Audit Flashcards
SECTION 1
Section 1.1: Overview of Auditing Engagements
What are the balance sheet assertions?
“CPR-ACE”
* Completeness
* Presentation
* Rights and Obligations
* Accuracy, Valuation and Allocation
* Classification
* Existence
Section 1.1: Overview of Auditing Engagements
What are the different types of terminology used by the auditor to articulate their understanding and responsibility within their respective standards?
- Must: Unconditional. Absolutely required.
- Should: Presumptively mandatory. The consideration is required, but carrying out the procedure is not required.
- Could, Might, May: Does not enforce a professional requirement. The auditor has the responsibility to consider the matter.
Section 1.3: Overview of Attestation Engagements
What is the purpose of Statement on Standards of Attestation Engagement (SSAE)?
- Attestation engagements are additional services that are the responsibility of another party, other than an audit, that a CPA performs
- An attestation engagement reports on subject matter other than traditional financial statements
- A party, who is not the practitioner, makes an assertion about whether the subject matter is measured or evaluated in accordance with suitable criteria
Section 1.4: Additional Professional Services
What are assurance and advisory services?
- Assurance and advisory services focus on improving information for better decision making.
- Involves monitoring one party by another party.
- They improve the quality of information for its decision makers.
- They often relate to audit, attestation or other non-standard services.
Section 1.4: Additional Professional Services
What are consulting services?
Think a retirement advisor. The Retirement Advisor consults you to purchase certain stock. This will result in more money being earned.
- Consulting services strive to provide advice
- They often involve two-party arrangements.
- Consulting services are designed for the improvement of operations, resulting in better outcomes.
Section 1.5: Quality Control
What is included in the Acceptance component in regard to quality control?
- Consideration of client’s integrity.
- Competence, capabilities and resources of the firm’s personnel to perform the engagement.
- The firm can comply with legal, regulatory and ethical requirements.
Section 1.5: Quality Control
What are the components of Engagement Performance in regard to quality control?
- Engagements are preformed in accordance with professional standards and legal requirements.
- The firm issues appropriate reports.
- Consistency in the quality of engagement performance.
- Supervision responsibility
- Review responsibility
Section 1.5: Quality Control
What are the components of Relevant Ethical Requirements in regard to quality control?
“RIP-SOD”
* Responsibilities
* Integrity
* Public interest
* Scope and nature of services
* Objectivity and independence
* Due Care
Section 1.5: Quality Control
What are the components of Monitoring in regard to quality control?
The policies and prcedures are:
* Relevance
* Adequate
* Operating effectively
* Complied within practice
* Includes inspection and evaluation of prior engagements.
SECTION 2
Section 2.1: Code of Professional Conduct
What is included in the AICPA Code of Professional Conduct?
- General ethical principles that are aspirational in character
- Set of specific, mandatory rules describing minimum levels of conduct a member must maintain
Section 2.2: Independence
When is a CPA not independent?
- Preparing an actuarial report using assumptions not approved by the client
- The CPA owns investments that are material
- An investment held through a regulated mutual fund
- Determining which recommendations for improving internal control should be implemented for a non public attest client
Section 2.2: Independence
When is a CPA independent?
- Providing extensive advisory services for a client
- Advisor to a client’s board of trustees
Section 2.2: Independence
What would be considered an indirect financial intererst that may cause lack of independence?
An investment held through a regulated mutual fund
Section 2.3: Integrity and Objectivity
What is included when an CPA violates the material misrrepresentation rule?
- Making materially false and misleading entries in financial statements or records
- Failing to make corrections in materially false or misleading statements or records when the member has such authority
- Signing a document with materially false and misleading information
Section 2.3: Integrity and Objectivity
What are the elements that underlies the development of an overall audit strategy?
Materiality and audit risk in determining the nature, timing, and extent of procedures to apply
Section 2.6: Other Responsibilities
What services cannot have contingent fee arrangements?
- Audits or reviews of financial statements
- An examination of prospective financial information
- Certain tax services
- Compilation that reasonably might be used by a third party that does not disclose lack of independence in the report
Section 2.6: Other Responsibilities
What are some characteristics of alternative practice structures (APS)?
- Independence rules for an APS apply
- CPAs who own the attest firm and remain financially responsible under state law for the firm’s attest work are deemed to be in compliance with the financial-interests requirement
- CPAs may own the majority of financial interests in the attest firm, but substantially all revenues may be paid to another entity for services and the lease of employees and equipment
- CPAs remain responsible, financially and otherwise, for the attest work performed to protect the public interest, not the interest of the CPA
Section 2.6: Other Responsibilities
What are some of the requirements for the Form of Organization and Name Rule?
