A statistical sampling method used to estimate the numerical measurement of a population, such as a dollar value (e.g., accounts receivable balance).
Audit Strategy An overall plan for the audit, typically used to develop the more detailed audit plan. Audit Trail Evidence indicative of the sequential flow of accounting operations. Auditing Procedures Tasks performed to accomplish the objectives of the audit. Bank Confirmation An independent bank verification of year-end bank balances; also may provide information regarding loans, contingent liabilities, discounted notes, pledged collateral, and guarantees or security agreements. Bank Reconciliation A schedule that compares the cash balance reported by the bank with the cash balance reported by the client, and explains any differences. Bank Transfer Schedule A schedule that itemizes transfers of cash among banks, including the record date per the client and the transaction date per the bank. Bias Threat The threat that an auditor will, as a result of political, ideological, social, or other convictions, take a position that is not objective. Bill of Lading A shipping document issued by a carrier evidencing receipt of goods and terms of transport. Blank Confirmation A confirmation in which the recipient is requested to fill in the balance. Capsule Financial Information Unaudited summarized interim information for subsequent periods. Combined Approach An audit approach in which both tests of the operating effectiveness of controls and substantive procedures are used. If controls are operating effectively, less assurance will be required from substantive procedures. Common Size Financial Statements Restated financial statements in which each balance sheet component is expressed as a percentage of total assets, and each income statement component is expressed as a percentage of total revenue. = IS = % of TOTAL REVENUE; BS = % of TOTAL ASSETS Compilation An engagement in which an accountant presents in the form of financial statements information that is the representation of management. Completeness A financial statement assertion appearing in all three assertion categories and indicating that all transactions, events, assets, liabilities, and equity interests that should have been recorded have been recorded, and that all disclosures that should have been included in the financial statements have been included. Compliance Audit An attest engagement under GAAS (and sometimes GAGAS) in which the auditor reports on whether the entity or compliance audit client(s) complied, in all material respects, with the compliance requirements applicable to its programs. Additional Single Audit Act requirements may apply. Component An entity or business activity that prepares financial information that is included in the group financial statements in the audit of a nonissuer. Component Auditor An auditor who performs work on the financial information of a component that will be used as audit evidence for the group audit of a nonissuer. A component auditor may be part of the group engagement partner's firm, a network firm, or another firm. Components of Internal Control Interrelated elements of the system of internal control used to achieve an entity's objectives; control components consist of: control environment, risk assessment, information and communication systems, monitoring, and (existing) control activities. Concurring Approval of Issuance Approval of the issuance of the engagement report granted by the engagement quality reviewer under PCAOB standards. A firm cannot give an issuer permission to use the engagement report until concurring approval of issuance has been granted. Condensed Financial Statements Historical financial information that is presented in less detail than a complete set of financial statements, in accordance with an appropriate financial reporting framework. Condensed financial statements may be separately presented as unaudited financial information or may be presented as comparative information. Confidence Level (also called Reliability) In sampling, a measure of how certain the auditor wants to be that his or her results are accurate. Note that the confidence level plus the risk of being ineffective equals 100 percent. Confirmation A direct written response to the auditor from a third party, either in paper form or by electronic or other medium. Consigned Goods Goods belonging to one party that are held for sale by another party; the seller does not pay the owner until the goods have been sold. Consistency A measure of the comparability of financial statements from one year to the next. Contingency An event that may, but is not certain to, occur. A loss contingency that is probable and that can be reasonably estimated should be reflected in the accounts.
197
After obtaining an understanding of how management developed its estimate, the auditor would perform one or a combination of the following procedures: Review subsequent events and transactions (occurring prior to completion of fieldwork) that corroborate the value of the estimate (choice "A"). Develop an auditor's point estimate or range (choice "B"). Review and test the procedures used by management to develop the estimate (choice "D").
Attributes of Risk Four characteristics used in analyzing risk: type, significance, likelihood, and pervasiveness.
198
Social media post -Unstructured data
spreadsheet, data mart data - structured data
199
Variance analysis-bullet charts
Scatter plots - analyzing relationships
200
Pie chart
Propotional make up of analysis of category of population
201
Ratio estimation is most effective if there is a correlation between book values and audit amounts.
A relatively small number of differences do not improve the effectiveness of ratio estimation sampling relative to other techniques.
202
Overstated units have a higher (not lower) probability of sample selection than units that are understated, because with PPS sampling, each item is given a probability of selection in proportion to its recorded amount (probability-proportional-to-size).
. The sampling distribution does not have to approximate the normal distribution in order for PPS sampling to be used.
203
Sampling interval = Tolerable misstatement/Reliability factor
Dollar unit sampling or In PPS sampling, the auditor controls the risk of incorrect acceptance by specifying that risk level for the sampling plan. The inputs for PPS are tolerable misstatement, risk of incorrect acceptance (reliability factor), and the recorded amount of the population being sampled.
204
An emphasis-of-matter paragraph is used to emphasize a matter that is appropriately presented or disclosed in the financial statements.
An other-matter paragraph is used to refer to matters other than those presented or disclosed in the financial statements.
205
Negative cash flows from operations are examples of negative trends that the entity has experienced. They may be an indicator of financial difficulties that the entity is facing.
. If substantial doubt remains, a separate section should be added to the auditor's report with the heading "Substantial Doubt About an Entity's Ability to Continue as a Going Concern." If management's plans alleviate the substantial doubt, an emphasis-of-matter may be added (optional). When a CPA concludes that there is substantial doubt about an entity's ability to continue as a going concern and that doubt remains (is not alleviated by management's plans) and the entity adequately discloses its financial difficulties, an unmodified opinion is appropriate. A separate section with the heading "Substantial Doubt About the Entity's Ability to Continue as a Going Concern," rather than an emphasis-of-matter paragraph, should be added to the auditor's report. This paragraph should include the phrases "substantial doubt" and "going concern." If substantial doubt about the entity's ability to continue as a going concern has been removed in the current period, the separate going concern section included in the prior period auditor's report should not be repeated, and no description of the reasons or plans for recovery need be included.
206
Inadequate disclosure of the substantial doubt about an entity's ability to continue as a going concern is a departure from GAAP, resulting in either a qualified or adverse opinion.
Scope limitations result in either a qualified opinion or in a disclaimer of opinion, but not in an adverse opinion.
207
Risk of incorrect acceptance: Deciding from the sample that the balance is correct when it is really materially misstated; affects audit effectiveness.
Risk of incorrect rejection: Deciding from the sample that the balance is materially misstated when it is really correct; affects audit efficiency.
208
Risk of assessing control risk too low: The risk that the assessed level of control risk is less than the true risk, which is caused by thinking that the control is more effective and reliable than it really is; affects AUDIT EFFECTIVENESS(incorrectly accepted)
Risk of assessing control risk too high: The risk that the assessed level of control risk is greater than the true risk, which is caused by thinking that the control is less effective and reliable than it really is; affects audit efficiency.EFFICIENCY (incorrectly rejected)
209
Sampling risk + reliability (confidence)=
100%
210
Susbtantive tests or tests of details are performed to detect material misstatements in the FS.
When the client refuses to accept the modified opinion due to noncompliance issues, the auditor should withdraw from the engagement and notify those charged with governance in writing. Accounting estimates are imprecise and can be susceptible to unintentional or intentional management bias, which in turn increases the risks of material misstatement of accounting estimates. Consistency is ONLY mentioned in the report IF it is LACKING (otherwise not required to be mentioned explicitly)
211
These factors affect sample size in an attribute sampling application:
1. Risk of assessing control risk too low (inverse relationship) 2. Tolerable deviation rate (inverse relationship) - In sampling, the maximum rate of deviation from a prescribed procedure that the auditor will tolerate without modifying planned reliance on internal control. 3. Expected deviation rate (direct relationship) - Expected Deviation Rate. In sampling, the auditor's best estimate of the rate of deviation from a prescribed control procedure. 4. Population size (not an issue if the population is large)
212
The auditor compares the upper deviation rate with the tolerable deviation rate in drawing conclusions about an attribute sampling application. If the upper deviation rate exceeds the auditor's tolerable deviation rate, the auditor will not rely on the control.
(The upper deviation rate is the sample deviation rate plus an allowance for sampling risk)
213
Providing more supervision during an audit of a nonissuer in response to assessed risks of material misstatement at the financial statement level is an example of an overall response
Substantive procedures include both tests of details and substantive analytical procedures. Substantive procedures are required for all relevant assertions related to each significant transaction class, account balance, and disclosure item. An auditor would most likely respond to a heightened assessed risk of material misstatement by using substantive tests of details at period end, when appropriate. Substantive analytical procedures are often used when there is a large volume of predictable transactions and when the risk of material misstatement is low.
214
If control risk and inherent risk are both high, the auditor will likely assess the risk of material misstatement higher as well. If the risk of material misstatement is higher and the auditor is performing tests of details, the auditor will select a larger sample for their audit procedure.
If the auditor determines that testing the operating effectiveness of controls would not be efficient, he or she may choose to use only substantive procedures to evaluate specific assertions and risks.
215
A dual-purpose test is a test of controls that is performed concurrently with a test of details on the same transaction. The purpose of a test of controls is to evaluate the operating effectiveness of a control, whereas the purpose of a test of details is to support relevant assertions or to detect material misstatements. A dual-purpose test should be designed to accomplish both objectives.
e.g. A senior auditor conducted a dual-purpose test on a client's invoice to determine whether the invoice was approved and to ascertain the amount and other terms of the invoice.
216
Substantive procedures are used to detect material misstatements and include tests of details (as applied to transaction classes, account balances, and disclosures) and substantive analytical procedures. A dual-purpose test is defined as a test of controls that is performed concurrently with a test of details on the same transaction.
A dual-purpose test is defined as a test of controls that is performed concurrently with a test of details on the same transaction.
217
If it would take less time or be more efficient to perform substantive tests than it would to perform tests of controls, and if there is no other reason to test controls (i.e., if there is not a high degree of electronic processing), the auditor would not be likely to test controls.
Substantive procedures are always be necessary for all assertions relevant to material transaction classes, account balances, and disclosures. Assuming inventory is material, tests of controls alone would not be sufficient.
218
Substantive auditing procedures are required in the financial statement audit, but not in the audit of internal control.
Tests of controls include such procedures as inspecting documentation, inquiry, observation, and reperformance. Note that inquiry alone is not sufficient as the auditor should use a combination of procedures.
219
Analytical procedures are used for planning purposes, as substantive tests, and as an overall final review, but they do not provide evidence about control risk.
Calculation is used as a substantive test rather than as a test of controls. Confirmation represents a substantive test rather than a test of controls.
220
"Substantive response" is not a term used in the audit literature. The terms used are "overall response," "response to risks at the relevant assertion level," and "response to significant risks." The auditor develops these responses to the assessed risks of material misstatement.
. A substantive procedure test the dollar amount of an account, balance, or disclosure. A test of controls is where the auditor tests controls that exist at the client. A combined approach refers to the auditor performing both a test of controls and a substantive procedure.
221
A management representation letter must be obtained in any audit, regardless of the level of risk of material misstatement.
The auditor most likely would perform tests of controls at period end because it provides greater assurance. Testing at interim is often performed when the risk of material misstatement is low.
222
Negative confirmations provide less assurance than positive confirmations. Negative Confirmations A confirmation in which a response is requested only if the amount stated is incorrect.
If the auditor determines that testing the operating effectiveness of controls would not be efficient, he or she may choose to use only substantive procedures to evaluate specific assertions and risks.
223
A dual-purpose test is a test of controls that is performed concurrently with a test of details on the same transaction. The purpose of a test of controls is to evaluate the operating effectiveness of a control, whereas the purpose of a test of details is to support relevant assertions or to detect material misstatements. A dual-purpose test should be designed to accomplish both objectives.
If it would take less time or be more efficient to perform substantive tests than it would to perform tests of controls, and if there is no other reason to test controls (i.e., if there is not a high degree of electronic processing), the auditor would not be likely to test controls.
224
In order to assess control risk at a low level, tests of controls would need to be performed. Assessing control risk may be performed concurrently during an audit with obtaining an understanding of the entity's system of internal control.
Substantive auditing procedures provide the audit evidence that an auditor needs in order to opine on the financial statements. Substantive procedures include substantive analytical procedures and tests of details. These types of procedures are performed in a financial statement audit but not in the audit of internal control.
