3 Planning and Risk Assessment Flashcards
What are the preconditions for an audit?
Before agreeing to conduct an audit, the auditor should determine that manatement:
- uses an acceptable financial reporting framework (ex- GAAP) in preparation and fiar presentation of the financial statements
- understands its responsibility for the preparation and fair presentation of the financial statements
- understands its responsibility for the design, implementation, and maintenance of internal control
- understands its responsibility to provide access to all information and persons deemed necessary for the audit
What is client acceptance?
Client acceptance includes the continued evaluation of existing clients and the evaluation of new clients.
What happens if an audito concludes that management lacks integrity?
It causes the auditor to reject a potential client or to end a relationship with an existing client.
Should the auditor communicate with the predecessor auditor befoer final acceptance of the engagement?
Yes
Who is responsible for initiating the communication when determining client acceptance?
The auditor
Should the client and the predecessor auditor obtain client permission to have discussions about the integrity of management and other audit-related issues?
Yes, AICPA Code of Professional Conduct requires members to protect the confidentiality of client information
What inquiries should be made to the predecessor auditor?
- facts that are relevant to the integrity of management
- disagreements with management about accounting principles, audit procedures, or other similar matters
- communications to those charged with governance (ex- the audit committee) about fraud and noncompliance with laws and regulations
- communications to management and those charged with governance about significant deficiencies and material weaknesses in internal control
- the predecessor’s understanding as to the reason for the change in auditors
What inquiries should be made to the predecessor auditor?
- facts that are relevant to the integrity of management
- disagreements with management about accounting principles, audit procedures, or other similar matters
- communications to those charged with governance (ex- the audit committee) about fraud and noncompliance with laws and regulations
- communications to management and those charged with governance about significant deficiencies and material weaknesses in internal control
- the predecessor’s understanding as to the reason for the change in auditors
What happens if the client refuses to grant permission to communicate with the predecessor auditor or the predecessor auditor fails to respond fully?
This requires the auditor to consider the implications when deciding whether to accept the engagement.
If management requests to change the terms of the engagement, what should the auditor do?
Evaluate the changes for reasonableness
If management’s changes are unreasonable and the auditor is not permitted to continue the original engagement, what should the auditor do?
The auditor should withdraw and communicate the circumstances to those charged with governance
If management’s changes are unreasonable and the auditor is not permitted to continue the original engagement, what should the auditor do?
The auditor should withdraw and communicate the circumstances to those charged with governance
What is quired for the terms of the engagement?
- the auditor should agree with management or those charged with governance up on the terms
- the terms should be documented in an engagement letter
- an engagement letter should be sent by the CPA to the prospective client on each engagement, audit or otherwise
In relation to the terms of engagement, when should the auditor accept the engagement?
The preconditions for an audit are present and a common understanding of the terms has been reached.
What are preconditions of an engagement?
They relate to the fundamental responsibilities of management and, if appropriate, those charged with governance.
These are included in a statement of responsibilities in an engagement letter.
What are preconditions of an engagement?
They relate to the fundamental responsibilities of management and, if appropriate, those charged with governance.
These are included in a statement of responsibilities in an engagement letter.
What should be included in an engagement letter?
- objective and scope of the audit
- responsibilities of the auditor and management
- inherent limitations of the audit and internal control
- the financial reporting framework
- the expected form and content of audit reports
When is a contract formed between a CPA and a client?
If the client agrees to the terms by signing a copy of the engagement letter and returning it to the CPA.
What is the initial step in planning an audit?
Developing an overall audit strategy.
What can affect audit planning?
The size and complexity of the entity, the auditor’s experience with the entity, and changes in circumstances during the audit.
How long does audit planning last?
Planning continues throughout the audit.
What should the auditor consider in develping the audit strategy?
- characteristics of the engagement and reporting objectives
- determination of materiality
- areas of high risk of material misstatement
- involvement of specialists and use of component auditors
- management’s commitment to sount internal control
- relevant entity-specific, industry, or financial developments
- audit resources required
- the results of preliminary engagement activities related to matters such as continuance of the client, compliance with ethical requirements, and the terms of the engagement.
What is the engagement partner’s role in an audit?
They are responsible for directing, supervising, and performing the audit in accordance with professional standards, legal and regulatory requirements, and firm policies.
What is an audit plan?
An audit plan, based on the audit stragegy, is developed and documented for all audit engagements and includes the nature, timing, and extent of procedures expected to reduce audit risk to an acceptably low level.
What is included in an audit plan?
- a description of risk assement procedures
- a description of further procedures at relevent assertion levels for material classes of transactions, account balances, and disclosures
- a description of any other procedures required by GAAS or the PCAOB
When are further procedures to be performed?