All CPA owners must be members
Section 2.7: Other Pronouncements on Professional Responsibilities
What are the conditions when an auditor may provide an issuer client nonaudit services without impairing independence and without obtaining the preapproval of the audit committee?
- Nonaudit services were promptly brought to the attention of, and approved by, the audit committee prior to the completion of the audit
- The services were not recognized as nonaudit services by the issuer at the time of the engagement
- The revenue limit
Section 2.7: Other Pronouncements on Professional Responsibilities
What are the responsibilities and activities of the PCAOB?
- Registering public accounting firms
- Overseeing the audit of public companies that are part of the SEC
- Establishing or adopting standards on auditing, quality control, ethics and independence
- Inspecting audit firms. 1 year for over 100 audits/year; 3 years for less than 100 audits/year
- Conducting investigations and disciplinary proceeds that involve registered public accounting firms and those that are associated with the firms.
SECTION 3
Section 3.1: Pre-Engagement Acceptance Activities
What is usually communicated to management in an audit?
Arrangements that involve a predecessor auditor
Section 3.1: Pre-Engagement Acceptance Activities
Why is it important for an auditor to detect illegal acts?
Because the illegal acts may prevent the auditor from relying on the representation from management
Section 3.2: Planning and Audit
What should be included in an engagement letter?
- Objective and scope
- Responsibilites of auditor and management
- Inherent limitations
- Internal Control
- Involvement of internal auditors
- The financial reporting framework
- The expected form and content of audit reports
- Management will not intervene in the auditor’s work
Section 3.2: Planning an Audit
When does the auditor begin the financial statement audit plan?
- After the overall audit strategy is developed by the auditor
- After preliminary judgments about materality
Section 3.2: Planning an Audit
What should be included in the audit plan?
- Nature, timing and extent of procedures
- Extent of risk of material misstatement
- Planned further audit procedures
- Procedures that relate to the financial statement assertions
- Other audit procedures required by GAAS and PCAOB
The auditor does not discuss the nature and timing of detailed procedures
Section 3.2: Planning an Audit
Why would the auditor need to review the prior-year financial statements when conducting an audit?
By reviewing the prior-year financial statements, the auditor is obtaining assurance that
* Opening balances do not contain misstatements that may have an affect on the current year’s financial statements
* Accounting policies that are reflected in the opening balances are consistently applied to the current period’s financial statements
Section 3.2: Planning an Audit
What should an auditor do if non-issuer management refuses to provide access to the documentation?
The auditor should review the risk assessment on the opening balances of the financial statements.
Section 3.2: Planning an Audit
What are the purposes for evaluating the risk and adequacy and effectiveness of controls?
- Compliance with laws and regulations
- Safeguarding of assets
- Reliability and integrity of financial information
Section 3.3: Audit Risk and Materiality
What are the types of risk factors?
- Audit Risk: The risk, which is assessed by the auditor, that the auditor will fail to modify an opinion on the financial statements when they are actually materially misstated.
- Control Risk: Assumes the risk will not be prevented or detected on a timely basis by internal controls.
- Inherent Risk: Assumes no internal controls exist. Also, complex calculations are more likely to be misstated than simple ones.
- Detection Risk: Detection risk is the amount that the auditor is willing to accept.
Section 3.3: Audit Risk and Materiality
What is the definition of audit risk?
Audit risk is an aggregate of risk of material misstatements and detection risk
A material misstatement:
* May happen in the company’s accounting process
* Will not be detected or prevented by the company’s own internal control
* Will not be detected by the independent auditors, which will then be inadvertently reported in the audited financial statements.
Section 3.3: Audit Risk and Materiality
Why does an auditor evaluate inherent risk?
Inherent risk is the suspectability that there may be a material misstatement to a financial statement assertion before the auditor considers related controls
Section 3.3: Audit Risk and Materiality
What is the Audit Risk Model?
Audit risk is based on the risk of material misstatements and detection risk.
Audit Risk = Risk of Material Misstatement (RMM) x Detection Risk
Risk of Material Misstatement = Inherent Risk x Control Risk
Detection Risk = Auditor’s Risk
Section 3.3: Audit Risk and Materiality
How does a decrease in the amount of misstatements, or audit risk, impact the auditor’s plan?
The acceptable level of detection risk is inversely related to assessed risk of material misstatement
Greater assurance of substantive testing needs to be done:
* Planned audit procedures should be performed at year-end instead of interim
* Selecting a more effective audit procedure
* Increasing the extent of particular tests
Section 3.3: Audit Risk and Materiality
What would an auditor most likely review in a preliminary judgement about the materiality of financial statements as a whole for non-issuers?