225
Nonrecognized Subsequent Event A subsequent event that relates to conditions existing after the balance sheet date that generally requires footnote disclosure, but rarely requires an adjustment to the financial statements.
Nonsampling Risk All aspects of audit risk that are not due to sampling (e.g., selecting inappropriate audit procedures, failing to recognize a misstatement in documents examined, etc.).
226
Analytical procedures are used for planning purposes, as substantive tests, and as an overall final review, but they do not provide evidence about control risk.
Tests of controls include such procedures as inspecting documentation, inquiry, observation, and reperformance. Note that inquiry alone is not sufficient as the auditor should use a combination of procedures.
227
As part of understanding internal control, an auditor is not required to obtain knowledge about the operating effectiveness of controls. Operating effectiveness is evaluated later, and only for those controls on which the auditor plans to rely.
Tests of controls are required to support the auditor's assumption that controls are operating effectively. Obtaining an understanding of each of the five components of internal control is required before making an assessment of control risk. The entity's accounting system (part of the information and communication component) and control environment are part of the five components. Considering whether control activities can have a pervasive effect on financial statement assertions is part of the auditor's risk assessment process.
228
Test counts and cut-off procedures are effective substantive tests of inventory (existence assertion). Analytical procedures and invoice recomputation are substantive tests performed by the auditor to gather evidence regarding management's assertion of valuation of the inventory. Document inspection and reconciliation generally is not helpful in testing segregation of duties, since even appropriate segregation often does not provide documentary evidence.
CONTROL/OPERATING EFFECTIVENESS OF OPERATION - Reperformance of a control by the auditor is used to evaluate the effectiveness of the operation of that control. Inquiry, observation, inspection, recalculation, and reperformance are procedures used to test operating effectiveness of controls. SUBSTANTIVE PROCEDURES - Confirmation, verification, and analytical procedures are substantive procedures. Recalculation related to the BALANCE of accounts is a substantive procedure. Recalculation related to a CONTROL would help the auditor obtain evidence of the control's effectiveness.
229
Chatgpt: An integrated audit refers to an audit process that combines both financial audits and internal control audits into one comprehensive evaluation. It typically aims to assess not only the accuracy and fairness of a company's financial statements but also the effectiveness of its internal controls, risk management processes, and overall governance. For example, in the context of publicly traded companies in the U.S., integrated audits are often required under the Sarbanes-Oxley Act (SOX). This legislation mandates that auditors must evaluate and report on the effectiveness of a company’s internal control over financial reporting (ICFR) as part of the overall audit of its financial statements. In essence, an integrated audit provides a broader, more holistic view of an organization’s financial health and risk management practices, ensuring that the financial statements are accurate and that the controls in place are sufficient to prevent fraud or errors.
Analytical procedures do not provide evidence about the operating effectiveness of a control. However, analytical procedures may be used in the testing phase of the audit as a substantive procedure to provide evidence about the dollar balance of an account.
230
An auditor uses the knowledge provided by the understanding of internal control and the final assessed risk of material misstatement primarily to determine the nature, timing, and extent of the substantive tests to be performed.
Extent of Testing The degree to which an audit test is performed; a greater extent of testing is achieved by increasing sample size, performing testing at a more detailed level, or performing more extensive tests. External Evidence Information obtained from independent sources outside the enterprise, excluding those acting in the capacity of a management's specialist. Factual Misstatement Misstatements about which there is no doubt. Fair Presentation Accurate representation in the financial statements, within a range of acceptable limits, of a company's financial position, results of its operations, etc. Fair Presentation Framework A financial reporting framework that requires compliance with the requirements of the framework, acknowledges explicitly or implicitly that it may be necessary for management to provide disclosures beyond those specifically required by the framework in order to achieve fair presentation of the financial statements, and acknowledges explicitly that it may be necessary for management, in extremely rare circumstances, to depart from a requirement of the framework to achieve fair presentation of the financial statements. Fair Value The amount at which an asset could be bought or sold (or the amount at which a liability could be incurred or settled) in a current transaction between willing parties.
231
Natural umployment
Full employment
232
Stagflation
High unemployment, high inflation
233
A characteristic of nonstatistical sampling is it requires judgment to select a sample.
A characteristic of statistical sampling is it uses the laws of probability to select a sample. A characteristic of statistical sampling is each item in the sample has an equal probability of being selected.
234
Both statistical and nonstatistical sampling are acceptable methods for sampling in an audit. However, statistical sampling is sometimes preferred over nonstatistical sampling because it offers several advantages, such as it provides an objective basis for quantitatively evaluating sampling results.
Statistical sampling still requires judgment to determine sample sizes. The tolerable rate of deviation, the likely rate of deviation, and the allowable risk of assessing control risk too low are all determined by the auditor's professional judgment. Statistical sampling does not afford greater assurance than a nonstatistical sample of the same size. It only provides the auditor with a better measure of the sufficiency of the evidence found, and helps to evaluate the results found. A principal advantage of statistical methods of attribute sampling over nonstatistical methods is that they provide a scientific basis for planning the sample size.
235
The risk of incorrect acceptance is the risk that the sample supports the conclusion that the recorded account balance is not materially misstated when in fact it is materially misstated (i.e., sample results fail to identify an existing material misstatement).
In both statistical and nonstatistical sampling, the sample size is determined based on the sampling risk that the auditor is willing to accept based on their professional judgment.
236
The risk of assessing control risk too high is a sampling risk related to the efficiency of an audit.
The risk of incorrect acceptance is a sampling risk related to the effectiveness of an audit.
237
Inherent risk is not associated with the efficiency of an audit and is not a sampling risk. Inherent risk is the susceptibility of a relevant assertion to a material misstatement, assuming that there are no related controls.
Detection risk is not associated with the efficiency of an audit and is not a sampling risk. Detection risk is the risk that the auditor will not detect a material misstatement that exists in a relevant assertion.
238
Nonsampling risk includes all aspects of audit risk that are not due to sampling. It is always present and cannot be measured; the auditor can only attempt to reduce this risk to a very low level through adequate planning and supervision of the audit and quality control of all firm practices. Nonsampling risk can arise because an auditor failed to recognize misstatements in documents examined.
Analytical procedures -(Required at PLANNING AND REVIEW STAGE) are required during the planning and final review stages, but optional (yet common) during the substantive phase.
239
The auditor’s allowable risk of assessing control risk too low has an inverse relationship with sample size when planning a sample for a test of controls.
Preliminary judgments about materiality levels might be a consideration in planning an auditor’s sample for a substantive test, but not for a test of controls. The auditor’s desired level of detection risk might be a consideration in planning an auditor’s sample for a substantive test, but not for a test of controls.
240
In both statistical and nonstatistical sampling, the sample size is determined based on the sampling risk that the auditor is willing to accept based on their professional judgment.
Consumer price index measures rate of inflation.
241
Standards for audits of federal financial assistance recipients
Government Accountability Office. Governmental Auditing Standards (the Yellow Book)
242
The primary purpose of the consumer price index (CPI) is to compare relative price changes over time.
243
A decrease in govt spending is an example of fiscal, not monetary policy. Although this decrease would tighten the money supply for businesses and consumers, it would not necesssarily impact the int rates charged by banks.
244
CHATGPT: A disclaimer of opinion is an auditor's statement that they cannot express an opinion on the financial statements of a company. This typically happens when the auditor is unable to gather enough evidence to form an opinion, or when there are significant limitations in the scope of their audit. A disclaimer of opinion may be issued if: Scope limitation: The auditor is unable to obtain sufficient audit evidence (e.g., access to certain records or information is restricted). Uncertainty: There are significant uncertainties or issues that prevent the auditor from forming a clear opinion about the financial statements, like going concern issues. Inability to assess fairness: The auditor might not be able to assess whether the financial statements are presented fairly due to lack of adequate information.
245
Analytical procedures are evaluations of financial information made by a study of plausible relationships among both financial and nonfinancial data.
For example, the analytical procedure may consist of reviewing changes in account balances from the prior year to the current year using the unadjusted trial balance, and for others, it may be a more detailed analysis of a monthly or quarterly financial statement. Analytical procedures may be done using a variety of tools or techniques, including automated tools, such as a spreadsheet or a more sophisticated form of software used for performing audit data analytics.
246
The analytical procedures performed in planning assist in assessing the risk of material misstatement, including inherent risk factors, and determining the nature, extent, and timing of audit procedures that will be used to obtain audit evidence.
During planning, the auditor is specifically required to perform analytical procedures related to revenue in order to identify unusual or unexpected relationships that might indicate material misstatement, including material misstatement due to fraud. The auditor should also take into account analytical procedures performed during interim reviews (if performed).
247
Form 4 is a required form for principal owners to file with the SEC when they purchase or dispose of equity in an entity in which they own more than 10 percent of the voting interests.
248
ANALYTICAL PROCEDURES
High level review with an intention of inspection e.g. auditors scanned the repairs account to find unusually large amounts.
249
Authorization transactions - TEST OF CONTROLS
$$ amount = SUbstantive procedure
250
An investment held through a DEFINED BENEFIT PLAN for which CPA is not a trustee is an _______
INDIRECT FINANCIAL INTEREST
251
Kiting occurs when a check drawn on one bank is deposited in another bank and no record is made of the disbursement in the balance of the first bank. Frequent kiting may result in a high level of deposits coupled with a low average balance. Kiting A scheme whereby a check drawn on one bank is deposited in another bank, but the disbursement is not recorded on a timely basis, resulting in an overstatement of cash.
Lapping A scheme whereby a current receipt of cash (or a check) is stolen. To prevent detection, a subsequent receipt is applied to the previously unrecorded customer account. A lockbox system is the best means of preventing defalcation of cash by employees because the employees never have direct access to cash receipts.Lock Box-A system in which customers send their payments directly to the bank, preventing access by company employees. The use of prenumbered remittance advices is not effective in preventing theft of receipts by employees because it does not prevent employee access to cash receipts. While the performance of monthly bank reconciliations is a good control, it would not be effective in preventing the theft of receipts because it does not prevent employee access to cash receipts. (It might, however, be effective at detecting a theft that has already occurred). Daily deposit of cash receipts is not an effective control for preventing theft of receipts by employees because it does not prevent employee access to cash receipts. Logical Control A control that addresses the authorization for access to computer programs and data files.
252
Judgmental Misstatements Differences that arise from the judgments of management concerning accounting estimates that the auditor considers unreasonable, or the selection and application of accounting policies that the auditor considers inappropriate.
Lead Auditor The accounting firm that bears responsibility for issuing the auditor’s report. The lead auditor supervises the work of other auditors involved in the audit of an issuer and determines whether to divide responsibility. Letter of Audit Inquiry A direct letter sent to the client's attorney detailing any pending or threatened litigation matters and requesting the attorney to provide his or her evaluation directly to the independent auditor. Limited Use Report A report that is intended only for specified parties.
253
Sending a confirmation to a bank will result in external evidence from an independent source. This is the most reliable form of evidence.
IT Auditor Someone possessing specialized knowledge in information technology (IT) participating in the audit. Hypothetical Transaction A transaction not involving the facts or circumstances of a specific entity.
254
According to the Contingent Fee Rule, contingent fees are permitted when they involve a legal proceeding or ruling. When a CPA is receiving a contingent fee for a private letter ruling, it would be allowed under the Contingent Fee Rule and not be considered "contingent" because it would most likely be fixed by the legal jurisdiction. Contingent Fee A fee established for performing services when no fee is charged unless a specific finding or result is obtained, or the fee amount is dependent upon the finding or result obtained.
PROHIBITED Contingent fee Contingent fees are prohibited for audits of a client's financial statements. Contingent fees are not allowed for a review engagement of a client's financial statements. Contingent fees are prohibited for an examination of a prospective client's financial information.
255
SSARS apply when an accountant prepares, compiles, or reviews financial statements. Using information in the general ledger to prepare financial statements outside an accounting software system is considered a preparation engagement. Typing or reproducing client-prepared financial statements, without modification, as an accommodation to a client does not constitute preparation of financial statements because the accountant has not prepared those statements. Providing a client with a financial statement format does not constitute preparation of financial statements and, therefore, this does not fall within the guidelines of SSARS. Proposing correcting journal entries does not constitute preparation of financial statements. Even entering general ledger transactions or processing payments (general bookkeeping) in an accounting system does not constitute a preparation engagement because it is considered merely "assisting " in preparing the financial statements (bookkeeping service.)
