A2 - Engagement Quality Flashcards
Who can sit on the audit committee?
○ 3-5 “outside directors” - directors who aren’t employees of the company
§ E.g. CEO usually sits on the BOD, they can’t sit on the AC though
○ Directors that don’t have a “material financial interest” in the company
§ E.g. outside director can’t have a big personal investment in the company
What does the AC do?
a) Appoint auditor and determine how much auditor is paid
b) Assurances the auditor is independent from the company
c) Review any auditor findings
d) Ensure audit is good quality
e) Ensure recommendations from auditor is given appropriate attention
f) Resolve disagreements between auditor and management
g) Evaluate internal control environment of the company
h) Report to BOD and stockholders
How often does the auditor need to be allowed private communications with the AC?
At least once a year
What are some of the things the auditor should assess before they accept an engagement?
a) Can they meet the reporting deadline
b) Do they have enough staff capacity
c) Independence
d) Management’s integrity
e) Management’s framework is acceptable
f) Management accepts responsibility for FS and internal controls
g) Management will give them access to all information relevant to the FS and unrestricted access to personnel within the company
This is one of the very rare circumstances in which “all” answers are correct
h) Scope limitations (e.g. client says that they don’t have adequate accounting records)
§ Or they can accept if a disclaimer of opinion is okay for the client’s purposes
§ If the management imposed scope limitation will result in a qualified opinion or the scope limitation is due to something beyond management’s control (e.g. a fire destroyed their records), then the auditor could still accept
What is the engagement letter and what should be included in it?
a. Addressee
b. Objective and scope of audit
§ Reasonable, not absolute, assurance
c. Responsibility of auditor
d. Responsibility of management
§ Management is responsible for preparing the FS and internal controls
e. Other relevant information
f. Reporting
g. Signature
h. Other relevant items
§ Information relating to the timing
§ Information about arrangements with the previous auditor
§ Management will provide responses in a timely manner
§ Information about specialists that will be used
What are the additional criteria for acceptance under an ERISA plan financial audit?
§ Maintain a current plan instrument
§ Plan is in conformity with the plan’s provisions
What is an ERISA Section 103(a)(3)(c) audit? What are management’s additional responsibilities?
□ Auditor doesn’t have to look at all of the investments b/c certain investments can be certified by a qualified institution
□ Management likes these types of audits b/c auditor does less and therefore management is charged less
□ If management wants to do this, they are responsible for making sure that:
® they qualify for that type of audit
® investment info can be prepared and certified
® information is appropriately measured, presented, and disclosed
□ Management also has to provide the auditor Form 5500 (not required in typical FS audit, only ERISA)
Do auditors of issuers and nonissuers need to obtain a new engagement letter every year?
- Issuers - auditor must obtain signed engagement letter EVERY YEAR
○ Signed by AC and auditor - Nonissuers - if no revision is necessary, auditor should remind management of the terms of the engagement letter (either orally or in writing)
What does the auditor have to do before the accept an audit?
*important area
○ Must talk to predecessor auditor
§ Must obtain client’s permission first
§ If management refuses, then you shouldn’t accept the engagement
○ Certain questions that they have to ask (HEAVILY TESTED AREA):
a) Management’s integrity
b) Disagreements with management
c) Reason for change in auditor
d) Any communication with AC (fraud, noncompliance, internal control matters)
e) Nature of entity’s relationships and transactions with related parties and unusual transaction
f) Look at predecessor’s working papers
What are the 6 elements of quality control?
Hint: HELP ME
1) Human Resources
§ Recruitment and hiring
§ Figure out who is going to what engagement
§ Performance evaluation, compensation, and advancement
2) Engagement/client acceptance and continuance
§ Should the firm accept a client or continue a relationship?
§ Can the firm reasonably expect to complete the engagement competently?
§ Legal and ethical requirements
3) Leadership responsibilities
§ Firm leadership bears ultimately responsibility for firm’s quality control system
4) Performance of the engagement
§ Policies & procedures to ensure engagements have proper supervision
§ Information is kept confidential and safe
5) Monitoring
§ Helps ensure policies and procedures are actually in place and being followed
□ Just b/c you have them, doesn’t mean they are followed
§ “Wrap-up” or second partner review by a partner not involved in the audit
□ Required for issuers
□ Not required for nonissuers
6) Ethical requirements
§ Helps maintain public confidence in the profession
§ Maintain independence
§ At least annually, employees fill out independence form
□ Includes their investments, spousal investments, spousal jobs, parents jobs, etc.
What is the difference between quality control standards and GAAS?
Quality Control Standards
- Applies to all professional activities of the firm
- HELP ME
GAAS
- Applies to each individual engagement
- Acceptance, risk and response, performing procedures and obtaining evidence, forming conclusions, reporting
- Doesn’t apply to stuff such as who you hired, do you have peer reviews, do you have proper training
*Failed or inadequate quality control ≠ lack of compliance with GAAS
What areas of work should an engagement partner not be delegating?
○ Critical judgement areas
○ Significant risks
○ Other areas based on significant professional judgement
What is an EQCR? Is this required for issuers and/or nonissuers?
EQCR is an engagement quality control review. It is performed by a partner not on the engagement who looks at a high level to make sure that important areas of the audit are being handled appropriately (e.g. sig judgement, independence, etc.).
Required for issuers
Performed only when required for nonissuers
Do the auditor’s working papers support the audit opinion or the client’s presented FS?