- Reported income categories
- Total Equity
- Net Asset Value
Section 3.3: Audit Risk and Materiality
What would an auditor most likely review in a preliminary judgement about the materiality of financial statements as a whole for issuers?
- Pre-tax profit from continuing operations
- Prior-period information
- Period-to-date information
- Budgets
- Forecasts
Section 3.3: Audit Risk and Materiality
What is a judgmental misstatement?
Judgmental misstatements are differences arising from the judgments of management about recognition, measurement, presentation and disclosure that the auditor may consider unreasonable or inappropriate
Section 3.3: Audit Risk and Materiality
What are the different types of known misstatements?
- Missapplication of accounting principles
- Inaccuracy of processing data
- Classification difference of a reported financial statement element to a classification according to GAAP
Section 3.3: Audit Risk and Materiality
What is a projected misstatement for a non-issuer?
A projected misstatement is the auditor’s best estimate based in populations from the audit sample
Section 3.3: Audit Risk and Materiality
What does the auditor include when evaluating for uncorrected misstatements of an issuer?
- Prior years and misstatements detected in the current year that relate to prior years
- Possible undetected misstatements
- Accumulated uncorrected misstatements could exceed materiality
Section 3.4: Understanding the Entity and Its Environment
What risk assessment procedures would a continued auditor perform in planning an audit?
- Internal audit reports
- Interim statements
- Quarterly reports
- Minutes of board meetings
Section 3.4: Understanding the Entity and Its Environment
In a new audit engagement, what should an auditor do if they do not have expertise in the new client’s industry?
- Inquiries of management and others in the new engagement
- Analytical procedures
- Observation and inspection
Section 3.5: Audit Data Analytics and Analytical Procedures
What is the objective of analytical procedures applied as risk assessment procedures?
- Improve the auditor’s understanding of the client’s business
- Improve the auditor’s understanding of significant events and transactions
- Identify unusual transactions or events and amounts
Section 3.5: Audit Data Analytics and Analytical Procedures
How does an auditor determine whether to apply analytical procedures as substantive procedures or to perform tests of transactions and account balances?
The determination is whether the audit risk can be sufficiently reduced
Section 3.5: Audit Data Analytics and Analytical Procedures
What is the main reason to use analytical procedures in an audit?
- Analytical procedures alone may be enough to provide a level of assurance for some assertions.
- Relationships within the data is expected to exsist, even if there certain conditions not present.
Examples include:
* Unusual events or transactions
* Business or accounting changes
* Misstatements
* Fluctuations in the data
Section 3.5: Audit Data Analytics and Analytical Procedures
What type of accounts are used for analytical procedures?
- Income statement accounts
- Income statement accounts may be more predictable because they represent transactions over a period of time
Section 3.5: Audit Data Analytics and Analytical Procedures
What is the purpose of analytical procedures?
- Analytical procedures focus on the relationships between financial and nonfinancial data at a high level using simple and complex models
- The precision of the data is important to the auditor in determining on how to use analytical procedures as substantive procedures.
- Study of how elements of the financial data is expected to conform to a pattern that is based on the entity’s experience
- The auditor will determine the best analytical procedure to use for testing the nature of an assertion
Section 3.5: Audit Data Analytics and Analytical Procedures
What might be the outcome if analytical procedures are more precise?
- Differences between the auditor’s expectation and management’s reported amount are more likely to be caused by material misstatements
- The more detailed information, the more precise the expectation
Section 3.5: Audit Data Analytics and Analytical Procedures
What analytical procedures are included when forming an overall conclusion of an audit?
- Consider the adequacy of evidence gathered in response to unusual or unexpected balances identified
- Unusual or unexpected balances or relationships not previously identified
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What is the auditor’s responsibility regarding consideration of fraud in a financial statement audit?
Assess the risks of material misstatement due to fraud
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What are examples of misstatements?
- Inaccuracy of processing or obtainin financial data
- Omission of an amount or disclosure
- A disclosure is not presented
- Incorrect accounting estimate is made by misstake
- Unreasonable management judgments about accounting estimates
- Inappropriate selection or application of accounting policies that the auditor considers inappropriate
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What is a potential risk of material misstatement due to fraud?
- Management overide of controls
- The auditor’s procedures should address the risk of management override of controls apart from any possible existence of more identifiable risks
Section 3.6: Consideration of Fraud in a Financial Statement Audit
How should an auditor identify and assess risks that may result in material misstatements due to fraud in a financial statement audit?
Evaluating whether the entity’s related controls have been suitably designed and implemented
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What is the auditor’s responsibility to report fraud?
