Assessing Risk and Developing a Planned Response

Question 1

Identify the topics associated with the three general standards formerly known as Generally Accepted Auditing Standards (GAAS), which are still applicable to the PCAOB’s auditing standards.

Answer 1

1. Training
2. Independence
3. Due professional care.

Question 2

Identify the topics associated with the four reporting standards for generally accepted auditing standards (GAAS) that are still applicable to the auditing standards of the Public Company Accounting Oversight Board (PCAOB).

Answer 2

1. Generally accepted accounting principles (GAAP)
2. Consistency
3. Disclosure
4. Opinion

Question 3

Identify the topics associated with each of the AICPA’s seven principles for audit standard setting.

Answer 3

1. Purpose
2. Premise
3. Responsibilities
4. Reasonable assurance
5. Performance requirements to achieve reasonable assurance
6. Inherent limitations
7. Reporting

Question 4

Identify the four primary themes associated with the AICPA’s seven principles for audit standard setting.

Answer 4

1.Purpose/premise
2.Responsibilities
3.Performance
4.Reporting
(PR PR)

Question 5

Identify the topics associated with the three field work standards formerly known as Generally Accepted Auditing Standards (GAAS), which are still applicable to the PCAOB’s auditing standards.

Answer 5

1. Planning and supervision
2. Internal control
3. Evidence.

Question 6

What type of professional requirement is indicated by the word “must” in AICPA professional standards?

Answer 6

Unconditional requirement

Question 7

What type of professional requirement is indicated by the word “should” in AICPA professional standards?

Answer 7

Presumptively mandatory requirement

Question 8

What is meant by the term “interpretive publications”?

Answer 8

These consist of the appendices to the Statements on Auditing Standards, auditing interpretations of the Statements on Auditing Standards, the AICPA Audit and Accounting Guides, and AICPA auditing Statements of Position.

Question 9

List the services for which a CPA firm is required to have a sytem of quality control.

Answer 9

Audits, attestation, compilation, and review services. (Not applicable to tax or consulting services.)

Question 10

What is meant by the term “engagement quality control review”?

Answer 10

A process designed to provide an objective evaluation, before the report is released, of the significant judgments the engagement team made and the conclusions it reached. (Such a process is only for those audit engagements for which the firm has determined that an engagement quality control review is required; it is not applicable to all audits.)

Question 11

List the six elements of a quality control system.

Answer 11

1. Leadership responsibilities for quality within the firm
2. Relevant ethical requirements (especially independence)
3. Acceptance and continuance of client relationships
4. Human resources
5. Engagement performance
6. Monitoring

Question 12

Who is responsible for the administration of a quality control system?

Answer 12

Authority may be vested in one person but everyone shares responsibility.

Question 13

List the four basic steps in the audit process.

Answer 13

1. Planning
2. Internal control consideration
3. Substantive audit procedures
4. Reporting

Question 14

What considerations should be given by the auditor regarding internal controls prior to beginning an audit or performing substantive audit procedures?

Answer 14

> Obtain the required understanding of the design of internal control for planning purposes.
Perform tests of controls to evaluate operating effectiveness of internal control if contemplating reliance on specific controls

Question 15

What are some considerations that must be given by the auditor during the planning phase of the audit?

Answer 15

1. Determine whether to accept or continue the audit engagement
2. Assess the risk of material misstatement
3. Evaluate requirements for staffing and supervision
4. Prepare the required written audit program (also called the audit plan).

Question 16

List the two types of substantive audit procedures.

Answer 16

1. Analytical procedures

2. Tests of details

Question 17

List the two types of test of details.

Answer 17

1. Tests of ending balances

2. Tests of transactions

Question 18

What type of professional requirement is indicated by the word “must” in AICPA professional standards?

Answer 18

Unconditional requirement

Question 19

What type of professional requirement is indicated by the word “should” in AICPA professional standards?

Answer 19

Presumptively mandatory requirement

Question 20

What is meant by the term “interpretive publications”?

Answer 20

These consist of the appendices to the Statements on Auditing Standards, auditing interpretations of the Statements on Auditing Standards, the AICPA Audit and Accounting Guides, and AICPA auditing Statements of Position.

Question 21

Financial Reporting Oversight Role (FROR)

Answer 21

A role in which a person is in a position to or does exercise influence over the contents of the F/S or anyone who prepares them. Examples: director, CEO, president, CFO, COO, general counsel, CAO, controller, director of internal audit, director of financial reporting, treasurer, or any equivalent position.