Statements on Standards for Accounting and Review Services (SSARS) are applicable for a compilation of a nonissuer. Statements on Auditing Standards (SAS) apply to audit engagements for nonissuers. Statements on Standards for Attestation Engagements (SSAE) provide guidance for attestation engagements for issuers and nonissuers. Generally accepted auditing standards (GAAS) apply to audit engagements for issuers and nonissuers. (SAS provide guidance on GAAS for auditors of nonissuers and the PCAOB provides guidance on GAAS for issuers.)
256
When an accountant performs more than one level of service (for example, a compilation and a review, or a compilation and an audit) concerning the financial statements of a nonissuer, the accountant generally should issue the report that is appropriate for the highest level of service rendered.
A compilation of financial statements in accordance with Statements on Standards for Accounting and Review Services (SSARS) presents information that is the representation of management in the form of financial statements. A compilation does not provide assurance on the financial statements. A compilation of financial statements is not limited to presenting accounting data that conforms to a special purpose framework. A compilation of financial statements may present accounting data that conforms to frameworks other than special purpose frameworks, such as GAAP. A compilation of financial statements is not limited to presenting unaudited financial statements that omit substantially all required GAAP disclosures. Compilation of financial statements also includes compiling financial statements that present all required GAAP disclosures. A compilation of financial statements is not limited to presenting supplementary information that has been subjected to inquiry and analytical procedures. Supplementary information may or may not be subjected to compilation procedures, and compilation engagements do not require analytical procedures.
257
SSARS requires compiled financial statements to be accompanied by a compilation report. SSARS requires compiled financial statements to be accompanied by a compilation report. Note that an accountant who lacks independence is still permitted to compile financial statements of a nonissuer entity as long as lack of independence is disclosed. SSARS requires compiled financial statements to be accompanied by a compilation report even if the financial statements are not expected to be used by a third party. SSARS requires compiled financial statements to be accompanied by a compilation report. Compiled financial statements may be prepared using a framework other than GAAP, such as a special purpose framework or IFRS.
SSARS applies to the preparation of financial statements that are presented "alongside" the entity's tax return. Note: SSARS would not apply if the preparation of the financial statements with the tax return were solely for submission to taxing authorities.
258
Statements on Standards for Accounting and Review Services (SSARS) establish standards and procedures for an engagement to compile an individual's personal financial statements to be used to obtain a mortgage. Choice "A" is incorrect. Proposing adjustments to the books of account for a partnership is an engagement that does not pertain to SSARS, as it falls short of preparing financial statements. Choice "B" is incorrect. Reviewing interim financial data required to be filed with the SEC is covered under PCAOB standards. Choice "C" is incorrect. Preparing standard monthly journal entries is not covered by SSARS, as it falls short of preparing financial statements.
The accounting and review services committee is the authoritative body designated to promulgate standards concerning an accountant's association with unaudited financial statements of a nonissuer (i.e., an entity that is not required to file financial statements with an agency regulating the issuance of the entity's securities). Choice "A" is incorrect. The Financial Accounting Standards Board (FASB) is responsible for GAAP standards. Choice "B" is incorrect. The General Accounting Office (GAO) is responsible for audit standards under the federal "Single Audit Act." Choice "D" is incorrect. The Auditing Standards Board (ASB) is responsible for auditing standards under GAAS.
259
An accountant should be able to justify departures from SSARS. Choice "B" is incorrect. An accountant may occasionally depart from SSARS guidelines, but should be prepared to justify such departures. Choice "C" is incorrect. While it is true that an accountant should exercise professional judgment in applying SSARS, it is not true that SSARS are considered recommendations. SSARS are professional standards, which the accountant should generally follow. Choice "D" is incorrect. Statements on Auditing Standards do not apply to compilations or reviews of the financial statements of a nonissuer.
Continuing Accountant An accountant with whom the client has an ongoing relationship, as opposed to an accountant hired only to report on the application of accounting principles. Control A policy or procedure that an entity establishes to achieve control objectives. Control Deficiency A weakness that exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. Control Environment The tone of an organization, including management attitude, participation of those charged with governance, organizational structure, and human resource policies. Control Risk The risk that a material misstatement that could occur in an assertion will not be prevented or detected on a timely basis by the entity's system of internal control. Control Risk of Noncompliance The risk that noncompliance with a compliance requirement that could be material will not be prevented or detected on a timely basis by an entity's system of internal control. Controlled Processing - ACTUAL PROCESSING RUN A form of parallel simulation in which the auditor observes an actual processing run and compares the actual results to the expected results based on the auditor's own program. Controlled Reprocessing - ARCHIVED COPY A form of parallel simulation in which the auditor uses an archived copy of the program in question (generally the auditor's control copy) to reprocess transactions. The results are then compared with the results from the normal processing run. Corroborating Evidence Support that gives validity to recorded accounting data. Credit Memo = AR An internal document used to indicate a credit to a particular account, typically accounts receivable. Parallel Simulation (Reperformance Test) A technique by which the auditor reprocesses some or all of the client's live data (using the auditor's own software) and then compares the results with the client's files.
260
PREPARATION - Non Attest engagement
COMPILATION, REVIEW and AUDIT - Attest engagements
261
Negative confirmations are used when the combined assessed level of inherent and control risk is low, a large number of small balances is involved, and the auditor has no reason to believe that the recipients of the requests are unlikely to give them consideration.
Negative confirmation of accounts receivable is less effective than positive confirmation of accounts receivable because the auditor cannot infer that all nonrespondents have verified their account information. Negative confirmations returned do produce information (e.g., errors noted in accounts) that can be statistically quantifiable.
262
The negative request form of accounts receivable confirmation is useful particularly when: The assessed level of control risk relating to receivables is low (if control risk is high, then positive confirmation requests would probably be sent), There are many small balances (which would make it difficult to keep the number of positive confirmations to a reasonably low level), and Consideration of the confirmation by the recipient is likely (since the auditor is relying on the customers' consideration as the sole basis of support for the confirmation).
When there are unreturned positive confirmations of accounts receivable, the auditor would first respond by sending second confirmation requests.
263
. In a computerized accounting environment, audit trails generally exist for only a short time. Choice "C" is incorrect. The management representation letter should be signed and dated on the date of the auditor's report. Choice "D" is incorrect. Consultation with other accountants would not cause an auditor to believe material misstatements have occurred.
he auditor would only increase detection risk in response to a decrease in inherent and/or control risks, which is not the case here. Additionally, confirmation relates to the existence assertion, not the valuation assertion.
264
CHATGPT 1. Substantive Procedures Substantive procedures are designed to detect material misstatements in the financial statements, whether due to fraud or error. These procedures focus on the accuracy, completeness, and validity of financial statement information. Purpose: To provide evidence on the financial statement assertions (existence, completeness, valuation, rights and obligations, and presentation). Examples: Tests of details (e.g., verifying individual transactions or balances like inspecting invoices, confirmations with customers, or verifying physical assets). Substantive analytical procedures (e.g., comparing current financial data to historical trends or industry averages to identify discrepancies). 2. Tests of Control Tests of control are designed to evaluate the effectiveness of an entity's internal controls in preventing, detecting, or correcting misstatements. They help auditors assess whether the internal control systems in place are operating as intended. Purpose: To gather evidence on the operating effectiveness of the controls. Examples: Observing the application of a control (e.g., watching a company employee perform a control activity). Reperformance (e.g., the auditor independently performing the control to verify it works as designed). Inspection of documentation (e.g., reviewing signed authorization forms for transactions to check whether controls are being followed).
Purchase orders should be issued by the purchasing department, not the accounts payable department. Internal control is enhanced if check mailing is performed by the treasury (cash disbursements) department. Mailing disbursement checks and remittance advices should be controlled by the employee who signs the check last. This employee is generally in the treasury department. Approving the vouchers for payment and matching the receiving report, purchase orders, and vendor's invoices are functions of the vouchers payable department. When a mechanical check-signing device is used, there is generally dual control. One person maintains possession of the device itself, and the other controls the signature plates. The person with possession of the device would not mail disbursement checks, since mailing should be done by the last check signer.
265
The authority to accept incoming goods in receiving should be based upon an approved purchase order. A vendor's invoice does not serve as an authority to accept incoming goods since it is generated by the vendor, not a responsible employee in the purchasing department. A materials requisition, which is prepared by the ultimate user of the goods, does not serve as an authority to accept incoming goods since it has not been approved by the purchasing department. A bill of lading does not serve as an authority to accept incoming goods since it is generated by the carrier, not a responsible employee in the purchasing department.
The purchasing department is responsible for preparing the purchase order, the accounts payable department is responsible for matching documents, and the treasurer is responsible for making payment. Once signed, the check should be mailed to the payee by the check signer or an employee operating under the supervision of the check signer to prevent defalcations of checks. Generally this occurs in the treasurer's department. The check signer should have access to supporting documentation so that it can be reviewed before the check is signed. Under an effective system of internal control, the accounts payable clerk should ensure that supporting documents (invoice, receiving report, and purchase order) are in agreement before the voucher is submitted for payment.. By stamping the voucher "paid," the check signer cancels the voucher so it cannot be resubmitted for payment.
266
When nonconforming goods are returned to a vendor, the purchasing department should send a debit memo to the accounting department to ensure that the accounts payable balance is reduced appropriately. Choice "A" is incorrect. The unpaid voucher is sent from the accounts payable department to the treasurer's department for payment when conforming goods are received. Choice "C" is incorrect. The vendor invoice is sent to the accounting department when conforming goods are received. Choice "D" is incorrect. A credit memo is generally used to reduce accounts receivable, not accounts payable.
In a well designed internal control, employees in the purchasing department most likely would approve purchase orders and also negotiate terms with vendors. Personnel in the accounts payable department reconcile the open invoice file while the purchasing agent approves purchase orders. Employees in the receiving department inspect goods upon receipt while the purchasing agent approves purchase orders. The stores department (personnel in the raw materials inventory area) authorize requisition of goods while the purchasing agent approves purchase orders.
267
Agreed-Upon Procedures An attestation engagement in which a practitioner performs specific procedures on underlying subject matter or subject matter information and reports the findings without providing an opinion or conclusion.
Allowance for Sampling Risk In sampling, a "cushion" for protection against undetected deviations that is added to the sample deviation rate to arrive at the upper deviation rate.
268
Analytical Procedures Evaluations of financial information made by a study of plausible relationships among both financial and nonfinancial data.
Analytical Procedures Evaluations of financial information made by a study of plausible relationships among both financial and nonfinancial data.
269
Assumption of Responsibility A situation in which the group engagement partner decides to assume responsibility for the work performed by a component auditor, and therefore does not refer to the component auditor in the auditor's report. Attestation Risk In an examination or review attest engagement, attestation risk is the risk that the practitioner expresses an inappropriate opinion or conclusion, respectively, when the subject matter information or assertion is materially misstated.
Attest Engagements An engagement in which a practitioner is engaged to issue or does issue an examination, a review, or an agreed-upon procedures report on subject matter, or on an assertion about the subject matter, that is the responsibility of another party.
270
Choice "C" is correct. Analytical review is generally used to ascertain the reasonableness of investment income in relationship to the amount invested. Choice "A" is incorrect. Valuation would be verified using listed prices (NYSE, etc.). Choice "B" is incorrect. Classification of gains or losses would be evaluated based upon appropriate accounting principles. Choice "D" is incorrect. Existence and ownership is generally evaluated by inspection of securities, review of brokerage statements, or confirmation with an outside independent custodian.
The standard AICPA bank confirmation form includes spaces for the bank to confirm both cash balances on deposit at the bank and collateral pledged on loans originating from the bank. Choice "A" is incorrect. Purchase commitments are not typically confirmed on an accounts payable confirmation request. Choice "C" is incorrect. Contingent liabilities (confirmed in a letter of inquiry to the client's attorney or bank) and inventory on consignment (confirmed with the consignee) are not confirmed together. Choice "D" is incorrect. Accrued interest receivable (usually on investments held by a trust company) is not typically confirmed along with trade accounts receivable.
271
The standard confirmation request seeks information on contingent liabilities and security agreements in addition to information related to deposit account balances. Choice "A" is incorrect. The standard confirmation request does not provide all of the data necessary to prepare a "proof of cash" (i.e., bank reconciliation), since it only confirms the balances at the end of a period, and does not provided information about the activity during the period under audit. Such information is necessary to perform a bank reconciliation and would be provided in a bank statement. Choice "B" is incorrect. A request for a cut-off statement, and not the standard bank confirmation form, is used to obtain a cut-off bank statement and related checks. Choice "C" is incorrect. The bank cut-off statement, not the standard confirmation request, is used to detect kiting activities that may not otherwise be discovered.
