9.7 Flashcards
Which of the following matters in a financial statement audit is most appropriate to communicate with those charged with governance?
An overview of the planned scope and timing of the audit.
The auditor should communicate with those charged with governance (1) the auditor’s responsibilities under generally accepted auditing standards, (2) an overview of the planned scope and timing of the audit, and (3) significant findings from the audit.
Which of the following is least likely indicative of a significant deficiency or material weakness in internal control?
A potential future internal control problem having no effect on the current period.
According to AU-C 265, the auditor should communicate material weaknesses and significant deficiencies in internal control to management and those charged with governance. A material weakness is a deficiency, or combination of deficiencies, in internal control such that a reasonable possibility exists that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance. However, an auditor is not required to report a potential future internal control problem unless it affects the period under audit.
Which of the following matters should an auditor communicate to those charged with governance?
The process used by management in formulating sensitive accounting estimates.
Certain accounting estimates are particularly sensitive because they are significant to the financial statements, and future events affecting them may differ from current judgments. Those charged with governance should be informed about the process used in formulating sensitive estimates, including fair value estimates, and the basis for the auditor’s conclusions about their reasonableness (AU-C 260).
Which of the following best describes the responsibility of an auditor of a private entity with respect to significant deficiencies and material weaknesses under AU-C 265, Communication of Internal Control Related Matters Identified in an Audit?
The communication by the auditor must be in writing.
The auditor communicates on a timely basis and in writing to those charged with governance significant deficiencies and material weaknesses identified during the audit. This communication includes those remediated during the audit. The auditor also communicates on a timely basis and in writing to the appropriate level of management significant deficiencies and material weaknesses communicated (or intended to be communicated) to those charged with governance. (But certain deficiencies should not be reported directly to management.)
When planning an engagement to audit the effectiveness of the entity’s internal control in an integrated audit of a nonissuer, a practitioner would least likely consider which of the following factors?
The evaluation of the operating effectiveness of the controls.
The audit of a nonissuer’s internal control over financial reporting should be integrated with the financial statement audit. Evaluating certain matters may assist the auditor’s planning of the audit, but the evaluation of the operating effectiveness of the controls is not one of those matters. This evaluation is not made until the auditor forms an opinion by considering the evidence obtained from all sources, including (1) tests of controls, (2) misstatements detected during the audit, and (3) identified deficiencies.
In the integrated audit, which of the following would not be considered an entity-level control?
The outside auditor’s assessment process of internal auditor competence and objectivity.
The auditor begins an integrated audit at the statement level by understanding overall risks to internal control over financial reporting. (S)he then focuses on entity-level controls and works down to significant classes of transactions, account balances, disclosures, and their relevant assertions. The following are examples of entity-level controls: (1) the control environment, (2) controls over management override, (3) monitoring of the results of operations, (4) controls over the period-end financial reporting process, (5) monitoring of other controls, and (6) the risk assessment process. But the outside auditor’s assessment process of internal auditor competence and objectivity is external to the entity.
A service auditor’s report on internal control may be issued on management’s description of a service organization system and the suitability of the design of controls or management’s description of a service organization system and the suitability and operating effectiveness of controls. Which of the following is true about a type 1 report?
It should state that the auditor did not test the effectiveness of the controls.
A service auditor’s type 1 report should contain a statement that the auditor did not test the effectiveness of the controls.
The AICPA has issued additional guidance on service auditor reports. The term System and Organization Controls (SOC) report is used in this guidance. The reports obtained by the user auditor in an audit are called SOC 1 reports (type 1 or type 2). Service auditors also may prepare SOC 2 and SOC 3 reports to provide assurance on more than internal controls over financial reporting (e.g., security, availability, processing integrity, confidentiality, or privacy). SOC 2 reports are to be used by those identified in the report, and SOC 3 reports may be used by any user.
