AUD 2 - Quality Control, Acceptance, Planning, and Internal Control

Question 1

What are the contents of the Engagement Letter?

Answer 1

1. Objective and scope of the audit
2. The responsibilites of the auditor
3. The responsibilities of management
4. A statement that some material misstatements may not be detected even though audit was in accordance with GAAS
5. The applicable financial reporting framework
6. Reference to the expected form and content of any reports to be issued by auditor

Question 2

During a financial statement audit, the internal auditor may provide direct assistance to the independent CPA in performing:

Test of control or substantive tests?

Answer 2

Both; the work of an internal auditor may aid the external auditor in obtaining an understanding of internal control, assessing risk, and performing substantive tests, including the test of controls.

Question 3

is a tax expert employed by the auditor’s CPA firm to review the client’s tax accrual considered a specialist?

Answer 3

No they are not considered a specialist because tax expert skills fall within the accounting categorization.

GAAS defines specialist as a person/firm with special skills in fields other than accounting or auditing…

Question 4

What are the 5 components of internal control?

Answer 4

1. Control Environment
2. Risk Assessment
3. Information and Communication Systems
4. Monitoring
5. Existing Control Activities

Question 5

What is the objective of internal control for an entity?

Answer 5

1. Reliability of financial reporting
2. Effectiveness and efficiency of operations
3. Compliance with applicable laws and regulations

Question 6

The system of quality control should include policies and procedures addressing each of the following elements:

Answer 6

1. Leadership responsibilities for quality within the firm (tone at the top)
2. Relevant ethical requirements
3. Acceptance and continuance of client relationships and specific engagements
4. Human resources
5. Engagement performance
6. Monitoring

Question 7

Upon discovering material misstatements in a client’s financial statements that the client would not revise, a predecessor auditor withdrew from the engagement. If asked by the auditor about the termination of the engagement, the predecessor auditor should

Answer 7

Request that the auditor obtain the client’s permission to discuss the reasons.

Question 8

What is the relationship between the risk assessment and audit procedure?

Answer 8

The auditor’s risk assessment impacts the nature, extent and timing of the audit procedures

Question 9

what are the financial statement assertions?

Answer 9

Think of the acronym “COVERUP”

Completeness
cutOff
Valuation, allocation, and accuracy
Existence and occurrence
Rights and obligations
Understandability and Presentation and classification

Question 10

Proper segregation of duties calls for separate functions of:

Answer 10

1. Authorization
2. Recording
3. Custody

Question 11

What are the components of the control environment?

Answer 11

(1) commitment to competence, (2) human resource policies and practices, (3) assignment of authority and responsibility, (4) management’s philosophy and operating style, (5) participation of those charged with governance, (6) integrity and ethical values, and (7) the organizational network.

Question 12

What are risk assessment procedures performed to obtain evidence about the design and implementation of relevant controls?

Answer 12

1. inquiries
2. observation of the application of specific controls,
3. inspection of documents and reports, and
4. tracing transactions

Question 13

The auditor should prepare audit documentation that is sufficient to permit an experienced auditor to understand

Answer 13

(1) the nature, timing, and extent of audit procedures performed to comply with GAAS and other requirements; (2) the results and evidence obtained; and (3) significant findings or issues, the conclusions reached, and judgments made (AU-C 230).

Question 14

After the auditor evaluates the design of relevant controls and determines that they have been implemented, this knowledge is used to

Answer 14

(1) identify the types of potential misstatements, (2) identify the factors that affect the risks of material misstatements, and (3) design further audit procedures.

Question 15

What are the risk assessment procedures performed to obtain an understanding of an entity and its internal controls?

Answer 15

They include (1) inquiries, (2) analytical procedures, and (3) observation and inspection.

Question 16

What is the maximum number of days an auditor should complete the assembly of the final audit file following the release date?

Answer 16

45 days for an issuer (PCAOB standards)
60 days for a non issuer

Question 17

what would an auditor most likely use to make a preliminary determination of materiality?

