Chapter 9: Assessing Control Risk for a F/S Audit Flashcards
What must auditors do to assess control risk in order to plan the audit?
determine whether and to what extent they can rely on internal controls in order to determine how much audit testing they need to do to verify management’s assertions
Procedures used to meet GAAS 3rd standard of field work
1) Obtain an understanding of the IC structure and verify that controls have been placed in operation, 2) Document the understanding, 3) For each key assertion, assess control risk and document rationale for assessment, 4) If CR assessed at < 100%, perform tests of controls to ensure control is actually in place and functioning as intended, 5) Report to audit committee and management all significant or material control deficiencies found during audit
Types of Control Weaknesses
1) Control Deficiency, 2) Significant Deficiency, 3) Material Weakness
Control Deficiencies
IC design of operation would fail to prevent/detect a misstatement in a timely manner
Significant Deficiency
control deficiency that is less severe than material weakness but is important enough to merit attention by those responsible for IC, could cause a problem
Material Weakness
control deficiency where there is reasonable possibility that material misstatement will not be prevented or detected on a timely basis, will likely cause a problem
What should auditor have clear understanding of related to organization’s IC structure
1) Origin of every document and record in the system, 2) All processing that takes place, 3) Final resting place of each document and record, 4) Control activities that exist
Walkthrough
auditor walks through the control process and observes documentation and various activities being performed
Why is written documentation of IC understanding important?
because it provides an easily recalled source of information that will be useful throughout the audit and it also provides evidence of compliance with the standards
Levels of assessing control risk
1) Entity-Level Controls, 2) Process-Level Controls
Relationship between entity-level controls and IC
if entity-level controls are weak, low reliance on IC
Process-level controls
specific control procedures and information flows in place to help ensure specific f/s assertions are met
Control assessment
consider the specific threats one wants to control and identify the controls that are available to minimize each threat
Key control objectives for process controls
1) Completeness, 2) Accuracy, 3) Validity (occurrence), 4) Restricted Access
Completeness
all transactions are processed
