Internal Control Flashcards

1
Q

If Internal Control is poor and a company’s accounting practices are sloppy - which risk is higher?

A

Control risk increases with poor Internal Controls and sloppy accounting practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

If Internal Control is poor - what is the effect on the audit?

A

Auditor will need to perform more testing and dig deeper into accounts in order to arrive at an opinion regarding the financial statements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does Internal Control provide reasonable assurance for?

A

Internal control provides reasonable assurance that

Material misstatements will be prevented

Reliability/integrity of financial statements will be preserved

Assets are protected against misuse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is required in an examination of Internal Control under Sarbanes-Oxley?

A

CEO/CFO must disclose Internal Control deficiencies

Management must provide assessment of Internal Control

Management must certify Financial Statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the relationship between Internal Control and Substantive Testing?

A

Inverse Relationship

Stronger Internal Controls - Less Testing Needed

Weaker Internal Controls - More Testing Needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the objectives of Internal Control?

A

Accurate Financial Reporting

Compliance with Laws and Regulations

Efficiency/effectiveness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the 5 components of Internal Control?

A
Control Activities
Risk Assessment
Info & Communication
Monitoring
Environment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why is the Control Environment important to internal control?

A

Sets tone for the entire company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the components of the Control Environment?

A
Commitment to Competence by management
Human resources policies/procedures
Org structure
Participation of those charges with governance
Philosophy of management
Ethical values & integrity
Responsibility assignment
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does an auditor’s assessment of Detection Risk determine?

A

Detection Risk determines nature- timing- and extent of audit procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What determines the acceptable level of Detection Risk?

A

Risk of material misstatement determines acceptable level of Detection Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What items could increase the risk of material misstatement?

A

Rapid growth in the company.

The methods management uses to identify risk- estimate its significance and assess the likelihood of occurrence

Major changes to operations- personnel- systems- IT- products- corporate organization- and foreign operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What happens when Control Risk is assessed to be at the maximum level?

A

No Internal Control testing is performed.

All audit procedures are increased in intensity to compensate for increased risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What happens when Control Risk is below the maximum level?

A

Auditor tests Internal Controls.

Auditor evaluates Control Risk based on tests

Auditor adjusts substantive tests accordingly

Weaker Internal Control - More substantive tests

Stronger Internal Control - Less substantive tests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe some common examples of Control Activities.

A
Prenumbered documents
Authorized transactions
Independent checks to maintain accountability
Documentation
Timely performance reviews
Information processing controls
Physical controls to safeguard assets
Segregation of duties

PAID TIPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What should an auditor understand with respect to Information and Communication on an audit?

A

Understand Client’s

Major transaction classes
Transaction initiation
Support records/documents
Transaction processing
Financial Statement internal reporting process
Financial Statement external reporting process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How must an auditor document understanding of Internal Control?

A

Through written documentation such as Internal Control memos- flowcharts- and questionnaires

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What questions should be asked to determine the risk of material misstatement?

A

Were all transactions recorded?
Were they timely?
Measured appropriately?
Recorded in correct period?
Presented and disclosed properly?
Did Management communicate their responsibilities?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the purpose of testing Internal Controls?

A

Auditor needs reasonable assurance that controls are functioning as designed and effective

Internal Control Testing should be strong as (IRON) so that nothing gets past them

Inquiry - Interview company personnel
Re-performance - Can it be replicated?
Observation - Watch the control be applied
INspection - Dig into the details/documents

If results are as expected- substantive procedures do not need to be adjusted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When can controls tested by an auditor in a prior year be used in the current year’s audit assessment?

A

Controls tested by auditor in a prior year can be used in the current year’s audit assuming they are re-tested every third year

Exception If the control has changed since the last audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What happens if Internal Controls are deficient?

A

Control Risk increases

Scope of substantive procedures increases

Detection Risk decreases

Material Weakness - Reasonable possibility that a material misstatement in Financial Statements would not be found- more than a remote chance of occurrence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is a Material Weakness?

A

Reasonable possibility exists that a material misstatement in Financial Statements would not be found- and has more than a remote chance of occurrence.

23
Q

What does Tracing test?

A

Tests Completeness

Starts with source document and traces forward to the journal entry.

24
Q

What does Vouching test?

A

Tests Existence.

Starts with a journal entry and searches for a voucher or source document to support the entry.

25
Q

What activities represent Segregation of Duties?

Remember these are your ARC to protect against a flood of troubles

A

Authorization
Recording
Custody

not one person should do more than one of these activities.

26
Q

With respect to signing checks - how are duties segregated?

A

Employees who prepare vouchers/invoices should not also have the authority to SIGN CHECKS

Tip - Remember this as an underlying theme with Segregation of Duties. The authority to make a payment should not also lie in the hands of those creating invoices/vouchers. Why? People commit fraud by setting up fake companies and basically paying themselves

27
Q

With respect to custody of assets - how should duties be segregated?

A

Employees who have custody of assets should not also RECORD those assets

Someone in charge of petty cash should not also control the petty cash records

Treasury Department (custodians) should NOT have record keeping duties

They control assets and should not be able to adjust any recording of those assets

28
Q

What are the limitations on Control Activities?

