Exam 3 - Section 5 audit Flashcards
Who does an audit report inform and what does it tell you?
- oversight bodies, and the public
- Tell us how well a governmental entity has performed its function
What is an audit?
- An independent, systematic, objective, and unbiased assessment provide answers to a set of questions
- The auditor generally expresses an opinion, or reaches a conclusion about what was audited
- Questions can be explicit or implicit
What question is answered in financial audits?
Whether the financial statements fairly present in all material respects the financial conditions, results, and use of resources of the entity
What are some examples of questions that performance audits can answer?
- What is organization operating in an economical manner?
- Did this organization achieve its program objectives?
- did the costs claimed under the federal grant conform to the grant requirements?
- Was the program program operated in compliance with laws and regulations
What type of assurance do auditors give in their opinion?
Reasonable assurance in all material respects
Material and inaccuracy can exist without impacting the auditors opinion
How is the term material used?
Material is used in the context of whether a reasonable and informed third-party would consider that an omission or misstatement would have changed their opinions regarding the auditors conclusion
How is materiality determined?
- auditors use professional judgment determine what material/significance is
- Financial audit must follow specific material criteria in the GAO/CIGIE financial audit manual
How are materiality levels different in the government versus private industry?
Materiality levels in the government may be lower than they would be in a private firm
What are the three types of engagements according to GAS?
- Financial audits.
- Attestation engagements and reviews of financial statements
- Performance audits.
What standards did the AICPA issue for financial statement audit engagement?
Statements on accounting standards (SAS)
These are incorporated by reference in GAS
What type of opinion does a financial statement audit usually render?
An opinion on whether the financial statements present fairly, in all material respects, the financial of the auditee at the point in time and for the fiscal period then ending
What does an opinion of an audit the financial statements mean?
The financial statements were prepared, usually in accordance with appropriate, generally accepted accounting principles (GAAP) (but occasionally with another set of principles)
Who establishes GAAP for public and private companies and for not for profit organizations?
The financial accounting standards board (FASB)
Who establishes GAAP for state and local governments?
Governmental accounting standards board (GASB)
Who establishes GAAP for the federal government?
The federal accounting standard advisory board (FASAB)
What other types of audits can financial audits include?
- Ones that are not the complete set of financial statements
- Reporting on a single financial statement or specified elements, accounts, or line items on a financial statement
- Issuing letters for underwriters and certain other requesting parties
- Auditing applicable compliance and internal control requirements relating to one or more government programs
- Conducting an audit of internal control over financial reporting that is integrated with an audit of financial statements (integrated audit)
What do attestation engagements cover?
Abroad range of financial or non-financial objectives about the subject matter or assertion, depending on the users needs
What standards did the AICPA issue for attestation engagements?
The statements on standards for attestation engagements (SSAE) which are incorporated by reference in GAS
How can attestation engagements be performed?
As standalone engagements, or performed in conjunction with a financial or performance audit
What are the three types of attestation engagements?
- Examination.
- Review.
- Agreed-upon procedure engagements.
In an attestation engagement, what do auditors issue and examination, for review, or an agreed-upon procedure on?
Report on a subject matter or an assertion about a subject matter that is the responsibility of another party
What does an auditor do an examination?
Obtain reasonable insurance by obtaining sufficient, appropriate evidence about the measurement or evaluation of subject matter against criteria in order to be able to draw reasonable conclusions on which to base the auditors opinion about whether the subject matter is an accordance with/based on the criteria or the assertion is fairly stated, and all material respects
What level of assurance does an examination provide?
The same level of assurance as a financial statement audit
What does an auditor do in a review?
Obtain limited assurance by obtaining sufficient appropriate review evidence about the measurement or evaluation of subject matter against criteria in order to express a conclusion about whether any material modification should be made to the subject matter in order for it to be in accordance with/based on the criteria, or to be the assertion in order for it, to be fairly stated
What do reviews not include?
Reporting on internal control or compliance with provisions of law, regulation, contracts, and grant agreements
What level of assurance does a review provide?
The same level of assurance as a review of financial statements
What does an auditor do in agreed-upon procedure engagements?
An auditor performs specific procedures on subject matter or an assertion, and reports on the findings, without providing an opinion, or a conclusion on it
They specified parties to the engagement, agree upon, and are responsible for this sufficiency of the procedures for their purposes. And the specified parties are the intended users to whom the report is limited.
What are some possible subjects for attestation engagements?
- Historical or perspective, performance or condition, historical or perspective financial information, performance measurements, or backlog data
- physical characteristics, such as narrative descriptions, or the square footage of facilities
- Historical events, such as the price of a market basket of goods on a certain date
- analysis such as break analysis
- Systems and processes such as internal control
- behavior, such as corporate governance, compliance with laws and regulations, and HR practices
What policies/guidelines can auditors use for attestation engagements?
