Audit 3

Question 1

Define audit sample

Answer 1

The selection and evaluation of less than 100 percent of the items in a population of relevant audit evidence selected in such a way that the auditor expects the sample to be representative of the population and thus likely to provide a reasonable basis for conclusions about the population.

Question 2

How has technology changed audit samples?

Answer 2

Technological advances have reduced the number of times auditors need to apply sampling techniques to gather audit evidence:

1 ) Development of well-controlled, automated accounting systems.

2) Advent of powerful audit and business analytics software to download and examine data.

Question 3

Define Sampling Risk

Answer 3

Sampling risk is the element of uncertainty that enters into the auditor’s conclusions anytime sampling is used. There are two types of sampling risk:

Question 4

Define Nonsampling Risk

Answer 4

Nonsampling risk is the risk that the auditor reaches an erroneous conclusion for any reason not related to sampling risk:

• Judgment error
• Selecting inappropriate procedures
• Failing to detect a misstatement when applying an audit procedure

Why do auditors often use nonstatistical sampling?

Question 5

Define Statistical vs. Nonstatistical Sampling

Answer 5

Nonstatistical sampling: Audit sampling that relies on the auditor’s judgment to determine sample size, select the sample, and/or evaluate the results for the purpose of reaching a conclusion about the population.

Question 6

. There are two types of sampling risk:

Answer 6

Risk of incorrect rejection (Type I)

Risk of incorrect acceptance (Type II)

Question 7

Confidence Level

Answer 7

is the complement of sampling risk (i.e. 100% - sampling risk (as a %) = confidence level (as a %)

The auditor may set sampling risk for a particular sampling application at 5 percent.

This results in a confidence level of 95 percent for the sampling application.

Question 8

Tolerable and Expected Error:

Answer 8

Once the desired confidence level is established, the appropriate sample size is determined largely by how the tolerable error exceeds expected error. The smaller the difference between these two variables, the more precise the sample must be, and therefore the larger the sample size required.
Example:
Tolerable error (or deviation) rate: 5%
Expected error (or deviation) rate: 2%
What happens if the tolerable error rate declines to 2.5%?

Question 9

Procedures performed that commonly involve sampling include…

Answer 9

inspection of tangible assets, inspection of records and documents, reperformance, recalculation and confirmation.

Question 10

Procedures performed that do NOT commonly involve sampling include…

Answer 10

analytical procedures, scanning, inquiry and observation.

Question 11

Controls Tests:

Answer 11

Determine from a
sample whether a control is operating
effectively for the entire population.

Question 12

Tests of details:

Answer 12

Determine from
a sample if an account balance or
class of transactions is recorded
accurately for the entire population.

Question 13

the types of audit sampling:

Answer 13

Sampling in tests of controls

Sampling in tests of details of transactions

Question 14

Tests of Controls:

Table 8-2 on page 279

Answer 14

.

Question 15

Tests of Details:

Table 9-1 on page 315

Answer 15

.

Question 16

COSO’s definition of internal controls

Answer 16

Policies, processes and procedures, which are designed and effected by an entity’s board of directors, management and other personnel to provide reasonable assurance about the achievement of the entity’s objectives in the following categories:

(1) reliability of financial reporting;
(2) effectiveness and efficiency of operations; and
(3) compliance with applicable laws and regulations.

Question 17

COSO’s 5 internal control components

Answer 17

the control environment
risk assesment 
the AI and communication systems
control activites
monitoring

Question 18

the control environment

Answer 18

Sets the tone of an organization, influencing the control consciousness of its people. The foundation for effective internal control, providing discipline and structure. “Tone at the Top”

Question 19

elements of the control enviroment

Answer 19

Elements: (1) Communication and enforcement of integrity and ethical values; (2) commitment to competence; (3) participation of those charged with governance; management’s philosophy and operating style; (4) organizational structure; (5) assignment of authority and responsibility; (6) H/R policies and procedures

Question 20

risk assessment

Answer 20

The process for identifying and responding to business risks and the results thereof. Given that an entity’s objectives are broader than those of the auditor, this risk assessment will include risks not relevant to the audit.

