Auditing Flashcards
What is the primary duty of an auditor?
To provide users of financial information with REASONABLE ASSURANCE that the financial statements are not materially misstated.
What is the auditor’s responsibility for detecting theft or fraud?
Auditors are not responsible for detecting theft or fraud.
Instead- they are responsible for providing REASONABLE ASSURANCE that the financial statements are not materially misstated.
When should an auditor be hired in relation to the balance sheet date for optimum audit planning and efficiency?
The earlier the auditor is hired- the better for audit planning and efficiency.
When can audit procedures be performed at interim dates?
If Control Risk for the accounts and/or transactions is low- audit procedures can be performed at interim dates.
The auditor then reviews changes in the balances at year-end.
When can an auditor accept an engagement offered after the year is already closed?
The auditor can take the engagement if they are able to overcome the limitations of the engagement.
For what does an auditor use professional skepticism?
To plan the scope of the audit
To plan the objectives of the audit
How can analytical procedures be performed in audit planning?
The auditor can compare actual versus forecasted numbers.
What must an auditor have in order to discuss issues relating to a predecessor auditor’s work?
If issues relating to predecessor auditor’s work on previous Financial Statements come up during the current audit- Auditor must have client’s permission to discuss the issue.
What questions must an auditor ask with respect to procedures carried out by assistants?
Were they adequately performed? (Review the working papers)
Are the results consistent with the audit report?
How is audit strategy mapped out?
Auditor determines what the reporting objectives are.
Auditor determines the scope of the audit.
Describe the key components of maintaining auditor independence.
Auditor must be independent in fact and appearance
Honesty
No direct financial interest
No indirect material financial interest
Describe Due Professional Care
Technical abilities mirror those held by peers in the profession
Follow GAAS Standards
Obtain a Reasonable Level of Assurance
Maintain Reasonable Level of Skepticism
Supervise Audit Staff
Review judgment at every level
What should an auditor do prior to accepting an audit engagement?
Review the previous financial statements
Speak to third parties
Contact predecessor auditor to evaluate whether engagement should be accepted (must have client permission)
What questions should be asked by an auditor prior to taking an engagement?
Note: must have permission of client to contact predecessor auditor (no permission = no engagement)
Why the Auditor Change?
Any Serious Discussions with Audit Committee?
How is Management Integrity? Disagreements?
How was Internal Control?
Understand Industry or Be Willing to Learn
Consider Scope Limitation - Limited evidence available = no engagement
What should be included in an audit engagement agreement?
Note: must be written
Objectives of Engagement
Limitations of Engagement
Responsibilities of Management - Provide written assertions
Responsibilities of Auditor - Limited error/fraud responsibility
Expectations of Access to Records
Financial Statements (and Disclosures) are Management’s Responsibility
Compliance with Laws
Internal Control
What is management’s responsibility with respect to the financial statements?
Management is responsible for financial statements and adequacy of disclosures.
Presentation & Disclosure
Existence (Tests Overstatements)
Rights & Obligations
Completeness (Tests Understatements)
Valuation & Allocation
What is the purpose of the Audit Committee?
Responsible for Hiring Auditor
Oversees Internal Control
Must Agree with Auditor on: Responsibility of the Parties- Audit Fee- Timing of the Audit- Audit Plan
Acts as Liaison Between Auditor and the Board
Auditor Communicates Concerns about: Internal Control Deficiencies- Errors- Fraud- Illegal Activities
How is Audit Risk calculated?
Inherent Risk x Control Risk x Detection Risk
Risk that material mistakes- errors- omissions- or fraud will result in an inaccurate audit report
Based on Auditor Judgment
Measured in both Qualitative and Quantitative
Describe Control Risk
Risk that internal control will not detect error or fraud
Auditor cannot control this.
Describe Inherent Risk.
Which transactions have a higher level of risk?
Auditor cannot control
Describe Detection Risk.
Will the auditor fail to detect a material misstatement?
Auditor CAN control
Do testing at year-end
Increase substantive testing
Run more effective tests
What responses should an auditor take based on different levels of acceptable detection risk (DR)? What type of tests should be performed?
