Flashcards in NINJA AUD Internal Control Deck (43)
If Internal Control is poor and a company's accounting practices are sloppy - which risk is higher?
Control risk increases with poor Internal Controls and sloppy accounting practices.
If Internal Control is poor - what is the effect on the audit?
Auditor will need to perform more testing and dig deeper into accounts in order to arrive at an opinion regarding the financial statements.
What does Internal Control provide reasonable assurance for?
Internal control provides reasonable assurance that
Material misstatements will be prevented
Reliability/integrity of financial statements will be preserved
Assets are protected against misuse
What is required in an examination of Internal Control under Sarbanes-Oxley?
CEO/CFO must disclose Internal Control deficiencies
Management must provide assessment of Internal Control
Management must certify Financial Statements
What is the relationship between Internal Control and Substantive Testing?
Stronger Internal Controls - Less Testing Needed
Weaker Internal Controls - More Testing Needed
What are the 3 objectives of Internal Control?
Reliability of Financial Reporting
Compliance with Law and Regulations
What are the 5 components of Internal Control?
Information and Communication
What is the purpose for a Control Environment assessment?
Sets tone for the entire company
What are the components of the Control Environment?
Integrity/Ethics of Management
Competence of Management
Human Resource Policies
Assignment of Authority/Responsibility
Management's Style (riskier with a dominant/aggressive individual)
Board/Audit Committee involvement
What does an auditor's assessment of Detection Risk determine?
Detection Risk determines nature- timing- and extent of audit procedures.
What determines the acceptable level of Detection Risk?
Risk of material misstatement determines acceptable level of Detection Risk
What items could increase the risk of material misstatement?
Rapid growth in the company.
The methods management uses to identify risk- estimate its significance and assess the likelihood of occurrence
Major changes to operations- personnel- systems- IT- products- corporate organization- and foreign operations.
What happens when Control Risk is assessed to be at the maximum level?
No Internal Control testing is performed.
All audit procedures are increased in intensity to compensate for increased risk.
What happens when Control Risk is below the maximum level?
Auditor tests Internal Controls.
Auditor evaluates Control Risk based on tests
Auditor adjusts substantive tests accordingly
Weaker Internal Control - More substantive tests
Stronger Internal Control - Less substantive tests
Describe some common examples of Control Activities.
Segregation of Duties
What should an auditor understand with respect to Information and Communication on an audit?
Major transaction classes
Financial Statement internal reporting process
Financial Statement external reporting process
How must an auditor document understanding of Internal Control?
Through written documentation such as Internal Control memos- flowcharts- and questionnaires
What questions should be asked to determine the risk of material misstatement?
Were all transactions recorded?
Were they timely?
Recorded in correct period?
Presented and disclosed properly?
Did Management communicate their responsibilities?
What is the purpose of testing Internal Controls?
Auditor needs reasonable assurance that controls are functioning as designed and effective
Internal Control Testing should be strong as (IRON) so that nothing gets past them
Inquiry - Interview company personnel
Re-performance - Can it be replicated?
Observation - Watch the control be applied
INspection - Dig into the details/documents
If results are as expected- substantive procedures do not need to be adjusted
When can controls tested by an auditor in a prior year be used in the current year's audit assessment?
Controls tested by auditor in a prior year can be used in the current year's audit assuming they are re-tested every third year
Exception If the control has changed since the last audit
What happens if Internal Controls are deficient?
Control Risk increases
Scope of substantive procedures increases
Detection Risk decreases
Material Weakness - Reasonable possibility that a material misstatement in Financial Statements would not be found- more than a remote chance of occurrence
What is a Material Weakness?
Reasonable possibility exists that a material misstatement in Financial Statements would not be found- and has more than a remote chance of occurrence.
What does Tracing test?
Starts with source document and traces forward to the journal entry.
What does Vouching test?
Starts with a journal entry and searches for a voucher or source document to support the entry.
What activities represent Segregation of Duties?
Non-compatible duties performed by separate individuals- such as
Authorization of asset disbursement vs. Recording of Assets vs. Custody of assets
If supporting audit evidence doesn't exit - use Observation and Inquiry
Accounting should be segregated from Production
With respect to signing checks - how are duties segregated?
Employees who prepare vouchers/invoices should not also have the authority to SIGN CHECKS
Tip - Remember this as an underlying theme with Segregation of Duties. The authority to make a payment should not also lie in the hands of those creating invoices/vouchers. Why? People commit fraud by setting up fake companies and basically paying themselves
With respect to custody of assets - how should duties be segregated?
Employees who have custody of assets should not also RECORD those assets
Someone in charge of petty cash should not also control the petty cash records
Treasury Department (custodians) should NOT have record keeping duties
They control assets and should not be able to adjust any recording of those assets
What are the limitations on Control Activities?
Controls can't stop collusion or bad judgment
Management can override controls
Cost vs. Benefit relationship of Internal Control
What is required if a Material Weakness is identified?
A written report to management is required.
Report declaring that no material weaknesses were found is allowed
Previous weaknesses reported that still exist should be reported again
Should be reported no later than 60 days after audit report release date
If one or more material weaknesses is uncorrected at year-end- an Adverse Opinion on Internal Control must be given