8 Audit Procedures Evidence Gathering and Evaluation Flashcards
What does audit evidence need to be?
Sufficient, relevant and reliable, for the purposes of the audit opinion
What are the 5 ESSENTIAL criteria audit evidence must support
To achieve this aim and be relevant to the audit objectives, there must be sufficient and reliable audit evidence about all of the following:
1. Existence (assets and liabilities at y/e) and occurrence (transactions throughout the year). Genuine or not?
2. Completeness (includes accuracy of recording and correct cut-off)
3. Rights and obligations (per conceptual framework definitions of assets and liabilities)
4. Valuation and/or measurement (in accordance with relevant IAS / FRS)
5. Presentation or disclosure (in accordance with relevant IAS / FRS and/or Companies Act)
What is occurance
Transactions and events that have been recorded have occurred and pertain to the entity – i.e. they are genuine
What is completeness
- All transactions and events that should have been recorded have been recorded
- “Completeness” includes:
o Accuracy and reliability of data recording and processing throughout the year – amounts and other data relating to transactions and events have been classified and recorded appropriately so that y/e transaction totals and balances are not over/under recorded
o Correct cut-off – transactions and events have been recorded in the correct accounting periods
What is presentation and disclosure
Financial information is appropriately presented and described, and disclosures are clearly expressed in accordance with International Accounting Standards, the Companies Act, and LSX listing rules
What is the correct cut off
- Sales and purchases recorded in the correct month
- Accidental cut of errors are fairly common, but management can apply deliberate cut-off ‘errors’ as a means of window-dressing. See topic 4 re Thomas Gerard legal case
- Easy place for management to apply fraudulent accounting as errors here are common and therefore if they are caught they can pass it off as just a mistake
- General rule sale is considered to be the point of dispatch
What is existence
Assets, liabilities, and equity interests exist (they are genuine) (reliable)
What is completeness
All assets, liabilities and equity interests that should have been recorded have been recorded, and y/e cut-off is correct for debtors, creditors and inventory (reliable)
What is rights and obligations
The entity holds or controls the rights to assets, and liabilities are the obligations of the entity (they meet the ASB definitions of assets and liabilities) (reliable and relevant)
What is valuation and measurement
Assets, liabilities, and equity interests are included in the financial statements at appropriate amounts in accordance with International Accounting Standards, to show a ‘true and fair view.’ (reliable)
What is presentation and disclosure
Financial information is appropriately presented and described, and disclosures are clearly expressed in accordance with International Accounting Standards, the Companies Act, and LSX listing rules. (understandable, relevant, consistent).
What are internal controls
- Internal control is ‘all embracing’ and includes absolutely everything which is designed/intended to help an organization achieve any of the above objectives.
- All internal controls are ultimately the responsibility of the directors
What are the objectives of internal controls
Internal controls within accounting systems typically have one or more of the following specific objectives:
* Ensuring complete and reliable data processing (accounting records)
* Ensuring proper authorization, and preventing unauthorized transactions
* Safeguarding assets
* Detecting/preventing/correcting errors
* Deterring fraud (by making fraud more difficult and/or increasing the chance of detection)
* Facilitating management supervision and review (includes internal checks and reconciliations, and internal audit)
* Maintaining an audit trail
What are the limitations of internal controls
- All systems of internal control are designed, operated and supervised by human beings.
o Some are more careful and honest - Therefore, they will never be perfect. CR will never be zero
o Therefore AR can never be zero
Why is the segregation of responsibilities important when considering internal controls
- This is a very important feature of internal control, and auditors will always look for this. It involves the division of functional responsibilities between different people, together with regular ‘internal checks’ and/or reconciliation by different members of staff and/or supervisors.
- This can greatly reduce the risks of undetected errors, unauthorized transactions.
How does strong internal controls make fraud harder
- Fraud would require collusion, in a well designed system
- Fraud by nature is devious and by nature carefully concealed
- If good segregation then need lots of people to come together to create a successful fraud
How does strong internal controls reduce audit work
- Strong segregation will allow auditors to place more reliance on compliance testing and do less substantive testing
o Lower control risk and reliable internal control and records
o Also accidental errors are far more likely to be detected
What are the 4 main functions of controls that need separating (CARR)
Custody
* Maintains safe custody of particular assets/money/data. Can only accept/release assets after authorization (see below). Should deliver information to the record keeping function (see below).
Authorisation
* Authorises activities and takes decisions (of transactions/events relating to those assets).
Recording
* Records all the activities/events taking place (complete and reliable accounting records).
Reconciliation
* Independently checks and reconciles assets against authorisations and accounting records.
What are the components of internal controls
- Control environment
- Entity’s risk assessment processes
- Information systems
- Control activities
- Monitoring of controls
What is the control environment
- This is important and pervasive.
- It sets the overall tone for the entire organisation and influences the consciousness of its people.
o Leadership comes from to top directors must set a good example for all lower members of staff - It is the foundation for all other components of the internal control structure.
- It Includes corporate governance (based on the UK C.G. Code, see Gray & Manson Chapter 5), integrity, ethical values and management attitudes to internal controls
o UK companies either have to comply with the corporate governance code of explain why not. It is not law so cant force companies
What are the elements of the control environment
- Communication and enforcement of integrity and ethical values
- Commitment to competence
- Management’s philosophy and operating style
- Organizational structure
- Assignment/delegation of authority and responsibility
- Human resource policies and practices
o If any of the above are unsatisfactory, it is likely that ‘inherent risk’ and ‘control risk’ will BOTH be higher
What should a risk assessment cover
- This involves detailed analysis by the PLC of its strategic, operational and market risks.
