AUD Ninja Flashcards
What is the primary duty of an auditor?
To provide users of financial information with REASONABLE ASSURANCE that the financial statements are not materially misstated.
What is the auditor’s responsibility for detecting theft or fraud?
- Auditors are *NOT RESPONSIBLE* for Detecting theft or fraud.
- Instead- they are responsible for providing REASONABLE ASSURANCE that the financial statements are not materially misstated.
When should an auditor be hired in relation to the balance sheet date for optimum audit planning and efficiency?
The earlier the auditor is hired- the better for audit planning and efficiency.
When can audit procedures be performed at interim dates?
- When Control Risk for the accounts and/or transactions is low
- Audit procedures can be performed at interim dates.
- Auditor Reviews changes in the balances at year-end.
When can an auditor accept an engagement offered after the year is already closed?
The auditor can take the engagement if they are able to overcome the limitations of the engagement.
For what does an auditor use professional skepticism?
- To plan the scope of the audit
- To plan the objectives of the audit
How can analytical procedures be performed in audit planning?
The auditor Compares Actual vs. Forecasted Numbers.
What must an auditor have in order to discuss issues relating to a predecessor auditor’s work?
- Auditor must have client’s permission to discuss the issue
What questions must an auditor ask with respect to procedures carried out by assistants?
- Were they adequately performed?
- Review the working papers
- Are the results consistent with the audit report?
How is audit strategy mapped out?
- Auditor determines what the reporting objectives are.
- Auditor determines the scope of the audit.
Describe the key components of maintaining auditor independence.
- Must be independent in fact and appearance
- Honesty
- No direct financial interest
- No indirect material financial interest
Describe Due Professional Care
Technical abilities mirror those held by peers in the profession Follow GAAS Standards Obtain a Reasonable Level of Assurance Maintain Reasonable Level of Skepticism Supervise Audit Staff Review judgment at every level
What should an auditor do prior to accepting an audit engagement?
Review the previous financial statements Speak to third parties Contact predecessor auditor to evaluate whether engagement should be accepted (must have client permission)
What questions should be asked by an auditor prior to taking an engagement?
Note: must have permission of client to contact predecessor auditor (no permission = no engagement) Why the Auditor Change? Any Serious Discussions with Audit Committee? How is Management Integrity? Disagreements? How was Internal Control? Understand Industry or Be Willing to Learn Consider Scope Limitation - Limited evidence available = no engagement
What should be included in an audit engagement agreement?
Note: must be written Objectives of Engagement Limitations of Engagement Responsibilities of Management - Provide written assertions Responsibilities of Auditor - Limited error/fraud responsibility Expectations of Access to Records Financial Statements (and Disclosures) are Management’s Responsibility Compliance with Laws Internal Control
What is management’s responsibility with respect to the financial statements?
Management is responsible for financial statements and adequacy of disclosures. Presentation & Disclosure Existence (Tests Overstatements) Rights & Obligations Completeness (Tests Understatements) Valuation & Allocation
What is the purpose of the Audit Committee?
Responsible for Hiring Auditor Oversees Internal Control Must Agree with Auditor on: Responsibility of the Parties- Audit Fee- Timing of the Audit- Audit Plan Acts as Liaison Between Auditor and the Board Auditor Communicates Concerns about: Internal Control Deficiencies- Errors- Fraud- Illegal Activities
How is Audit Risk calculated?
Inherent Risk x Control Risk x Detection Risk Risk that material mistakes- errors- omissions- or fraud will result in an inaccurate audit report Based on Auditor Judgment Measured in both Qualitative and Quantitative
Describe Control Risk
Risk that internal control will not detect error or fraud Auditor cannot control this.
Describe Inherent Risk.
Which transactions have a higher level of risk? Auditor cannot control
Describe Detection Risk.
Will the auditor fail to detect a material misstatement? Auditor CAN control Do testing at year-end Increase substantive testing Run more effective tests
What responses should an auditor take based on different levels of acceptable detection risk (DR)? What type of tests should be performed?
Less Acceptable DR = Run More Substantive Tests More Acceptable DR = Run Less Substantive Tests More Substantive Tests (DR down) = Less Audit Risk; (AR = IR x CR x DR) Less Substantive Tests (DR up) = More Audit Risk; (AR = IR x CR x DR)
What are quantitative measurements versus non-quantitative measurements with respect to risk?
Quantitative Measurements - Inherent- Control- and Detection Risk can all be measured in terms of percentages Non-Quantitative Measurements - Inherent- Control- and Detection Risk can all be measured in terms of acceptable ranges
Whose responsibility is it to FIND and PREVENT fraud?
It is Management’s responsibility.
What is the auditor’s responsibility with respect to fraud and illegal acts?