Less Acceptable DR = Run More Substantive Tests
More Acceptable DR = Run Less Substantive Tests
More Substantive Tests (DR down) = Less Audit Risk; (AR = IR x CR x DR)
Less Substantive Tests (DR up) = More Audit Risk; (AR = IR x CR x DR)
What are quantitative measurements versus non-quantitative measurements with respect to risk?
Quantitative Measurements - Inherent- Control- and Detection Risk can all be measured in terms of percentages
Non-Quantitative Measurements - Inherent- Control- and Detection Risk can all be measured in terms of acceptable ranges
Whose responsibility is it to FIND and PREVENT fraud?
It is Management’s responsibility.
What is the auditor’s responsibility with respect to fraud and illegal acts?
Assess the RISK that such things will lead to material misstatements
Design the audit to provide reasonable assurance against fraud- illegal acts that directly and materially affect the financial statements
Report ALL management fraud to the audit committee (minor fraud by low-level employees not reported to committee)
Perform required inquiries and procedures (management inquiries- analytical procedures- discussions with audit personnel about fraud)
What are the three factors that affect/influence fraud?
Fraud is born out of:
Rationalization
Incentive
Opportunity
(RIO)
What is the difference between fraud and errors?
Errors are unintentional- fraud is intentional.
What red flags may indicate higher risk in an audit?
Management compensation tied to stock
Aggressive financial forecasting
Former auditor disagreed with Management
Records not available for audit
Current audit procedures may need to be reconsidered if red flags exist.
Describe the characteristics of a Fraud Risk Factor.
Has been observed in similar situations
Does NOT necessarily mean that there is a material weakness in internal control
Leads to an auditor taking action
What does an examination of internal control accomplish with respect to illegal acts?
Internal control analysis can result in the conclusion that IC is weak- but probably won’t identify illegal acts
What is the purpose of adjusting audit procedures in light of fraud risk factors identified during an audit?
Strives to make audit engagement procedures less patterned and predictable
Re-evaluates management’s application of accounting procedures
Finds and assigns audit personnel with relevant skills in this area
What should be documented with respect to fraud risk factors in an audit?
Any fraud risks identified that could lead to material misstatement
Audit procedures performed to assess risks
Nature of communication made to audit committee and company management
Disclosure to third parties regarding fraud not normally the auditor’s responsibility
Fraud by management should normally be reported to the audit committee- NOT the SEC.
What was the effect of the SOX Act of 2002?
Created PCAOB
Designates Officer responsibility for internal control
Must disclose significant internal control weaknesses to auditor and audit committee
Must disclose any level of fraud discovered by employees with internal control responsibilities
What is the Hierarchy of Authoritative Literature?
- Statements on Auditing Standards (SAS)
- Auditing Interpretations- AICPA Guides & SOPs
- Industry Articles (no authority)
What quality control activities are undertaken by CPA firms with audit practices?
Firm Leadership exhibits quality and leads by example and sets the tone for the organization
Firm should Monitor and document that its policies and procedures are being followed
Firm should have Relevant Ethical Requirements
Acceptance and continuance of client engagements should continue to be evaluated for client integrity- auditor competency- and legality
Firm should have competent and ethical personnel
Firm engagements are performed- supervised- and reviewed in accordance with professional standards and regulations.
Which literature governs Compilation services?
SSARS - Statements on Standards for Accounting and Review Services
These govern reporting for non-public entities only
What is the independence requirement for Compilations?
Independence NOT required for Compilations
No Internal Control work allowed
No assurance given
What type of assurance is provided by a Compilation?
Compilations are not an assurance service. No assurance is provided.
What type of assurance is provided by Review services?
Reviews provide NEGATIVE assurance.
What is the independence requirement for a Review?
Reviews require independence.
No Internal Control work allowed
Performs analytical procedures
No material indirect financial interest allowed
No immaterial direct financial interest allowed
For compilations and reviews- what knowledge must a service provider have?
Must have an understanding of the client industry.
What are attestation services?
CPA expresses a conclusion about an assertion - Compliance with laws
NOT considered a Consulting engagement
Independence Required
What is the independence requirement for consulting services?
Independence is not required for consulting services.
Describe the limitations on Prospective Financial Statements?
Report is restricted to specified users.
Agreed-upon procedures are implemented.
What is the role of the Group Engagement Team?