The SEC has strongly recommended that companies establish audit committees, but does not require this action-NOT MANDATORY by SEC. Choice “A” is incorrect. The use of an audit committee does strengthen the public’s sense of the independence of the external auditor. Choice “B” is incorrect. Large accounting firms strongly support the function of an audit committee. Choice “D” is incorrect. The New York Stock Exchange requires listed companies to have audit committees.
272
Choice "A" is correct. The audit committee is considered a subgroup ordinarily charged with assisting the board of directors in fulfilling its oversight responsibilities. Choice "B" is incorrect. Secured creditors are lenders to the entity that hold a legally enforceable claim on the entity's assets. Secured creditors are not responsible for assisting the board of directors in their oversight duties, nor are they a subgroup of the board of directors. Choice "C" is incorrect. Internal auditors are not a subgroup of the board of directors. The internal audit function may report to the audit committee or the board of the directors, but they are not a subgroup of the board of directors. Choice "D" is incorrect. Senior management assists the board of directors with the day to day activities of the business. Senior management reports to the board of directors but is not considered a subgroup of the board of directors.
Same CPA firm that audits financials will take care of your assessment of internal control. due to cost benefit analysis
273
INTEGRATED AUDIT Includes: 1. AUDIT of FS 2. AUDIT of MGT ASSESSMENT/ASSERTION on the EFFECTIVENESS of IC over Financial Reporting or Audit over ICFR
Internal control - main role is to detect, prevent and correct errors/frauds. Internal Monitoring is for MONITORING that internal controls are present and are functioning effectively.
274
The identification of fraud, even if immaterial, by a member of senior management is indicative of a material weakness.
A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented or detected/corrected.
275
An auditor is required to communicate significant deficiencies and material weaknesses in writing to management and to those charged with governance within 60 days of the report release date.
For nonissuers, if an auditor has communicated other deficiencies in a prior period and management has chosen not to correct the deficiencies for cost or other reasons, the auditor need not repeat the communication in the current period.
276
All material weaknesses are significant deficiencies.
The auditor should separately identify those significant deficiencies that are considered to be material weaknesses.
277
The auditor is not required to search for significant deficiencies (but any that are identified should be reported).
The auditor should not indicate to management that no significant deficiencies were noted during the audit, as this might cause misinterpretation of the auditor's responsibility in such cases.
278
In an audit of a nonissuer, the auditor is required to communicate both significant deficiencies and material weaknesses to management and those charged with governance.
Communication of a significant deficiency and material weakness (even though corrected during the audit) is required to be reported in writing to management and those charged with governance by the report release date, with a window extending 60 days beyond the report date being acceptable. Earlier communication is also acceptable and is not required to be in writing; however, this does not negate the requirement for eventual written communication of all significant deficiencies and material weaknesses.
279
The auditor need not search for significant deficiencies in internal control, but should document and communicate any such deficiencies that are discovered.
Tests of controls are designed and applied to evaluate the risk of financial statement misstatement, and to determine the nature, timing, and extent of substantive tests to be performed. They are not designed to discover significant deficiencies in internal control.
280
The Statements on Auditing Standards (SASs) is the appropriate authoritative literature for both an audit of internal control and a financial statement audit of a nonissuer.
UNAUDITED - The Statements on Standards for Accounting and Review Services (SSARSs) is the appropriate authoritative literature for unaudited financial statements or information of a nonissuer. ATTESTATION Engagements - The Statements on Standards for Attestation Engagements (SSAEs) is the appropriate authoritative literature for attestation engagements.
281
The auditor provides an opinion on the entity's financial statements and on the effectiveness of internal control. The auditor is not required to provide an opinion on the audit committee's oversight (but is required to report to the board when such oversight is ineffective).
PCAOB Standards require Jackson to perform an integrated audit, which includes audits of both the financial statements and the effectiveness of internal control. PCAOB Standards require the same auditor to perform the audit of the financial statements and the audit on the effectiveness of internal control. An audit of internal control is required, regardless of the type of opinion rendered on the financial statements.
282
Under the Sarbanes-Oxley Act, the chief executive officer is required to certify (or sign off) on all the other items, but is not required to certify the financial expertise of the audit committee. The expected financial expertise of the audit committee is typically verified by the entity's board.
Periodic comparison of actual assets with amounts shown in the accounting records is a control activity related to the existence of specific assets. It is not an entity-level control. Risk assessment process controls, biannual distribution of the code of conduct, and period-end financial reporting controls are considered entity-level controls, as they have a pervasive effect on a company’s internal control.
283
Entity-level controls include controls related to the control environment and period-end financial reporting. Depending on the specific control, the control could be classified as either preventive or detective.
The "top-down approach" used during an audit of internal control over financial reporting begins by understanding the overall risks to internal control over financial reporting at the financial statement level.
284
Performing walkthroughs are frequently the most effective way of understanding sources of potential misstatements. A walkthrough involves following a transaction from origination through the entity's processes, including information systems, until it is reflected in the entity's financial records, using the same documents and IT that entity personnel use.
An entity-level control exists independently of the audit. Controls over the completeness of deposited cash relates to controls at the account level and NOT ENTITY Level. The evaluation of risk factors is the same for both an audit of the financial statements and an audit of internal control. Confirmation is an audit procedure that is performed during substantive procedures. Operating effectiveness of controls can be tested through inspection, reperformance, or recalculation. OPERATING EFFECTIVENESS = INSPECTION, REPERFORMANCE OR RECALCULATION DESIGN EFFECTIVENESS = Recalculation is NOT Included.
285
It is unlikely that the reliability of the financial statements would be increased if an audit on internal control is performed; however, the audit might be more efficient due to the integration of the two audits. Controls related to shipping most likely relate to the revenue cycle.
In a financial statement audit, communication of significant deficiencies must be made within 60 days of the report release date, whereas in an audit of internal control, the communication must be made by the report release date. An auditor’s consideration of internal control in a financial statement audit is more limited than that of an auditor engaged to examine the effectiveness of internal control. An opinion on financial statements is over a period of time, and an opinion of internal control is at a point in time. In a financial statement audit, communication of significant deficiencies should include restricted use language, whereas in an audit of internal control, no restriction on the use of the report is required.
286
Combined report on FS and ICFR (ISSUER) HEADINGS 1. Opinion 2. Basis for Opinion 3. Definitions and Limitations 4. CAMs (Critical Audit Matters)
287
NON-ISSUER - it's upto non-issuer if it wants to file separate or combined report (SEPARATE REPORT Sections) HEADINGS 1. Opinion on internal control over financial reporting 2. Basis for opinion 3. Responsibilities of managements for ICFR 4. Auditor's responsibilities for the audit of ICFR 5. Definition and inherent limitation of ICFR 6. Report on other legal and regulatroy requirements 7. Report on audits of ICFR
NON-ISSUER - COMBINED report on ICFR (Nonissuer) 1. Opinions on the FS and ICFR 2. Basis for opinion 3. MGT Responsibilities for the FS and ICFR 4. Auditor's responsibilities for the audits of the FS and ICFR 5. Definition and inherent limitations of ICFR 6. Report on other legal and regulatory requirements 7. Report on audit of ICFFR 8. Basis for adverse opinion on ICFR (if applicable)
288
Separate report ISSUER -Sign -*Different than Non-issuer report We have served as the company's auditor since (year) -City and state or country -Date
289
Scope Limitation - The auditor should withdraw from the engagement or issue a disclaimer of opinion if the scope of the audit is restricted.
In a DISCLAIMER of opinion, the auditor should (a) modify the first sentence of the introductory paragraph slightly (we were engaged to audit) and omit the last sentence. (b) Omit the scope paragaph (ISSUER) or amend the auditor's responsibility paragraph (nonissuer) to state: OUR responsibility is to conduct an audit of ABC company's ICFR in accordance with GAAS. However, because of the matter described in the basis for DISCLAIMER OF OPINION on ICFR section, we were not able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion. Separate paragraph for reason of disclaimer
290
COMPONENT AUDITOR = Other Auditor The group engagement partner = Principal auditor
The auditor is required to communicate all deficiencies in internal control to management, and deficiencies that constitute a significant deficiency or a material weakness to management and the audit committee. Identification of a material weakness results in an adverse opinion. Restrictions on the scope of the engagement may result in a disclaimer of opinion or withdrawal from the engagement.
291
A scope limitation requires the auditor to disclaim an opinion or withdraw from the engagement, and a material weakness in internal control requires the auditor to issue an adverse opinion. Neither situation would result in a qualified opinion.
DIRECT FINANCIAL INTERESTS, even if Immaterial ALWAYS IMPAIR INDEPENDENCE INDEPENDENCE IS NOT REQUIRED FOR COMPILATIONS AND CONSULTING engagements
292
Depression- A very severe recession, characterized by a relatively long period of stagnation in business activity and high unemployment rates. Deviation Rate- In sampling, the error rate found in a sample, used to estimate the overall error rate in the population. Difference Estimation A sampling plan that uses the average difference between the audited (correct) values of items and their book values to project the actual population value. Direct Controls-Controls that are precise enough to address the risk of material misstatement at the assertion level. Direct Examination-An attestation engagement in which the practitioner obtains reasonable assurance by measuring or evaluating the underlying subject matter against the criteria and performing other procedures to obtain evidence to express an opinion that conveys the results of the measurement or evaluation. No assertion is provided by the responsible party. Directional Testing-Following an audit trail either forward (from source documents to financial records) or backward (from financial records to source documents). Discovery Sampling-A special type of attribute sampling appropriate when the auditor believes that the population deviation rate is zero or near zero.
Detection Risk The risk that an auditor will not detect a material misstatement that exists in a relevant assertion. Detection Risk of Noncompliance-The risk that the auditor will not detect material noncompliance that exists. Documentation Completion Date- The end of the period during which the auditor assembles the final audit documentation file. After this date, existing documentation must not be deleted, and additions to the workpapers must be documented as such. Auditing standards define this date as 60 days following the report release date; PCAOB standards define it as 14 days following the report release date. Dual Purpose Test An audit procedure in which the auditor uses the same transaction as both a test of controls and a substantive test.
293
Emphasis-of-Matter Paragraph A paragraph included in the auditor's report when required by GAAS or at the auditor's discretion when referring to a matter that is appropriately presented or disclosed in the financial statements and is of such importance that it is fundamental to the users' understanding of the financial statements. Emphasis-of-matter paragraphs are used by nonissuers only.
