Chapter 9 - Control Risk Assessment Part 2

Question 1

What is application programming interfaces?

Answer 1

The glue that connects IoT devices to the company’s applications and dashboards so the data can be analyzed.`

Question 2

What does IoT and API improve?

Answer 2

1. Business processes
2. Accounting system

They improve the quality and accuracy of the data

Question 3

What is the impact of IoT and API on the accounting system?

Answer 3

Financial transactions from any department are automatically recorded in the ERP without human intervention, reducing input errors. They are also continuously being monitored, reducing the need for reconciliation.

Question 4

What is the impact of IoT and API on auditors?

Answer 4

Auditors cannot rely upon manual controls and must evaluate associated automated controls related to data from IoT, API, and the ERP, in addition to access controls and services providers in the processing of new e-commerce transactions.

Question 5

What is the idea behind smart contracts?

Answer 5

Allow for all kinds of transactions to be made automatically without third parties, such as banks, to verify the payments.

Question 6

What is a blockchain?

Answer 6

A distributed digital ledger to which certain computers, or nodes are granted access.

Question 7

What is a smart contract?

Answer 7

A computer code running on top of a blockchain containing a set of rules by which the parties to the contract agree to interact with each other. When predefined rules are met, the agreement is automatic, no human intervention.

Question 8

What is a benefit of the blockchain?

Answer 8

Fast and less expensive than traditional methods and it minimizes theft and fraud as no one person can alter the blockchain.

Question 9

What are disadvantages of the blockchain?

Answer 9

Can have errors in coding and in interpreting intended outcomes. Risks relating to handoffs

Question 10

How will the blockchain and smart contracts alter the way in which auditors perform controls risk assessment? Why?

Answer 10

• If it affects financial reporting, they need to understand the impact on the assessment of internal controls. Auditors must be concerned with the reliability, accuracy, and completeness of the data since blockchain can be unauthorized, fraudulent, illegal or involve related parties.

Question 11

What is the consensus mechanism and what is the impact? What does this assist in assessing?

Answer 11

Dictates how parties reach agreements on the transactions to be added top the blockchain. Allows the auditor to assess reliability and the ability to be manipulated or altered, look at the consensus algorithm attacks.

Question 12

What are the two situations where a test of controls is performed?

Answer 12

1. When the auditors assessment of RMM at the assertion level includes an expectation that controls are operating effectively
2. When substantive procedures cannot provide sufficient appropriate evidence.

Question 13

What is the purpose of the tests of controls

Answer 13

The purpose of the test of controls is to determine and ensure that the control activities were working within the relevant period in preventing, detecting, and/or correcting misstatements. Unlike substantive testing, it does not look at the relevant assertions.

Question 14

Which controls do we test?

Answer 14

Performed only on the controls that are suitably designed to prevent or detect a material misstatement in a relevant assertion and the auditor plans to test those controls.

Question 15

What are the Three Characteristics of Effective Controls

Answer 15

1. Well designed (Control design)
2. In use (control implementation)
3. Operate reliably throughout the period

Question 16

What are the 4 Types of Procedures used to test controls?

Answer 16

1. Inquiry
2. Inspection
3. Observation
4. reperformance

Question 17

What are three considerations to look at during the test of controls to ensure that it is effective?

Answer 17

1. How the control was applied at the relevant times during the period
2. The consistency with which the controls were applied
3. By whom (or by what means) the controls were applied

Question 18

What is the test data approach?

Answer 18

Reperformance of the control through processing the auditor’s test data on the client’s computer system and application program, including test data that the client’s control system should accept or reject, then comparing the actual output to the expected output to assess the effectiveness.

Question 19

What are generalized audit software (GAS)?

Answer 19

Programs designed specifically for auditing purposes, to perform data analytics that test the effectiveness of client controls for an entire population.

Question 20

What is the primary difference between the test of controls and the risk assessment procedures?

Answer 20

The extent to which procedures are performed. In risk assessment procedures, the auditor will examine one or two transactions or observe at one point in time. Controls tests are performed on large samples and observations are made at more than one time.

Question 21

Describe the extent of controls tests meaning.
- What type of procedures will they use?

Answer 21

To obtain sufficient appropriate evidence regarding the effectiveness, they will use a combination of procedures like inquiry with inspection or reperformance. The greater the reliance to rely on the effectiveness of controls the more persuasive the evidence.