Question 22

Audit and Professional Engagement Period

Answer 22

Includes the period covered by any F/S being audited or reviewed (the “audit period”) and the period of the engagement (the “professional engagement period”). The professional engagement period begins at the earlier of when the accountant signs an initial engagement letter or begins the audit and ends when the audit client or the accountant notifies the SEC that the client is no longer the accountant’s audit client.

Question 23

Close Family Member (CFM)

Answer 23

A person’s spouse, spousal equivalent, parent, dependent, nondependent child, and sibling.

Question 24

Immediate Family Member (IFM)

Answer 24

A person’s spouse, spousal equivalent, and dependents.

Question 25

To what services are Statements on Standards for Accounting and Review Services (SSARs) applicable?

Answer 25

Statements on Standards for Accounting and Review Services (SSARs) are applicable to reviews and compilations of the financial statements of private companies, that is, nonissuers.

Question 26

What is a compilation?

Answer 26

A compilation is an assembly of the financial records of a private company into a financial statement format without expressing any degree of assurance on the reliability of those financial statements.

Question 27

What type of assurance is associated with an “audit” of an entity’s financial statements?

Answer 27

Positive assurance, which is considered a high level of assurance

Question 28

What type of assurance is associated with a “review” of an entity’s financial statements?

Answer 28

Negative assurance, which is considered a moderate level of assurance

Question 29

What is a review?

Answer 29

This occurs when the CPA is engaged to provide a lower level of assurance (relative to that of an audit) on financial statements of a private company by performing limited procedures, including reading the financial statements, performing analytical procedures, and making appropriate inquiries of client personnel.

Question 30

AICPA’s Statements on Standards for Attestation Engagements (SSAEs)

Answer 30

hese are applicable when the CPA provides assurance about written representations or subject matter other than historical financial statements (e.g., management may make representations about its superior product performance that may be made more reliable by the CPA’s independent verification and report).

Question 31

Written engagement letters must______.

Answer 31

A written engagement letter must be obtained for engagements to audit, review, or compile an entity’s financial statements under AICPA Professional Standards.

Question 32

Levels of Assurance

Answer 32

1. Audit—An audit conveys a high level of assurance about the reliability of the financial statements, and is expressed as positive assurance in the form of an opinion (recall that the SASs apply to audits of “nonissuers”).
2. Review- A review conveys a lower (i.e., “moderate”) level of assurance about financial statements (for a private company under the AICPA’s SSARSs).
3. Compilation—A compilation conveys no assurance about the reliability of the financial statements (for a private company under the AICPA’s SSARSs).

Question 33

Public Company Accounting Oversight Board (PCAOB)—Five primary responsibilities:

Answer 33

1.Registration of public accounting firms—U.S. and non-U.S. accounting firms that prepare audit reports of any U.S. public company (issuer of securities) must register with the PCAOB. (This includes non-U.S. accounting firms that play a substantial role in the preparation of such audit reports.)

2.Inspections of registered public accounting firms—PCAOB is directed to conduct a continuous program of inspections that assess compliance with SOA, PCAOB rules, SEC rules, and applicable professional standards. (A written report is required for each such inspection.)
Firms that provide audit reports for at least 100 issuers—PCAOB must inspect annually.
Firms that provide audit reports for fewer than 100 issuers—PCAOB must inspect every three years (triennially).

3. Standard setting—PCAOB is directed to establish auditing and related attestation, quality control, ethics and independence standards and rules to be used by registered public accounting firms in the preparation of audit reports for issuers. (The Office of the Chief Auditor and the Standing Advisory Group (SAG) assist PCAOB in establishing such auditing and professional practice standards.)
4. Enforcement—PCAOB has broad authority to investigate registered public accounting firms and persons associated with such firms.
5. Funding—PCAOB’s budget is funded by (1) registration and annual fees from public accounting firms and (2) an annual accounting support fee assessed on issuers (based on their relative monthly market capitalization).

Question 34

List the standard-setting responsibilities of the Public Company Accounting Oversight Board (PCAOB).