- The auditor should obtain reasonable assurance about whether the financial statements are free from material misstatement
It is not the auditor’s responsibility to parties that are not members of governance or the audit committee that the auditor discovered fraud
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What is the difference between incentive, rationalization and opportunity?
- Incentives are reasons for management to feel motivated to commit fraud
- Rationalization can relate to a person frequently justifying reasons for committing fraud
- Opportunities occur when company management will have the opportunity to take advantage of ineffective internal control procedures or override those controls in order to take advantage for their own self-interest
Section 3.6: Consideration of Fraud in a Financial Statement Audit
Why are new accounting requirements subject to being an incentive for fraudulent reporting?
Management may feel pressure to maintain financial stability while changing to the new accounting requirements
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What are the three conditions of fraud?
- Incentives or pressures from management
- Opportunity to override controls
- Ability to rationalize the fraudulent act
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What are examples of intentional misstatements to deceive users?
- Altering accounting records or documents
- Misrepresenting or omitting significant information
- Misapplying accounting principles
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What are examples of missappropriation of assets?
- Theft of physical assets
- Embezzelment
- An action that causes a payment not to be received
- Using entity assets for personal reasons
Section 3.7: Consideration of Laws and Regulations in an Audit
When would an auditor withdraw from an engagement if a client committed an illegal act?
- The auditor should consider the implications in relation to other representaions of management
- If the illegal act is questionable
- Management cannot be trustedin the matter
- Serious doubts arise about management’s representations
Section 3.7: Consideration of Laws and Regulations in an Audit
What is the main reason that an auditor cannot discover all noncompliance in an audit?
- Noncompliance by the client often includes operating aspects, as well as accounting aspects
- The auditor has the responsibility to detect noncompliance that has a direct effect on the financial statements
- Since the client’s operating activities are not part of the audit, the auditor will not find the compliance
Section 3.7: Consideration of Laws and Regulations in an Audit
What should an auditor do if noncompliance is discovered?
The auditor should apply audit procedures specifically directed to determine if act of compliance has occurred
Section 4
Section 4.1: Using the Work of Internal Auditors
What type of work may an internal auditor perform to assist the independent auditor?
- Obtaining and understanding of internal control
- Performing tests of controls
- Performing substantive testing
- Perform tests of internal controls
- Procedures performed in assessing risk of material misstatement
Section 4.1: Using the Work of Internal Auditors
What would an audit consider when assessing the competence and objectivity of an entity’s internal auditor?
- External quality reviews of the internal auditor’s activities
- Discussions with management personnel
- Previous experience with the internal auditor
Section 4.2: Using the Work of a Specialist
What is the purpose of a management’s specialist?
- A management’s specialist possess expertise in a field other than accounting or auditing.
- The work in the management specialist’s field is used by the entity to assist in preparing the financial statements
Section 4.3: Related Parties
What does an auditor place primary emphasis on when auditing related party transactions?
- Related party transactions are disclosed in the financial statement
- Assessing the risk of material misstatement of related party transactions
Section 4.3: Related Parties
What are the type of transactions that could be related party transactions?
- Loans with no scheduled terms for payment
- Borrowing or lending at either interest-free or low rate
- Selling real estate below the appraised value
Section 4.3: Related Parties
What type of testing should an auditor do for newly identified related party transactions?
Focus on substantive testing of the transactions
* Analyze account records for transactions
* Evaluate the business purpose of the transaction
* Verify the terms and conditions of the transaction
Section 4.4: Accounting Estimates and Fair Value
How should an auditor evaluate the reasonableness of accounting estimates?
- The auditor considers that management bases its judgement on both subjective and objective factors.
- Controls over estimates may be difficult to establish
- There may be potential bias in the subjective factors
- The auditor should maintain professional skepticism towards both subjective and objective factors
Section 4.4: Accounting Estimates and Fair Value
What is the difference between estimates best supported by evidence and best supported by financial statements?
- For financial statements, if the amount is not reasonable, then it should be treated as an identified misstatement.
- For estimates, the amounts may be possibly bias and the auditor should reconsider the estimate as a whole
Section 4.4: Accounting Estimates and Fair Value
What should an auditor consider in evaluating assumptions?
- Economic conditions
- Management’s selection of the assumptions of market participants
- The result of modifications from management’s assumptions
- The entity’s plans
- Past experience
- Prior-period assumptions
Section 4.4: Accounting Estimates and Fair Value
How would an auditor determine that an interest rate swap contract is properly stated at fair value on the client’s balance sheet?
- The auditor will test the data to arrive at the fair value of the interest rate swap contract
- The auditor should test how management made an accounting estimate and the data on which it is based, including evaluation of the method of measurement and the assumptions used
Section 5
Section 5.1: Introduction to Internal Control
How come substantive tests may not provide affirmative evidence of the effectiveness of monitoring controls?