Answer 17

the entity’s prior year financials

Question 18

what are examples of inherent limitations to internal control?

Answer 18

1. mgmt override
2. collusion
3. human error

Question 19

What is one of the primary benefits of using generalized audit software packages to audit the financial statements?

Answer 19

is the ability to access client data stored in computer files without having a detailed understanding of the client’s hardware and software features

Question 20

What is nonsampling risk?

Answer 20

onsampling risk is the risk that the auditor may draw an erroneous conclusion for any reason not related to sampling risk. Examples include the use of inappropriate audit procedures or misinterpretation of audit evidence and failure to recognize a misstatement or deviation

Question 21

what is sampling risk?

Answer 21

Sampling risk results from not performing an audit procedure on every sampling unit in a population.

Question 22

The audit plan is based on the overall audit strategy. It describes:

Answer 22

(1) the nature and extent of risk assessment procedures;
(2) the nature, timing, and extent of further audit procedures at the assertion level; and
(3) other procedures required by GAAS.

**Risk assessment procedures are performed to obtain an understanding of the entity and its environment (including its internal control). Their purpose is to identify and assess the risks of material misstatement (whether due to fraud or error) at the financial statement and relevant assertion levels.

Question 23

The three types of control totals are record counts, financial (amount) totals, and hash totals. Define each of them:

Answer 23

1. Record counts establish the number of source documents and reconcile it to the number of output records.
2. Financial (amount) totals compute dollar or amount totals from source documents (e.g., the total dollar amount of invoices processed) and reconcile them with the output records.
3. Hash totals add numbers on input documents that are not normally added (e.g., department numbers for payroll processing) and reconcile them with output records.

Question 24

The internal audit function falls under which of the five components of internal control described in the COSO model?

Answer 24

it is part of the monitoring component

Question 25

According to the COSO, an entity’s internal control has five components:

Answer 25

(1) the control environment,
(2) risk assessment process,
(3) control activities,
(4) information systems, and
(5) monitoring

Question 26

A conceptually logical approach to the auditor’s consideration of relevant controls consists of the following four steps:

1. Determine whether the relevant controls are capable of preventing, or detecting and correcting, material misstatements and have been implemented.
2. Evaluate the operating effectiveness of relevant controls.
3. Assess the risks of material misstatement.
4. Design further audit procedures.

Answer 26

1. Determine whether the relevant controls are capable of preventing, or detecting and correcting, material misstatements and have been implemented.
2. Assess the risks of material misstatement.
3. Design further audit procedures.
4. Evaluate the operating effectiveness of relevant controls.

Question 27

The audit plan is a tool for scheduling and controlling the audit. What should it include?

Answer 27

It should contain a detailed set of procedures for accomplishing audit objectives, estimated times for each step, and the personnel required.

Question 28

For which of the following judgments may an independent auditor share responsibility with an entity’s internal auditor who is assessed to be both competent and objective?

Assessment of Inherent Risk

Assessment of Control Risk

Answer 28

neither

The auditor may use the internal auditor to provide direct assistance in the audit as long as the auditor supervises, reviews, evaluates, and tests the work of the internal auditor. However, an internal auditor, regardless of his or her competence and objectivity, should never make judgments about the audit work being conducted. All judgments, including assessments of the risks of material misstatement (inherent and control risk), should be made by the auditor

Question 29

What is the risk of underreliance??

Answer 29

It is the risk that the sample indicates that the controls are less effective than they actually are.

Question 30

What is Computer Assisted Audit Techniques?

Answer 30

Auditing through the computer. The focus is on the input and processing stages of transaction processing. CAATs include:

1. Transaction Tagging
2. Embedded Audit Modules
3. Test Data
4. Integrated Test Facility
5. Parallel Simulation

Question 31

What is Transaction Tagging?

Answer 31

a technique the auditor uses to electronically mark (or tag) specific transactions and follow them through the client’s system.

tagging allows the auditor to test both the computerized processing and the manual handling of transactions

Question 32

What is Embedded Audit Modules?