Answer 34

• Auditing and related attestation
• Quality control
• Ethics and independence standards

Question 35

A PCAOB engagement that focuses on the sufficiency of a CPA firm’s quality control system is most likely to be referred to as a(n)

Answer 35

Inspection-Section 104 of the Sarbanes-Oxley requires that the PCAOBs evaluate the sufficiency of a CPA firm’s quality control system as a part of an inspection.

Question 36

List the five primary responsibilities of the PCAOB.

Answer 36

1. Registration of public accounting firms
2. Inspection of registered public accounting firms
3. Standard setting
4. Enforcement
5. Funding

Question 37

What is the purpose of the Sarbanes-Oxley Act of 2002?

Answer 37

To address a series of perceived corporate misconduct and alleged audit failures (including Enron, Tyco, and WorldCom, etc.) and to strengthen investor confidence in the integrity of the U.S. capital markets

Question 38

List the two primary revenue sources through which the PCAOB’s budget is funded.

Answer 38

1. Registration and annual fees from public accounting firms

2. An annual “accounting support fee” assessed on issuers based on their relative monthly market capitalization

Question 39

What are the requirements regarding concurring approval of issuance of an engagement report as prescribed by Public Company Accounting Oversight Board (PCAOB) auditing standards?

Answer 39

• The firm cannot give permission to the client to use the engagement report until the engagement quality reviewer provides concurring approval of issuance.
• The engagement quality reviewer cannot express such approval if there is any “significant engagement deficiency.”

Question 40

List the qualifications required of an engagement quality reviewer under Public Company Accounting Oversight Board (PCAOB) auditing standards.

Answer 40

• Must be an “associated person” of a registered public accounting firm
• Must have competence, independence, integrity, and objectivity

Question 41

Under Public Company Accounting Oversight Board (PCAOB) auditing standards, what should the engagement quality reviewer do to evaluate the significant judgments and conclusions of the engagement team?

Answer 41

• Hold discussions with the engagement partner and other members of the engagement team.
• Review the audit documentation.

Question 42

Describe the basic requirements associated with Public Company Accounting Oversight Board (PCAOB) auditing standards dealing with “engagement quality review.”

Answer 42

PCAOB auditing standards require an engagement quality review and concurring approval before issuing the report for audit (or review) engagements conducted under PCAOB standards.

Question 43

What is the purpose of the engagement quality reviewer under Public Company Accounting Oversight Board (PCAOB) auditing standards?

Answer 43

To perform an evaluation of the significant judgments made by the engagement team and the related conclusions reached and in preparing any engagement report(s)

Question 44

Describe the engagement quality review “cooling off” restriction in Public Company Accounting Oversight Board (PCAOB) auditing standards.

Answer 44

The person serving as engagement partner during either of the two audits preceding the audit subject to engagement quality review is not permitted to serve as engagement quality reviewer, unless the registered firm qualifies for a specific exemption to this requirement.

Question 45

Identify the differences in the Statements on Quality Control Standards (SQCS) of the American Institute of Certified Public Accountants (AICPA) relative to Public Company Accounting Oversight Board (PCAOB) auditing standards.

Answer 45

SQCS do not:

• Require an “engagement quality review” for any type of engagement.
• Impose a “cooling-off” restriction or a requirement that the reviewer must be an “associated person” of a registered public accounting firm.
• Require a “concurring approval of issuance” before issuing a report.
• Specifically require that engagement quality review documentation must be retained with other documentation.

Question 46

A CPA firm evaluates its personnel advancement experience to ascertain whether individuals meeting stated criteria are assigned increased degrees of responsibility.

This is evidence of the firm’s adherence to which of the following prescribed standards

Answer 46

Quality control.

Question 47

After field work audit procedures are completed, a partner of the CPA firm who has not been involved in the audit performs a second or wrap-up working paper review. This second review usually focuses on

Answer 47

The fair presentation of the financial statements in conformity with GAAP.

Question 48

What if the successor believes that the financial statements covered by the predecessor’s report require revision?

Answer 48

Try to arrange a meeting with the three parties (i.e., the successor, predecessor, and client management). If the client refuses to meet to discuss issues reflecting on the appropriateness of the previously issued financial statements, the successor should consider the risks of being the entity’s auditor.

Question 49

What if the auditor is unable to observe the beginning inventory?

Answer 49

If unable to verify the beginning inventory, the auditor may be unable to reach a conclusion about the cost of goods sold and, hence, the net income. As a result, the auditor may not be able to express an opinion on the fairness of the income statement, statement of cash flows, or statement of retained earnings. However, the auditor could still express an opinion on the balance sheet itself.