294
CHATGPT : TEST OF CONTROLS Key Points about Tests of Controls: Purpose: To verify the operation of internal controls: Tests of controls help auditors determine whether the internal control systems are functioning properly. To assess risk: The results of these tests are used to assess the risk of material misstatement in the financial statements. If the controls are operating effectively, the auditor may reduce the extent of other audit procedures. To decide the nature, timing, and extent of substantive procedures: If controls are deemed effective, the auditor may perform fewer substantive procedures. If they are ineffective, the auditor will need to perform more extensive substantive testing. Types of Tests of Controls: Inquiry: Asking employees about how the control works or what procedures are followed. Inspection: Examining documents or records to check if the control procedure was followed (e.g., checking approval signatures). Observation: Watching employees in action to see if they are adhering to the control processes (e.g., observing the process of cash handling). Reperformance: Repeating a control activity to see if it works as intended (e.g., recalculating a transaction to verify accuracy). Examples: Segregation of Duties: Verifying that no individual has control over both the recording and processing of transactions (e.g., someone who authorizes payments shouldn't also be the one who makes the payment). Authorization Controls: Ensuring that transactions are authorized by the appropriate person before they are processed. IT Controls: Testing whether access to financial data is restricted and if backups are performed regularly. When Are Tests of Controls Performed? These tests are primarily performed when the auditor is relying on the effectiveness of internal controls to reduce substantive testing. If the auditor finds that internal controls are weak or ineffective, they might expand the scope of substantive testing. Why Are They Important? Efficiency: If controls are strong, auditors can reduce the number of substantive procedures, saving time and resources. Assurance: Testing controls gives assurance to the auditor that the company’s internal processes are reducing the risk of errors or fraud in financial reporting. Would you like to dive deeper into any specific tests or examples? You said: e.g. of test of controls ChatGPT said: Here are some practical examples of tests of controls that an auditor might perform when evaluating an organization’s internal control systems: 1. Segregation of Duties (SOD) Test: The auditor may test if the duties of authorizing transactions, recording transactions, and handling assets are segregated among different employees to prevent fraud or error. Example: Checking whether the same employee is responsible for both approving purchase orders and making payments. If this is the case, the auditor would likely flag it as a control weakness. Procedure: The auditor could examine the company's organizational structure, review employee roles and responsibilities, and ensure no employee has overlapping duties that would allow them to bypass controls. 2. Authorization of Transactions Test: The auditor will check whether proper authorization procedures are followed for significant transactions. Example: Testing whether purchase orders over a certain amount are approved by a manager. Procedure: The auditor might sample a few transactions and verify that each one has an authorized signature or approval before processing. If the transaction lacks approval, the auditor will note the weakness in the control. 3. Access Controls (IT Systems) Test: Evaluate whether the company’s IT system controls restrict access to financial data based on user roles. Example: Ensuring that only certain individuals (e.g., accountants or auditors) can access the general ledger or make journal entries. Procedure: The auditor might request access logs or review the permissions assigned to users within the company’s financial software to verify that access is restricted to authorized individuals. 4. Reconciliations (Bank & Account Reconciliations) Test: The auditor tests whether reconciliations are performed regularly to ensure that records match between two or more accounts, such as the bank and cash account. Example: Verifying whether the bank account balance reconciles to the cash book balance and if the reconciliation was reviewed and signed off by an appropriate person. Procedure: The auditor would review several months of bank reconciliations, verify that the reconciliations are complete, and confirm that an appropriate supervisor has reviewed and signed off on the reconciliations. 5. Physical Controls over Assets (e.g., Inventory) Test: Ensure that physical controls are in place to safeguard assets like inventory, cash, or equipment from theft or misappropriation. Example: Verifying that a company performs regular inventory counts, and that the inventory is physically secured (e.g., locked storage rooms, access-controlled areas). Procedure: The auditor may observe a physical count of inventory or inspect security procedures (e.g., cameras, authorized access logs) to ensure inventory is adequately safeguarded. 6. Document Retention and Control Test: Verify that there are proper controls for retaining and managing documents, especially those related to financial transactions. Example: Testing whether the company keeps copies of all invoices, contracts, or sales orders for a required number of years (e.g., 7 years in some jurisdictions). Procedure: The auditor might inspect document storage systems (both physical and electronic) to ensure that they are properly maintained and accessible. 7. Cash Receipts and Disbursements Test: Verify that controls over cash receipts and disbursements are effective to prevent errors or fraud. Example: Checking if cash receipts are recorded promptly and if cash disbursements require dual signatures for amounts over a certain threshold. Procedure: The auditor could examine the company’s process for receiving payments, ensuring that they are recorded promptly and that there is no one employee responsible for handling cash receipts and disbursements alone. 8. Approval of Journal Entries Test: Verify whether all manual journal entries are reviewed and authorized by an appropriate person to ensure that they are legitimate and accurate. Example: Ensuring that all significant journal entries (e.g., adjusting entries or end-of-month entries) are approved by the accounting manager before they are posted. Procedure: The auditor might review a sample of journal entries and verify that the entries have been reviewed and signed off by management. 9. IT System Backups Test: Check whether the organization regularly backs up its financial data to ensure business continuity in the event of data loss. Example: Testing whether the company performs daily backups of its financial systems and stores them securely offsite. Procedure: The auditor could request documentation of the company’s backup procedures, inspect logs for recent backups, and verify that the backups are completed successfully. 10. Independent Reviews and Monitoring Test: Verify that the company conducts periodic independent reviews or internal audits of its financial processes to ensure controls are working effectively. Example: Checking whether the internal audit team regularly reviews internal control systems, financial reporting processes, and risk management activities. Procedure: The auditor may review the findings from prior internal audits and confirm whether any identified weaknesses have been addressed by management. 11. IT Change Management Test: Evaluate whether there are controls in place to review and approve changes to the financial systems or software. Example: Verifying that updates to financial software or changes to system configurations are reviewed and approved by authorized personnel before implementation. Procedure: The auditor might review change management documentation to confirm that changes were properly authorized and tested for potential issues before being deployed.
AICPA uses management ASSESSMENT PCAOB uses management ASSERTION DESIGN EFFECTIVENESS - e.g. Walkthroughs which include inquiry, observation and inspection of documentation OPERATING EFFECTIVENESS - tested through inquiry, inspection of documentation, observation, recalculation and reperformance.
295
In a financial statement audit, the communication of significant deficiencies and material weaknesses must be made within 60 days of the report release date, whereas in an audit of ICFR, the communication must be made by the report release date. In a financial statement audit, the communication of significant deficiencies and material weaknesses should include restricted-use language, but in an audit of ICFR, no restriction on the use of the report is required.
MIstatement rate is generally lower than pertinent deviation rate.
296
SAARS - Compilations - SAARS do not require that the compilation report be printed on the accountant's letterhead. -No assurance -Independence is not required but lack of indepedence must be disclosed -No title -Material departures from GAAP-CANNOT issue ADVERSE opinion because you didn't AUDIT, you WITHDRAW from the engagement as an AUDITOR -YOU CANNOT DO COMPILATIONS for an ISSUER or PUBLIC company, it's NOT ALLOWED. It can only be done for a NON-ISSUER. -
297
Internal auditors are allowed to TEST CONTROLS and perform tests of INTERNAL CONTROLS but not audit a major subsidiary or NOT TO BE INVOLVED WITH ANY TESTS OF DETAILS (unless external auditor is overseeing or involved). Coz these are high risk areas or will impact FS significantly.
2 members must be CPA - Sarbanes-Oxley act
298
DOL (U.S. Dept of Labor) has established guidelines for determining when a qualified public accountant is independent for the purpose of rendering an opinion on an employee benefit plan under the EMPLOYEE RETIREMENT INCOME SECURITY ACT OF 1974 (ERISA). Independence required: Auditor independnce is required when auditing and rendering an opinion on the financial information required to be submitted to the Employee Benefits Security Administration of the DOL.
Impairment of Independence 1. Any direct financial interest or a material indirect financial int in the plan or the plan sponsor 2. An interest was held during the period of the engagement, at the date of the opinion or during the period covered by the FS 3. An accountant or a member of the accounting firm maintaining financial records for the employee benefit plan. 4. Connection to the plan or the plan sponsor as a promoter, underwriter, investment advisor, voting trustee, director, officer or employee.
299
consistency modifications in the auditor’s report — specifically when there's a lack of consistency in the financial statements due to changes in accounting principles (like a switch in GAAP methods).
OCBOA or Special Purpose Frameworks - Cash basis, tax basis, regulatory basis, contractual basis.
300
Non-issuer Emphasis of matter paragraph and Other matters paragraph
ISSUER Explanatory paragraph The explanatory paragraph generally should include an appropriate title and should describe the matter being emphasized and the location of relevant disclosures about the matter in the financial statements.  The explanatory paragraph will generally follow the opinion paragraph when added to an unqualified report.
301
REVIEWS provide LIMITED ASSURANCE COMPILATION - NO ASSURANCE
Financial projection - Prospective financial statement-requires a PARA stating RESTRICTS the USE AND DISTRIBUTION OF THE REPORT. Projection - Statements on Stds for ACCOUNTING AND REVIEW SERVICES
302
Precision Interval- In sampling, an allowance for sampling risk that is added to a point estimate to provide a range within which the true population value is expected to fall. Preconditions for an Audit Requirements that must be met before an audit can be accepted, including determining that the financial reporting framework used by the client is acceptable and obtaining an agreement from management that it acknowledges and understands certain responsibilities. Presentation and Disclosure One of three categories of financial statement assertions, relating primarily to disclosure in the financial statements. Pro Forma Financial Statements Financial statements used to demonstrate the effect of a proposed transaction or event by showing how it might have affected the historical financial statements, if it had occurred during the period covered by those statements. Purchase Requisition A document or form generated by a user group, requesting goods or services; serves as a request for the purchasing department to prepare a purchase order. Random Sample A sample selected in such a way that every item in the population has an equal chance of being included in the sample. Ratio Estimation A sampling plan that uses the ratio of the audited (correct) values of items to their book values, to project the true population value.
Probability-Proportional-to-Size (PPS) Sampling- A sampling technique in which the sampling unit is defined as an individual dollar in a population. Once a dollar is selected, the entire account (containing that dollar) is audited. Program-Specific Audit A governmental audit used in situations when no overall opinion is rendered on the financial statements. A program-specific audit must follow specialized rules designed for the particular type of program involved. Projected Misstatement In sampling, an estimate of the total error in a population, determined by finding the error in a sample and adding an adjustment for sampling risk. Prospective Financial Statements Financial statements that attempt to reflect a company's expected financial position and expected results of operations. See also financial forecast and financial projection. Public Company Accounting Oversight Board (PCAOB) A regulatory body created pursuant to the Sarbanes-Oxley Act of 2002. The PCAOB establishes auditing and related professional practice standards to be used in the preparation and issuance of audit reports for "issuers." Purchase Order A document or form generated by a customer (typically within the customer's purchasing department), identifying goods or services to be purchased.
303
Receiving Report A document or form used to indicate that purchased goods have been received and inspected. Recession A period of two consecutive quarters of falling national output. Reconciliation The process of comparing financial amounts from two independent sources for agreement. Referred-to Auditor The other auditors or accounting firm when the lead auditor divides responsibility for the audit and references the other auditor in the auditor’s report of an issuer. Registration Statement An informational document filed with the SEC to register securities for public offering. Responsible Party A person, other than the practitioner, who is accountable for the underlying subject matter or, if no such person exists, a person who has a reasonable basis for making a written assertion about the underlying subject matter. Restrictively Endorsed An endorsement limiting future actions on an item (e.g., "for deposit only" marked on the back of a check).
Reissued Report A report that is issued subsequent to the date of the original report, but which bears the same date as the original report, indicating that no additional work has been performed since that date. Related Parties A reporting entity's affiliates, principal owners, and management; also, any members of their immediate families. Relevant Assertion An assertion about a class of transactions, an account balance, or a disclosure that has an identified risk of related material misstatement. Report Release Date The date on which the auditor grants the client permission to use the report. Reporting Accountant An accountant in public practice who prepares a written report (or provides oral advice) on the application of accounting principles or on the type of opinion that may be rendered. Representative Sample A sample whose characteristics are comparable to the characteristics of the population from which the sample was drawn. Retention Period The period for which audit documenta­tion must be kept. Auditing standards define this period as five years from the report release date; PCAOB standards define it as seven years from the report release date.
304
Review - LIMITED ASSURANCE An attestation engagement in which the practitioner obtains limited assurance by obtaining sufficient appropriate review evidence about the responsible party's measurement or evaluation of underlying subject matter against criteria in order to express a conclusion about whether any material modification should be made to the subject matter information in order for it to be in accordance with (or based on) the criteria, or to the responsible party's assertion in order for it to be fairly stated.
Risk Assessment (performed by the auditor) The process by which an auditor obtains an understanding of an entity and its environment, including its system of internal control and the applicable financial reporting framework, in order to evaluate the likelihood of material misstatement. Risk Assessment (performed by the entity) An entity's identification and analysis of risks to the achievement of its objectives. Risk of Assessing Control Risk Too High In sampling, the risk that the assessed level of control risk based on the sample is greater than the true risk based on the actual operating effectiveness of the control (i.e., sample results indicate a greater deviation rate than actually exists in the population). Note that this risk relates to tests of controls and to audit efficiency. Risk of Assessing Control Risk Too Low In sampling, the risk that the assessed level of control risk based on the sample is less than the true risk based on the actual operating effectiveness of the control (i.e., sample results indicate a lower deviation rate than actually exists in the population). Note that this risk relates to tests of controls and to audit effectiveness.
305
Risk of Incorrect Acceptance In sampling, the risk that the sample supports the conclusion that the recorded account balance is not materially misstated when in fact it is materially misstated (i.e., sample results fail to identify an existing material misstatement). Note that this risk relates to substantive testing and to audit effectiveness. Risk of Incorrect Rejection In sampling, the risk that the sample supports the conclusion that the recorded account balance is materially misstated when in fact it is not materially misstated (i.e., sample results mistakenly indicate a material misstatement). Note that this risk relates to substantive testing and to audit efficiency.