The information used in monitoring may be correct, but the subject tested may be ineffective to control
Section 5.1: Introduction to Internal Control
What are the types of inherent limitations of internal control?
- Faulty human judgment
- Simple errors or misstakes
- Management override
- Cost-benefit considerations
- Losses
- Lawsuits and other contingencies
- Violations of laws and regulations
- Warranties
- Theft
Override by a low-level employee is not considered an inherent limitation
Section 5.2: Internal Control Components
What are the five components of internal control?
“CRIME”
Control Activities
Risk Assessment
Information Services
Monitoring
Environment of Control
Section 5.2: Internal Control Components
What are the components of a control environment?
- Participation of those charged with governance (aka Tone at the Top)
- Integrity and ethical values (including hiring personnel)
- Organizational structure
- Management’s philosophy and operating style
- Assignment of authority and responsibility
- Human Resources polices and practices
- Committment to competence
- Removing incentives that increase the probability of dishonest or unethical acts (i.e. bonuses for high rate of growth revenues)
Section 5.2: Internal Control Components
What are the components of control activities?
- Performance reviews
- Information processing
- Physical controls
- Authorization
- Segregation of Duties
Section 5.2: Internal Control Components
What are the components of Risk Assessment in Internal Control?
- Identify risks relevant to the preparation of the financial statements
- Estimate their significance
- Assess the probability
- Decide about responses to them
Section 5.2: Internal Control Components
What are the components of Monitoring internal control?
- Monitoring ongoing activities (i.e. supervision)
- The actions of internal auditors
- Consideration of communications from external parties (i.e. customer complaints)
Section 5.2: Internal Control Components
What are the components of the Information System of Internal Control?
- Physical and hardware components
- Software
- People
- Procedures
- Data
Section 5.3: Understanding Internal Control
What should an auditor document when understanding internal controls?
- The entity and its environment
- Sources of information given about the understanding
- Risk assessment procedures performed
Identifying specific controls relevant to management assertions is not part of the documentation
Section 5.3: Understanding Internal Control
What type of understanding is an auditor required to obtain when planning an audit?
The auditor is required to have an understanding of each of the five components of internal control when evaluating the design of controls
Section 5.3: Understanding Internal Control
When are tests of controls used?
- Operating effectiveness evaluation
- Test of controls are used primarily for an audit of an issuer
Section 5.3: Understanding Internal Control
What should an auditor concentrate on when obtaining an understanding of an entity’s internal control?
Substance rather than form because management may establish the internal control, but not enforce them.
Section 5.3: Understanding Internal Control
What are the risk assessment procedures an auditor should do to evaluate the design of relevant controls?
- Inquiries
- Observations
- Inspection of documents and reports
- Tracing transactions
Section 5.3: Understanding Internal Control
What are the steps in performing risk assessment procedures to evaluate the design of relevant controls and determine if they have been implemented?
- Determine whether the relevant controls are capable of preventing, or detecting and correcting, material misstatements and have been implemented
- Assess the risks of material misstatement
- Design further audit procedures
- Evaluate the operating effectiveness of relevant controls.
Section 5.3: Understanding Internal Control
What understanding of an entity’s information system should an auditor obtain?
- Processes used to prepare significant accounting estimates
- Classes of significant transactions
- How the transactions are recorded
- If the transactions are electonric or manual
- How the transactions are captured
- Controls over journal entries
Section 5.4: Flowcharting
What is the difference between a system and a program flowchart?
- A system flowchart shows the overall view of inputs, outputs and processes of a system
- A program flowchart shows specific steps in regarding to a computer program
Section 5.5: Internal Control and Information Technology
What is included in general controls?
- Controls over operations are effective and efficient
- The procedures used to acquire, test, develop, etc.
- Access of the equipment and data
- Documenting and approving programs and changes to programs
- Control over data center and network operations
- Systems software acquisition and maintenance
- Access security
- Application system acquisition, development, and maintenance.
Section 5.3: Understanding Internal Control
What is the objective of an auditor understanding internal control?
- Understanding of internal control to evaluate the design of relevant controls and determine if they have been implemented.
- Knowledge about the design and implementation of relevant internal controls should be used to identify types of misstatements that could occur
- The auditor is interested in the design of the control and whether the control has been placed into operation at the entity
Section 5.3: Understanding Internal Control
What is not included in an auditor’s understanding of an entity’s internal control?
