Assessing Risk & Developing Planned Response Flashcards
Developing overall engagement strategy - 4 things
1) determine characteristics that define scope (basis for reporting, industry-specific reporting requirements, entity’s locations)
2) determine reporting objectives of engagement to plan timing of audit, nature of communications requirements and key dates for expected communications
3) consider important factors that determine focus of audit team’s efforts (materiality levels, preliminary areas for potential misstatements, financial reporting developments)
4) determine nature/timing/extent of resources necessary to perform engagement
Process of developing audit strategy helps auditor - 3 things (resources)
1) determine type and amount of resources to assign to specific audit areas
2) plan timing of resources
3) manage/direct/supervise resources (when meetings are held, how reviews will take place)
5 considerations for planning initial (first) audits
1) arrangements with previous auditor
2) major issues with initial selection discussed with mgmt
3) obtain sufficient audit evidence regarding opening balances
4) personnel with appropriate capabilities and competence assigned
5) other personnel to assist with firm’s quality control function
developing detailed audit plan
1) reviewing correspondence, last year’s workpapers, perm files, FS, auditor reports
2) discussing matters that may affect audit with firm personnel responsible for nonaudit services to entity
3) inquiring about current business developments affecting entity
4) reading current year interim FS
5) discussing type/timing/scope of audit w/mgmt, BOD, AC
6) considering effects of applicable/new accounting pronouncements
7) coordinating assistance of entity personnel
8) determining extext of involvement of specialists, consultants
9) establishing timing of audit work
10) establishing and coordinating staffing requirements
audit plan MUST HAVE these 3 things:
1) description of nature/extent/timing of planned risk assessment procedures sufficient to assess risks of material misstatement
2) nature/extent/timing of planned further audit procedures for each material class of transactions/account balances/disclosure
3) other audit procedures to comply with GAAS
developing detailed plan for attest engagement
1) while detailed plan not required, accountant should prepare /retain sufficient documentation to allow engagement teams/partners to satisfy supervision/review/QC responsibilities
2) accountant should determine nature/extent/timing of planned procedures in order to achieve engagement objectives
understanding entity - external factors
1) industry (market, competition (demand/price/capacity), cyclical, product technology, supply)
2) regulatory (framework, accounting principles, legislation, taxation, gov policies, environmental)
3) nature of entity
4) entity’s objectives and strategies and related business risks that may result in material misstatement
5) measurement and review of entity’s financial performance
6) IC, including selection and application of accounting policies
7) other
a) general level of economic activity (recession, growth)
b) interest rates and availability of financing
c) inflation and currency revaluation
understanding entity - internal factors
a) business operations (related parties, nature of revenue sources, products/services//markets, suppliers/clients, R&D)
b) investments (M&A, disposals, investments in nonconsolidated entities)
c) financing (structure, with related parties, derivatives)
d) financial reporting (accounting principles, rev rec, FV, inventory, FS presentation and disclosures)
e) IT environment - software, devices, telecom, technology services (cloud), emerging technology (AI, crypto, blockchain)
f) objectives and strategies - industry developments, new products/services, expansion of business, regulatory requirements, new accounting requirements, use of IT, risk appetite of entity
g) financial performance (pressure to misstate, reliance on IT)
auditor should identify the relevant factors that define the nature of an entity, including the impact on the risk of material misstatement (e.g., its operations, ownership and governance structure, investment and financing plans, selection of accounting policies, and objectives and strategies), and document the procedures performed to obtain that understanding. In particular, that understanding establishes a frame of reference within which the auditor plans the audit and exercises professional judgment about assessing risks of material misstatement of the financial statements and responding to those risks throughout the audit.
this helps:
1) establish materiality and reevaluate that throughout the audit
2) consider appropriateness of chosen accounting policies and adequacy of disclosures
3) identify special areas of consideration might be necessary
4) develop expectations when performing analytical procedures
5) design and perform further audit procedures to reduce audit risk
6) evaluate sufficiency/appropriateness of audit evidence obtained
auditor should use professional judgment to determine the extent of the understanding required of the entity and its environment, including its internal control. The auditor’s primary consideration is….