Develop Audit Strategy; Communicate with Component Auditors; Perform work on the Consolidation Process; Evaluate Audit Conclusions; Understand work of Component Auditors;
Who is on the Group Engagement Team?
Firm Partners; Group Engagement Partner; Audit Staff
Who establishes the Materiality threshold for the Component Auditor?
The Group Engagement Team; The Materiality threshold must be lower than the Group Materiality threshold
What is the Group Engagement Partner responsible for?
Group Audit Engagement Direction - Supervision - Performance and the Audit Report
What is the role of a Component Auditor
Audit a component of the entity
What should the Group Engagement Team do if a Component Auditor audits a Significant Component due to Financial Materiality?
Audit the Financial Information
What should the Group Engagement Team do if a Component Auditor audits a Significant Component due to Risk of Material Misstatement?
Perform Audit Procedures
What should the Group Engagement Team do if a Component Auditor audits a Non-Significant Component?
Analytical Procedures performed at Group Level
Why does an Auditor do if they suspect legal proceedings could contribute to a Material Misstagement?
Contact Client external counsel through a Letter of Inquiry
When is an audit of IT NOT required?
Controls are redundant to another department
The system does not appear to be reliable and testing controls would not be an efficient use of time
Costs exceed benefit
When can an audit of IT be performed without directly interacting with the system?
System isn’t complex or complicated
System output is detailed
What is the role of a Database Administrator?
Maintains database
Restricts access
Responsible for IT internal control
What is the role of a Systems Analyst?
Recommends changes or upgrades
Liaison between IT and users
What is the role of the data Librarian?
Responsible for disc storage
Holds system documentation
What is the benefit of Generalized Audit Software in an audit?
Uses computer speed to quickly sort data and files- which leads to a more efficient audit
Compatible with different client IT systems
Extracts evidence from client databases
Tests data without auditor needing to spend time learning the IT system in detail
Client-tailored or commercially produced
What is a Relational Database?
Group of related spreadsheets
Retrieves information through Queries
What is a Data Definition Language?
A language that defines a database and gives information on database structure.
It maintains tables- which can be joined together.
It establishes database constraints.
What functions are performed by a Data Manipulation Language?
Maintains and queries a database
Auditor needs information- so client uses DML to get the information needed
What functions are performed by a Data Control Language?
A Data Control Language controls a database and restricts access to the database.
What are Check Digits?
A numerical character consistently added to a set of numbers.
It makes it more difficult for a fraudulent account to be set up or go undetected.
What is the purpose of a Code Review?
A Code Review tests a program’s processing logic.
Advantageous because auditor gains a greater understanding of the program.
What is the purpose of a Limit Test?
Examines data and looks for reasonableness using upper and lower limits to determine if data fits the correct range.
Did anyone score higher than 100%?
What is the Test Data Method?
Auditor processes data with client’s computer - fake transactions are used to test program control procedures.
Each control needs to only be tested once
Problem with this method - fake data could combine with real data.
How can Operating Systems Logs be utilized during an audit?
Auditor can review logs to see which applications were run and by whom.
What is the purpose of Access Security Software?
Helpful in online environments
Restricts computer access - may use encryption.
How can Library Management Software assist with an audit?
Library Management Software logs any changes to system/applications etc.
How can Embedded Audit Modules in software be utilized in an audit?
Assist with audit calculations
Enable continuous monitoring in an audit environment that is changing
Weakness: requires implementation into the system design
Example: SCARF - Collects information based on some criteria and can be analyzed at a later time (necessary because the audit environment is continually changing)
What is an Audit Hook?
An Audit Hook is an application instruction that gives auditor control over the application.
What is the purpose of Transaction Tagging?
Transaction Tagging allows logging of company transactions and activities.
How do Extended Records assist in audit trail creation?
Extended Records add audit data to financial records.
How does Real Time Processing affect an audit?
Destroys prior data when updated
aka Destructive Updating
Requires well-documented Audit Trail
What is the risk of auditing System outputs versus Application outputs?
If the auditor only audits the outputs of a computer system and doesn’t also audit the software applications- an error in the applications could be missed.
What is a Compiler?
Software that translates source program (similar to English) into a language that the computer can understand
How is Parallel Simulation utilized during an audit?