A

Controls can’t stop collusion or bad judgment

Management can override controls

Cost vs. Benefit relationship of Internal Control

29
Q

What is required if a Material Weakness is identified?

A

A written report to management is required.

Report declaring that no material weaknesses were found is allowed

Previous weaknesses reported that still exist should be reported again

Should be reported no later than 60 days after audit report release date

If one or more material weaknesses is uncorrected at year-end- an Adverse Opinion on Internal Control must be given

30
Q

What is the effect of a Significant Deficiency? What is it?

A

A significant deficiency adversely affects a company’s ability to report in the financial statements according to GAAP.

A significant deficiency is a more than a remote likelihood of material misstatement by more than an inconsequential amount

31
Q

What must occur if a Significant Deficiency is identified?

A

If a Significant Deficiency is identified- a written report to management required

Report declaring that no significant deficiencies exist is not allowed

Previous deficiencies reported that still exist should be reported again

Should be reported no later than 60 days after the audit report release date

32
Q

What is a Control Deficiency?

A

A control is not operating as intended.

33
Q

What must an auditor ask if using the work of third parties?

A

Are they competent?

Are they objective?

34
Q

What must an auditor understand with respect to internal auditors?

A

Auditor needs to understand the role of Internal Auditors within the organization because their work affects the audit plan

Responsibility for judgments about materiality or appropriateness of entries or estimates cannot be shared with third parties like Internal Auditors

Internal Auditors should be asked to do some of the legwork like preparing schedules or running reports

They should not be asked to make any decisions or judgments

35
Q

What is required in an examination of Internal Control under Sarbanes-Oxley?

A

CEO/CFO must disclose deficiencies

Management must provide assessment of Internal Controls

Management must certify Financial Statements

36
Q

What is the relationship between Internal Control and Substantive Testing?

A

Has inverse relationship

Stronger Internal Control results in LESS substantive testing

Weaker Internal Control leads to MORE substantive testing

37
Q

What are the three objectives of Internal Control?

A

Reliability of Financial Reporting

Operational Efficiency/Effectiveness

Compliance with Law and Regulations

38
Q

What are the five components of Internal Control?

A

Control Activities

Risk Assessment

Information and Communications

Monitoring

Control Environment

39
Q

What are the components of the Control Environment?

A

Integrity/Ethics of Management
Competence of Management
Organizational Structure
Human Resources Policies
Assignment of Authority/Responsibility
Management’s Style (riskier with a dominant/aggressive individual)
Board/Audit Committee involvement

40
Q

What happens when Control Risk is below the maximum level?

A

Auditor tests Internal Controls.

Auditor evaluates Control Risk based on tests

Auditor adjusts substantive tests accordingly

Weaker Internal Control - More substantive tests

Stronger Internal Control - Less substantive tests

41
Q

What should an auditor understand with respect to Information and Communication on an audit?

A

Understand Client’s

Major transaction classes
Transaction initiation
Support records/documents
Transaction processing
Financial Statement internal reporting process
Financial Statement external communication process

42
Q

How must an auditor document understanding of Internal Control?

A

Auditor must document understanding of Internal Control via Memos - Flowcharts - Questionnaires

43
Q

What is the purpose of testing Internal Controls?

A

Auditor needs reasonable assurance that controls are functioning as designed and effective

Internal Control Testing should be strong as (IRON) so that nothing gets past them

Inquiry - Interview company personnel
Re-performance - Can it be replicated?
Observation - Watch the control be applied
INspection - Dig into the details/documents

If results are as expected - substantive procedures do not need to be adjusted

44
Q

What are some inherent limitation of internal control?

A

Collusion
Override by Management
Competence
Obsolescence

COCO

45
Q

Describe the “risk assessment” component of internal control.

A

Risk assessment is the identification and analysis of internal and external factors that risks the objectives of financial reporting.

factors include: rapid growth, Foreign operations, Accounting pronouncements.

46
Q

What activities may be considered part of “monitoring” component of internal control?

A

Separate internal control evaluations
The internal audit function
Evaluation of communication from external parties
Management and supervisory activities

STEM

47
Q

Why does an auditor obtain an understanding of the client’s internal control?

A

to evaluate the design of controls, and determine if they have been IMPLEMENTED.

to assess the RMM.

and nature, timing, and extent of further audit procedures.

48
Q

The sales department is responsible for preparing what kind of document?

A

The sales order

49
Q

Which department is responsible for approving the sales order?

A

The credit department

50
Q

Which department is responsible for preparing the bill of lading?

A

The shipping department

51
Q

Which department is responsible for preparing the invoice?

A

The billing department

52
Q

Which department should approve write-offs of uncollectible accounts?

A

The treasury department

53
Q

A listing of cash receipts should be sent to which three departments?

A

The cashier, Accounts receivable, and general accounting department.

53
Q

What is the result on the report if the auditor has a scope limitation?

A

The auditor will disclaim an opinion or withdrawal from the engagement during a scope limitation