9.6 Flashcards
To what degree, if at all, is a significant deficiency related to a material weakness?
It is less severe than a material weakness.
A significant deficiency is a deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness but that merits attention by those charged with governance.
Which of the following best describes a CPA’s engagement to report on an entity’s internal control over financial reporting?
An audit engagement that results in issuance of a report relating to the effectiveness of internal control.
In such an attest engagement, the auditor issues a report relating to the effectiveness of the entity’s internal control over financial reporting. The practitioner, as part of engagement performance, obtains from management a written assessment about such effectiveness. AU-C 940 and AS 2201 define the objective of the engagement to express an opinion on the effectiveness of internal control over financial reporting similarly.
An auditor is auditing a mutual fund company that uses a transfer agent to handle accounting for shareholders. Which of the following actions by the auditor would be most efficient for obtaining information about the transfer agent’s internal controls?
Review reports on the suitability of design and operating effectiveness of controls produced by the agent’s own auditor.
The mutual fund auditor can use the service auditor’s report to gain an understanding of the controls and to assess the risk of material misstatement at the transfer agent.
Management of an issuer subject to SEC requirements requests the auditor to report on whether a previously reported material weakness in internal control continues to exist. The request comes 3 months after the annual audited financial statements and report on internal control were released.
The auditor may accept the engagement if management provides a statement that the identified material weakness no longer exists.
PCAOB AS 6115 applies to engagements solely to report on whether a previously reported material weakness continues to exist. Such an engagement is voluntary and may be performed as of any reasonable date selected by management. To perform such an engagement, the auditor should receive a written report from management that the identified material weakness no longer exists as of the date specified. The auditor then applies appropriate procedures to assess whether remediation has been accomplished.
An auditor is auditing internal control in conjunction with the audit of financial statements for an issuer. The auditor is considering the appropriate materiality level for planning the audit of internal control. Relative to the materiality level for the audit of the financial statements, materiality levels for the audit of internal control are
The same.
Auditing standards indicate that the auditor should use the same materiality considerations in the audit of internal control over financial reporting that (s)he would use in planning the audit of annual financial statements.
In identifying matters for communication with an entity’s audit committee, an auditor most likely would ask management whether
It consulted with another CPA firm about accounting matters.
Unless all those charged with governance are managers, the auditor should communicate his or her views on significant accounting and auditing matters about which management consulted with other accountants (AU-C 260).
In an integrated audit, an auditor should issue an adverse opinion on the effectiveness of an entity’s internal control in which of the following situations?
A material weakness exists.
An audit of the effectiveness of internal control over financial reporting is integrated with an audit of the financial statements. If the engagement determines that a material weakness exists, the auditor should express an adverse opinion on the effectiveness of internal control (AU-C 940).
Which of the following statements is true about an auditor’s communication with those charged with governance?
This communication should include management changes in the application of significant accounting policies.
The auditor should communicate to those charged with governance, among other things, management’s selection of and changes in significant accounting policies or their application. The auditor also should determine that those charged with governance are informed about the methods used to account for significant unusual transactions and the effects of significant accounting policies in controversial or emerging areas (AU-C 260).
When the regular audit leading to an opinion on financial statements discloses specific circumstances that create suspicion that fraud may exist, and the auditor concludes that the results of such fraud, if any, could not be so material as to affect the opinion, (s)he should
Refer the matter to the appropriate representatives of the client with the recommendation that it be pursued to a conclusion.
The auditor should refer the matter of an immaterial fraud to an appropriate level of management. The appropriate level of management is at least one level above the highest level involved. The auditor should also be satisfied that, in view of the organizational position of the likely perpetrator, the fraud has no implications for other aspects of the audit or that those implications have been adequately considered (AU-C 240).
The development of constructive suggestions to a client for improvements in its internal control is a
Desirable by-product of an audit engagement.
During an audit, the auditor may become aware of matters related to internal control that may be of interest to management and those charged with governance. Those matters meeting the definition of significant deficiencies or material weaknesses in internal control should be communicated in writing. Other deficiencies that merit attention should be communicated to management either orally or in writing. The auditor may make constructive suggestions to the client for improvements in its internal control for the benefit of management or others.
The activities of the user entity and the service organization have a high degree of interaction. The user auditor
Need not test the service organization’s internal control if the user entity has effective controls related to service organization processing.
The significance of controls at the service organization depends on the degree of interaction between its activities and those of the user entity. The degree of interaction is the extent to which the user entity can, and chooses to, implement effective controls over service organization processing. In these circumstances, the user auditor may be able to obtain an understanding from the user entity of the service organization’s services that suffices to assess the RMMs. Accordingly, the user auditor need not obtain a type 1 or type 2 report.
A service auditor’s report on internal control may be issued on management’s description of a service organization system and the suitability of the design of controls or management’s description of a service organization system and the suitability and operating effectiveness of controls. Which of the following is true about a type 1 report?
It should state that the auditor did not test the effectiveness of the controls.
A service auditor’s type 1 report should contain a statement that the auditor did not test the effectiveness of the controls.
The AICPA has issued additional guidance on service auditor reports. The term System and Organization Controls (SOC) report is used in this guidance. The reports obtained by the user auditor in an audit are called SOC 1 reports (type 1 or type 2). Service auditors also may prepare SOC 2 and SOC 3 reports to provide assurance on more than internal controls over financial reporting (e.g., security, availability, processing integrity, confidentiality, or privacy). SOC 2 reports are to be used by those identified in the report, and SOC 3 reports may be used by any user.
Which of the following is least likely indicative of a significant deficiency or material weakness in internal control?
A potential future internal control problem having no effect on the current period.
According to AU-C 265, the auditor should communicate material weaknesses and significant deficiencies in internal control to management and those charged with governance. A material weakness is a deficiency, or combination of deficiencies, in internal control such that a reasonable possibility exists that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance. However, an auditor is not required to report a potential future internal control problem unless it affects the period under audit.
Which of the following statements is true about the auditor’s communication of a material weakness in internal control?
Suggested corrective action for management’s consideration concerning a material weakness need not be communicated to the client.
Although the auditor should communicate material weaknesses to management and those charged with governance, suggested corrective action need not be communicated.
During the audit of internal controls integrated with the audit of the financial statements, the auditor discovered a material weakness in internal control. The auditor most likely will express a(n)
Adverse opinion on internal control.
Material weaknesses are significant control deficiencies that result in more than a remote chance that a material misstatement will result in the financial statements. A material weakness requires the auditor to express an adverse opinion on the effectiveness of internal control.