Depending on the nature of the engagement, or subject matter being audited, they can use the standards for attestation engagements, or performance audits.
What do performance audits provide?
Objective analysis, findings, and conclusions to assist management in those charge with governance and oversight with, among other things, improving performance and operations; reducing costs; facilitating decision-making by parties, responsible for overseeing or initiating corrective action; and contributing to public accountability
What determines what type of sufficiency in appropriate evidence is needed in performance audits?
How is testing determined? (How much)
The sufficiency and appropriateness of evidence needed, and the testing of evidence are determined by the auditors based on the audit objectives, findings, and conclusions.
What objectives can performance audits cover?
- assessing internal controls
- Determining the resources, used in compliance with laws, regulations, and other requirements
- Assessing the extent to which legislative, regulatory, or organizational goals, and objectives are being achieved
- Assessing the reliability of alternative approaches to yield better program performance, or eliminating factors that inhibit program effectiveness
- Analyzing the relative effectiveness of a program or activity
- Determining whether a program produced intended
- Determining whether the entity used resources, efficiently, effectively and economically
What type of non-audit services can auditors assist management with?
- Analyzing data
- Developing or implementing accounting system
- Developing internal control systems
- Providing specific information without verifying its accuracy
Non-governmental entities as advisory or consulting services
Government are limited to protect their independence
What standards do non-audit services follow?
Do not follow oddity standards because they’re not auditing
What are some of the standards that auditors follow?
- Government auditing standards/GAS issued by GAO
- Generally accepted auditing standards/GAAS issued by AICPA
- international standards for the professional practice of internal auditing issued by the institute of internal auditors/IA
What policies does the auditing standards board of the AICPA issue?
- statements on auditing standards/SAS, which are annually codified into a single publication
- Statements on standards for attestation engagements/SSAE
What did the budgeting and accounting act of 1921 establish
GAO as a non-partisan agency of Congress
Who is GAO headed by?
The comptroller general of the United States
What does GAO do?
They perform the audit function for Congress
What are the provisions in GAS that App apply to financial audits, attestation, engagements, and performance audits?
- General requirement for compliant with GAS
- Ethics, independence, and professional judgment
- Competence and continuing professional education
- Quality control and peer review
What does GAGAS incorporate by reference for financial audits and attestation agreements?
AICPA statements on auditing standards and statements on standards for attestation engagements
GAGAS also add a number of additional requirements because of the need of greater accountability of government activities
What does GAGAS incorporate by reference for performance audits?
AICPA standards are not referenced because they do not address performance audits
GAGAS provides separate fieldwork and reporting standards for performance audits
What standards does IIA issue?
International standards for the professional practice of internal auditing
What is IIA?
An international association dedicated to the continuing professional development of the individual internal auditor and internal auditing profession
What do IIA standards provide?
Guidance for the conduct of internal oddity, which is an independent objective assurance and consulting activity, designed to add value and improve an organizations operations
What do the IIA standards concern?
Internal audit, structure, proficiency and professional care taken by internal auditors, and the scope and performance of internal auditing
What is the objective of internal auditing?
To assist members of the organization in the effective discharge of the responsibilities
Focus on performance rather than financial
What is the focus of internal auditing?
Risk and control
What are the two categories of engagements from IIA?
- assurance
- Consulting
Does the government follow IIA standards?
Local governments follow IIA standards, but may follow GAS or both
Why was PCAOB established and what did they oversee?
Public company, accounting oversight board
Was created as a result of publicly traded companies, financial reporting fraud
PCA O B overseas the audits of companies who’s stock is publicly traded in order of protect The interest of investors and further the public interest in the preparation of informative, fair and independent auto reports
What types of standards does the PCAOB establish and who do they apply to?
- establish auditing and related at test, standards, quality control, standards, and ethic standards
- Standards apply to registered public accounting firms that prepare an issue audit reports of public companies
- They do not apply to government entities, but may influence future auditing standards that affect government auditing
What is the objective of the international auditing and assurance standards board (IAASB)?
To serve the public interest by setting, independently, and under its own authority, high-quality standards, dealing with auditing, review, and other assurances, quality control, and related services; and by facilitating the convergence of national international standards
- IAASB may influence future auditing standards that affect audits of government entities
- The auditing standards board of the AICPA is converging. It’s auditing standards with the international standards on auditing (ISA) issued by the IAASB
What is the international organization of supreme audit institutions (INTOSAI) and what does is it provide?
- Operates as an umbrella organization for the external government audit community
- provides an institutionalized framework for national audit offices to provide the development and transfer of knowledge, improve government, auditing worldwide and enhance professional, capacities standing and influence about 200 members in their respective countries
- non-government organization with special consultative status with the economic and social council/ECOSOC of the United Nations
- May influence future standards affect audits of government entities
When was GAO‘s first yellow book published? And when was the latest version issued?