Assess the RISK that such things will lead to material misstatements Design the audit to provide reasonable assurance against fraud- illegal acts that directly and materially affect the financial statements Report ALL management fraud to the audit committee (minor fraud by low-level employees not reported to committee) Perform required inquiries and procedures (management inquiries- analytical procedures- discussions with audit personnel about fraud)
What are the three factors that affect/influence fraud?
Fraud is born out of: Rationalization Incentive Opportunity (RIO)
What is the difference between fraud and errors?
Errors are unintentional- fraud is intentional.
What red flags may indicate higher risk in an audit?
Management compensation tied to stock Aggressive financial forecasting Former auditor disagreed with Management Records not available for audit Current audit procedures may need to be reconsidered if red flags exist.
Describe the characteristics of a Fraud Risk Factor.
Has been observed in similar situations Does NOT necessarily mean that there is a material weakness in internal control Leads to an auditor taking action
What does an examination of internal control accomplish with respect to illegal acts?
Internal control analysis can result in the conclusion that IC is weak- but probably won’t identify illegal acts
What is the purpose of adjusting audit procedures in light of fraud risk factors identified during an audit?
Strives to make audit engagement procedures less patterned and predictable Re-evaluates management’s application of accounting procedures Finds and assigns audit personnel with relevant skills in this area
What should be documented with respect to fraud risk factors in an audit?
Any fraud risks identified that could lead to material misstatement Audit procedures performed to assess risks Nature of communication made to audit committee and company management Disclosure to third parties regarding fraud not normally the auditor’s responsibility Fraud by management should normally be reported to the audit committee- NOT the SEC.
What was the effect of the SOX Act of 2002?
Created PCAOB Designates Officer responsibility for internal control Must disclose significant internal control weaknesses to auditor and audit committee Must disclose any level of fraud discovered by employees with internal control responsibilities
What is the Hierarchy of Authoritative Literature?
- Statements on Auditing Standards (SAS) 2. Auditing Interpretations- AICPA Guides & SOPs 3. Industry Articles (no authority)
What quality control activities are undertaken by CPA firms with audit practices?
Firm Leadership exhibits quality and leads by example and sets the tone for the organization Firm should Monitor and document that its policies and procedures are being followed Firm should have Relevant Ethical Requirements Acceptance and continuance of client engagements should continue to be evaluated for client integrity- auditor competency- and legality Firm should have competent and ethical personnel Firm engagements are performed- supervised- and reviewed in accordance with professional standards and regulations.
Which literature governs Compilation services?
SSARS - Statements on Standards for Accounting and Review Services These govern reporting for non-public entities only
What is the independence requirement for Compilations?
Independence NOT required for Compilations No Internal Control work allowed No assurance given
What type of assurance is provided by a Compilation?
Compilations are not an assurance service. No assurance is provided.
What type of assurance is provided by Review services?
Reviews provide NEGATIVE assurance.
What is the independence requirement for a Review?
Reviews require independence. No Internal Control work allowed Performs analytical procedures No material indirect financial interest allowed No immaterial direct financial interest allowed
For compilations and reviews- what knowledge must a service provider have?
Must have an understanding of the client industry.
What are attestation services?
CPA expresses a conclusion about an assertion - Compliance with laws NOT considered a Consulting engagement Independence Required
What is the independence requirement for consulting services?
Independence is not required for consulting services.
Describe the limitations on Prospective Financial Statements?
Report is restricted to specified users. Agreed-upon procedures are implemented.
What is the role of the Group Engagement Team?
Develop Audit Strategy; Communicate with Component Auditors; Perform work on the Consolidation Process; Evaluate Audit Conclusions; Understand work of Component Auditors;
Who is on the Group Engagement Team?
Firm Partners; Group Engagement Partner; Audit Staff
Who establishes the Materiality threshold for the Component Auditor?
The Group Engagement Team; The Materiality threshold must be lower than the Group Materiality threshold
What is the Group Engagement Partner responsible for?
Group Audit Engagement Direction - Supervision - Performance and the Audit Report
What is the role of a Component Auditor
Audit a component of the entity
What should the Group Engagement Team do if a Component Auditor audits a Significant Component due to Financial Materiality?
Audit the Financial Information
What should the Group Engagement Team do if a Component Auditor audits a Significant Component due to Risk of Material Misstatement?
Perform Audit Procedures
What should the Group Engagement Team do if a Component Auditor audits a Non-Significant Component?
Analytical Procedures performed at Group Level
Why does an Auditor do if they suspect legal proceedings could contribute to a Material Misstagement?
Contact Client external counsel through a Letter of Inquiry
If Internal Control is poor and a company’s accounting practices are sloppy - which risk is higher?
Control risk increases with poor Internal Controls and sloppy accounting practices.
