What is the purpose of performing a walkthrough?
Obtain some feedback as to whether the way the auditor has understood (and documented) the entity's internal controls is consistent with the way the entity is actually processing such transactions.
List the disadvantages of Internal Control Questionnaires (ICQs) to document the auditor's understanding of internal controls.
1. These are generic and not tailored to any client specifically; 2. Irrelevant questions may annoy clients; 3. Client might conceal deficiencies by incorrect answers.
Define transaction cycle.
A group of essentially homogeneous transactions, that is, transactions of the same basic type.
List the advantages of Internal Control Questionnaires (ICQs) to document the auditor's understanding of internal controls.
1. Can have a standard form for many clients; 2. Deficiencies are easily indicated by "no" answers.
List the advantages of narratives (memos) to document the auditor's understanding of internal controls.
1. Tailored to client; 2. Can be as detailed or as general as desired; 3. Easy to prepare; 4. Easy to read.
Identify 3 procedures an auditor might perform to obtain an understanding of internal controls?
1. Inquiry of appropriate personnel 2. Observation of client's activities 3. Review entity's documentation of internal controls.
List the advantages of using flowcharts to document the auditor's understanding of internal controls.
1. Systematic approach with emphasis on important accounting records 2. Tailored to client 3. Fairly easy for others to review and understand 4. Easy to update from year to year.
Identify 3 ways auditors might document their understanding of internal controls?
1. Flowcharts of transaction cycles; 2. Internal control questionnaires; 3. Narrative write-ups (memos).
List the disadvantages of flowcharts to document the auditor's understanding of internal controls.
1. Tedious and time consuming to initially prepare; 2. Might fail to recognize deficiencies by getting overly absorbed in details.
List the disadvantages of narratives (memos) to document the auditor's understanding of internal controls.
1. Writing such a memo is rather unstructured, lacking a systematic approach; 2. It may be rather easy to overlook relevant internal control issues.
When should the auditor assess the operating effectiveness of internal control?
Whenever the auditor contemplates a reliance strategy (which means the same thing as "assessing control risk at less than the maximum level") and only after performing the appropriate tests of control.
Identify 3 inherent limitations of internal controls?
1. Cost of controls should not exceed expected benefits 2. Mistakes may occur due to carelessness, fatigue, misjudgments, etc. 3. Segregation of duties may break down due to collusion or management override of internal controls.
When should the auditor assess the design effectiveness of internal control?
In planning every audit under GAAS, as a basis for determining the nature, timing, and extent of further audit procedures.
Identify 2 reasons for assessing control risk at the maximum level.
1. The auditor believes that the design of internal control is ineffective; or 2. The auditor believes that reliance on internal control (and performing applicable tests of control) is not an efficient audit strategy compared to a wholly substantive audit approach.
Identify the five interrelated components of internal controls.
1. Control Environment 2. Risk Assessment 3. Control Activities 4. Information and Communication systems 5. Monitoring.
What is meant by the term monitoring (as it relates to internal controls)?
The policies and procedures involving the ongoing assessment of the efectiveness of internal control over time.
Define the term risk assessment procedures.
Procedures performed to obtain an understanding of the entity and its environment, including its internal control.
What is meant by the term control environment?
The policies and procedures that determine the overall control consciousness of the entity, sometimes called "the tone at the top."
Identify 3 risk assessment procedures that might be used by an auditor to obtain an understanding of the entity and its environment, including its internal control.
1. Inquiries of management and others; 2. Observation and inspection; 3. Analytical procedures.
What is meant by the term risk assessment?
The policies and procedures involving the identification, prioritization, and analysis of relevant risks as a basis for managing those risks.
What is meant by the term control activities?
The policies and procedures that help ensure that management directives are carried out especially those related to (1) segregation of duties, (2) physical controls, (3) authorization of transactions, (4) performance reviews, and (5) information processing.
What are the three objectives of internal control as identified in the definition of internal control?
1. Reliability of financial reporting 2. Effectiveness and efficiency of operations 3. Compliance with applicable laws and regulations.
What is meant by the term information and communication systems?
The policies and procedures related to the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities.
Define "internal control."
A process - effected by those charged with governance, management, and other personnel - designed to provide reasonable assurance about the achievement of the entity's objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.
What specific matters should the auditor document regarding the auditor's assessment of the risks of material misstatement?
The discussion with key members of the audit team about the risks of material fraud and errors; The major elements of the understanding of the five components of internal control; The assessment of the risks of material misstatement (at the financial statement and relevant assertion levels) and the basis for that assessment; and The risks identified and the related controls the auditor evaluated.
When must tests of control be performed?
When the auditor's risk assessment includes an "expectation of the operating effectiveness of controls." Note that this is frequently referred to as "relying" on internal control as a partial basis for the auditor's conclusions, or "assessing control risk at less than the maximum level."
Define the term significant risks.
Risks that the auditor believes require special audit consideration.
List some examples of appropriate responses by the auditor to risks of material misstatement at the financial statement level.
Assign more experienced staff to the engagement; Provide closer supervision; Use specialists; Use more unpredictable audit procedures.
What is the auditor's responsibility for assessing the risk of material misstatement?
The auditor should identify and assess the risks of material misstatement (1) at the financial statement level and (2) at the relevant assertion level related to classes of transactions, account balances, and disclosures.
What is meant by the term deficiency in design?
When a control necessary to meet the control objective is missing, or when the control objective is not always met, even if the control operates as designed.