Risk of Material Misstatement The susceptibility of the financial statements to error based on the likelihood and magnitude of potential misstatements. The risk of material misstatement is composed of inherent risk and control risk. RMM = IR*CR Risk of Material Noncompliance The risk that material noncompliance exists, composed of the inherent risk of noncompliance and control risk of noncompliance.
306
Safeguards Controls designed to eliminate, or reduce to an acceptable level, threats to independence. Sales Invoice A bill sent to a customer indicating goods and services sold, prices applied, payment terms, etc. Sales Order A form or document prepared upon receipt of a customer purchase order indicating goods or services to be provided to that customer. Sampling Interval In PPS sampling, a range of dollars from which each sampling unit will be selected (e.g., in a population of $500,000 with a sampling interval of $5,000, there would be 100 sampling intervals; the sample would consist of 100 items, with one item being selected from each of the 100 intervals). Sampling Risk In sampling, the risk that the sample is not representative of the population, and that the auditor's conclusion therefore will be different from the conclusion that would have been reached had the tests been applied to all items in the population. Service Auditor An independent auditor responsible for evaluating and reporting on the controls and processes of a service organization in a SOC engagement. See also Service Organization and Control (SOC) Reports. Service Organization An outside organization that provides services to user entities (e.g., a payroll processing company such as ADP). The controls within its system are subject to evaluation in a SOC engagement. See also Service Organization and Control (SOC) Reports. Service Organization and Control (SOC) Reports A type of audit report that focuses on the controls at the service organization that are likely to be relevant to user entities' internal control over financial reporting (SOC 1®) or controls at the service organization over its system relevant to security, availability, processing integrity, confidentiality, or privacy (SOC 2® and SOC 3®).See also SOC 1® engagement and SOC 2® engagement and SOC 3® engagement. SOC 1® Engagement ICFR- An audit of controls at a service organization relevant to the user entities' internal control over financial reporting. See also Service Organization and Control (SOC) Reports. SOC 2® Engagement An audit of controls at a service organization relevant to one or more of the five trust services criteria: security, availability, processing integrity, confidentiality, and privacy. See also Service Organization and Control (SOC) Reports. SOC 1, Type 2 - ICFR A SOC 1® report is a report on the internal controls over financial reporting at a service organization and a SOC 2® report is a report on internal controls related to one or more of the Trust Services Criteria. The SOC 2® Type 1 report provides assurance over the design and implementation of controls in place at a service organization related to security, availability, processing integrity, confidentiality, and privacy. As it is not specifically related to the internal control over financial reporting (SOC 1®), it is not as useful to the user auditor when assessing risk of material misstatement. The SOC 2® Type 2 report provides assurance over the design, implementation, and operating effectiveness of controls in place at a service organization related to security, availability, processing integrity, confidentiality, and privacy. As it is not specifically related to the internal control over financial reporting (SOC 1®), it is not as useful to the user auditor when assessing risk of material misstatement. A Type 1 report on the design and implementation of controls includes a statement that, "our responsibility is to express an opinion on the fairness of the presentation of the description and on the suitability of the design of the controls to achieve the related control objectives stated in the description. SOC 3® Engagement An audit that provides assurance about the controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy. It contains an opinion on the operating effectiveness of controls but does not include a detailed description of tests of controls performed by the service auditor or the results of those tests. See also Service Organization and Control (SOC) Reports. Significant Component A component that is of individual financial significance to the group or that is likely to include significant risks of material misstatement of the group financial statements. Significant Deficiency A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. Significant Engagement Deficiency Exists when the engagement team fails to obtain sufficient appropriate evidence, the engagement team reaches an inappropriate overall conclusion, the engagement report is not appropriate for the circumstances, or the firm is not independent of the client. The existence of a significant engagement deficiency prevents the engagement quality reviewer from providing concurring approval of issuance. Significant Estimates Estimates at the balance sheet date that could change materially within the next year. Significant Risk A risk for which the identified risk of material misstatement is close to the UPPER end of the spectrum of INHERENT risk.
Sampling Unit In sampling, an item selected from the population for testing. Sarbanes-Oxley Act of 2002 Legislation that amended federal securities laws after a series of corporate financial scandals exposed serious weaknesses in the self-regulating system that had been intended to provide reliable company financial statements. Scope Limitation A restriction on an engagement that occurs when the accountant is unable to fully complete necessary procedures. Search for Unrecorded Liabilities Audit procedures that aid the auditor in identifying obligations that should have been recorded at the balance sheet date but were not. Securities and Exchange Commission (SEC) A governmental commission of the United States given the authority to set guidelines for publicly traded companies. Segment Information Information about certain portions of an enterprise, presented in the annual financial statements of public companies (e.g., information about products and services, about geographic areas, or about major customers). Segregation of Duties- The separation of the: (1)authorization, (2) record keeping, and (3) custodial functions to ensure that individuals do not perform incompatible duties. Selected Financial Data Additional financial information presented by management that is not a required part of the basic financial statements. Significant Audit Findings Findings that should be included in the audit documentation because they are related to the selection and application of accounting principles or to possible material misstatements in the financial statements; or because they cause significant difficulty in, or indicate the need for significant revision of, necessary audit procedures; or because they may result in modification to the auditor's standard report. Significant Class of Transactions, Account Balance, or Disclosure When a class of transaction, account balance, or disclosure has an identified risk of material misstatement at the assertion level. Single Audit An audit of entities expending federal assistance and that has two main components: an audit of the entity's financial statements and separate schedule of expenditures of federal awards, and a compliance audit of major federal awards. Single Audit Act A federal act requiring entities that expend federal assistance equal to or in excess of $750,000 annually to have a program-specific or entity-wide audit that complies with the act. Special Purpose A financial reporting framework other than GAAP that is one of the following bases of accounting: cash basis, tax basis, regulatory basis, contractual basis, or any other basis of accounting that uses a definite set of logical, reasonable criteria that is applied to all material items appearing in the financial statements. Specialist A person or firm with special skills in a field other than accounting or auditing (e.g., actuaries, appraisers, attorneys, engineers, etc.). Spectrum of Inherent Risk A range, from lower to higher, that the auditor uses to apply judgment to the significance of the combination of the likelihood and magnitude of a misstatement. Standard Deviation A mathematical measure of population variability. Statements on Auditing Standards (SAS) Standards issued by the Auditing Standards Board (ASB) of the AICPA. Statements on Auditing Standards (SAS)- Standards issued by the Auditing Standards Board (ASB) of the AICPA. Stock Certificate Book A collection of the documents used to evidence ownership of shares in a corporation. Stock Transfer Agent A person hired to maintain records with respect to the transfer (i.e., purchase, sale, etc.) of corporate securities.
307
Statements on Standards for Accounting and Review Services (SSARS)-Standards established by the AICPA to regulate the provision of services to privately held companies not seeking audited statements.
Statements on Standards for Attestation Engagements (SSAE) Standards issued by senior technical bodies of the AICPA regarding attest engagements, including engagements with respect to agreed-upon procedures; financial forecasts and projections; pro forma financial statements; internal control over financial reporting; compliance; and management's discussion and analysis.
308
Stratification- In sampling, the separation of the total population into several relatively homogeneous groups, with each group then treated as a separate population. Subject Matter Information The outcome of the measurement or evaluation of the underlying subject matter against criteria. Submission (of Financial Statements) Presentation of financial statements prepared by the accountant to a client or third party. Subsequent Events Events or transactions that occur after the balance sheet date, but before the financial statements are issued. Supplementary Information Information outside the basic financial statements that is nevertheless required because it is considered an essential part of the financial reporting for that specific entity. System of Internal Control The system of policies and procedures (controls) put in place to provide reasonable assurance about an entity's ability to meet its objectives (e.g., reliability of financial information, effectiveness and efficiency of operations, and compliance with laws and regulations). Those Charged With Governance Those who bear responsibility to oversee the obligations and strategic direction of an entity. Top-Down Approach Approach used when selecting controls to test in an integrated audit in which the auditor evaluates overall risks at the financial statement level, considers controls at the entity level, and then focuses on accounts, disclosures, and assertions for which there is a reasonable possibility of material misstatement.
Structural Threat The threat that an audit organization's placement within a government entity, in combination with the structure of the government entity being audited, will affect the audit organization's ability to perform work and report results objectively. Subsequent Events Review Procedures the auditor is required to perform for the period after the balance sheet date up to the date of the auditor's report. Subsequent Period The period between the date of the financial statements and the date of the auditor's report. Substantive Approach An audit approach in which only substantive procedures will be performed, either because controls are nonexistent or because it would be inefficient to test controls. Sufficient (Sufficiency of Audit Evidence) The measure of the quantity of audit evidence considering both the auditor's assessment of risk and the quality of audit evidence obtained. Systematic Selection In sampling, a method of sample selection whereby every nth item in the population is chosen as part of the sample. Test Count An auditor's tally of a specific inventory item, which is later compared with the physical inventory report as a means of testing that report.
309
Substantive Procedures Tests of details of transactions and balances and analytical review procedures designed to substantiate the account balances shown in the financial statements. Tickmark A symbol indicating that a specific audit procedure has been performed. Tests of Details Substantive audit procedures that are applied to transaction classes, account balances, and disclosure items in order to substantiate the amounts and disclosures reflected in the financial statements.
Tests of Controls - OPERTAING EFFECTIVENESS Audit tests used to obtain evidence about the operating effectiveness of a control by determining how, by whom, and with what level of consistency controls have been applied. Tests of controls include inquiry, inspection, observation, and reperformance, and they are performed when the auditor's risk assessment is based on the assumption that controls are operating effectively.
310
Test Data (Test Deck) - CAAT A computer assisted audit technique in which the auditor uses the client's application program to process, off-line, a set of test data for which the proper results are already known.
311
The service auditor is required to obtain a management representation letter.
312
Vouching - Occurrence and Existence
Tracing - completeness
313
Choice "C" is correct. 2 CFR 200 single audit allows auditors to use a risk-based approach to determine major grants. Choice "A" is incorrect. The judgment of the Office of the Inspector General would not exclusively influence the selection of major programs. Choice "B" is incorrect. Programs in excess of $750,000 are generally considered to be major grants; however, the dollar threshold is not the exclusive determinant of major programs. Choice "D" is incorrect. Risk-based auditing allows auditors to test as little as 20 percent of total federal programs or as much as 40 percent of total federal programs, depending on circumstances and on the auditor's judgment
314
Negative assurance, not an opinion, may be rendered in an engagement in which the auditor is reporting on compliance with aspects of contractual agreement in connection with audited financial statements. The report on compliance with contractual agreements is not required to include a specific date regarding when documentation regarding compliance was obtained. The report references the financial statement audit performed, which would have a corresponding audit report date. Compliance attestation standards apply for an examination of a client's compliance with specified requirements, such as debt covenants associated with a bank loan. In addition, examination engagements fall under attestation standards.
NO OPINION, only NEGATIVE ASSURANCE - If an auditor reports on compliance with contractual agreements in a separate report, but the report is in connection with an audit of financial statements, it is not correct to include a statement that the audit was directed primarily toward obtaining knowledge regarding compliance. The audit was performed in accordance with auditing standards for the purpose of expressing an opinion on the financial statements.Negative assurance is given with a compliance report issued in connection with audited financial statements. OPINION - The purpose of examination procedures applied to compliance requirements is for the practitioner to accumulate sufficient evidence regarding an entity's compliance with specified requirements to allow for the practitioner to issue an opinion with reasonable assurance. Specific findings are presented when an agreed-upon procedures engagement is performed and not when an examination is performed.
315
EXAMINATION, ASSESS CONTROL RISK - In an examination of an entity's compliance with specified requirements, the auditor should assess attestation risk, which is composed of control risk, inherent risk, and detection risk. For purposes of a compliance examination, control risk represents the risk that material noncompliance will not be prevented or detected on a timely basis by the entity's controls.
ATTESTATION RISK = Inherent risk *control risk * detection risk 2 CFR 200 single audit allows auditors to use a risk-based approach to determine major grants. The Single Audit Act does not require that all balances be tested.
316
A nonfederal entity that expends federal financial assistance administered by another entity is a sub recipient. For example, a state might receive federal funds and in turn provides those funds to a not-for-profit organization to accomplish an objective (e.g., mental health care, homeless relief, etc.). The not-for-profit organization would be the sub recipient.