Audit opinion
○ Client’s records support their FS
○ Working papers are for us, not them
How long do you need to keep audit documentation for?
○ Nonissuer - 5 years
○ Issuer - 7 years
How long does the auditor have to gather their final documentation file after the report release date? Why does this matter?
○ Nonissuer - 60 days after report release date
○ Issuer - 45 days after report release date
○ Important date b/c after this date, you can’t delete or add anything to the file without extensive documentation
What are the 2 types of audit documentation?
- Permanent/Continuous Audit File
§ Things that are relevant for >1 year (e.g. pension plans, multi-year contracts, leases, stock options, bylaws, articles of incorporation, bond info) - Current File
§ Relates to this year (e.g. audit plan, audit report, FS, trial balance, adjusting JEs, confirmations, management representation letter, etc.)
What is a control?
a policy/procedure established to achieve the control objectives of management
What are the 3 categories of control management?
Hint: ERC
- Effectiveness and efficiency of operations
- Reliability - of financial reporting
§ Most relevant for audit - Compliance - with applicable laws and regulations
What is the COSO framework?
Committee of Sponsoring Organizations
- First released in 1992 to try and help entities reduce fraudulent financial reporting
- In 2013, the framework was updated to deal with all of the changes that have occurred since 1992
○ Introduced 17 principles that have been categorized into 5 major components
What are the 5 elements of internal controls? Which are considered direct and which indirect?
Hint: CRIME
Direct:
1. Control Environment
2. Risk Assessment
5. Monitoring Activities
Indirect:
3. (Existing) Control Activities
4. Information and Communication
What is the control environment part of internal controls?
Tone at the top of the organization
○ EBOCA
§ Ethics - commitment to ethics and integrity
§ Board - board independent and oversight
§ Organizational structure
§ Commitment to competence
§ Accountability
What is the risk assessment part of internal controls? What is the auditor’s additional responsibility in relation to IT risks?
Auditor tries to understand how management addresses risk areas
○ We want to make a “SAFR” environment
§ Specify objectives
§ Assess - identify and assess changes
§ Fraud - consider the potential for fraud
§ Risks - identify and analyze risks
- Auditor must also evaluate IT risk:
○ Potential reliance on inaccurate IT
○ Unauthorized access to data
○ Unauthorized changes to data
○ Potential loss of data
What is the (Existing) Control Activities part of internal controls?
Process an entity uses to assess the quality of their controls over time
○ CATP
§ Control Activities - select and develop control activities
§ Technology - select and develop technology controls
§ Policies - deploy policies and procedures
What is the Information and Communication part of internal controls?
○ “OIE, this is a lot of information”
§ Obtain - and use information
§ Internally - internally communicate information
§ External parties - communicate with external parties
What is the Monitoring Activities part of internal controls?
○ “Monitor your SOD to make sure the grass grows”
§ Separate and Ongoing - separate and ongoing evaluations of controls
□ Frequency depends on the risk
§ Deficiencies - communication of deficiencies
□ Not good enough to just identify
What are the 8 control activities we want an entity to have?
Hint: PAID TIPS
- Prenumbering of documents
- All transactions are recorded (completeness)
- No transactions are recorded more than once (existence)
- E.g. you can see you have checks 11, 12, and 14 but no 13
○ Or you can see you have 11, 12, 12, 13 so you have 12 twice
- Authorization and Approval of Transactions
- Happens before a transaction happens
- Affirms a transaction is valid
- Independent Checks
- Verification of work performed by somebody else
○ Have someone independent review another’s work
- Verification of work performed by somebody else
- Documentation
- E.g. need to have certain documentation in place before a transaction can be processed
- Timely and Appropriate Financial Performance Reviews
- Comparison of actual and forecast performance
- Any variances would be looked into
- Information Processing Controls
- Can be automated or manual
- Makes sure items captured by the system are recorded accurately and correctly
- Physical or Logical Controls for Safeguarding Assets
- Physical - e.g. locks to prevent access to certain rooms or passwords that you need to enter to gain access somewhere
- Logical - e.g. not everyone has access to all information in the system
- Segregation of Duties
- ARC should all be different people
○ Authorization - person who authorizes
○ Record keeping - person who records
○ Custody - person who ships items
- ARC should all be different people
As part of planning, auditors decide on:
a) Nature and Extent of Planning
b) Involvement of Key Engagement Team Members
c) Supervisors of Assistants
d) Nature, Extent, and Timing
e) Disagreement Among Auditors
Talk about each and what auditors consider when planning for them.
a) Nature and Extent of Planning
- depends on the complexity of the client
b) Involvement of Key Engagement Team Members
- partner has ultimate responsibility for audit and signing off
seniors and staff need to be supervised and work reviewed
c) Supervisors of Assistants
- schedule a call with the team prior to the audit
- inform them of the objectives of the audit, NET of procedures, any other important stuff
d) Nature, Extent, and Timing
- depends on complexity of client, nature of work, experience of team, riskiness
e) Disagreement Among Auditors
- should be brought up to the audit partner who makes the final decision
- If staff still disagree after partner ruling, the staff can decide to be disassociated from the audit
What does it mean for audits to use a “risk based” approach?
Test risky areas more heavily. Not every account is audited equally
Do auditors need to have experience in the industry of their prospective client before accepting an engagement?
No, but once accepted they need to become familiar and gain experience (e.g. through reading standards and industry guidance)