- The auditor is not attempting to determine whether the control is effective
- The auditor’s understanding is not established to design risk assessment procedures
- Analtyical procedures are not used to demonstrate an auditor’s understanding of the client’s internal control
- The auditor does not search for significant deficiencies
Section 5.4: Flowcharting
Why are flowcharts useful?
- Flowcharts are useful for systems development
- For understanding, evaluating and documenting an entity’s internal control
Section 6
Section 6.1: Sales Responsibilities/Organizational Structure/Flowcharts
What is the Flowchart in Sales-Receivables?
- Customer: Places Order
- Sales: Sends order for credit approval
- Credit Department: Approves credit for order
- Sales: Sends acknowledgement of approved order to customer
- Inventory Warehouse: After receiving approved credit, sends goods to shipping.
- Shipping: After receiving approved credit order, ships the product, with a BOL and packing slip to the customer.
- Billing: After receiving the approved credit order, BOL and packing slip, creates an invoice.
- Accounts Receivable: Records the invoice in the A/R file
- General Ledger: The invoice is recorded in the Daily Invoice Summary and posts the General Ledger File
- General Ledger is reconciled with the A/R file and inventory records.
Section 6.1: Sales Responsibilities/Organizational Structure/Flowcharts
What is the flowchart for Cash Receipts
- Customer: Sends a check for payment with the remittance advice.
- Mailroom: Creates a remittance listing
- Cash Receipts: Receives the remittance listing and checks and prepares the deposit slips and deposits the checks at the bank.
- Accounts Receivable: Receives the remittance listing and records in the A/R file.
- Controller: Receives the remittance listing and updates the General Ledger File.
- Bank: Deposits the checks and provides a validated deposit slip.
- Controller: Compares the remittance listing with the validated deposit slip
Section 6.1: Sales Responsibilities/Organizational Structure/Flowcharts
What is the objective of obtaining credit approval before shipping goods to a customer?
- Confirms valuation, accuracy and allocation
- The credit approval provides proof that the account receivable is collectible.
Section 6.1: Sales Responsibilities/Organizational Structure/Flowcharts
What are included in the transaction cycle of Sales/Receivables/Cash Receipts?
- Cash
- Trade Receivables
- Other Receivables
- Allowance for Credit Losses
- Sales
- Sales Returns
- Credit Loss Expense
Section 6.1: Responsibilities/Organizational Structure/Flowcharts
Which control is used to help ensure that all credit sales transactions of an entity are recorded?
- The billing department supervisor matches prenumbered shipping documents with entries in the sales journal
- Compare shipments with the sales journal
Section 6.1: Responsibilities/Organizational Structure/Flowcharts
Why is the shipping documentation used in determining whether or not internal controls relative to the revenue cycle are operating effectively?
- Because the shipping file or shipping documentation would provide the best evidence of a sale or transaction occurring
- All other areas (i.e. customer file, invoice) occur after a shipment was made
Section 6.1: Sales Responsibilities/Organizational Structure/Flowcharts
What is the purpose of the customer’s account ledger?
- The open accounts receivable records are maintained in the customer’s account ledger
- Reviewing the customer’s account ledger will provide evidence that uncollected items in the customer’s account are valid receivables
Section 6.2: Controls in a Cash Sale Environment
What is the existence assertion for cash receipts?
Whether all cash receipts are kept and recorded.
Section 6.2: Controls in a Cash Sale Environment
What are the controls to confirm the existence assertion of cash receipts?
- Bank lockbox system
- Daily reconciliation of cash discounts and cash receipts
- Surveillance system over the cashier
Section 6.4: Technology Considerations
What is the difference between a field check and a validity check?
- A field check tests the characters to verify that they are the correct type for that field
- A validity check tests the relationships among other items and other parts of the system (i.e. Customer #1272 is included in the customer file)
Section 7
Section 7.1: Purchases Responsibilities/Organizational Structure
What is the systems process for purchases and payables?
- Inventory Control: Authorizes a purchase requisition to the purchasing and accounts payable departments.
- Purchasing: Creates a purchase order based on the requisition with the approved vendor.
- Receiving: Receives a blind copy of the purchase Order
- Vendor: Receives the purchase order
- Vendor: Ships Goods
- Receiving: Receives the goods and compares the information on the packing slip with the purchase order
- Receiving: Creates a receiving report
- inventory Control: Updates inventory records based on receiving report.
- Accounts Payable (Vouchers Payable): Receives receiving report and enters information in the A/P file for payment.
Section 7.3: Electronic Data Interchange (EDI)
What should be included in an EDI agreement?
- The responsibilities of all parties involved
- The messages that will be initiated
- How the messages will be interpreted
- Means of authenticating and verifying the completeness and accuracy of the messages
- The effective date of the contract
- The required level of security
Section 7.3: Electronic Data Interchange (EDI)
In EDI, why are preventive controls more important than detective controls?