Question 50

Preconditions for an Audit:

Answer 50

The use by management of an acceptable financial reporting framework in the preparation of the financial statements and the agreement of management to the premise on which an audit is conducted.

Question 51

What matters should be covered in the (successor) auditor’s inquiry of the predecessor auditor?

Answer 51

• Facts related to management’s integrity
• Significant accounting or auditing disagreements
• Any communications with the audit committee (or others charged with governance) about fraud, illegal acts, and significant deficiencies in internal control matters
• Predecessor’s understanding of the reason(s) for the client’s change in auditors

Question 52

What is meant by the term “initial audit”?

Answer 52

The prior year’s financial statements have been audited by a predecessor auditor.

Question 53

Who initiates the communications between the predecessor auditor and successor auditor?

Answer 53

The successor auditor initiates the communication with the predecessor by requesting that the client authorize the predecessor auditor to allow the successor auditor to review the predecessor auditor’s working papers.

Question 54

What matters are typically addressed in an engagement letter?

Answer 54

1. The objective and scope of the audit
2. The auditor’s responsibilities
3. Management’s responsibilities
4. A statement about the inherent limitations of an audit
5. A statement identifying the applicable financial reporting framework
6. Reference to the expected content of any reports to be issued
7. Other matters, as warranted (e.g., fees, etc.)

Question 55

Identify three planning-related issues that should be included in the auditor’s documentation.

Answer 55

1. The overall audit strategy
2. The audit plan
3. Any significant changes made to the audit strategy or the audit plan during the engagement, along with the reasons for any such changes

Question 56

List several circumstances that impact the extent of planning activities.

Answer 56

• Size and complexity of the entity
• Auditor’s experience with that entity
• Auditor’s understanding of the entity and its environment, including its internal control

Question 57

What is the difference between an overall audit strategy and an audit plan?

Answer 57

An audit strategy deals with higher-level issues, such as allocating audit resources, whereas an audit plan is more detailed and deals more specifically with the nature, timing, and extent of audit procedures to be performed.

Question 58

List the audit procedures that should occur during the planning phase of an audit.

Answer 58

1. Review client records.
2. Make inquires of client personnel.
3. Coordinate client assistance.
4. Determine if specialists are needed.
5. Coordinate staffing requirements.

Question 59

Identify some activities associated with pre-engagement activities.

Answer 59

1. Perform appropriate procedures to address the quality control issues associated with the acceptance/continuance of the audit engagement.
2. Evaluate the audit team’s compliance with relevant ethical requirements (especially independence issues).
3. Establish an understanding in writing of the terms of the engagement.

Question 60

Identify factors relevant to establishing an overall audit strategy.

Answer 60

• Identify characteristics of the engagement affecting its scope.
• Identify the reporting objective of the engagement and required communications.
• Consider the factors relevant to utilizing the audit team.
• Consider the results of preliminary engagement planning activities.
• Determine the nature, timing, and extent of necessary resources for the engagement.

Question 61

What is the auditor’s basic audit planning responsibility?

Answer 61

The auditor should plan the audit (and design the required written audit program or plan) to be responsive to the auditor’s assessment of the risk of material misstatement.

Question 62

The auditor should address the following matters in the audit documentation:

Answer 62

(1) the overall audit strategy; (2) the audit plan; and (3) any significant changes made to the audit strategy or the audit plan during the audit engagement, along with the reasons for any such changes

Question 63

To what services are Statements on Standards for Accounting and Review Services (SSARs) applicable?

Answer 63

Statements on Standards for Accounting and Review Services (SSARs) are applicable to reviews and compilations of the financial statements of private companies, that is, nonissuers.

Question 64

What is a compilation?

Answer 64

A compilation is an assembly of the financial records of a private company into a financial statement format without expressing any degree of assurance on the reliability of those financial statements.

Question 65

What type of assurance is associated with an “audit” of an entity’s financial statements?

Answer 65

Positive assurance, which is considered a high level of assurance

Question 66

What type of assurance is associated with a “review” of an entity’s financial statements?

Answer 66

Negative assurance, which is considered a moderate level of assurance

Question 67

When is a written engagement letter required?