Question 21

three examples of risk assessment

Answer 21

(1) New technology; (2) New or revamped information systems; (3) New accounting pronouncements

Question 22

Accounting information and communication systems

Answer 22

The information system relevant to financial reporting objectives, which includes the accounting system, consists of procedures (automated or manual) and records established to (1) initiate, (2) record, (3) process, and (4) report entity transactions and to maintain accountability for related assets, liabilities, and equity.

Communication involves providing an understanding of individual roles and responsibilities pertaining to internal control over financial reporting.

Question 23

Accounting Information and Communication Systems Elements:

Answer 23

• Identify and record all valid transactions
• Describe on a timely basis, the transactions in sufficient detail to permit proper classification of transactions for financial reporting
• Measure the value of transactions in a manner that permits recording their proper monetary value
• Determine the time period in which transactions occurred to permit recording transactions in the appropriate period
• Properly present the transactions and related disclosures in the financial statements

Question 24

control activites

Answer 24

The policies, processes and procedures that help ensure that management directives are carried out. In particular, these control activities are implemented to address the risks to achieving any of the entity’s objectives.

Question 25

types of control activities

Answer 25

(1) Performance reviews; (2) Information processing controls, including authorization and document-based controls; (3) Physical controls; and (4) Segregation of duties

Question 26

Monitoring of controls

Answer 26

A process to assess the quality of internal control performance over time, which involves assessing the design and operation of controls on a timely basis and taking necessary corrective actions, where required

Question 27

highlights of monitoring controls

Answer 27

(1) Risks change over time, controls should too; (2) Monitoring relates to each of the other four control components; (3) Monitoring can be done through (a) ongoing, or recurring, activities and/or (b) separate evaluations

Question 28

Consideration of Internal Control includes...

Answer 28

- Develop an understanding of internal control | - Decided whether you (the auditor) intend to rely on the internal controls

Question 29

Develop an understanding of internal control by...

Answer 29

(a) evaluating their design and (b) determining whether they have been implemented

Question 30

Decided whether you (the auditor) intend to rely on the internal controls: if yes... if no...

Answer 30

If no, set control risk at a maximum, document the level of control risk and perform substantive tests (substantive strategy) If yes, plan and perform tests of controls to evaluate the operating effectiveness; set control risk based on the tests of controls; compare achieved control risk to preliminary control risk and change audit programs as necessary; perform substantive tests (reliance strategy)

Question 31

The auditor may elect to pursue a substantive strategy for some or all of the management assertions because of one or more of the following factors:

Answer 31

The implemented controls do not pertain to the assertion the auditor is considering The implemented controls are assessed as ineffective Testing the operating effectiveness of the controls would be inefficient

Question 32

The auditor obtains an understanding of internal control in order to:

Answer 32

Identify the types of potential misstatement Pinpoint the factors that affect the risk of material misstatement Design tests of controls and substantive procedures

Question 33

Factors to consider include for an IT specialist:

Answer 33

The complexity of the entity’s I/T systems and controls and the manner in which they are used to conduct business The significance of changes made to existing systems , or the implementation of new systems The extent to which data are shared among systems The extent of the entity’s participation in e-commerce The entity’s use of emerging technologies The significance of audit evidence that is available only in electronic form

Question 34

Procedure manuals and organizational charts (client-prepared)

Answer 34

Preliminary documents used to obtain an understanding

Question 35

Flowcharts (client- or auditor-prepared)

Answer 35

Provide a “picture” of the client’s accounting system

Question 36

Narrative Description (client- or auditor-prepared)

Answer 36

Provides a written summary of controls – more useful when the entity has a simple internal control system

Question 37

Internal Control Questionnaires (auditor-prepared)

Answer 37

Provide a systematic means for the auditor to investigate a series of areas and topics (“memory jogging tool”) through inquiries; the questionnaire responses should be validated/verified using alternative audit procedures as appropriate

Question 38

Limitations to Internal Control Include:

Answer 38

Management override of internal control Human errors or mistakes Collusion

Question 39

Scope of Audit Procedures includes...

Answer 39

nature timing extent

Question 40

nature

Answer 40

Primarily impacts the reliability of audit evidence. Bear in mind that more reliable procedures are typically more costly. However, the auditor must also ensure the tests correspond with the relevant assertion.

Question 41

timing

Answer 41

Tests performed after year-end are deemed more reliable, but an auditor will typically need to perform some tests at an interim period.