In response to assessed risks and evaluations of audit evidence collected to date.
What are futher procedures based on?
This element of the plan is based on:
- the decision whether to test the operating effectiveness of controls
- the nature, timing, and extent of planned substantive procedures
The overall audit strategy and audit plan are likely to be adjusted as the audit progresses. What is an example?
The auditor may change the nature, timing, and extent of further audit procedures as risk assessments are revised.
Are changes in the overall audit strategy and the audit plan documented?
Yes
Planning also involves determining whether and to what extent the services of IT, Tax and other specialists will be required. Should the auditor have supervisory responsibility for the specialists?
Yes
When involving specialists in an audit, what should the auditor have sufficient knowledge to do?
- communicate their objectives
- evaluate whether their planned procedures will achieve the objectives
- evaluate the results
When involving specialists in an audit, what should the auditor have sufficient knowledge to do?
- communicate their objectives
- evaluate whether their planned procedures will achieve the objectives
- evaluate the results
When communicating with management about performing the audit, what should the auditor do?
Discuss elements of planning, but the communication should not compromise the audit, for example, by making detailed procedures too predictable.
When communicating with management about performing the audit, what should the auditor do?
Discuss elements of planning, but the communication should not compromise the audit, for example, by making detailed procedures too predictable.
What are examples of additional planning considerations for initial audits?
- performance of quality control procedures, such as those related to acecptance and continuance of clients and engagements, assignment of engagement teams, ethical requirements, and performance
- communicate with the predecessor auditor
- major issues discussed with management
- planned audit procedures regarding opening balances to gain assurance
Gaining assurance about opening balances is perfmormed to provide?
- assurance that opening balances do not contain misstatements that materially affect the current period’s financial statements
- assurance that accounting policies reflected inthe opening balances have been consistently applied in the current period’s financial statements
When the prior-period statements were audited by a predecessor auditor, what should the auditor request management to authorize the predecessor to do?
Management should authorize the predecessor to:
- allow a review of audit documentation
- respond fully to inquiries by the auditor
When the prior-period statements were audited by a predecessor auditor, what should the auditor request management to authorize the predecessor to do?
Management should authorize the predecessor to:
- allow a review of audit documentation
- respond fully to inquiries by the auditor
Ordinarily, what does the predecessor permit the auditor to review?
Audit documentation, including documentation of:
- planning
- risk assessement procedures
- further audit procedures
- audit results
- other matters of continuing accounting and audit significance
What may be affected by a predecessor’s denial or limitation of access?
- the auditor’s assessment of risk regarding the opening balances
- the nature, timing, and extent of the auditor’s procedures applied to the opening balances and the consistency of accounting principles
What happens if a possible material misstatement is discovered in the prior-period financial statements audited by a predecessor?
The successor auditor should request a meeting with management and the predecessor auditor to address the issue.
AU-C 220 addresses quality control for an audit, what does it state about informing team members?
Direction and Supervision - it states that informing team members involves:
- Their responsibilities, including ethical requirements and planning and performing the audit with professional skepticism.
- The objectives of the work
- The nature of the entity’s business
- Risks
- Potential problems
- The specific approach to the engagement
Why should team members hold discussions about the engagement?
So that questions about the engagement may be raised.
What considerations about the competencies of team members does supervision of the engagement include?
Considerations of the competencies of the team members:
- Whether they have enought time for the work
- Whether they understand the instructions
- Whether they can carry out the work in accordance with the audit plan
What does supervision of an audit include?
- tracking engagement progress
- addressing significant findings
- modifying the approach if necessary
matters may arise that should be considered by qualified team members during the engagement
According to AU-C 220 and QC 10, differences of opinion within the engagement team, with a consultant, or between the engagement partner and quality control reviewer should be resolved by?
The firm’s related policies and procedures
According to QC 10, how should disagreements be documented?
The disagreement should be documented with the conclusions reached after appropriate consultation
- conclusions should be documented and implemented
- the report should be released only after resolution of the matter
What is the difference between external and internal auditing?
External auditors express an opinion on the fairness of the financial statements, an internal auditor’s work is more comprehensive.
According to The Institute of Internal Auditors, what is internal auditing?
An independent, objective assurance and consulting function that adds value and improves an organizatin’s operations. Internal auditors evaluate and improve the effectiveness of governance, risk management, and control processes.
According to The Institute of Internal Auditors, what is internal auditing?
An independent, objective assurance and consulting function that adds value and improves an organizatin’s operations. Internal auditors evaluate and improve the effectiveness of governance, risk management, and control processes.
Internal auditors evaluate risks and the adequacy and effectiveness of controls regarding?