Answer 67

A written engagement letter must be obtained for engagements to audit, review, or compile an entity’s financial statements under AICPA Professional Standards.

Question 68

Define “control risk.”

Answer 68

The probability that a material misstatement, which occurred in the first place, would not be detected by applicable internal controls

Question 69

What audit risk model is applicable to classes of transactions or to account balances?

Answer 69

Audit risk = Inherent risk × Control risk × Detection risk

Question 70

List the variables of planned audit procedures that can be adjusted to change detection risk.

Answer 70

Nature
Timing
Extent of substantive testing

Question 71

Define “audit risk.”

Answer 71

The probability that the auditor fails to modify the opinion on financial statements that contain a material misstatement

Question 72

Define “risk of material misstatement.”

Answer 72

The risk that the financial statements contain one or more material misstatements prior to the audit. (Note: RMM = IR × CR)

Question 73

Define “inherent risk.”

Answer 73

The probability that a material misstatement would occur in the particular audit area in the absence of any internal control policies and procedures

Question 74

Define “detection risk.”

Answer 74

The probability that a material misstatement, which was not prevented or detected by internal control, was not detected by the auditor’s substantive audit procedures

Question 75

Basic Auditor Responsibility

Answer 75

The auditor should properly plan and perform the audit to obtain reasonable assurance that material misstatements, whether caused by errors or fraud, are detected.

Question 76

Define “analytical procedures.”

Answer 76

Evaluations of financial information through analysis of plausible relationships among both financial and nonfinancial data

Question 77

What three purposes might analytical procedures serve?

Answer 77

1. Required during planning
2. May be used as substantive evidence (not required)
3. Required during final review

Question 78

What matters must be documented in connection with analytical procedures?

Answer 78

• The auditor’s expectation and the factors considered in developing it
• The results of the comparison of the recorded amounts (or ratios) with the expectations
• Any additional auditing procedures performed to investigate significant differences identified by that comparison

Question 79

List the four factors that affect the efficiency and effectiveness of analytical procedures for substantive purposes.

Answer 79

1. Nature of assertion
2. Plausibility and predictability of relationship
3. Availability and reliability of data
4. Precision of expectation

Question 80

What is the purpose of analytical procedures in the overall review?

Answer 80

To verify the conclusions reached in the audit

Question 81

What is the purpose of analytical procedures in audit planning?

Answer 81

To aid in understanding client activities and in targeting risky areas where material misstatements are more likely to occur

Question 82

List the two types of financial statement-related frauds.

Answer 82

1. Fraudulent financial reporting (sometimes called “cooking the books”)
2. Misappropriation of assets (covering up theft by false journal entries)

Question 83

What definition of fraud is relevant to the auditor?

Answer 83

An intentional act by one or more individuals among management, those charged with governance, employees, or third parties, involving the use of deception that results in a misstatement in the financial statements

Question 84

Identify the auditor’s responsibility for detecting fraud in a financial statement audit.

Answer 84

Auditors must:

1. Design audit to provide reasonable assurance of detecting material misstatements whether due to fraud or error.
2. Specifically assess the risk of material misstatement due to fraud.
3. Document the assessment of the risk of material misstatement due to fraud and the resulting response(s) associated with any risk factors identified.

Question 85

What are the three categories of fraud-related risk factors that should be considered by the auditor?

Answer 85

1. Incentives/Pressures (the motivation for committing fraud)
2. Opportunities (the ability to commit fraud)
3. Attitudes/Rationalizations (the justification or excuse for committing fraud)

Question 86

Does failure to detect a material misstatement imply a substandard audit?

Answer 86

No! An auditor may be unable to detect a material misstatement owing to forgery, collusion, or upper management involvement, etc.

Question 87

Who should be informed when the auditor has identified fraud, but that fraud is not material and does not involve senior management?

Answer 87

The appropriate level of management should be notified (defined to be at least one level above the level where the fraud occurred).

Question 88

When might an auditor have a duty to inform others outside of the audited entity of fraud-related matters?

Answer 88

• In response to a valid subpoena
• To comply with applicable legal and regulatory requirements
• To respond appropriately to successor auditor’s inquiries when the former client has given permission to the predecessor
• To report fraud to the applicable funding agency under the requirements of government auditing standards

Question 89

What are the auditor’s responsibilities to communicate fraud identified by the auditor?