Question 42

extent

Answer 42

The quantity of evidence to be collected (e.g. limited or extensive testing; sample 5% of the population or 50% of the population; etc.)

Question 43

What is a control deficiency

Answer 43

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis.

Question 44

material weakness

Answer 44

A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected.

Question 45

significant deficientcy

Answer 45

A Significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

Question 46

IT controls 2 parts

Answer 46

general controls | application controls

Question 47

general controls

Answer 47

Data center and network operations System software acquisition, change, and maintenance Access security Application system acquisition, development, and maintenance

Question 48

application controls

Answer 48

``` Data capture controls Data validation controls Processing controls Output controls Error controls ```

Question 49

major sections of SOX

Answer 49

Creation of the PCAOB Corporate Responsibility (e.g. Section 302) Enhanced Financial Disclosures (Sections 404a and 404b) Corporate and Criminal Fraud Accountability White Collar Crime Penalty Enhancement

Question 50

SOX MGMT requirements

Answer 50

Certify the integrity of their F/S (Section 302) Issue a report on internal controls and explicitly take responsibility for maintaining adequate internal control over financial reporting (Section 404a)

Question 51

SOX auditor requirements

Answer 51

Must perform an audit of an entity’s internal controls for all accelerated filers (Section 404b) – known as the “integrated audit”

Question 52

Internal Control Over Financial Reporting (“ICOFR”) is defined as ...

Answer 52

as a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP

Question 53

ICOFR includes procedures that:

Answer 53

Pertain to the maintenance of records that fairly reflect the transactions and dispositions of the assets of the company Provide reasonable assurance that transactions are recorded in accordance with GAAP Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets

Question 54

The Integrated Audit topics

Answer 54

2-in-1: Internal Controls & Financial Statement Audit Top-down Risk-based Approach Identifying Significant Accounts Evaluating Control Deficiencies Opining on Internal Controls and Related Reports Remediation of Control Weaknesses

Question 55

An integrated audit definition

Answer 55

is composed of the audits of internal control and the financial statements. The control testing impacts the planned substantive procedures. Also, the results of the substantive procedures are considered in the evaluation of internal control.

Question 56

Identifying significant accounts

Answer 56

Size and composition of the account Susceptibility to misstatement due to errors or fraud Volume of activity, complexity, and homogeneity of the individual transactions processed through the account or reflected in the disclosure Nature of the account or disclosure Accounting and reporting complexities associated with the account or disclosure Exposure to losses in the account Possibility of significant contingent liabilities arising from the activities reflected in the account or disclosure Existence of related-party transactions in the account Changes from the prior period in account or disclosure characteristics

Question 57

Evaluating control deficientcy

Answer 57

As discussed previously, the auditor must consider the likelihood and magnitude of the control deficiency. If a deficiency, or combination of deficiencies, prevents the auditor from having reasonable assurance that transactions are recorded properly, then the auditor should treat the deficiency as an indicator of a material weakness.

Question 58

remediation of control weaknesses

Answer 58

Remediation is the process of correcting a material weakness in the ICFR If a material weakness is corrected before the “as of” date, there must be sufficient time for both management and the auditor to test the operating effectiveness of the control – if not, an adverse opinion is still issued.

Question 59

In a financial statement audit:

Answer 59

No requirement that an auditor confirm the client has effective ICOFR. The auditor may elect to test NO controls and set control risk at the maximum level (substantive approach) or may test controls to assess control risk at less than the maximum level (reliance strategy).

Question 60

In an integrated audit:

Answer 60

When an entity has effective ICOFR, the auditor should be able to perform sufficient testing of controls to assess control risk for all relevant assertions at a low level.

Question 61

management assertions

Answer 61

Completeness Existence / Occurrence Accuracy (Numerical / Classification / Cutoff or Timing) Valuation / Allocation Obligations / Rights / Authorization Presentation

Question 62

Three important concepts pertaining to audit evidence:

Answer 62

Nature of audit evidence* --------Accounting records and other available information Sufficiency and appropriateness of audit evidence (Objective 5  Reliability)** --------Quantity and quality (relevance and reliability) Evaluation of audit evidence ---------“Trust but verify” (professional skepticism)

Question 63

journal or ledger---->source docs

Answer 63

vouching(occurance)

Question 64

source docs----->journal or ledger

Answer 64

tracing (completeness)

Question 65

Generally, audit evidence is more reliable if it is:

Answer 65

Obtained from knowledgeable sources outside the client company Generated internally through a system of effective internal controls Obtained directly by the auditor rather than indirectly or by inference Documentary in form rather than an oral representation Provided by original documents rather than photocopies or facsimiles

Question 66

Specific actsperformed by the auditorto gather evidence about whether specific assertions are being met. (3)

Answer 66

Risk assessment procedures Test of controls Substantiveprocedures

Question 67

Audit procedures (actions):

Answer 67

