Chapter 14: Communicating Assurance Engagement Outcomes and Performing Follow-Up Procedures Flashcards
Recommendations should be included in final audit communications to:
a. Provide management with options for addressing audit observations.
b. Ensure that problems are resolved in the manner suggested by the auditor.
c. Minimize the amount of time required to correct audit observations.
d. Guarantee that audit observations are addressed, regardless of cost.
A is the best answer. Recommendations represent options that are available to management. Problems must be resolved in the manner deemed appropriate by management, not the internal audit function. Providing recommendations may enable management to reduce the costs/time of addressing audit findings, but there is no guarantee of this.
Reported internal audit observations emerge as a result of comparing “what should be” with “what is.” In determining “what should be” during an internal audit engagement, which of the following would be the least appropriate criterion against which to assess current controls?
a. Industry best practices.
b. Control policies and procedures prescribed by senior management.
c. A standard of control effectiveness determined by the internal audit function.
d. The controls documented as being in place during the last audit.
D is the best answer. The controls documented as being in place during the last audit represent the “what is” condition at that point in time. They do not represent an appropriate “what should be” criterion against which the current “what is” controls should be compared. Each of the other answers represents an appropriate criterion against which current controls can be assessed.
According to the International Professional Practices Framework (IPPF), an engagement final communication should include, at minimum, which of the following?
I. Background information.
II. Purpose of the engagement.
III. Engagement scope.
IV. Results of the engagement.
V. Summaries.
a. I, II, and III.
b. I, III, and V.
c. II, III, and IV.
d. II, IV, and V.
C is the best answer. Implementation guidance to the Standards indicates that final engagement communications should contain, at a minimum, the purpose, scope, and results of the engagement. Background information and summaries are not required elements of a final engagement communica-tion.
Which of the following would not be considered a primary objective of a closing or exit conference?
a. To resolve conflicts.
b. To identify concerns for future audit engagements.
c. To discuss the engagement observations and recommendations.
d. To identify management’s actions and responses to the engagement observations and recommendations.
B is the best answer. Identifying concerns for future engagements is not a primary objective of the closing conference. Resolving conflicts, discussing the engagement observations to reach agreement on the facts, and determining management’s action plan and responses are all objectives of the closing conference.
During a review of purchasing operations, an internal auditor found that procedures in use did not agree with stated company procedures. However, audit tests revealed that the procedures used represented an increase in efficiency and a decrease in processing time, without a discernible decrease in control. The internal auditor should:
a. Report the lack of adherence to documented procedures as an operational deficiency.
b. Develop a flowchart of the new procedures and include it in the report to management.
c. Report the change and suggest that the change in procedures be documented.
d. Suspend the completion of the engagement until the engagement client documents the new procedures.
C is the best answer. This represents a change in process that should be brought to the attention of management and documented. The procedures in answer A do not represent a deficiency since effi-ciency has improved without diminishing control. The flowchart in answer B is not the best form of documentation because it does not address efficiency. Answer D is incorrect because the engagement should be completed.
A formal engagement communication must:
a. Provide an opportunity for the auditee to respond.
b. Document the corrective actions required of senior management.
c. Provide a formal means by which the independent outside auditor assesses potential reliance on the internal audit function.
d. Report significant observations.
D is the best answer. A formal communication must report significant observations. Documenting the auditee’s response is optional. The corrective actions in a communication are recommendations and senior management is not required to remediate observations using the internal audit function’s rec-ommendations. Formal engagement communication does not provide a means by which the indepen-dent outside auditor assesses reliance on the internal audit function.
Which of the following does the CAE need to consider when determining the extent of follow-up required?
I. Significance of the reported observation.
II. Past experience with the manager charged with the corrective action.
III. Degree of effort and cost needed for the corrective action.
IV. The experience of the internal audit staff.
a. I and III.
b. I, II, and III.
c. II, III, and IV.
d. I, II, III, and IV.
A is the best answer. The CAE should consider the significance of the observation and the degree of effort and cost needed to implement the corrective action when determining the extent of follow-up. Neither the CAE’s past experience with the manager charged with the corrective action nor the experi-ence of the internal audit staff are relevant.
An excerpt from an internal audit observation indicates that travel advances exceeded prescribed maximum amounts. Company policy provides travel funds to authorized employees for travel. Advances are not to exceed 45 days of anticipated expenses. Company procedures do not require justification for large travel advances. Employees can, and do, accumulate large unneeded advances, resulting in unnecessary allocation of capital. In this audit observation, the element of an audit observation known as “effect” is:
a. Advances are not to exceed estimated expenses for 45 days.
b. Travel advances exceed prescribed maximum amounts.
c. Employees accumulate large, unneeded advances, resulting in unnecessary allocation of capital.
d. Unauthorized employees are given travel advances.
