A5- Integrated Audits, Attestation, Engagements, Compliance, And Gov Audits Flashcards
What is an integrated audit
Auditing both financial statements and managements assessment of internal control
SOX requires each issuers annual report to contain an internal control report that
1- states managements responsibility for establishing and maintaining adequate internal control
2- contains an assessment of effectiveness of the internal controls
In an integrated audit, the auditor should evaluate the components of ICFR and determine whether the components are
1- present and functioning in design, implementation, and operation
2- operating together in an integrated manner
Is the auditor responsible for supporting an opinion about each internal control or the overall internal control
OVERALL internal control
Benchmarking strategy
If automated controls have not changed from one year to the next, the auditor not have to repeat specific testing performed but needs to verify the control hasn’t changed
This is most appropriate in LOW RISK situations
Who should the auditor communicate significant deficiencies & material weaknesses to in writing?
Management and those charged with governance IN WRITING
A material weakness in internal control forces what opinion
Adverse opinion
What is an Attest engagement
When a CPA is engaged to an agreed upon procedure that is NOT the responsibility of the CPA (usually management)
Attestation standards differ from GAAS in two ways
1- no reference is made to historical FS
2- no reference is made to GAAP
Common concepts of attestation (CAPE CORP)
C- compliance
A- acceptance and continuance
P- preconditions
E- engagement documentation standards
C- acceptance of change when reasonable
O- use work of other practitioner
R- responsibility for quality control
P- professional skepticism
Attestation risk formula
Attest risk = inherent risk X control risk X detection risk
Amount of assurance and result of examination
Reasonable (positive) assurance, issue opinion
Amount of assurance and result of review
Limited (negative) assurance, result is a conclusion
Amount of assurance and result of agreed upon procedure
Amount of assurance- none
result- list of findings
Conditions of agreed-upon procedures (I AM SURE)
I- independence of practitioner
A- agreement of parties
M- measurability and consistency
S- sufficiency of procedures
U- use of report can be general or restricted
R- responsibility of subject matter
E- engagements to perform AUP on prospective FS
Two types of prospective FS
- Financial forecast
- Financial projection
SOC 1 and SOC 2 reports
System and organization controls (SOC) offer a CPA controls in connection with system level controls at a service organization
Type l SOC report
Report on design and implementation of a service organizations controls but does not provide effectiveness of the controls
Type 2 SOC report
Report on design, implementation, and operating effectiveness of a service organizations controls
If an auditor is asked to report on clients compliance they must have audited the clients financial statements as well and may only issue (positive/negative) assurance
Negative assurance
What is negative assurance
A statement that nothing came to the auditors attention
For the financial statement audit of a government, the audit report is the same as a standard non-issuer except for 2 changes…
1- auditors responsibility paragraph should state the audit was in accordance with BOTH GAAS and government auditing standards
2- an other matter paragraph should be added to the end of the report referencing the GAGAS (yellow book report)
Government audit requires a written report on X
Internal control
2 objectives of a single audit
- Audit of FS and reporting on a separate schedule of expenditures of federal awards
- Compliance audit of federal awards
Materiality in a single audit is to be considered (separately by major program or FS as a whole)
Separately by major program
Audit threshold is expenditure of $$$?
$750,000
Single audits issue 5 reports …. What are those 5 reports
- FS report (GAAS)
- SEFA report
- GAGAS (yellow book) report
- Single audit report
- Schedule of findings and questioned costs
How many years must auditor & Auditee retain documentation of a single audit
3 years
How are major programs determined?
By the auditor using a risk based approach NOT by management
Financial projections are not appropriate for what use
General use
Top down approach order
Financial statement level
Entity level
Account level
SOC 1 Type 1 report
Managements description of service organizations system
Evaluating operating effectiveness of internal control comes in what phase
AFTER planning
What does government auditing standards require that GAAS does not in regard to reporting internal control
Report describing the scope of auditors testing on compliance and internal control