``` Inspection of records or documents Inspection of physical/tangible assets Observation Inquiry Confirmation Recalculation Reperformance Analytical Procedures (Planning, substantive, and final analytical procedures) Scanning ```

Question 68

Audit documentation has two primary functions:

Answer 68

To provide support for the audit report. To support the auditor’s compliance with applicable standards.

Question 69

– Audit Documentation (Secondary purposes)

Answer 69

Assist continuing and new audit team members in planning and performing the audit Serves as a record of matters of continuing audit interest (permanent file) Assists in supervision and review of the audit Demonstrates the accountability of audit team members Assists internal reviewers, external peer/PCAOB reviewers and successor auditors in performing their required duties

Question 70

Audit documentation should have the following characteristics:

Answer 70

Enable an experienced auditor to understand the work performed and the significant conclusions reached Identify who performed and reviewed the work Show that the accounting agrees or reconciles to the financial statements Audit documentation should include all significant audit findings and the actions taken to address them.

Question 71

Current Files:

Answer 71

The auditors’ report in a given year is supported by the working papers contained in the current file. It is typical to organize this file based around the accounts in the client’s financial statements, or around the client’s business cycles. (Examples?)

Question 72

Permanent Files:

Answer 72

Serves three purposes: (1) to refresh the auditors’ memories on items applicable over a period of many years; (2) to provide new staff members with a quick summary of policies and organization of the client; (3) to preserve working papers on items that show relatively few or no changes from year-to-year. (Examples?)

Question 73

Ownership:

Answer 73

The audit documentation is the property of the auditor, including those files completed by the client at the auditor’s request. SOX requires that audit documentation be retained for seven years from the completion date of the audit.

Question 74

Format: | topics

Answer 74

heading Indexing and cross-referencing Tickmarks

Question 75

heading

Answer 75

Date, Completed by, Client’s name, Reference number, Title

Question 76

Indexing and cross-referencing

Answer 76

Notations that provide a trail from the F/S to the supporting workpapers

Question 77

tickmarks

Answer 77

Notations made next to workpaper items denoting auditor/reviewer actions

Question 78

Risk Assessment Procedures

Answer 78

Used to assist the auditor to better understand the business and to plan the nature, timing, and extent of audit procedures.

Question 79

Substantive Analytical Procedures

Answer 79

Used to obtain evidential matter about particular assertions related to account balances or classes of transactions.

Question 80

Final Analytical Procedures

Answer 80

Used as an overall review of the financial information in the final review stage of the audit.

Question 81

Steps for Analytical Procedures

Answer 81

Develop expectation of account (or ratio) balance Determine amount of difference that can be accepted without investigation Compare the company’s account (ratio) with the expectation Investigate and evaluate significant differences (must do so for substantive analytical procedures and final analytical procedures)

Question 82

Expectations may be developed using:

Answer 82

Prior period information (historical) Anticipated results (forecasts) Relationships among elements of financial information Industry information Relationships between financial information and relevant non-financial data

Question 83

Type of expectations:

Answer 83

Trend analysis – analyze changes in accounts of a company over time Ratio analysis – compare relationships between two or more financial statement accounts and/or non-financial data

Question 84

Short-term Liquidity

Answer 84

Current Ratio, Quick Ratio, Operating Cash Flow Ratio

Question 85

Activity Ratios:

Answer 85

Receivables turnover, inventory turnover, days inventory on hand

Question 86

Profitability Ratios:

Answer 86

Gross profit percentage, profit margin, return on assets, return on equity

Question 87

Coverage Ratios:

Answer 87

Debt to equity, times interest earned

Question 88

common validation controls

Answer 88

``` limit test range test sequence check existence validity test field test sign test check digit verification page 214 ```