. Assurance (in the form of an opinion) is provided on the compliance requirements for major programs. . Reasonable assurance is provided on the entity's compliance with requirements of the major program (not on compliance tests.) If material instances of noncompliance are identified, a disclaimer of opinion is not appropriate.
317
Generally Accepted Government Auditing Standards primarily apply to audits of federal financial assistance and government organizations but have been adopted by some states for audits of state financial assistance and other governmental funding.
318
Choice "C" is correct. An auditor's reporting requirements under Generally Accepted Government Auditing Standards (GAGAS or the Yellow Book) are expanded to include reports on the audited entity's compliance with laws, rules, and regulations that have a material impact on the financial statements and on internal controls over financial reporting. Rule: Reporting responsibilities under GAGAS are expanded to include: Reports on compliance with laws, rules, and regulations, violations of which may affect financial statement amounts, and Reports on internal control over financial reporting.
CHATGPT Simple Regression Predicting house price based only on square footage Price = β₀ + β₁*(SquareFeet) + ε Multiple Regression Predicting house price based on square footage, location, and number of rooms Price = β₀ + β₁*(SquareFeet) + β₂*(Location) + β₃*(Rooms) + ε The term auditee refers to: 🔍 The individual, department, organization, or entity whose activities, processes, or records are being audited.
319
Those charged with governance include those who bear responsibility for overseeing the obligations and strategic direction of an entity (including financial reporting). This encompasses the "board of directors" and "audit committee." As part of pre-acceptance activities, the auditor should consider the firm's quality control policies and procedures related to client acceptance and continuance, including the firm's ability to meet reporting deadlines and staff the engagement, the firm's independence, the integrity of client management, and whether appropriate evidence can be obtained on group audits.
Know what an audit committee is (subset of the board; three to five members are outside directors) and its main functions/responsibilities within the corporation. * The Sarbanes-Oxley Act requires auditors of issuers to report to and be overseen by the audit committee. * The auditor should meet with the audit committee without management present at least once each year. * Among other things, the audit committee is responsible for the selection and appointment of the external auditor.
320
PPS = Overstatement, large item has higher chance of being selected std deviation for population not required
CClassical variable sampling = understatement
321
ATTRIBUTE SAMPLING = TEST OF CONTROLS = RIIO R-Reperformance I-Inspection I-Inquiry O-Observation
322
COMPILATION 1. The accountant should read the FS for obvious material mistatements and consider whether they are appropriate in form and free from obvious material errors. 2. Compiled financial statements may be used to obtain credit. 3. Accountant should possess adequate knowledge of the accounting principles and practices of a client's industry. 4. FS Compiled by an accountant should be accompanied by a report stating that the FS have not been audited or reviewed. 5. The accountant's report includes a statement that the accountant is not required to perform any procedures to verify the accuracy or completeness of the information provided by management. 6. An accountant may compile financial statements that omit substantially all disclosures required by the applicable financial reporting framework (but are otherwise in conformity with the financial reporting framework) provided that the omission is not intended to mislead the users of the financial statements and is properly disclosed in the accountant's report. 7. An accountant who is not independent with respect to an entity may compile financial statements for such an entity and issue a report. The last paragraph of the compilation report should disclose the lack of independence. 8.An accountant who has no prior experience with similar organizations within the industry may compile the financial statements. However, the accountant is responsible for gaining the required level of knowledge to appropriately perform the compilation engagement. For example, the accountant may attend industry-specific accounting conferences and/or read appropriate literature to obtain the required level of knowledge. 9. Mgt rep letter - N/A 10. Reviewing account balances for material changes subsequent to the year end is performed in an audit, not compilation engagement. 11. An accountant should perform analytical procedures related to financial data in a review or audit. Performing analytical procedures is not required in a compilation. 12. During a compilation engagement, if the accountant believes that the financial statements are materially misstated, then the accountant should obtain the additional or revised information needed to correct the financial statements. 14. If an accountant performing a compilation for a nonissuer believes that the financial statements might be materially misstated and the client refuses to provide additional or revised information, then the accountant should withdraw from the engagement. 15. If an accountant performing a compilation for a nonissuer believes that the financial statements might be materially misstated and the client refuses to provide additional or revised information, then the accountant should withdraw from the engagement. 16. An accountant would not issue an opinion in a compilation engagement. An opinion is issued in an audit report. 17. An accountant would not issue an adverse report in a compilation engagement. The accountant should either disclose the effects of the misstatement (if known) in a separate paragraph of the compilation report or withdraw from the engagement. Disclosing the effects of the misstatement is not known as an “adverse” report. The term “adverse” is typically used to describe a type of opinion issued in an audit or a conclusion issued in a review. 18. The report on compiled projected financial statements should include a separate paragraph that describes the limitations on the usefulness of the presented statements. 19. While a compilation is not designed to detect material misstatements in the financial statements, no mention of this limitation is made in the compilation report. 20. The date on a compilation report should be the date of completion of the compilation. 21. Documentation provides the support that the accountant compiled with SSARS when performing the compilation engagement. SSARS does not require internal control procedures, such as review of segregation of duties, to be performed in a compilation engagement. Significant issues, such as discussing with the client the proper presentation of investment purchases, which relate to the financial statements should be included in the documentation of a compilation. An engagement letter should be included in the documentation of a compilation. Written communications with management regarding fraud that came to the accountant's attention during a compilation should be included in the documentation of a compilation. 22. Because modification to the report is insufficient to disclose the departures from GAAP, the accountant should withdraw from the compilation engagement and provide no further services concerning these financial statements.
REVIEW 1. Inquiry is part of REVIEW engagement and not the compilation 2. A review primarily includes applying analytical procedures to management's financial data and making inquiries of company management. 3.Obtaining a management representation letter is required in a review and an audit, but is not required for a compilation engagement 4. A review report, not a compilation report, includes the phrase, "is substantially less in scope than an audit." 5. The accountant expresses no such assurance in a compilation engagement; limited assurance (i.e., "…accountant is not aware of…") is expressed in a review engagement. REVIEW Acronym (ULIARCPA) 1. U - Understanding with client should be established 2. L - Learn and/or obtain sufficient knowledge of the entity's business 3. I - Inquiries should be addressed to appropriate individuals 4. A - Analytical procedures should be performed. 5. R - Review - OTher procedures should be performed 6. C - Client representation letter should be obtained from mgt 7. P - Professional Judgement should be used to evaluate results 8. A - Accountant (CPA) Should communicate results.
323
GAGAS (Generally accepted govt standards specifically include all of the following ethical principals: 1. Serving the public interest 2. Integrity 3. Objectivity 4. Proper use of Govt information, resources and positions 5. Professional behavior Objectivity includes independence of mind and appearance when providing audits, maintaining an attitude of impartiality, having intellectual honesty, and being free of conflicts of interest. The public interest is defined as the collective well-being of the community of people and entities served by the auditor. Auditor services should be designed to meet those needs. Integrity includes auditors conducting their work with an attitude that is objective, fact-based, nonpartisan, and non-ideological with regard to the audited entities and users of the auditor’s reports. Professional behavior includes an auditor's honest effort in the performance of professional services in accordance with the relevant technical and professional standards.
324
SSAE - Agreed upon procedures, examination and review Statement on Standards for Attestation Engagements
325
In determining if previously presented FS are still appropriate as issued, the predecessor auditor should date the report as appropriate: 1. UNREVISED - Use ORIGINAL REPORT DATE when reissuing previous report. 2. REVISED- Dual date is used in the event that the predecessor auditor revises the report.
326
COVERED MEMBER - Whoever is in a position to influence the engagement - all partners and MDs no matter which office they are in
327
Overstated assets and Understated liabilities are biggest concerns for AUDITOR.
328
CHATGPT: CAAT (Computer-Assisted Audit Techniques) - A set of auditing techniques that involve using Computer software and technology to assist in the audit process. These techniques allow auditors to analyze large volumes of data, automate repetitive tasks, and increase the efficiency and accuracy of the audit process. 1. DATA EXTRACTION - Auditors extract large amounts of data from various sources such as databases, spreadsheets, and other financial systems. This data might include transactions, logs, or other relevant records. Auditors use software tools to pull data directly from systems, ensuring that it’s complete, accurate, and in a usable format for further analysis. 2. DATA ANALYSIS - Once data is extracted, CAATs can be used to perform various types of analysis, such as: Trend analysis: Identifying patterns or changes over time. Ratio analysis: Comparing financial ratios to detect anomalies or trends. Statistical analysis: Using techniques like sampling, regression, or hypothesis testing to identify outliers or unusual transactions. These analyses can identify risks, errors, or fraud that would be difficult to detect manually in large datasets 3. TESTING TRANSACTIONS - It can automate the testing of entire populations of transactions or records, rather than relying on a sample. For example, an auditor might use CAATs to verify that all invoices above a certain value were approved by the correct person. Auditors can also use CAATs to test the logic of business rules implemented in financial systems (e.g., ensuring that transactions comply with established approval workflows). 4. DATA RECONCILIATION - CAATs are useful for reconciling data between different systems. For example, auditors might use CAATs to compare the financial records in an accounting system with the records in a payroll system to ensure consistency and completeness. They can also help match records from different sources (e.g., bank statements vs. accounting ledgers) to detect discrepancies. 5. Continuous Auditing One of the advantages of CAATs is that they can be used to implement continuous auditing. This means that instead of conducting audits at fixed intervals (e.g., annually), auditors can continuously monitor transactions and system activity in real time or at frequent intervals. For example, the auditor might set up automated procedures to review transactions as they occur, flagging suspicious activities instantly. Automated Reporting After the data analysis is performed, CAATs can automate the process of generating reports, making the audit findings more efficient to communicate and review. These reports can include visualizations, summaries, and detailed findings, and they can be tailored to specific audiences, such as management or regulatory bodies. Fraud Detection CAATs are powerful tools for detecting fraud, especially when large volumes of data are involved. They can be used to identify patterns of behavior that are indicative of fraudulent activity, such as duplicate payments, unapproved transactions, or irregularities in financial records. Techniques like Benford’s Law, which detects anomalies in the distribution of digits in numbers, are often used in fraud detection.
CHATGPT: Types of CAATs Generalized Audit Software (GAS): Tools like ACL, IDEA, and TeamMate that allow auditors to import and manipulate data for analysis. Data Mining: Using algorithms to analyze data for hidden patterns or relationships. Automated Testing Scripts: Scripts that perform specific audit tests on data automatically. Excel-Based Tools: Simple yet powerful for data analysis, auditing tools can be built within Excel for small to mid-scale audits. Benefits of CAATs Efficiency: Automates routine tasks and analyzes large datasets faster than manual methods. Accuracy: Reduces human error in data handling and testing. Comprehensive Coverage: Can analyze entire populations of data, not just a sample. Fraud Detection: Helps uncover fraudulent activities that are hidden in large datasets. Cost-Effective: Can lower audit costs in the long run by streamlining processes. Challenges of CAATs Complexity: Requires specialized knowledge to use the software and interpret results. Data Quality: If the data fed into CAATs is incomplete or inaccurate, it could lead to incorrect conclusions. Security: Auditors must ensure that the data being accessed and analyzed remains secure and confidential. BECKER ADA Tools and Technology ADAs can be done manually, however, that approach is typically tedious and inefficient. As a result, most ADAs are performed using software. The types of software used include: Data Extracts and Preparation: This software is used to extract, transform, and load (ETL) data in preparation for analysis by allowing auditors to connect to data sources, clean the data to remove errors and inconsistencies, scrub the data to address integrity issues, adhere to data quality standards, allow for normalization, combine data from different sources, and summarize data. These tools also facilitate the automation of data collection by recording each of the ETL steps for reuse with new data: y Spreadsheet tools y Database or structured query language (SQL) explorer y Data transformation and cleaning software y Robotics process automation (RPA) software Data Modeling: This specialized software provides a platform for common data analytics procedures, in some cases tailored for common audit analytics, such as Benford's law analysis or sampling. In some cases, more robust or computationally intensive models require connecting to more powerful cloud-based service: y Data analytics software and plug-ins y Data mining software y Programming scripts Data Visualization: This software is useful for creating charts, graphs, diagrams, and dashboards to help emphasize trends, relationships, and composition of data elements. More advanced software can create graphs using text prompts instead of building visuals from scratch: y Charts and graphs y Data visualization software y Natural language processing (NLP) tools
329
Bank confirmation may be incomplete if the bank employee filling it out is unaware of all the bank-client relationships. CONTENTS OF BANK CONFIRMATION 1. Balances in deposit accounts 2. Balances of outstanding loans 3. Agreements regarding collateral, compensating balances.