Answer 89

• If the fraud is not material, the auditor should inform the appropriate level of management.
• If the fraud is material (or if senior management is involved, even if the fraud is not material), the auditor should inform those charged with governance.

Question 90

What is the required form of the auditor’s communications about fraud-related issues?

Answer 90

Communications may be either written or oral but should be timely

Question 91

Who should be informed when material fraud has occurred (whether senior management is involved in the fraud or not).

Answer 91

The auditor should inform those charged with governance.

Question 92

What procedure can an auditor undertake to help detect illegal acts?

Answer 92

Make inquiries of management about the entity’s compliance with applicable laws

Question 93

What matters should the auditor document with respect to the entity’s compliance with applicable laws and regulations?

Answer 93

• The results of the discussion with management, those charged with governance, and others, as applicable
• Any identified or suspected noncompliance with applicable laws and regulations

Question 94

What is the auditor’s responsibility to detect illegal acts?

Answer 94

The auditor should design the audit to provide reasonable assurance of detecting illegal acts having a direct and material effect on the financial statements.

Question 95

Identify three audit procedures that bring to the auditor’s attention noncompliance with laws and regulations that do not have a direct effect on the entity’s financial statements.

Answer 95

1. Inquiry of management and those charged with governance about noncompliance with applicable laws and regulations
2. Inspection of correspondence with regulatory authorities
3. Reading the minutes of meetings of those charged with governance

Question 96

What is meant by the term “legal and regulatory framework”?

Answer 96

Those laws and regulations to which an entity is subject; noncompliance may result in fines, litigation, or other consequences that may have a material effect on the financial statements

Question 97

When might an auditor have a duty to inform others outside of the audited entity of illegal acts known to the auditor?

Answer 97

• In response to a valid subpoena
• To comply with applicable legal and regulatory requirements
• To respond appropriately to the successor auditor’s inquiries when the former client has given permission to the predecessor
• To report illegal acts to the applicable funding agency under the requirements of government auditing standards

Question 98

What actions should an auditor consider when an illegal act has been detected?

Answer 98

• Gather additional evidence to determine relevant facts.
• Discuss the matter with the appropriate level of management.
• Consider consulting with the entity’s attorney and/or relevant specialists.
• Consider the implications to other audit areas.

Question 99

Identify three inherent limitations of internal controls.

Answer 99

1. Cost of controls should not exceed expected benefits.
2. Mistakes may occur due to carelessness, fatigue, misjudgments, and so on.
3. Segregation of duties may break down due to collusion or management override of internal controls.

Question 100

Identify two reasons for assessing control risk at the maximum level.

Answer 100

1. The auditor believes that the design of internal control is ineffective.
2. The auditor believes that reliance on internal control (and performing applicable tests of control) is not an efficient audit strategy compared to a wholly substantive audit approach.

Question 101

When should the auditor assess the design effectiveness of internal control?

Answer 101

In planning every audit under generally accepted accounting standards (GAAS), as a basis for determining the nature, timing, and extent of further audit procedures

Question 102

When should the auditor assess the operating effectiveness of internal control?

Answer 102

Whenever the auditor contemplates a reliance strategy (which means the same thing as “assessing control risk at less than the maximum level”) and only after performing the appropriate tests of control

Question 103

Why must auditors consider an entity’s internal control in planning the audit engagement?

Answer 103

In order to plan an effective and efficient audit, auditors must assess control risk as a basis for setting the appropriate level of detection risk related to their substantive auditing procedures (specifically, to determine the nature, timing, and extent of those substantive procedures).

Question 104

What is meant by the term “monitoring” (as it relates to internal controls)?

Answer 104

The policies and procedures involving the ongoing assessment of the effectiveness of internal controls over time

Question 105

What is meant by the term “control activities”?

Answer 105

The policies and procedures that help ensure that management directives are carried out, especially those related to (1) segregation of duties, (2) physical controls, (3) authorization of transactions, (4) performance reviews, and (5) information processing

Question 106

Identify three risk assessment procedures that an auditor might used to obtain an understanding of the entity and its environment, including its internal control.

Answer 106

1. Inquiries of management and others
2. Observation and inspection
3. Analytical procedures

Question 107

Define “internal control.”

Answer 107

A process—effected by those charged with governance, by management, and by other personnel—designed to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.

Question 108

Identify the five interrelated components of internal controls.