- Some of these may be highly unpredictable
- Public companies should consider the possibilities of various business risks crystallizing and the significance of the consequent financial impacts on the business. These are part of ‘inherent risk’, because they can have very serious impacts on profitability and asset values, and even ‘going concern’. Therefore, they impact the financial statements.
- When this has been done, suitable internal controls should be introduced to monitor and reduce risks to acceptable levels, to the extent that this is possible.
How can information systems support the 5 criteria
- Relevant and timely information about internal activities and external factors are essential if a company is to be successful. We live in the ‘information age’.
- Successful managers need timely, relevant and reliable information e.g. ‘management accounts’.
What is an accounting system
- It comprises all of the methods and records established to identify, assemble, analyse, classify, record and report transactions and accounting events, and maintain accountability for all assets and liabilities.
- It must also provide a complete audit trail for ALL transactions.
What is communication
Communication involves a clear organisation structure with good understanding of individual roles and responsibilities with respect to all functions and internal controls over internal and external reporting i.e. financial reporting and management accounting
What are control activities
These are the policies and procedures designed to ensure that management directives are carried out and that necessary actions are taken to address problems and risks as these arise.
What are examples of control activities
- Authorisation by designated staff only (and controls to prevent unauthorised actions)
- Performance reviews
- Physical controls
- Segregation of duties between custody, authorisation, recording, and reconciliation
- General controls and application controls over information processing
What are general controls
- General controls are controls over the environment in which information processing operates.
- They should ensure that applications are trouble free and prevent, detect or correct events that management do not intend to happen. They include:
o Systems development and maintenance controls
o Organizational controls, e.g. organisation chart, supervision, segregation of duties, proper authorisation of transactions, recording and safe custody, computer security.
What are application controls
- Application controls are designed to ensure individual applications/processes run smoothly. They include:
o Documentation and records
o Independent checks
What are monitoring controls
- This are any activities or procedures designed to assess the performance of controls and their adequacy and relevance over time, such that internal control failures and/or weaknesses are identified, reported to management, and resolved.
- The majority of large organisations have an internal audit department.
o Note: internal audit is a part of the internal control structure. The objectives of internal audit fall within the overall definition of internal control.
What are external audits on monitoring controls
- When external auditors identify internal control weaknesses, usually they will inform the client’s management.
- The notification is normally in the form of a ‘letter of weakness’ or ‘management letter’ which is provided to the client when the audit has been completed.
- Generally, this will include recommendations for improving internal control.
o This is a useful ‘service’ but is NOT part of the external auditor’s duties (lecture topic 1).
o Is benefit to both client as can improve controls and to auditor as strengthens internal controls so reduces control risk next year
What are the limitations on internal controls
- ‘Overarching limitation’ all systems of IC are designed, operated and supervised by human beings.
o Therefore, they will never be perfect. CR will never be zero!
o However, ICs can be highly effective, and those control risks related to Information systems and Control activities can be very low. - Internal controls may potentially be over-ridden by management.
o For example, if the Board of Directors want to ‘window-dress’ the accounts, they are only prevented by code of corporate governance
o The most effective check on ‘board level’ behaviour is sound and ethical corporate governance, in compliance with the UK C.G. Code.
As would have independent audit directors overseas activities
What is the audit ‘context’ for sales and debtors
- Sales generate profit and debtors are an asset.
- Therefore, it is extremely unlikely that the directors of a PLC would deliberately understate sales or debtors!
o However as sales is the largest, or the company would be loss making, it is the most material - If they are ‘window-dressing’, they might overstate sales or debtors or both. Therefore, in this context the main ‘audit risk’ is that of overstatement.
- There are a number of different ways in which sales and debtors can potentially be overstated, e.g. deliberate cut-off errors (see L8.1), recording of non-existent sales and/or debtors, understatement of sales returns transactions, understatement of bad and/or doubtful debts.
- However, these are not the only matter to be considered. All sections of the audit require evidence about all five assertion categories
How can you find a bad debt
- When the customer cannot be traced or is potentially insolvent
- Or when it would cost more to chase the debt than it is worth
o Good credit control would prevent this
o Therefore, looking at bad debts will allow you to understand the quality of the credit controls
How can information about bad debts relate to existence or occurrence
Transaction class audit objective
* Recorded sales and cash receipts represent goods shipped / services provided / cash received during the period. (sales are real and not made up)
* Recorded sales adjustments represent discounts, returns and bad debts during the period.
Account balance audit objectives
* Debtors represent amounts owed by customers at the y/e date
How can information about bad debts relate to completeness
Transaction class audit objective
* All sales, cash receipts, and sales adjustments transactions that occurred during the period have been recorded.
Account balance audit objectives
* Debtors include all claims on customers at the y/e date.
How can information about bad debts relate to rights and obligations
Transaction class audit objective
* The PLC has rights to the debtor balances and cash resulting from the revenue cycle transactions.
Account balance audit objectives
* Debtors represent legal claims of the PLC on customers at the y/e date.
How can information about bad debts relate to valuation or measurement
Transaction class audit objective
* All sales and cash receipts and sales adjustments are correctly journalised (classified), summarised and posted. Testing controls are working correctly
Account balance audit objectives
* Total accounts receivable in the draft f.s. agrees with the computer output and draft trial balance.
* The provision for doubtful debts is based on a reasonable estimate of the net realisable value of debtors.
How can information about bad debts relate to presentation or disclosure
Transaction class audit objective
* The details of sales, cash receipts and sales adjustment transactions are consistent with their classification and presentation in the income statement.
Account balance audit objectives
* Debtors are correctly identified and classified in the statement of financial position.
What is the difference between vouching and tracing
- These can be used in both compliance and substantive testing
- Difference is all about the direction of the test