ANALYTICAL PROCEDURES IN OVERALL REVIEW STAGE 1. Determine whether additional evidence is needed to explain UNEXPECTED BALANCES or RELATIONSHIPS identified PREVIOUSLY 2. Identify ADDITIONAL UNEXPECTEED BALANCES or relationships 3. Are performed by PARTNER OR MANAGER with broad knowledge of the entity and its industry PERFORMING AN ANALYTICAL PROCEDURE: 1. Develop expectation of amount based on other information (e.g. Prior year results) 2. Compare expectation to recorded amounts and consider whether differences are reasonable 3. Investigate significant differences.
330
AUDIT PROCEDURES
ANALYTICAL PROCEDURES are used in the: 1. Planning 2. Substantive testing (optional) 3. Overall review stages of audits But NOT in TESTS of Controls
331
TEST OF DETAILS
TEST OF CONTROLS 1. R-Reperformance 2. I-Inspection 3. I-Inquiry 4. O-Observation
332
VOUCH - From Book to going backwards to source. Book is the starting point. To determine whether something has occurred (e.g. recorded sales actually happened), an auditor would vouch information from the books back to the source documents.
TRACE - From Source to Books to determine a transaction's completeness.
333
RECEIVING REPORTS are associated with INVENTORY, not sales.
Compilation but not preparations require an accountant to read the compiled information, consider whether it's in an appropriate form and issue a report.
334
SAS - Statements on AUDITING STANDARDS 1. Audits 2. Reviews of interim FS when most recent annual FS have been audited SSARS - Statements on standards for accounting and review services 1. Preparations 2. Compilations 3. Reviews of Historical Financial Information, including Fin statements. SSAE - Statements on standards for attestation engagements 1. Agreed-upon procedures 2. Examinations 3. Reviews of anything other than Historical Financial information SSCS - Statements on Standards for Consulting Services (SSCS) 1. Consulting (e.g. implementing information system) SSTS - Statements on standards for Tax Services 1. Tax Preparation 2. Tax Planning 3. Tax Advice
PREVENTIVE CONTROLS - e.g. You try to enter Feb 31st - System prevents it from entering. Segregation of duties DETECTIVE CONTROLS - Bank reconciliation; normally performed after processing has been completed such as double entries or missed entries. Why it's a detective control: It helps detect errors, such as double entries or missed entries. It can reveal fraud, like unauthorized withdrawals or altered checks. It identifies timing differences (e.g. outstanding checks, deposits in transit). Imagine a company performs a monthly bank reconciliation. In the latest reconciliation: The company’s cash ledger shows $50,000. The bank statement shows $48,500. Upon investigation, the accountant discovers a bank fee of $1,500 was deducted but not recorded in the books. ➡️ This reconciliation detected an error (unrecorded expense), allowing the company to adjust the books — demonstrating it is a detective control.
335
CHATGPT: Embedded Audit Modules (EAMs) are software routines or code segments embedded into an organization’s application systems to monitor and collect data for audit purposes. They are typically installed by internal or external auditors in cooperation with IT departments and allow for continuous auditing or real-time monitoring of transactions and processes. KEY Features of Embedded Audit Modules: Run automatically with the host system. Monitor specific types of transactions or activities. Flag anomalies, errors, or policy violations. Store or forward data for audit analysis. ✅ Examples of Embedded Audit Modules 1. Payroll System Monitoring Scenario: Prevent unauthorized changes to employee salary data. EAM Function: Monitors changes to the salary master file (e.g., addition of new employees, changes to pay rates). Example: If an employee receives more than a 10% raise outside of a scheduled review period, the EAM flags and logs the transaction for audit. 2. Sales and Revenue Transactions Scenario: Detect possible revenue manipulation. EAM Function: Checks for backdated invoices or large discounts. Example: If a sale is recorded with a 50% discount without manager approval, the module logs this as an exception. 3. Inventory Control System Scenario: Detect unauthorized inventory movements. EAM Function: Monitors inventory adjustment transactions. Example: If inventory is written off after business hours or during weekends, the EAM generates an alert. 4. Procurement or Accounts Payable Scenario: Prevent duplicate or fraudulent payments. EAM Function: Matches purchase orders, invoices, and payment details. Example: If the same invoice number is entered more than once, the EAM flags it for duplicate payment check. 5. Banking and Financial Services Scenario: Monitor large transactions for potential fraud or money laundering. EAM Function: Triggers alerts for transactions above a certain threshold. Example: Transfers exceeding $10,000 without appropriate authorization or documentation are automatically flagged. 💡 Benefits of Embedded Audit Modules Real-time risk detection. Continuous auditing without disrupting operations. Increased audit efficiency and accuracy. Helps in compliance with regulatory standards (e.g., SOX, GDPR). ⚠️ Challenges Requires integration with existing systems. Needs close coordination between auditors and IT. May be resource-intensive to implement and maintain.
Omission of statement of cash flows - Qualified opinion (GAAP departure) Results when FS disclosures are INADEQUATE
336
Agreed upon procedures
FINDINGS, NO ASSURANCE
337
Examination - Opinion (positive assurance)
Review - Conclusion (Negative assurance or limite assurance)
338
SOC1 - Service organizations whose controls impact their end customers' FINANCIAL REPORTING, ADP. TYPE 1 report - AT a point in time TYPE 2 report - OVER A PERIOD OF TIME
SOC 2 - For service organizations e.g. ADP whose controls impact their end customers' OPERATIONS, COMPLIANCE and COMPUTERSHARE (non-financial data). SOC2 is a reporting framework as opposed to security framework. SECURITY - mandatory in SOC2 5 AICPA TRUST SERVICE CRITERIA (TSC) 1. Availability 2. Processing Integrity 3. Confidentiality 4. Privacy 5. SECURITY SOC 2, TYPE 1 - Fairness and presentation of the service organization's control design at a point in time (without testing of historical operating effectiveness) SOC 2, TYPE 2 - Includes testing of operating effectiveness over a period of time. Most service organizations first do a type 1 and then after a period of 6-12 months, have their first annual TYPE 2 Performed
339
Both SOC 1 and SOC 2 Reports are Restricted Use Reports. * Not available for general use. * SOC 1 reports are restricted to your management team, the end users of your services and your customers auditors only. * SOC 2 reports are restricted to your management team, the end users of your services and their management team, business partners, regulators, as well as potential clients who have an understanding of the service organization’s industry Review of SOC reporting *There are no regulatory requirements to perform a SOC 2 examination; however, many organizations may be required to obtain a SOC 2 report due to contractual requirements. Traditionally, a service organization elects to pursue SOC 2 for one or more of the following reasons: *Reason1:An organization desires to improve its security posture. *Reason 2:A prospect or client mandates it in a contractual agreement. *Reason 3:Prospective clients are asking about security or official certification during the sales cycle. *Reason 4:Your team is over-burdened with security questionnaires or customer audits.
SOC 1 and SOC 2 are both audits of a service organization’s controls. SOC 1 is appropriate for service organizations whose controls impact their end customers’ financial reporting, payroll processing companies SOC 2 is appropriate for service organizations whose controls impact their end customers’ operations and compliance. Managed services such as cloud service providers, Software as a Service, (SAAS), Infrastructure as a service (IAAS), Platform as a service, (PAAS) A SOC 2 Type 1 is a report on the fairness and presentation of the service organization’s control design at a point in time, but without testing of historical operating effectiveness. A SOC 2 Type 2 includes testing of operating effectiveness over a period of time. Most service organizations first do a Type 1, and then after a period of six to 12 months, have their first annual (12 month period) Type 2 performed. SOC 3 Reports are much more condensed report compared to SOC 1 and SOC 2. * SOC 3 report is suitable for public use,unlike SOC 1 and SOC 2 which result in restricted use. * The advantage of SOC 3 over SOC 2 is that SOC 3 reports become valuable tools to market the effectiveness of your control environment. * In order to obtain a SOC 3 report, your entity must complete a SOC 2 type audit. Looking at operative effectiveness over time regarding security or possibly additional criteria. * The scope of a SOC 3 report is similar to a SOC 2 report in that a similar set of criteria would be audited. A SOC 3 report results in an actual certification which can be published on the company’s website. *It is more of a certificate rather than a report. This is different from SOC 1 and SOC 2 reports which are formal audit reports and are restricted. * A SOC 3 report is condensed and does not contain details regarding the control environment and the extent of testing compared to a SOC 2. * SO3 available for marketing purpose A SOC 3 report is an opinion, an assertion and a high level description of services. * The scope is similar to a SOC 2 in that the same criteria is used, security plus any of the other four criteria may be audited against. * Security, Availability, processing integrity, confidentiality, and privacy. SOC2 Type 2 is annual report
340
The slope of the short run aggregate supply curve is UPWARD SLOPING TO THE RIGHT.
Long run supply curve is VERTICAL (no relation between Long run price move and supply)
341
Recovery is the last phase of the cycle
Expansion is the first phase of the cycle. Above the line!
342
Nominal GDP uses price levels at the time of production, today's prices. ?
Real GDP measures the value of all goods and services produced within a nation's borders but removed the effects of inflation, constant prices. (not impressive)? REAL GDP is the most common measure of economic activity because it factors in the inflation. GDP deflator or inflator
343
Confirmations provide evidence about regarding Existence and Rights and Obligations
INTERNAL CONTROL - The auditor's understanding should include an evaluation of the design and implementation of the entity's controls. The understanding is obtained through the following procedures (which must be documented): * Walk-throughs * Inquiry of entity personnel * Observation of the application of controls and of the entity's premises and plant facilities * Inspection of documents and records
344
Positive Confirmations Positive confirmations should be used to confirm accounts receivable when: *there are large individual accounts; *there are expected errors or items in dispute; and *when the system of internal control is weak
Negative Confirmations Negative confirmations differ from positive confirmations in that customers are requested to respond to the auditor only if they disagree with the stated amount owed. Negative confirmations may be used to confirm accounts receivable when: * the combined assessed level of inherent and control risk is low; * a large number of SMALL account balances are being confirmed; and * there is no reason to expect that recipients of the requests will ignore them. Negative confirmations are less effective than positive confirmations because lack of a response does not provide explicit verification of the existence of the receivable.
345
Large companies often use a registrar to provide registration services and maintain the stockholder list. The primary responsibility of the registrar is to verify that stock is issued only with proper authorization.
In order to maintain accurate perpetual inventory records, periodic inventory counts should be used to adjust perpetual records. An auditor most likely would compare a sample of creditor balances to supporting invoices, receiving reports, and purchase orders to verify that the accounts payable exist. The search for unrecorded payables is primarily used to support the completeness assertion. An auditor most likely would compare cash payments made after the balance sheet date with the accounts payable trial balance in searching for unrecorded payables. The auditor is looking for items that should have been recorded as of the balance sheet date, but were not.
346
The auditor may choose between two audit approaches for identified risks at the relevant assertion level: — A Substantive Approach—Only substantive procedures will be performed (controls are nonexistent or ineffective, or it would be inefficient to test them). — Tests of controls may be required when there is extensive use of technology, even if a substantive approach would otherwise be utilized. — A combined Approach—Tests of controls are performed in the hope that effective controls will allow a reduction in substantive testing. — Even if controls are effective, substantive tests are always required for each relevant assertion of each significant transaction class, account balance, or disclosure item. — Dual-purpose tests can be used to test controls concurrently with a test of details on the same transaction.
Responding to RMM: Tests of Controls  Tests of controls are performed when the auditor's risk assessment is based on the assumption that controls are operating effectively, or when substantive procedures alone are insufficient. * When performing tests of controls, the auditor must obtain evidence that the controls selected for testing were designed effectively and operated effectively during the period of reliance. * Inquiry, inspection, observation, and reperformance are used to test the operating effectiveness of controls. (It should be noted that inquiry alone is insufficient, and observation relates only to a specific point in time.) The two types of substantive procedures are tests of details and substantive analytical procedures.  Know the ways in which an auditor can vary the nature, extent, and timing of both tests of controls and substantive tests
347
Issuer Report structure 1. Opinion 2. Basis of Opinion 3. CAM
348
349