If Internal Control is poor - what is the effect on the audit?
Auditor will need to perform more testing and dig deeper into accounts in order to arrive at an opinion regarding the financial statements.
What does Internal Control provide reasonable assurance for?
Internal control provides reasonable assurance that Material misstatements will be prevented Reliability/integrity of financial statements will be preserved Assets are protected against misuse
What is required in an examination of Internal Control under Sarbanes-Oxley?
CEO/CFO must disclose Internal Control deficiencies Management must provide assessment of Internal Control Management must certify Financial Statements
What is the relationship between Internal Control and Substantive Testing?
Inverse Relationship Stronger Internal Controls - Less Testing Needed Weaker Internal Controls - More Testing Needed
What are the 3 objectives of Internal Control?
Reliability of Financial Reporting Operational Efficiency/Effectiveness Compliance with Law and Regulations
What are the 5 components of Internal Control?
Control Environment Risk Assessment Information and Communication Monitoring Control Activities
What is the purpose for a Control Environment assessment?
Sets tone for the entire company
What are the components of the Control Environment?
Integrity/Ethics of Management Competence of Management Organizational Structure Human Resource Policies Assignment of Authority/Responsibility Management’s Style (riskier with a dominant/aggressive individual) Board/Audit Committee involvement
What does an auditor’s assessment of Detection Risk determine?
Detection Risk determines nature- timing- and extent of audit procedures.
What determines the acceptable level of Detection Risk?
Risk of material misstatement determines acceptable level of Detection Risk
What items could increase the risk of material misstatement?
Rapid growth in the company. The methods management uses to identify risk- estimate its significance and assess the likelihood of occurrence Major changes to operations- personnel- systems- IT- products- corporate organization- and foreign operations.
What happens when Control Risk is assessed to be at the maximum level?
No Internal Control testing is performed. All audit procedures are increased in intensity to compensate for increased risk.
What happens when Control Risk is below the maximum level?
Auditor tests Internal Controls. Auditor evaluates Control Risk based on tests Auditor adjusts substantive tests accordingly Weaker Internal Control - More substantive tests Stronger Internal Control - Less substantive tests
Describe some common examples of Control Activities.
Performance Reviews Information Processing Physical Controls Segregation of Duties
What should an auditor understand with respect to Information and Communication on an audit?
Understand Client’s Major transaction classes Transaction initiation Support records/documents Transaction processing Financial Statement internal reporting process Financial Statement external reporting process
How must an auditor document understanding of Internal Control?
Through written documentation such as Internal Control memos- flowcharts- and questionnaires
What questions should be asked to determine the risk of material misstatement?
Were all transactions recorded? Were they timely? Measured appropriately? Recorded in correct period? Presented and disclosed properly? Did Management communicate their responsibilities?
What is the purpose of testing Internal Controls?
Auditor needs reasonable assurance that controls are functioning as designed and effective Internal Control Testing should be strong as (IRON) so that nothing gets past them Inquiry - Interview company personnel Re-performance - Can it be replicated? Observation - Watch the control be applied INspection - Dig into the details/documents If results are as expected- substantive procedures do not need to be adjusted
When can controls tested by an auditor in a prior year be used in the current year’s audit assessment?
Controls tested by auditor in a prior year can be used in the current year’s audit assuming they are re-tested every third year Exception If the control has changed since the last audit
What happens if Internal Controls are deficient?
Control Risk increases Scope of substantive procedures increases Detection Risk decreases Material Weakness - Reasonable possibility that a material misstatement in Financial Statements would not be found- more than a remote chance of occurrence
What is a Material Weakness?
Reasonable possibility exists that a material misstatement in Financial Statements would not be found- and has more than a remote chance of occurrence.
What does Tracing test?
Tests Completeness Starts with source document and traces forward to the journal entry.
What does Vouching test?
Tests Existence. Starts with a journal entry and searches for a voucher or source document to support the entry.
What activities represent Segregation of Duties?
Non-compatible duties performed by separate individuals- such as Authorization of asset disbursement vs. Recording of Assets vs. Custody of assets If supporting audit evidence doesn’t exit - use Observation and Inquiry Accounting should be segregated from Production
With respect to signing checks - how are duties segregated?
Employees who prepare vouchers/invoices should not also have the authority to SIGN CHECKS Tip - Remember this as an underlying theme with Segregation of Duties. The authority to make a payment should not also lie in the hands of those creating invoices/vouchers. Why? People commit fraud by setting up fake companies and basically paying themselves
With respect to custody of assets - how should duties be segregated?
Employees who have custody of assets should not also RECORD those assets Someone in charge of petty cash should not also control the petty cash records Treasury Department (custodians) should NOT have record keeping duties They control assets and should not be able to adjust any recording of those assets
What are the limitations on Control Activities?