- The benefits of preventive controls outweigh the costs
- The opportunity to apply detective controls is limited once a transaction has been processed
- Preventitive controls prevent fraud or error
Section 7.4: Payroll Responsibilities/Organizational Structure
What internal control activities most likely would prevent direct labor hours from being charged to manufacturing overhead?
- Time tickets should specifically identify labor hours as direct or indirect
- Compare daily journal entries with the factor labor summary
Section 7.4: Payroll Responsibilities/Organizational Structure
What is a design deficiency?
- Design is evaluated to determine whether a control can effectively prevent, or detect and correct, material misstatements
- A deficiency occurs when an unapproved change to the data was made after the data was approved (i.e. changing time worked after timecards have been approved)
Section 7.5: Payroll Technology Considerations
What is a data dictionary?
- A data dictionary is a file which the records relate to specified data items.
- It contains definitions of data records, files and the list of programs used to access and process the data.
- Permission is required to retrieve data or modify data items
Section 7.5: Payroll Technology Considerations
In a test of controls pertaining to the occurrence of payroll transactions, what would be used as a sampling unit?
- The payroll register file because it contains each payroll transaction for each employee.
- An entry in the payroll register is reconciled to time cards to test if the recorded transaction actually occurred.
Section 7.6: Other Cycles
What are the controls for PP&E?
- Written policies for capitalization and expenditure
- Review of application and depreciation methods
- Proper authority for acquisition and retirement of assets
- Detailed property records
- Physical controls over assets
- Using budget to forecast
- Control acquisitions and retirements
Section 7.6: Other Cycles
What is an internal control related to factory equipment?
- All purchases of factory equipment are required to be made through the purchasing department
- It is not made through the department needing the equipment
Section 7.6: Other Cycles
What is the proper internal control for obsolete materials?
An approved authorization determines that the materials are obsolete and unusable for normal purposes
Section 7.6: Other Cycles
What should an auditor do to obtain an understanding of a manufacturing entity’s internal control regarding inventory balances?
- Inquiries of personnel
- Observations of activities and operations
- Review entity’s documentation of controls, including policies and procedures
Section 7.6: Other Cycles
What test of controls would be included for raw materials in production?
- Prenumbered requisitions should be examined for proper authorizations, quantities, descriptions and dates
- Reperformance of relevant activities and client controls
- Examining material requisitions
Section 7.6: Other Cycles
How would an auditor test for the completeness assertion regarding long-term investments?
Compares the securities in the safe-deposit box with the recorded investments
SECTION 8
Section 8.1: Assessing Risks of Material Misstatement (RMMs)
When should an auditor perform tests of controls on the assessment of the risks of material misstatement?
- When the auditor has an expectation of the operating effectiveness of internal control; OR
- Substantive procedures alone cannot provide sufficient appropriate audit evidence at the relevant assertion level.
Section 8.1: Assessing Risks of Material Misstatement (RMMs)
Why may an auditor not place a reliance on controls for some assertions?
- The auditor believes that the controls are likely to be ineffective
- Performing only substantive procedures would effectively reduce audit risk to an acceptably low level
Section 8.2: Auditor’s Response to Risks
Why would an auditor use only substantive procedures to evaluate specific relevant assertions and risks?
- Testing the operating effectiveness of the relevant control may not be efficient
- Testing the control may be inefficient
- Risk assessment procdures may not have identified effective controls regarding the assertion
- Testing the operating effectiveness of control may be inefficient
Section 8.2: Auditor’s Response to Risks
What audit procedures should be combined with other audit procedures when testing the operating effectiveness of controls?
From Least to Most:
* Inquiry (Combined with other audit procedures i.e. observation and inquiry, etc.)
* Observation
* Inspection of relevant documentation
* Reperformance of a control.
Inquiry alone does not provide sufficient, appropriate evidence to support a conclusion about the effectiveness of a control.
Section 8.2: Auditor’s Response to Risks
What is Dual-Purpose Testing?
Dual-purpose testing involves performing:
* A test of details
* A test of controls on the same transaction. Tests of controls are used to determine whether controls are operating effectively.
Section 8.2: Auditor’s Response to Risks
What is the difference between test of controls and test of details?
Test of Controls: Testing that controls are operating effectively
Test of Details: Testing for specific management assertions
Section 8.2: Auditor’s Response to Risks
What are test of details?