Answer 108

1. Control environment
2. Risk assessment
3. Control activities
4. Information and communication systems
5. Monitoring

Question 109

What is meant by the term “control environment”?

Answer 109

The policies and procedures that determine the overall control consciousness of the entity, sometimes called “the tone at the top”

Question 110

What is meant by the term “information and communication systems”?

Answer 110

The policies and procedures related to the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities

Question 111

Define the term “risk assessment procedures.”

Answer 111

Procedures performed to obtain an understanding of the entity and its environment, including its internal control

Question 112

What is meant by the term “risk assessment”?

Answer 112

The policies and procedures involving the identification, prioritization, and analysis of relevant risks as a basis for managing those risks

Question 113

What are the three objectives of internal control as identified in the definition of internal control?

Answer 113

1. Reliability of financial reporting
2. Effectiveness and efficiency of operations
3. Compliance with applicable laws and regulations

Question 114

What duties need to be kept separate?

Answer 114

C-A-R
Custody
Authorization
Recording & reconcilliation

Question 115

What is the auditor’s responsibility for assessing the risk of material misstatement?

Answer 115

The auditor should identify and assess the risks of material misstatement (1) at the financial statement level and (2) at the relevant assertion level related to classes of transactions, account balances, and disclosures.

Question 116

When must tests of control be performed?

Answer 116

When the auditor’s risk assessment includes an “expectation of the operating effectiveness of controls.” Note that this is frequently referred to as “relying” on internal control as a partial basis for the auditor’s conclusions, or “assessing control risk at less than the maximum level.”

Question 117

Define the term “significant risks.”

Answer 117

Risks that the auditor believes require special audit consideration

Question 118

List some examples of appropriate responses by the auditor to risks of material misstatement at the financial statement level.

Answer 118

• Assign more experienced staff to the engagement.
• Provide closer supervision.
• Use specialists.
• Use more unpredictable audit procedures.

Question 119

What specific matters should the auditor document regarding the auditor’s assessment of the risks of material misstatement?

Answer 119

• The discussion with key members of the audit team about the risks of material fraud and errors
• The major elements of the understanding of the five components of internal control
• The assessment of the risks of material misstatement (at the financial statement and relevant assertion levels) and the basis for that assessment
• The risks identified and the related controls the auditor evaluated

Question 120

Define “material weakness.”

Answer 120

A deficiency (or combination of deficiencies) in internal control such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented or detected and corrected on a timely basis

Question 121

Describe the auditor’s requirements for communicating deficiencies in an entity’s internal controls.

Answer 121

• The auditor must communicate in writing the significant deficiencies (including material weaknesses) identified in the audit.
• The auditor may choose to communicate lesser matters, too as well.

Question 122

Describe the timing of the required communication of significant deficiencies in internal control.

Answer 122

Under AICPA professional standards, written communication is required no later than 60 days after the audit report release date (including matters communicated orally during the audit).

Question 123

Define “significant deficiency.”

Answer 123

A deficiency (or combination of deficiencies) in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance

Question 124

What is meant by the term “deficiency in design”?

Answer 124

There is a deficiency in design when a control necessary to meet the control objective is missing, or when the control objective is not always met, even if the control operates as designed

Question 125

What is meant by the term “deficiency in operation”?

Answer 125

There is a deficiency in operation when a properly designed control does not operate as designed, or when the person performing the control does not have the authority or competence to effectively perform the control.

Question 126

When using the internal audit function to provide direct assistance, what two matters should the external auditor evaluate?

Answer 126

1. Objectivity—the internal audit function’s organizational status and the objectivity of the internal auditors
2. Competence of the internal auditor

Question 127

Why isn’t a “systematic and disciplined approach, including quality control” a relevant consideration when the external auditor uses an internal audit function to provide direct assistance?

Answer 127

Because the work performed by the internal audit function is subject to the external auditor’s direction, supervision, and review

Question 128

What are the two ways the external auditor might use the work of an internal audit function?

Answer 128

1. To obtain audit evidence

2. To provide direct assistance

Question 129

When using the work of the internal audit function to obtain audit evidence, what three matters should the external auditor evaluate?

Answer 129

1. Objectivity—the internal audit function’s organizational status and the objectivity of the internal auditors
2. Competence of the internal auditors
3. Whether the internal audit function applies a “systematic and disciplined approach, including quality control”