Controls can’t stop collusion or bad judgment Management can override controls Cost vs. Benefit relationship of Internal Control
What is required if a Material Weakness is identified?
A written report to management is required. Report declaring that no material weaknesses were found is allowed Previous weaknesses reported that still exist should be reported again Should be reported no later than 60 days after audit report release date If one or more material weaknesses is uncorrected at year-end- an Adverse Opinion on Internal Control must be given
What is the effect of a Significant Deficiency? What is it?
A significant deficiency adversely affects a company’s ability to report in the financial statements according to GAAP. A significant deficiency is a more than a remote likelihood of material misstatement by more than an inconsequential amount
What must occur if a Significant Deficiency is identified?
If a Significant Deficiency is identified- a written report to management required Report declaring that no significant deficiencies exist is not allowed Previous deficiencies reported that still exist should be reported again Should be reported no later than 60 days after the audit report release date
What is a Control Deficiency?
A control is not operating as intended.
What must an auditor ask if using the work of third parties?
Are they competent? Are they objective?
What must an auditor understand with respect to internal auditors?
Auditor needs to understand the role of Internal Auditors within the organization because their work affects the audit plan Responsibility for judgments about materiality or appropriateness of entries or estimates cannot be shared with third parties like Internal Auditors Internal Auditors should be asked to do some of the legwork like preparing schedules or running reports They should not be asked to make any decisions or judgments
What is required in an examination of Internal Control under Sarbanes-Oxley?
CEO/CFO must disclose deficiencies Management must provide assessment of Internal Controls Management must certify Financial Statements
What is the relationship between Internal Control and Substantive Testing?
Has inverse relationship Stronger Internal Control results in LESS substantive testing Weaker Internal Control leads to MORE substantive testing
What are the three objectives of Internal Control?
Reliability of Financial Reporting Operational Efficiency/Effectiveness Compliance with Law and Regulations
What are the five components of Internal Control?
Control Activities Risk Assessment Information and Communications Monitoring Control Environment
What are the components of the Control Environment?
Integrity/Ethics of Management Competence of Management Organizational Structure Human Resources Policies Assignment of Authority/Responsibility Management’s Style (riskier with a dominant/aggressive individual) Board/Audit Committee involvement
What happens when Control Risk is below the maximum level?
Auditor tests Internal Controls. Auditor evaluates Control Risk based on tests Auditor adjusts substantive tests accordingly Weaker Internal Control - More substantive tests Stronger Internal Control - Less substantive tests
What should an auditor understand with respect to Information and Communication on an audit?
Understand Client’s Major transaction classes Transaction initiation Support records/documents Transaction processing Financial Statement internal reporting process Financial Statement external communication process
How must an auditor document understanding of Internal Control?
Auditor must document understanding of Internal Control via Memos - Flowcharts - Questionnaires
What is the purpose of testing Internal Controls?
Auditor needs reasonable assurance that controls are functioning as designed and effective Internal Control Testing should be strong as (IRON) so that nothing gets past them Inquiry - Interview company personnel Re-performance - Can it be replicated? Observation - Watch the control be applied INspection - Dig into the details/documents If results are as expected - substantive procedures do not need to be adjusted
When is an audit of IT NOT required?
Controls are redundant to another department The system does not appear to be reliable and testing controls would not be an efficient use of time Costs exceed benefit
When can an audit of IT be performed without directly interacting with the system?
System isn’t complex or complicated System output is detailed
What is the role of a Database Administrator?
Maintains database Restricts access Responsible for IT internal control
What is the role of a Systems Analyst?
Recommends changes or upgrades Liaison between IT and users
What is the role of the data Librarian?
Responsible for disc storage Holds system documentation
What is the benefit of Generalized Audit Software in an audit?
Uses computer speed to quickly sort data and files- which leads to a more efficient audit Compatible with different client IT systems Extracts evidence from client databases Tests data without auditor needing to spend time learning the IT system in detail Client-tailored or commercially produced
What is a Relational Database?
Group of related spreadsheets Retrieves information through Queries
What is a Data Definition Language?
A language that defines a database and gives information on database structure. It maintains tables- which can be joined together. It establishes database constraints.
What functions are performed by a Data Manipulation Language?
Maintains and queries a database Auditor needs information- so client uses DML to get the information needed
What functions are performed by a Data Control Language?
A Data Control Language controls a database and restricts access to the database.
What are Check Digits?
A numerical character consistently added to a set of numbers. It makes it more difficult for a fraudulent account to be set up or go undetected.
What is the purpose of a Code Review?
A Code Review tests a program’s processing logic. Advantageous because auditor gains a greater understanding of the program.