Client data is processed using Generalized Audit Software (GAS)
Sample size can be expanded without significantly increasing the audit cost
GAS output compared to client output
What does auditing internal control in a company’s IT environment accomplish?
Plan the rest of audit- Shorter audit trails that may expire- Less documentation
Assess the level of Control Risk - Unauthorized access to systems or data is more difficult to catch
Systems access controls adds another layer to separation of duties analysis
Focus should be on the general controls- new systems development- current systems changes- and program or data access control or computer ops control changes
What should be included for the Auditor’s address?
The City and State where located
What is Management Responsible for in regards to the Financial Statements?
Preparation and Fair Presentation of Financial Statements in accordance with the Applicable Financial Reporting Framework
What is Management Responsible for in regards to Internal Control?
Internal Control Design, Implementation, Maintenance
What are the headings in the Audit Report for an Unmodified Opinion?
(TIM-AA) Title; Introduction; Management Responsibility; Auditor Responsibility; Audit Opinion
What are the headings in the Audit Report for an Modified Opinion?
(TIMA-BA) Title; Introduction; Management Responsibility; Auditor Responsibility; Basis for (Modified) Opinion; Audit Opinion
In an Unmodified Opinion with Emphasis-of-Matter / Other-Matter sections, what is the order of the headings?
(TIM-AA EMO) Title; Introduction; Management Responsibility; Auditor Responsibility; Audit Opinion; Emphasis-of-Matter; Other-Matter
What are the requirements for referencing a Component Auditor in the Audit Report?
Component Financial Statements must be prepared using same Financial Reporting Framework as the Group Financial Statements; Component Auditor must have performed audit in accordance with GAAS or PCAOB Standards.
What must the Group Engagement Partner do if they assume responsibility for the Component Auditor’s work?
Perform additional audit procedures; Be involved in Component Auditors work; Perform Risk Assessment procedures; Assess Risk of Material Misstatement
What standards govern SSARS engagements?
Compilations are governed by SSARS (Statements on Standards for Accounting and Review Services)
Which clients can have compilation engagements?
Non-SEC (non-public) registrants only.
What is a Compilation?
Accountant puts together financial statements with information PROVIDED BY MANAGEMENT. No opinion is expressed and no assurances are given. Independence is not required.
What disclosures are required for Compilation engagements?
Disclosures not necessary must state that they are not included
What standards govern Review engagements?
SSARS (Statements on Standards for Accounting and Review Services)
What type of assurance is given in a Review engagement?
Reviews give limited assurance.
What procedures are required for Review engagements?
Analytical procedures are required for reviews. Compare results to documented predictions.
What is a Review engagement?
Financial statements are presented with no opinion expressed- and limited assurances are given. Independence is required for a review engagement.
What is a Forecast?
A prospective financial statement that uses normal circumstances. General and limited use allowed.
What is a Projection?
A prospective financial statement using hypothetical situations. Only limited use by the client is allowed.
What are the requirements for Agreed Upon Procedures?
Independence is required; Only limited use by the client is allowed.
What disclosures are required for remote likelihood of losses?
No disclosure required.
What disclosure is required for a probable loss contingency?
Accrue if estimable. Emphasis-of-Matter paragraph if not estimable.
What disclosure is made if a loss contingency is reasonably possible?
Auditor assesses need for Emphasis-of-Matter paragraph based on loss likelihood.
How is a gain contingency reported?
Gain contingencies are not reported.
How does an immaterial GAAP issue affect the audit opinion?
It doesn’t. Opinion is Unmodified.
How does a very material GAAP issue affect the Audit Report?
Modified-Adverse Opinion is issued. Emphasis-of-Matter paragraph is added after Opinion paragraph.
How do GAS standards compare to GAAS?
GAS is more strict than GAAS.
What is required under the Single Audit Act?
Funding Threshold is $750,000. An audit performed under governmental auditing standards (GAS). A report on internal control is required. GAAS and GAS don’t require the I/C report.
If Internal Control is poor and a company’s accounting practices are sloppy - which risk is higher?
Control risk increases with poor Internal Controls and sloppy accounting practices.
If Internal Control is poor - what is the effect on the audit?
Auditor will need to perform more testing and dig deeper into accounts in order to arrive at an opinion regarding the financial statements.