Question 22

What are factors to consider whether more effective controls evidence is needed? (FREE)

Answer 22

1. Frequency of control operations - Manual or automated. The auditor will test year end controls but also test a sample of controls that operate only monthly or quarterly.
2. Expected rate of deviation
3. Rational Testing
4. Evidence from Other Controls Tests

Question 23

What is the expected rate of deviation on manual controls and automated controls

Answer 23

Manual controls - Since manual controls are performed by people there may be manipulation. To test those controls they rely on sampling and selecting a sample of transactions to test whether the control is operating effectively.
Automated Controls - Expected rate of deviation is low as long as the computer is programed adequately. Thus the auditor may be able to assess only one transaction.

Question 24

What is rotational testing? What are the exceptions?

Answer 24

Test of controls must happen for each specific control once every 3 years, three year rule.

Exceptions: If a key control has been changed it will be assessed in the current year and a proportion of other controls must be tested in the current year. Significant risk controls must be tested every year.

Question 25

What are the impacts of changes in the IT system?

Answer 25

If an entire IT system or set of system is changed, auditors must ensure that the new systems internal controls are documented and evaluated and an audit of the data conversion if performed.

Question 26

What is the conversion audit? What does it emphasize?

Answer 26

Occurs when the conversion controls are poor or not documented, substantive tests must be performed on the conversion process. It emphasizes accuracy and authorization of new master files, completeness and existence of data in those files, and cutoff transactions.

Question 27

What are the three parts to the conversion audit? What are its purposes?

Answer 27

1. Test comparing details from the new system with the old system - To verify that only accurate, authorized information has been established. 2. Tests comparing details from the old system to those of the new system - To ensure accuracy and that no transactions are omitted. 3, Cutoff Testing - To ensure that transactions are included in the proper system and have not been omitted.

Question 28

What is the auditors responsibilities on reporting on internal control?

Answer 28

Required to communicate significant deficiencies and material weakness to those in charge of governance and management, audit committee or equivalent (board of directors or the owner-management)

Question 29

What is the internal control letter? What is included in the internal control letter? - What does the auditor do with these suggestions?

Answer 29

A letter or report from the auditor to the audit committee or senior management detailing significant control deficiencies. Includes - Description of the internal control deficiency, recommendation in the year end report - The auditor will have a discussion with the auditor and encourage them to implement the suggestions.

Question 30

What are management letters? What must the letter indicate?

Answer 30

This is made when auditors observe less significant internal controls related matters, as well as opportunities for the client to make operational improvements. Indicate that it is a derivative report to indicate that, while the purpose of the engagement was not to determine weaknesses in internal controls, such weaknesses were identified as a by product of the audit.

Question 31

What are the rules for public firms that must report on Internal controls? What is the Canadian equivalent to the requirements of the USA? Regarding the internal control rules, what is the responsibility of management and the responsibility of the auditors in Canada.

Answer 31

It is required by the Sarbanes Oxley act that affect Canadian companies that are subsidiaries of American companies or that register securities for sale in the United States. An audit of internal control over financial reporting performed that is integrated with an audit of the financial statements In Canada, management is required to provide an assessment of the internal controls, however the auditors are not required to do this.

Question 32

What is the difference between the internal controls assessment required by the Sarbanes Oxley act and financial statement audits?

Answer 32

For Sarbanes Oxley, since the auditor is providing an opinion on the effectiveness of the internal controls that management has assessed , the auditor must understand and perform test of controls for all significant account balances, transactions, disclosures, and related assertions, this is not required necessarily required under the financial statement audit, they must only test the controls that they are planning to rely on.

Question 33

What is the Internet of Things?

Answer 33

It is the concept of connecting all wifi enabled devices to the internet, each other, other devices, and centralized computers

Question 34

What is the impact of AI and Machine Learning in Audits?

Answer 34

It can help to identify patterns and trends, look for key terms, use logical reasoning to detect fraud and ultimately auditors need to take this into account when performing their internal controls risk assessment

Question 35

Provided below are the 7 types of functions that Generalized Audit Software does, briefly describe what they do:

Answer 35

1. Verify extensions and footings - Verify the accuracy of the clients computations by calculating information independently. 2. Examine records for quality, completeness, consistency, and correctness - Scan all records using a specified criteria 3. Compare data on separate files - Determine that information in two or more data files agree 4. Summarize or resequenced data and do analysis - Change or aggregate the data 5. Select the audit sample - Select samples from electronic data 6. Generate confirmation requests - Pull data for sample items selected for confirmation testing 7. Compare data obtained through other audit procedures with company records. - Compare machine readable electronic data with audit evidence gathered manually, which is converted to machine readable format.