Audit - Internal Controls AUD2

Question 1

What is Management’s Responsibility over Internal Controls? (ACE)

Answer 1

Accurate and reliable financial reporting
Compliance with Laws and Regulations
Effectiveness of operations

Question 2

SAS 109 (AU314) What are 5 components of Internal Controls? (CRIME)

Answer 2

1. Control Activities - act. vs budgets, IT systems processing
2. Risk Assessment - internal and external factors
3. Information and communication - info systems & comm but establishing duties
4. Monitoring - mgmt must monitor
5. Control Environment (chopper)

Question 3

What are the risk assesment procedures to assess RMM related to IC? (during the understanding control stage)

Answer 3

1. Analytics
2. Inquiries of management/staff
3. Inspections of documents
4. Observe application of controls

Key is auditor is trying to understand what controls have been implemented, not if it is operating effectively (during the understanding stage)

Question 4

What are the 4 procedures of testing controls?

Answer 4

1. Reperformance
2. Inspection
3. Inquiry
4. Observation

Question 5

Why should we reasess RMM to determine Detection Risk?

Answer 5

After testing controls, if operating effectively, then detection risk is lower, then you can do less substantive testing.

Question 6

What does SOX require of management?

Answer 6

1. Section 302: require officers responsible for maintaining effective IC and to disclose all known deficiencys to auditors and audit committee
2. Officers required to report any fraud (material or not) regarinding an EE with roles in internal controls

Question 7

What are inherent limitations of IC? (COCO)

Answer 7

1. Collusion
2. Override by Mangement
3. Competence - cant prevent human mistakes
4. Obsolescence - good controls can cease due to changes within the Company

Question 8

What is reasonable assurance over IC?

Answer 8

if management can create perfect IC, it wouldnt do so because it is not cost effective.

Question 9

SAS 99 (AU 316) What does this require?

Answer 9

Requires auditors to respond to management override of controls.

Question 10

What is the acrenim ARC for in employee responsbiity over IC?

Answer 10

Authorization, Records and Custody. No one person should have two of the ARCs

Question 11

What is a control deficiency?

Answer 11

when design of control does not allow management or EE in normal course of performing their assigned functions, to prevent or detect or correct mistatements on timely basis

Question 12

What is significant deficiency?

Answer 12

deficieny or combination of, in IC that is less severe than material weakness, yet important enough to merit attention by those charged with governance

Question 13

What is material weakness?

Answer 13

deficiency or combo of, in IC such that reasonablne/probable possibility that a material mistatement of entity FS will not be prevented/detected/corrected on timely basis.

Question 14

What is SSAE15 - Attestation Engagement to Examine IC?

Answer 14

1. It is considered an integrated audit and snould be done with FS audit.
2. Scope under AICPA
3. All deficiencies must be communicated in writing
4. Auditor not required to search for controls less severe than material weakness, but if identifieid, should be communicated.
5. Report is for General Distributions

Question 15

Public Company - Internal Control Over Financial Reporting (ICFR)? AS5 & SSAE#10

Answer 15

1. Existence of one or more material weakness warrants an “ADVERSE OPINION”. Unqualified opinon if no material weakness and scope limitation.
2. Scope Limitation requires auditor to disclaim opinion or withdraw from engagement
3. Key difference between non-issues report is that “correct” is not part of deficiency definition
4. All deficiency must be communicated in writing to MGMT

Question 16

Public Company - What are indications of Material Weaknesses?

Answer 16

1. ineffective oversight by those charged with governance
2. Restatement of PY FS due to material mistatements
3. Material mistatements that would not have been detected by Company’s IC, but were identified by Auditors
4. Fraud by senior mgmt, material or immaterial

Question 17

For IC reports - what is the key difference between public and non public?

Answer 17

1. Public under PCAOB. Non public under AICPA.
2. Public expresses an opinon (unqualified/averse) at the end. NP no opinion.
3. Public, all decifiecies must be written. NP, only SD and MW in writing.

Question 18

What is PCAOB AS4?

Answer 18

Engagement which firm auditor is engaged to report on whether previously identified material weakness exist or still exist at a point of time.

Question 19

What is FCPA?

Answer 19

FCPA makes payment of bribes to foreign officials illegal and requires publicly held companies to maintain systems of control sufficient to provide assurance IC objective are met.

Question 20

If control risk is high due to ineffective controls in place, what can compensate by increase ?

Answer 20

Auditor must increase extent of anayltics (not detection risk).