AICPA on Reporting on Internal Control in an Integrated Audit

Question 1

Define an Integrated Audit?

Answer 1

audit of internal controls over Financial Reporting AND audit of the nonissuers financial statements

Question 2

What is the key date when auditing internal controls?

Answer 2

Did the client have effective internal controls “as of”in managements assessment of ICFR (i.e. as of December 31)

Question 3

What are the preconditions of the audit of ICFR?

Answer 3

• Management accepts responsibility of internal control
• Management provides the auditors with an assessment of ICFR
• The auditor should plan and perform the integrated audit to achieve objectives of both engagements simultaneously

Question 4

When planning the audit of ICFR, what needs to be considered?

Answer 4

• Risk assessment
• Fraud Risk
• Multiple locations
• Materiality (same was financial statement materiality)
• Using the work of internal auditors
• Top-down approach

Question 5

What is the top-down approach for auditing internal controls?

Answer 5

Begin with financial statement level

Focus on entity-level controls

Focus on significant classes of transactions, process, monitoring controls

Verify auditors understanding of the risk in the entity

Question 6

How do you test controls?

Answer 6

• Evaluate design effectiveness- mix of inquiry, observation, inspection (a walkthrough is usually sufficient to evaluate design)
• Operating effectiveness- Mix of inquiry, observation, inspection

Question 7

What are some areas you want to focus on when looking at controls?

Answer 7

1) size and composition of the account
2) Susceptibility to misstatement
3) Volume of activity and complexity
4) Nature of accountant, transactions, disclosure
5) Exposure to loss in the accountant
6) Contingent liabilities
7) Existence of related parties

Question 8

When should you communicate material weaknesses and significant deficiencies?

Answer 8

60 days before the release date. Gives the client enough time to clean-up or fix the material weakness

This should be done in writing!

Question 9

What should be included in the auditors written report on ICFR?

Answer 9

• Title: Word Independent
• Introduction: Name of entity, states that ICFR has been audited “as of date”, and identified the criteria
• Management responsibility
• Auditor responsibility: Express an opinion, plan and perform the audit to obtain reasonable assurance, belief the the audit obtained sufficient and appropriate basis for the opinion

Definition and inherent limitation- Paragraph commenting on the inherent limitations of internal control

Opinion

Question 10

When would you issue an adverse report?

Answer 10

• At least one material weakness

Question 11

If there is a scope limitation on ICFR, what should the auditor do?

Answer 11

1) Disclaimer of opinion

2) Withdrawal from the engagement

Question 12

What is the most common control criteria?

Answer 12

COSO Framework

Question 13

What does “scaling the audit” mean?

Answer 13

Less complex procedures may be performed for less risky/complex areas of the audit

Question 14

What are the 5 reasons you would modify the report?

Answer 14

1) Adverse opinion
2) Scope limitation
3) Management report is incomplete or improperly presented
4) Making reference to a component auditor
5) Management report includes additional information