whether the understanding that has been obtained is sufficient to assess risks of material misstatement of the financial statements
auditor should identify and document entity’s business processes, comprised of: (IT)
a) inputs
b) actors - either automated or actual person that carries out business process
c) actual activity or process that transforms the input
d) outputs - generation of entity’s FS or mgmt reports
auditor should obtain understanding of entity’s IT systems infrastructure and document procedures to obtain understanding of…
a) description of functions of system
b) change control process
c) security evaluation
d) system documentation should be reviewed for completeness, accuracy, timeliness
how to update understanding of entity’s business and ICs:
1) reading documentation for prior year’s audit and review of interim
2) reading most recent annual and prior interim financial information
3) consider results of audit procedures performed
4) inquire mgmt of changes in business activities
5) inquire mgmt about significant changes in ICs related to preparation of interim financial information
attestation engagements: what is attestation risk?
the risk that the accountant expresses an inappropriate opinion or conclusion, as applicable, when the underlying subject matter or subject matter information (or assertion) is materially misstated.
Attestation risk is not applicable to an agreed‐upon procedures engagement, as the design .of procedures in that type of engagement is the responsibility of the specified party(ies).
3 objectives of audit engagement ORC
Operations
Reporting
Compliance
CRIME
Control environment EBOCA
Risk assessment SAFR
Information and communication systems OIE
Monitoring SOD
Existing control activities CATP
C - control environment EBOCA
Ethics
Board Independence & Oversight
Organizational Structure
Competence
Accountability
- sets tone of org, influencing control consciousness of employees
1) assignment of authority and responsibility - important in an IT environment due to the potential access to data by multiple users. When multiple users have access to a particular database, the potential for manipulation increases
2) human resource policies and practices - in a computerized environment, the need for skilled employees operating with a high degree of integrity is of great importance.
3) management’s philosophy and operating style - management’s failure to commit sufficient resources to address security risks presented by IT may adversely affect internal control by allowing improper changes to be made to computer programs or to data, or by allowing unauthorized transactions to be processed.
R - risk assessment SAFR
Specify Objectives
Assess Changes (in environment)
Fraud
Risk Analysis
- identification, analysis and management of risks relevant to the prep of FS that are fairly presented in conformity with applicable reporting framework
1) requires the inclusion of a strict policy of control over changes in programs and inappropriate access to data to prevent data alteration or manipulation
I - information and communication OIE
Obtain Information
Internally Communicate
Externally Communicate
- procedures and records relevant to financial reporting and communication to individuals of their roles and responsibilities pertaining to IC over financial reporting as well as to those charged with governance and regulatory authorities
1) quality of the information has a direct relationship to the relevance and appropriateness of the decision‐making process. For instance, continuous control modules (CCM) embedded within the software system enable management to monitor transaction processing of all data. Physical controls over hardware ensure actions that could affect data integrity are only carried out by responsible personnel.
M - monitoring SOD
Separate and Ongoing Evaluations
Deficiency Communication
- assessing IC performance over time to ensure that controls continue to operate effectively
1) Management is responsible for establishing and maintaining proper internal controls. Management must monitor controls to consider whether they are operating as intended and that they are modified as appropriate for changes in conditions.
E - existing control activities and control environment CATP
Control Activities
Technology
Policies and Procedures
- policies and procedures that ensure mgmt directives are carried out and necessary actions are taken to address risks that threaten achievement of entity objectives (authorization, seg of duties, safeguarding, asset accountability, performance reviews)
1) information processing - authorization of transactions and the maintenance of adequate documents and records (audit trail)
2) segregation of duties - adequate controls must be established within the IT department to compensate for the lack of segregation of duties that would normally be available in a manual system.