- The auditor assesses the risks of material misstatement at the financial statement and relevant assertion levels to design and perform further audit procedures
- Tests of details are substantive procedures
- They should be performed for all relevant assertions related to each material transaction class, balance, and disclosure
- The auditor’s objective is to obtain sufficient appropriate evidence to form an opinion on whether statements are materially misstated
Section 8.2: Auditor’s Response to Risks
What areas will an auditor assess when considering the risk of material misstatement of an entity’s control environment?
- Assessment of RMM at the financial statement level
- The auditor’s overall response
Section 8.2: Auditor’s Response to Risks
What is included in substantive testing for substantive procedures?
- Test of details
- Analytical procedures
Substantive procedures should be performed for significant transaction classes. Regardless of the assessed RMM.
Section 8.2: Auditor’s Response to Risks
What is included in test of controls?
Reperformance
Observation
Section 8.2: Auditor’s Response to Risks
What is the impact on timing of testing of controls?
- Over a period of time (i.e. a year): The auditor may be able to rely on the control
- At a point in time (i.e. interim): The auditor will need to include other tests
Section 8.2: Auditor’s Response to Risks
Why does observation provide the least level of assurance?
Because observation is only for a point in time – when the auditor is watching the process.
Section 8.2: Auditor’s Response to Risks
Why should an auditor perform substantive procedures when assessing for risks of material misstatement?
- To restrict detection risk for significant transaction classes
- The auditor should design and perform substantive procedures for all relevant assertions related to each material transaction class, account balance, and disclosure
Section 8.2: Auditor’s Response to Risks
What are examples of overall responses to assessed RMM?
- Professional skepticism
- Increased supervision
- Assignment of staff with more experience and expertise
- Greater unpredicability of audit procedure choices
- Changing nature, timing and extent of audit procedures
Section 8.2: Auditor’s Response to Risks
What are the overall responses an auditor would make when the risk of material mistatement increases?
- Assigning more experienced personnel and individuals with special skills
- Increasing supervision
- Emphasizing professional skepticism
- Modifying procedures to obtain more persuasive evidence.
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of parallel simulation?
Advantages
* The transactions from throughout the period may be processed and the results can be compared with the client’s results.
* Provides Assurance that edit checks have been applied during the period.
Disadvantages
* Cost of obtaining the program and the coordination effort required to obtain transactions to reprocess.
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of Integrated Test Facility?
Advantages
* It tests the actual program in operation.
Disadvantages
* It requires considerable coordination.
* The dummy transactions must be purged prior to internal and external reporting.
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of the Test Data Approach?
Advantages
* This approach directly tests specific controls.
Disadvantages
* It Tests Processing at only one moment in time, but not the system used throughout the year.
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of the Embedded Audit Module?
Advantages
* It permits continuous monitoring of online, real-time systems.
Disadvantages
* Audit hooks must be programmed into the operating system and applications program.
Secton 8.3: Assessing Risk in a Computer Environment
What is the difference between an Integrated Test Facility (ITF) and the Test Data Approach?
- ITF requires the auditor to create a dummy record within the client’s actual system
- Test data approach has the auditor create a set of dummy transactions for testing
SECTION 9
Section 9.1: Communicating Internal Control Related Matters Identified
Who is part of governance in regard to auditing and reports?
- Board of Directors
- Audit Committee
Section 9.1: Communicating Internal Control Related Matters Identified
What should be included in the communication of significant control deficiencies?
- Purpose of the Audit was to report on the financial statements, not to provide assurance on internal control
- Definition of Significant Deficiency
- Definition of Material Weakness
- Report of any significant deficiencies or material weaknesses
- Restricted Report
Section 9.1: Communicating Internal Control Related Matters
What is a control deficiency?
- A control deficiency may arise either in the design or operation of a control.
- It is the lowest level of deficiency identified in the standards.
Section 9.1: Communicating Internal Control Related Matters
What is an operating deficiency?
- Operating effectiveness relates to how and by whom the control (manual or automated) was applied and the consistency of application.
- A control that is not implemented, no matter how well designed, is ineffective absent the mitigating effect of compensating controls. Furthermore, the control risk is high for all other controls.
- A properly designed control does not function as designed
Section 9.1: Communicating Internal Control Related Matters
What is a design deficiency?
- The evaluation of design considers whether a control (alone or with others) can effectively prevent, or detect and correct, material misstatements.
- An improper design may be a significant deficiency or material weakness in internal control that the auditor should communicate to management and those charged with governance.
- The lack of a control that provides documentation for invoices is a failure of design, not an operating issue.
Section 9. 2: The Auditor’s Communication with Governance
What matters should the auditor communicate to those charged with governance?
- Disagreements with management that have been satisfactorily resolved
- Initial selection of significant accounting policies in emerging areas that lack authoritative guidance