In the audit, the auditor reports on the effectiveness of an entity’s internal control over financial reporting. Which of the following is not a condition of that engagement?
Management provides assurance that limitations inherent to internal control have been eliminated.
By their nature, limitations inherent to internal control cannot be eliminated. Thus, management is not expected to provide such assurance.
When an auditor is to conduct an audit of a service organization, what considerations should the auditor make in the planning stages regarding internal controls of the organization?
The auditor should determine whether management has adequately described complementary user controls.
The service auditor should obtain an understanding of the service organization’s system, including controls within the scope of the engagement. Understanding controls at the service organization requires evaluating management’s description of the service organization’s system, including complementary user entity controls (AT-C 320).
The AICPA has issued additional guidance on service auditor reports. The term System and Organization Controls (SOC) report is used in this guidance. The reports obtained by the user auditor in an audit are called SOC 1 reports (type 1 or type 2). Service auditors also may prepare SOC 2 and SOC 3 reports to provide assurance on more than internal controls over financial reporting (e.g., security, availability, processing integrity, confidentiality, or privacy). SOC 2 reports are to be used by those identified in the report, and SOC 3 reports may be used by any user.
Which of the following matters would an auditor most likely consider to be a significant deficiency or material weakness to be communicated to those charged with governance?
Evidence of a lack of objectivity by those responsible for accounting decisions.
Failures in internal control include deficiencies in internal control design and failures in the operation of internal control. An example of the second type is evidence of undue bias or lack of objectivity by those responsible for accounting decisions (AU-C 265).
Which of the following statements is true about the auditor’s communication of a material weakness in internal control?
Suggested corrective action for management’s consideration concerning a material weakness need not be communicated to the client.
Although the auditor should communicate material weaknesses to management and those charged with governance, suggested corrective action need not be communicated.
An auditor’s communication with the board of directors most likely should
Indicate that it is for the sole use of the board.
Communication may be either oral or in writing and should be documented. The auditor communicates significant findings from the audit in writing when (s)he judges that oral communication is inadequate. A written communication should indicate that it is for the sole use of those charged with governance.
An auditor would least likely initiate a discussion with a client’s audit committee concerning
The maximum dollar amount of misstatements that could exist without causing the financial statements to be materially misstated.
The auditor is responsible for determining the levels of materiality appropriate in the audit of a client’s financial statements. Only the general nature of materiality need be discussed.
An auditor (the user auditor) may decide to make use of another auditor’s (the service auditor’s) report on internal control at a service organization that provides certain services to the user auditor’s client. When the client’s transactions flow through the service organization’s accounting system, consideration of internal control may be necessary. The most efficient approach is often to obtain a service auditor’s report. Which of the following is a true statement about the relationship of the user and service auditors?
When reporting on an audit of financial statements, the user auditor should not refer to the service auditor’s report if the opinion is unmodified.
Because the service auditor is not responsible for auditing any portion of the financial statements being reported on by the user auditor, the service auditor should not be referred to in the user auditor’s report if the opinion is unmodified. But if the user auditor modifies the opinion because of a modified opinion by the service auditor, the user auditor may refer to the service auditor.
An auditor is required to establish an understanding with a client regarding the services to be performed for each engagement. For an auditor of a nonissuer, this understanding generally includes
The auditor’s responsibility for ensuring that management and those charged with governance are aware of any significant deficiencies or material weaknesses in control that come to the auditor’s attention.
An auditor should accept an engagement only when the basis for audit performance is agreed through (1) establishing whether the preconditions for an audit exist and (2) confirming that the auditor and management (and, possibly, those charged with governance) have a common understanding of the terms of engagement. The agreement typically is documented in an engagement letter (AU-C 210). An engagement letter for a nonissuer should indicate that a financial statement audit is not designed to provide assurance on internal control. However, the auditor is responsible for ensuring that management and those charged with governance are aware of any significant deficiencies or material weaknesses in control that come to his or her attention.
