8.3 Flashcards
When an auditor tests the internal controls of a computerized system, which of the following is true of the test data approach?
Test data are processed with the client’s computer and the results are compared to the auditor’s predetermined results.
The test data are processed by the client’s computer programs under the control of the auditor. These results are then compared to the auditor’s expectations.
The test data are processed by the client’s computer programs under the control of the auditor. These results are then compared to the auditor’s expectations.
The auditor’s objectives with respect to the assessment of the risks of material misstatement are the same as in a manual system.
The auditor is required to perform risk assessment procedures to obtain an understanding of the entity and its environment, including its internal control, to identify and assess the RMMs and to design further audit procedures. Whether the control system is manual or computerized does not affect this objective.
Which of the following types of risks most likely would increase if accounts receivable are confirmed 3 months before year end?
Detention.
Audit risk consists of (1) the risks of material misstatement (inherent risk combined with control risk) and (2) detection risk. The RMMs are the entity’s risks, and detection risk is the auditor’s risk. Detection risk is the risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a material misstatement. It is a function of the effectiveness of an audit procedure and its application by the auditor. Detection risk is the only component of audit risk that can be changed at the auditor’s discretion. An auditor who performs procedures at an interim date should cover the remaining period. The longer the remaining period, the greater the detection risk resulting from performing procedures at an interim date.
An auditor obtains a digital file that contains the dollar amounts of all client inventory items by style number. The auditor is aware that the client holds certain inventory styles on consignment for others. The auditor can best ascertain that the client’s inventory is not overstated by using a computer program that
Tests for and accumulates all amounts for items with style numbers indicating consigned merchandise.
Given that items on the inventory file are marked appropriately with style numbers, the auditor can best determine whether consigned merchandise is included by using a program that identifies and accumulates those items with style numbers corresponding to consigned merchandise.
How would an auditor of a nonissuer most appropriately respond to a heightened assessed risk of material misstatement?
By assigning more experienced staff or those with specialized skills to high-risk areas.
Overall responses apply to the assessed RMMs at the financial statement level. The following are examples of overall responses: (1) an emphasis on professional skepticism in evidence gathering and evaluation; (2) increased supervision; (3) assignment of staff with greater experience or expertise; (4) greater unpredictability in the choice of further audit procedures; and (5) changing the nature, timing, and extent of audit procedures, such as modifying the nature of a procedure to obtain more persuasive evidence. At the relevant assertion level, the response is to change the nature, timing, or extent of further audit procedures.
An auditor may compensate for a high assessed risk of material misstatement by
Increasing the extent of substantive analytical procedures.
When designing further audit procedures, the auditor obtains more persuasive evidence the higher the risk assessment. Thus, the auditor may increase the quantity of evidence or obtain more relevant or reliable evidence. Furthermore, the extent of audit procedures generally increases as the RMMs increase. For example, the auditor may increase sample sizes or perform more detailed substantive analytical procedures (AU-C 330).
After gaining an understanding of a client’s computer processing internal control, a financial statement auditor may decide not to test the effectiveness of the computer processing control procedures. Which of the following is not a valid reason for choosing to omit tests of controls?
The assessment of the risks of material misstatement permits the auditor to rely on the controls.
Although controls appear to be effective based on the understanding of internal control, the auditor should perform tests of controls when the assessment of the RMMs at the relevant assertion level includes an expectation of their operating effectiveness. This expectation reflects the auditor’s intention to rely on the controls in determining the nature, timing, and extent of substantive procedures.
When an auditor plans to rely on controls that have changed since they were last tested, which of the following courses of action would be most appropriate?
Test the operating effectiveness of such controls in the current audit.
Controls that have changed must be tested for operating effectiveness before they can be relied on.
Which of the following statements is not true of the test data approach to testing an accounting system?
The test data must consist of all possible valid and invalid conditions.
The test data approach includes preparation of dummy transactions by the auditor. These transactions are processed by the client’s computer programs under the auditor’s control. The test data consist of one transaction for each valid and invalid condition that interests the auditor. Consequently, the test data need not consist of all possible valid and invalid conditions.
An auditor who is testing computer controls in a payroll system will most likely use test data that contain conditions such as
Time tickets with invalid job numbers.
The auditor most likely tests computer controls for detection of time tickets with invalid job numbers. The validity of codes can be determined by the computer system. Testing of approvals, authorizations, and signatures usually require manual procedures.
As the acceptable level of detection risk increases for a given audit risk, an auditor may change the
Timing of substantive procedures from year end to an interim date.
For a given audit risk, the acceptable detection risk (the auditor’s risk) is inversely related to the assessed RMMs (the entity’s risks) at the assertion level. Detection risk is the risk that audit procedures will not detect a material misstatement. It relates to the nature, timing, and extent of procedures performed to reduce audit risk to an acceptably low level. Thus, it depends on the effectiveness of audit procedures and their application by the auditor (AU-C 330). For example, as the acceptable level of detection risk for a given audit risk increases, the audit effort devoted to substantive procedures may be reduced. The auditor may change the nature, timing, or extent of substantive procedures, for example, by changing the timing to an interim date.
Tests of controls in an advanced computer system
Can be performed using actual transactions or simulated transactions.
Tests of controls, that is, determining whether the prescribed controls are operating effectively at the assertion level, can be performed using either actual or simulated transactions. For example, the integrated test facility (ITF) method uses both actual and simulated transactions.
Which of the following is a computer-assisted audit technique that permits an auditor to insert the auditor’s version of a client’s program to process data and compare the output with the client’s output?
Parallel simulation.
Parallel simulation is the computer-assisted audit technique in which the auditor inserts the auditor’s version of the client’s program to reprocess client data and compare the output with the client’s output.
Which of the following is a step in an auditor’s decision to rely on internal controls?
Identify specific controls that are likely to prevent, or detect and correct, material misstatements and perform tests of controls.
An auditor should obtain an understanding of controls relevant to the audit. Thus, the auditor should evaluate their design and determine whether they have been implemented. The evaluation of design considers whether the controls can effectively prevent, or detect and correct, material misstatements (AU-C 315 and AS 2110). The auditor then tests relevant controls to obtain sufficient appropriate evidence about their operating effectiveness if (1) the auditor intends to rely on them in determining the nature, timing, and extent of substantive procedures, or (2) substantive procedures alone cannot provide sufficient appropriate evidence at the relevant assertion level (AU-C 330 and AS 2301).
Which of the following statements is false about the test data approach when testing a computerized accounting system?
Several transactions of each type must be tested.
The test data approach includes preparation of dummy transactions by the auditor. These transactions are processed by the client’s computer programs under the auditor’s control. The test data consist of one transaction for each valid and invalid condition that interests the auditor. The computer processes all similar transactions in the same way. Accordingly, only one transaction needs to be tested to determine whether a control is working effectively.