C is the best answer. “Employees accumulate large, unneeded advances, resulting in unnecessary allocation of capital” is the effect in the excerpt from the observation. “Advances are not to exceed estimated expenses for 45 days” represents the criteria. “Travel advances exceed prescribed maximum amounts” represents the condition. The excerpt of the observation does not mention unauthorized employees given travel advances.
Internal audit reports can be structured to motivate management to correct deficiencies. Which of the following report-writing techniques is most likely to be effective?
a. State the procedural inadequacies and resulting improprieties in specific terms.
b. Recommend changes and state the punitive measures that will follow if the recommendations are not implemented.
c. List the deficiencies found so as to provide an easy-to-follow checklist.
d. Suggest practical improvements to address the identified observations.
D is the best answer. Suggesting practical improvements to address identified observations will most likely motivate management to correct deficiencies. The other answers, if implemented, are likely to make management defensive rather than motivated.
The primary purpose of issuing an interim report during an internal audit is to:
a. Provide auditee management the opportunity to act on certain observations immediately.
b. Set the stage for the final report.
c. Promptly inform auditee management and their supervisors of audit procedures performed to date.
d. Describe the scope of the audit.
A is the best answer. While interim communication can set the stage for the final report and keep management informed of the status of the audit, the primary purpose is to provide management the opportunity to act on certain observations immediately. Interim communication is not intended to describe the scope of the audit.
Who has primary responsibility for providing information to the audit committee on the professional and organizational benefits of coordinating internal audit assurance and consulting activities with other assurance and consulting activities?
a. The external auditor.
b. The CAE.
c. The CEO.
d. Each assurance and consulting function.
B is the best answer. The CAE should provide the audit committee with information on the coordi-nation with and oversight of other control and monitoring functions. The responsibility for ensuring that the internal audit activity’s professional and organizational responsibilities maximize the benefits that can be achieved from coordination with other assurance consulting activities lies with the CAE, according to Standard 2050. Comments on this should be reported by the CAE to the audit committee. The CEO would not normally be responsible for planning, work, and coordination related to internal audit assurance and consulting engagements or coordination with other assurance and consulting activities. Not all other assurance and consulting activities are organizationally responsible to the audit committee for their work, and they may not have the opportunity to report information directly to the audit committee.
The primary reason for having written formal audit reports is to:
a. Provide an opportunity for engagement client response.
b. Document the corrective actions required of senior management.
c. Provide a formal means by which the external auditor assesses potential reliance on the internal audit function.
d. Record observations and recommended courses of action.
D is the best answer. Audit reports should present the purpose, scope, and results of an engagement. An engagement client should have an opportunity to respond before the report is written. Internal auditors make recommendations, they do not submit requirements. Where appropriate, external audi-tors would review workpapers to accomplish this end.
Which of the following statements best describes the internal audit function’s responsibility for follow-up activities related to a previous engagement?
a. Internal auditors should determine if corrective action has been taken and is achieving the desired results or if management has assumed the risk of not taking the corrective action.
b. Internal auditors should determine if management has initiated corrective action, but they have no responsibility to determine if the action is achieving the desired results. That determination is management’s responsibility.
c. The CAE is responsible for scheduling follow-up activities only if directed to do so by senior management or the audit committee. Otherwise, follow-up is entirely discretionary.
d. None of the above.
A is the best answer. Internal auditors should determine if corrective action has been taken and is achieving the desired results or if management has assumed the risk of not taking the corrective action. Standard 2500.A1 states that the CAE must establish a follow-up process. It is not dependent on directives of either senior management or the audit committee.
A follow-up review found that a significant internal control weakness had not been corrected. The CAE discussed this matter with senior management and was informed of management’s willingness to accept the risk. The CAE should:
a. Do nothing further because management is responsible for deciding the appropriate action to be taken in response to reported engagement observations and recommendations.
b. Initiate a fraud investigation to determine if employees had taken advantage of the internal control weakness.
c. Inform senior management that the weakness must be corrected and schedule another follow-up review.
d. Assess the reasons that senior management decided to accept the risk and inform the board of senior management’s decision.
D is the correct answer. Senior management may decide to accept the risk due to cost or other con-siderations. The CAE needs to assess senior management’s rationale and then inform the board of management’s decision.
If an auditor’s preliminary evaluation of internal controls results in an observation that controls may be inadequate, the next step would be to:
a. Expand audit work before the preparation of a final engagement communication.
b. Prepare a flowchart depicting the internal control system.
c. Note an exception in the engagement final communication if losses have occurred.
d. Implement the desired controls.
A is the best answer. If the preliminary evaluation indicates control problems, the auditor usually decides to perform some expanded testing. If a flowchart were necessary, the auditor would have prepared one during the preliminary evaluation. The auditor is not ready to make a report until more work has been performed. Auditors do not implement controls; that is a management function.