Answer 32

Are sections of the application program code that collect transaction data for the auditor.

For example, an auditor might want to examine all transactions affecting a specific account code that are greater that $500

Embedded audit modules are most often built into the application program when the program is developed. They are used to ensure that controls operate effectively

Question 33

What is test data?

Answer 33

this is a technique that uses the application program to process a set of test data, the results of which are already known.

the client’s system is used to process the auditors data, off-line, while still under the auditor’s control. Advantage is the live system is not impacted

The test data contains the types of invalid conditions in which the auditor is interested…examples are invalid #, excess payrate, excess hours, etc

Question 34

Integrated Test Facility

Answer 34

similar to the test data approach except the test data is commingled with live data.

The test data must be separated from the live data before the reports are created. This is usually accomplished by processing the test data to dummy accounts (ie fictitious customer, branch, vendor, etc)

Client personnel are not informed that the test is being run

Question 35

What is Parallel Simulation?

Answer 35

is a technique in which the auditor reprocesses or all of the client’s live data (using software provided by the auditor) and then compare the reuslts with the client file

Question 36

What is Generalized Audit Software Packages (GASPs)?

Answer 36

allow the auditor to perform test of controls and substantive tests directly on the client’s system.

advantages: allows the auditor to sample and test a much higher percentage of transactions, making a more reliable; GASPs require little technical knowledge (of client’s hardware and software); GASPs can significantly reduce audit time without sacrificing quality

Question 37

What are included in procedures for a walkthrough?

Answer 37

Walkthrough procedures usually include a combination of inquiry, observation, inspection of relevant documentation, and reperformance of controls.

Question 38

does analytical procedures in the planning stage help the auditor develop a preliminary judgment about materiality?

Answer 38

no

Question 39

If the acceptable level of detection risk decreases, does an auditor require more or less assurance from substantive procedures?

Answer 39

more assurance is required from substantive procedures

Question 40

Does an increase in RMM, cause an increase or decrease to allowable detection risk?

Answer 40

this would cause a decrease to allowable detection risk

Question 41

Which of the following is considered a test of control?

interviewing or observing personnel to determine segregation of duties?

Answer 41

both are considered test of controls

Question 42

What are the elements of quality control?

Answer 42

think of the acronym “HELP ME”

Human resources
Engagement/client acceptance and continuance
Leadership responsibilities
Performance of the engagement
Monitoring
Ethical requirements

Question 43

Is there a requirement to be independent for both assurance and advisory services?

Answer 43

yes need to be independent for both

Question 44

What is due professional care when it comes to auditing?

Answer 44

1. The auditor must possess the requisite skills to evaluate financial statements
2. The auditor has a duty to employ such skill with reasonable care and diligence
3. The auditor undertakes his task(s) with good faith and integrity but is not infallible
4. The auditor may be liable for negligence, bad faith, or dishonesty, but not for mere errors in judgment

Question 45

One of the internal control components is control activities. what do these relate to?

Answer 45

(1) performance reviews, (2) information processing, (3) physical controls, (4) authorization, and (5) segregation of duties.

Question 46

An auditor anticipates relying on the operating effectiveness of controls in a computerized environment. What controls should the auditor focus on initially?

Answer 46

General controls.

Relying on controls involves (1) identifying specific controls that are suitably designed to prevent, or detect and correct, material misstatements in relevant assertions; (2) performing tests of controls; and (3) assessing the RMMs. Some computer controls relate to all computer activities (general controls), and some relate to specific tasks (application controls). Because general controls have pervasive effects, they should be tested before application controls. If the general controls are ineffective, tests of the application controls over input, processing, and output are unlikely to permit the auditor to rely on controls.

Question 47

Which component of internal control includes development and use of training policies that communicate prospective roles and responsibilities to employees?

Answer 47

Control environment.

The control environment sets the tone of an organization. It includes human resource policies and practices relative to hiring, orientation, training, evaluating, counseling, promoting, compensating, and remedial actions.