1.22.19 Flashcards
Which of the following statements about an auditor’s communication of internal control related matters identified in an audit of a nonissuer is true?
The auditor should communicate significant internal control related matters no later than 60 days after the report release date.
Timely communication of significant deficiencies or material weaknesses should be made no later than 60 days after the report release date. But the communication is best made by the report release date. However, early communication may be important because of the significance of the matters noted and the urgency of corrective action.
Which of the following matters in a financial statement audit is most appropriate to communicate with those charged with governance?
An overview of the planned time and scope of the audit.
The auditor should communicate with those charged with governance (1) the auditor’s responsibilities under generally accepted auditing standards, (2) an overview of the planned scope and timing of the audit, and (3) significant findings from the audit.
The Code of Professional Conduct contains Principles that guide all members of the AICPA. A commitment to act for the benefit of clients, creditors, investors, and others is most directly embodied in which Principle?
The public interest.
All members of the AICPA should act to benefit the public interest, honor the public trust, and demonstrate commitment to professionalism. The AICPA adopted ethical standards because a distinguishing mark of a profession is an acceptance of responsibility to the public. The public includes clients, credit grantors, investors, and others who rely on the integrity and objectivity of members to maintain the orderly functioning of commerce.
The auditor should establish an overall audit strategy. Which one of the following statements is most consistent with this requirement?
The auditor should plan the audit so that it will be performed effectively.
An audit plan is developed and documented based on the overall audit strategy. It is more detailed than the audit strategy because it includes the nature, timing, and extent of work to be performed. The plan includes (1) risk assessment procedures, (2) further audit procedures at the assertion level, and (3) other procedures to comply with GAAS.
When obtaining an understanding of an entity’s control environment, an auditor should concentrate on the substance of controls rather than their form because
Management may establish appropriate controls but not act on them.
In obtaining an understanding of the control environment, the auditor seeks to understand the attitude, awareness, and actions concerning the control environment on the part of management and the directors. For this purpose, the auditor must concentrate on the substance of controls rather than their form because controls may be established but not acted upon. For example, management may adopt a code of ethics but condone violations of the code.
Internal control is strengthened when the quantity of merchandise ordered is omitted from the copy of the purchase order sent to the
Receiving department.
A receiving department should accept merchandise only if a purchase order or approval granted by the purchasing department is on hand. A standard control is to delete the quantity from the receiving department’s copy of the purchase order. If the receiving clerk does not know the quantity ordered, an independent count is more likely.
Which of the following is an element of a CPA firm’s quality control policies and procedures applicable to the firm’s accounting and auditing practice?
Engagement performance.
Engagement performance relates to policies and procedures implemented by a CPA firm to ensure quality performance of each engagement. Matters addressed include responsibilities for consistency of performance, supervision, and review.
A CPA’s understanding of internal control in a financial statement audit of a nonissuer
Is usually more limited than that made in an audit of internal control integrated with an audit of financial statements.
The scope of the understanding of internal control in a financial statement audit of a nonissuer is usually less than that in an audit of internal control integrated with an audit of financial statements. In the integrated audit, the auditor tests controls to support the opinion on the effectiveness of internal control. To express an opinion on internal control, the auditor obtains evidence about the effectiveness of selected controls over all relevant assertions. When obtaining the understanding of internal control during a financial statement audit, the auditor need not test controls unless (1) the auditor’s risk assessment is based on an expectation of the effectiveness of controls or (2) substantive procedures alone do not provide sufficient appropriate evidence.
In an integrated audit, if an auditor concludes that a material weakness exists as of the date specified in management’s assertion, the auditor should take which of the following actions?
Issue an adverse opinion.
A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that a reasonable possibility exists that a material misstatement of the entity’s annual or interim financial statements will not be prevented or detected on a timely basis. A material weakness requires the auditor to express an adverse opinion on the effectiveness of internal control.
The understanding with the client regarding a financial statement audit generally includes which of the following matters?
The responsibilities of the auditor.
The auditor should establish an understanding with the client through a written communication regarding the services to be performed. The objectives and limitations of the audit as well as the responsibilities of the auditor and management should be described in a contract stated in an engagement letter.
The activities of the user entity and the service organization have a high degree of interaction. The user auditor
Need not test the service organization’s internal control if the user entity has effective controls related to service organization processing.
The significance of controls at the service organization depends on the degree of interaction between its activities and those of the user entity. The degree of interaction is the extent to which the user entity can, and chooses to, implement effective controls over service organization processing. In these circumstances, the user auditor may be able to obtain an understanding from the user entity of the service organization’s services that suffices to assess the RMMs. Accordingly, the user auditor need not obtain a type 1 or type 2 report.
Which of the following statements is correct concerning an auditor’s responsibility to report fraud?
The disclosure of fraudulent activities to parties other than the client’s senior management and its audit committee is not ordinarily part of the auditor’s responsibility.
The auditor should obtain reasonable assurance about whether the financial statements are free from material misstatement, whether due to fraud or error. However, if noncompliance or fraud is found, disclosure of these acts to outside parties ordinarily is not the auditor’s responsibility and would violate the duty of confidentiality (AU-C 240).
Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by
Direct participation by the owner of the business in the recordkeeping activities of the business.
The manner in which control objectives are achieved varies with the size and complexity of the entity. Thus, direct participation of an owner-manager in the recordkeeping and other activities of the business facilitates monitoring of employee actions. Such effective involvement may preclude the need for extensive accounting procedures, sophisticated information systems, or written policies.
An entity has many employees who access a database with numerous access points. The database contains sensitive information about the customers of the entity. Access controls prevent employees from entry to those areas of the database for which they have no authorization. All salespersons have certain access permission to customer information. Which of the following is a true statement about the nature of the controls and risks?
A salesperson’s access to customer information should extend only to what is necessary to perform his or her duties.
Internal control risks vary with the nature and characteristics of IT usage. Employees should be allowed access to systems only to the extent necessary for them to carry out their responsibilities.
Which of the following audit activities is an analytical procedure used to form an overall conclusion to ensure that the financial statements are free from material misstatement?
Comparing the current year’s financial statements with those of the prior year.
Analytical procedures used to form an overall conclusion ordinarily include reading the financial statements and notes and considering (1) the adequacy of evidence regarding unusual or unexpected balances detected in planning or performing the audit and (2) such balances or relationships not detected previously.