3) physical controls - access to assets is often possible through the computer system. As such, the need for enhanced physical controls is of great importance in an IT environment. It is also important to have adequate backup for computer files, as their destruction or damage could result in significant problems for a business entity.
identifying controls relevant to financial reporting
controls over FS that present according to GAAP and manage risk of material misstatement
whether and how a control prevents, detects, corrects material misstatement in either classes of transactions, account balances, or disclosures
identifying controls relevant to financial reporting - factors to consider
1) materiality
2) size of entity
3) nature of entity’s business
4) diversity and complexity of entity’s operations
5) applicable legal and regulatory requirements
6) nature and complexity of systems that are part of entity’s ICs
identifying controls relevant to financial reporting - accounting review and engagements (preparation, compilation, review)
engagement to prepare financial statements is a nonattest engagement and does not require the accountant to be independent. The accountant is not required to verify the accuracy or completeness of the information provided by management or otherwise gather evidence to express an opinion or conclusion on the financial statements.
compilation engagement is a no‐assurance engagement. There is no expectation that the accountant would obtain an understanding of internal control in this type of engagement. The accountant only needs to be able to have competence and capabilities to read the financial statements for obvious departures from the applicable financial reporting framework.
review engagement provides limited assurance. There is no requirement in a review to obtain a specific understanding of the design of internal controls;
identifying controls relevant to financial reporting - attestation engagements (control risk and attestation risk)
Control risk is the risk that a material misstatement could occur in the subject matter and not be prevented, or detected and corrected, on a timely basis by internal control
Attestation risk is the risk that the accountant expresses an inappropriate opinion or conclusion, as applicable, when the underlying subject matter or subject matter information (or assertion) reported on is materially misstated.
Attestation risk is not applicable to an agreed‐upon procedures engagement, as the design of procedures in that type of engagement is the responsibility of the specified party(ies).
IT general controls apply when?
apply to all aspects of IT function BEFORE TRANSACTIONS ARE PROCESSED (vs. application controls that operate at the process level and apply to processing transactions)
outside controls that provide protection for applications and mitigate:
risk of system crash
risk of unauthorized processing
risk of unauthorized master file updating
risk of unauthorized change to application software
IT general controls - 6 types
1) admin of IT function (tone at the top, control environment)
2) segregation of duties
3) system development (segregation of roles)
4) physical and online security
5) backup and contingency planning
6) hardware controls (to detect system failure)
IT general controls - admin of IT function
1) admin of IT function (tone at the top, control environment)
attitude of sr mgmt and BOD
resource allocation to IT function
involvement of IT in decision making, signal to IT importance
IT steering committee
smaller org = CIO relied upon by BOD
if assigned to lower level employees who don’t have any authority or outsourced, may signal less importance
IT general controls segregation of duties ARC
ARC “Protect you from a flood of problems”
Authority
Record keeping
Custody of related assets
IT general controls - system development
BOD
CIO or IT Mgr
Security Admin (physical assets and online security)
System development (purchase and/or develop/test software) (“authorization”)
system analysts - architect designs system
programmers - create/write the program, document it (cannot be user of system - violation of segregation of duties)
Operations (“recording/record keeping”)
Librarian - program moves from programmer to librarian , who controls the use of the program and does not release it back to the programmers when they need to make changes
network administrator - maintains network, supports all users using network
computer operators - import data into the computer system
Data control (“custody”)
database admin - “hold keys”, super user logins and all data for company (cannot have access to operations or system development - violation of segregation of duties)
data input/data output
IT general controls - physical and online security
Security admin
IT general controls - backup and contingency planning
power failure, fire, excessive heat/humidity, water damage, sabotage, terrorism
battery backups, generators
disaster recovery plan
offsite storage
outsource to firms that specialize in secure data storage
hot site - secondary site to continue to conduct business
cold site - secondary site that would need a bit of time to get going, but less expensive
IT general controls - hardware controls
6) hardware controls
built into computer equipment to detect and report equipment failure
IT application controls (what are they and what do the controls surround?)