- The reliability and integrity of financial and operational information
- The effectiveness and efficiency of operations
- The safeguarding of assets
- Compliance with laws, regulations, and contracts
Internal auditor’s plans are more detailed and cover areas that normally are not considered by the independent auditor
Internal auditors evaluate risks and the adequacy and effectiveness of controls regarding?
- The reliability and integrity of financial and operational information
- The effectiveness and efficiency of operations
- The safeguarding of assets
- Compliance with laws, regulations, and contracts
Internal auditor’s plans are more detailed and cover areas that normally are not considered by the independent auditor
Internal auditors evaluate risks and the adequacy and effectiveness of controls regarding?
- The reliability and integrity of financial and operational information
- The effectiveness and efficiency of operations
- The safeguarding of assets
- Compliance with laws, regulations, and contracts
Internal auditor’s plans are more detailed and cover areas that normally are not considered by the independent auditor
Why do auditors obtain an udnerstanding of the entity and it’s environment?
- to determine materiality for planning the audit and evaluating it during the audit
- considering accounting policies and disclosures
- identifying areas for special audit consideration - Ex. complex financial transactions
- setting expectations for results of analytical procedures
- designing further audit procedures
- evaluating audit evidence - related to management’s assumtions and representations
Why do auditors obtain an understanding of the entity and it’s environment?
- to determine materiality for planning the audit and evaluating it during the audit
- considering accounting policies and disclosures
- identifying areas for special audit consideration - Ex. complex financial transactions
- setting expectations for results of analytical procedures
- designing further audit procedures
- evaluating audit evidence - related to management’s assumtions and representations
How do auditors obtain an understanding of the entity and it’s environment, including internal controls?
They perform risk assessment procedures
What risk assessment procedures are performed by an auditor?
- inquiries of management, appropriate individuals in the internal audit function, and others within the entity
- analytical procedures
- observation and inspection
They may also perform other appropriate procedures, such as inquiring of external parties (ex. legal counsel) or reviewing externally generated informatoin (ex. financial publications).
What risk assessment procedures are performed by an auditor?
- inquiries of management, appropriate individuals in the internal audit function, and others within the entity
- analytical procedures
- observation and inspection
They may also perform other appropriate procedures, such as inquiring of external parties (ex. legal counsel) or reviewing externally generated informatoin (ex. financial publications).
What risk assessment procedures are performed by an auditor?
- inquiries of management, appropriate individuals in the internal audit function, and others within the entity
- analytical procedures
- observation and inspection
They may also perform other appropriate procedures, such as inquiring of external parties (ex. legal counsel) or reviewing externally generated informatoin (ex. financial publications).
When inquiries are within the entity, who are they directed to?
They maybe directed to:
- those responsible for financial reporting
- those charged with governance
- to evaluate accounting policies, employees involved in complex or unusual transactions
- legal counsel
- marketing, sales, and production managers
- the risk management function
- information systems personnel
- others at different levels of authority who may have informatoin about the risks of material misstatements (RMMs)
What are examples of observation and inspection that provide support for inquiries and direct evidence about the entity and its environment?
- observing activities and operations
- inspecting documents and records
- reading reports - Ex. internal audit reports, interim statements, quarterly reports, and minutes of board meetings
- tours of facilities
- tracing financial transactions through the information system (a walk-through)
The understanding of the entity should go beyond informatoin in the general and subsidiary ledgers, what does this include?
- industry, regulatory, and other external factors, including accounting framework
- the nature of the entity, including its operating characteristics
- ownership and governance structures, expecially complex structures such as those that include subsidiaries or multiple locations
- investments and investment activities, such as acquisitions, divestitures, and capital outlays
- financing activities
- selection and application of accounting principles, including any changes
- objectives and strategies and the related business risks, sushc as those related to new products, markets, or expansion
- measurement and review of financial performance as an indication of what the entity considers important
How do business risks arise?
They can result from:
- significant factors that could adversely affect an dntity’s ability to achieve objectives and execute strategies
- setting inappropriate objectives and strategies
The auditor should obtain an understanding of the entity’s objectives and strategies and the related business risks with immediate or longer-term consequences that may result in risks of material misstatement. Ex. - risks may result from developing new products that may fail.
How should prior-period information be used?
It should be used to gain an understanding of the entity and it’s environment (structure, nature of business, controls, and responses to prior misstatements). However, procedures should be performed to evaluate its current relevance
How should prior-period information be used?
It should be used to gain an understanding of the entity and it’s environment (structure, nature of business, controls, and responses to prior misstatements). However, procedures should be performed to evaluate its current relevance
When designing auditing procedures what is specifically assessed?
The risk of material misstatement (RMM) due to fraud. This assessment is considered in designing auditing procedures.