Assessing & responding to RMM due to error or fraud Flashcards
what is the audit risk model?
audit risk = inherent risk X control risk X detection risk
what is inherent risk?
risk that a material misstatement will exist if there were no I/C;
determined by nature of entity and environment
what is control risk?
the entity’s I/C will fail to prevent or detect a material misstatement (managed by internal control); determined by controls put in place by the entity
what is detection risk?
the risk that if a material misstatement exists in the F/S, auditors will fail to identify it (gets reduced by audit procedures, response to RMM)
true or false: RMM exists independently of audit
TRUE
if CR is below maximum auditors may…
reduce number of substantive tests planned because some risks is mitigated
auditors will omit interim testing if CR were assessed at….
maximum level but not below
what are the tasks required for a review?
-Perform analytical procedures (3 STEPS)
1. develop expectations
2. compare client’s actual data with
expectations
3. investigate significant differences
-Perform inquires
-Obtain management representation
-Maintain independence
-Obtained signed engagement letter
-Express conclusion
-Limited assurance
what are the tasks required for an audit?
-Perform analytical procedures (3 STEPS)
1. develop expectations
2. compare client’s actual
data with expectations
3. investigate any
significant differences
-Perform inquires
-Obtain management representation
-Maintain independence
-Obtained signed engagement letter
-Communicate with predecessor CPA
-Understand I/C
-Assess RMM
-Send letter to client’s lawyer
-Substantive testing to detect material misstatement
-Express opinion
-Reasonable assurance
if true state of population has a deviation rate > tolerable rate and the auditor’s estimate based on sample results deviation rate > tolerable rate
control risk increased properly
if true state of population has a deviation rate > tolerable rate and the auditor’s estimate based on sample results deviation rate < tolerable rate
control risk decreased improperly (Type 2 error) Ineffective
if true state of population has a deviation rate < tolerable rate and the auditor’s estimate based on sample results deviation rate < tolerable rate
control risk unchanged properly
if true state of population has a deviation rate < tolerable rate and the auditor’s estimate based on sample results deviation rate > tolerable rate
control risk increased improperly (Type 1 error) Ineffective
increase in RMM leads to…
decrease in acceptable level of detection risk and increase in substantive testing to maintain the desired audit risk
if RMM is high then…
increase professional skepticism and planned audit procedures
1. more thorough tests
2. rely on more year-end testing
3. assign experienced staff with specialized skills
4. close supervision required
what does RACE stand for in relationship to year end balance sheet accounts
Rights and obligations: own or have the rights to use?
Allocation and valuation: are the recorded amounts correct?
Completeness: are all assets/liabilities recorded?
Existence: do the assets/liabilities exist?
after CR and RMM are assessed, what tests will the auditor perform
tests of transactions details because they are needed to detect material financial misstatements
what is audit risk?
the risk that a material misstatement exists in the financial statements and will not be detected by the audit
If I/C is effective…
control risk is low, there’s an increased reliance on the controls and a decreased number of substantive procedures performed
which two components of the risk are characteristics of the entity?
inherent risk and control risk
segregation of duties protects assets from…
misappropriation
what are the 4 phases in the process for understanding I/C and assessing CR
- obtain an understanding of the design and operation of I/C
- assess CR
- design, perform and evaluate tests of controls if applicable
- set detection risk and plan substantive procedures
if tests of controls are not performed when assessing CR
leave CR at max level because I/C is poorly designed
during the “design, perform and evaluate tests of controls if applicable” phase, if testing indicates I/C effective
reduce CR; auditors increase reliance on controls and decrease substantive testing
what are the three things that lead to fraud?
incentive, opportunity and rationalization
what is fraud incentive?
reason (motivation) for committing the fraud; ex. personal gain, pressure to meet operating objectives
what is opportunity fraud?
have the ability to commit the fraud; ex. management override, lack of I/C, collusion
what is rationalization fraud?
attitude, justify the fraud in a manner consistent with their beliefs; ex. “getting worse”, don’t believe they are wrong
what is the purpose of substantive testing?
to identify material financial misstatements the amount and type of substantive testing is based on previously assessed level of control risk
who determines the acceptable level of audit risk?
auditor