IT application controls - designed to achieve specific control objectives related to specific accounting tasks. They pertain to the processing of individual applications. The auditor is responsible for identifying and documenting an entity’s relevant IT application controls within the flow of an entity’s transactions for a significant business process and must consider the effect of these controls on the completeness, accuracy, and reliability of an entity’s data.
Application controls - **controls that surround the applications themselves **
designed for each software specifically
manual or automated controls - input, processing, and output controls
IT application controls - INPUT CONTROL
1) input control - info entered is authorized, accurate and complete (garbage in, garbage out)
-management authorization
-adequate prep of input source documents
-competent personnel
-adequately designed input screens with preformatted prompts for transaction information
-online based input controls for ecommerce applications where external parties perform the initial art of the transaction inputting
-check digit - purpose of a check digit is to verify that the information on the barcode has been entered correctly
-validity check - computer-performed validation test of input accuracy such as validation of customer number against customer master file
-edit check - auto controls programmed into application to help prevent invalid data being entered
-limit test - user has to enter SSN before any other input; check over $$$ threshold is void
-pull-down menu
-immediate error correction procedures to provide for early detection and correction of input errors
-accumulation of errors in an error file for subsequent follow up by data input personnel
IT application controls - INPUT CONTROL (record count vs hash total, vs financial total)
record count hash total financial total
count account# $ owed
1 1256 200
2 3645 300
3 2542 500
4 2569 650
5 5987 100
6 4386 350
7 6598 200
8 3749 125
9 5823 275
45 36555 2700
IT application controls - PROCESSING CONTROL
2) processing control - prevent and detect errors while transaction data are processed
this is where the general controls during the development stage provide essential control for minimizing processing errors
specific processing controls are often programmed into the software to prevent, detect, and correct processing errors
-validation test - ensures particular type of transaction is appropriate for processing (does tran code = predetermined code?)
-sequence test - determines that data submitted for processing are in the correct order (payroll transactions in dept order before processing?)
-arithmetic accuracy test - checks accuracy of processed data (does sum of net pay + withholdings = gross pay?)
-data reasonableness test - determines whether data exceed prespecified amounts (does gross pay > 60 hours for week?)
-completeness test - determines that every field in a record has been completed ( are emp #, name, etc. included for every employee?)
IT application controls - OUTPUT CONTROLS
3) output controls - detects errors after processing
-review data for reasonableness by knowledgeable employees
-reconcile (compare sample of transactions, reconcile to manual control totals, compare number of units processed to number submitted)
Preventative controls
qualified personnel, adequate training
segregating duties to prevent fraud
controlling physical access and system access (key cards, passwords, biometrics)
Detective controls
QC
reconcilement
Corrective controls
backup copies
procedures to correct errors
DR plan
computer emergency response team (CERT) to react to security breaches and take corrective action timely
-determine problem exists
-contain the problem quickly to minimize damage
-identify why problem occurred
-repair damage and correct problem (retore backup, reinstall corrupted program)
-determine prevention in future
-determine whether to prosecute perpetrator
understanding business processes - walkthrough and document
1) classes of transactions that are significant to financial reporting
2) procedures (auto and manual) to initiate/authorize/record/process/report transactions in FS
3) related (electronic or manual) accounting records and supporting information that are significant to FS
4) how info systems capture events and conditions other than transactions that are significant to FS
5) financial reporting process used to prep FS, including significant estimates and disclosures
6) controls around JEs, especially those recording nonrecurring, unusual transactions or adjusting transactions
understanding relevant controls - identify and document; consider effect on completeness, accuracy, reliability of data
1) identifies and records all valid transactions
2) describes transactions in sufficient detail to permit proper classification for financial reporting
3) measures value of transactions that permit proper value in FS
4) determines correct time period to record
5) presents transactions (and disclosures) in FS
auditor should obtain an understanding of IT systems that are:
auditor should obtain an understanding of IT systems that are, directly or indirectly, the source of financial transactions or the data used to record financial transactions and document the procedures performed to obtain that understanding.
assertions by class