- 1972
- July 2018
When is the 2018 GAS revision effective?
- for financial audits, attestation, engagements, and reviews of financial statements. Ending on or after June 30, 2020.
- For performance audits beginning on or after July 1, 2019
Who is required to conduct audits in accordance with yellow book?
- all federal inspector generals
- Audits of federal financial statements required by the CFO act, GMRA and the accountability of tax dollar act
- All audits of state and local governments and other recipients of federal financial assistance required under the single audit act
- State government and/or law and policies require auditors to adopt GAGAS
- Many local governments follow IIA standards (red book), yellow book or a mix
What was the major point of the April 2021GAO technical update to the yellow book?
Updated the concept of accountability for use of public resources and government authority. It added “equitably” to the list
“ the administration of the government program or activity is equitable when it consistently serves members of the public…”
What are the two categories of professional requirements that GAGAS uses to describe the degree of responsibility they impose on auditors and audit organizations?
- unconditional requirement
- presumptively mandatory requirement
When must auditors and audit organizations comply with an unconditional requirement? What is used to indicate it’s an unconditional requirement?
- All cases were such requirement is relevant
- and unconditional requirement uses the word must
When must auditors and audit organizations comply with a presumptively mandatory requirement? What word is used to indicate a presumptively mandatory requirements
- in all cases were such a requirement is relevant
- alternative procedures to achieve the attempt of the acquirement must be performed in the rare case of departing from it. Document documentation of the justification for departure, and how alternative procedures were performed as required
- The word
What is explanatory material? What words are used to describe explanatory information?
- explanatory material is in the form of application guidance within GAGAS text other than requirements (outside of the box)
- May, might, and could
What must an auditor do if it departs from an unconditional requirement?
Include a modified GAGAS compliance statement in the report on the GAGAS engagement
What if the auditor departs from a presumptively mandatory requirement?
- Perform alternative procedures to achieve the attend of that requirement
- Document the justification for the departure
What must a report include if an auditor followed all GAGAS requirements?
An unmodified GAGAS compliance statement
The statement indicates that the “ engagement was conducted in accordance with GAGAS”
What should a report include when an auditor departs from GAGAS requirements?
- a “ modified GAGAS compliance statement”
- Indicate that either:
1. Engagement was conducted in accordance with GAGAS, except for specified requirements that were not followed
2. The departures from GAGAS requirements were so significant that the auditors were evil to conduct the engagement in accordance with GAGAS
What should the modified compliance statement include if auditors were unable to conduct the engagement in accordance with GAGAS?
- disclosure of the requirements not followed
- The reasons not followed
- Not following the requirement affected or could have affected the engagement and its resulting assurance
What situations may lead to a modified statement?
scope limitations, such as restrictions on access to records, government officials, or other individuals needed to conduct the engagement
How is public interest defined?
The collective well-being of the community of people and entities that the auditors serve. The yellow book and bodies the concept of accountability for public resources, which is fundamental serving the public interest in honoring the public trust.
What does integrity include?
Auditors conducting their work with the attitude that is objective, fact-based, non-partisan, non-ideological with regard to audited entities and users of the audit reports
What does yellow book say about proper use of government, information, resources, and positions?
- there to be used for official purposes only and not inappropriately for the auditors personal gain, or in the manner contrary to law, or detrimental, took the legitimate interest of the audit entity, or audit organization
- Includes proper handling of classified information or resources
What does professional behavior include?
Auditors put it forth and honest effort, and performing their duties in accordance with the relevant, technical and professional standards
The high expectations for auditors include compliance with law and regulations, and avoidance of any conflicts of interest
What is the most important GAGAS requirement?
Independence
What does the concept of independence cover?
The attitude of the auditor in the way, they would be perceived by knowledgeable third parties
What are the two most important aspects of independence?
- Independence of mind.
- Independence of appearance.
What is independence of mind?
The state of mind that permits, the conduct of an engagement, without being affected by influences that compromise professional judgment, thereby allowing an individual to act with integrity and exercise, objectivity and professional skepticism
What is independence in appearance?
The absence of circumstances that would cause a reasonable and informed third-party to reasonably conclude that the integrity, objectivity, or professional skepticism of an audit organization, or member of the engagement team has been compromised
When must an otter be independent from an audited entity?
- any period of time falls within the period covered by the financial statements, or subject matter of the engagement
- The period of a professional engagement
what is the conceptual framework approach (also, sometimes called threats and safeguards approach)?
- Identifying the threats to independence.
- Evaluating the significance of the threat identified.
- Applying safeguards, as necessary to eliminate the threats or reduce them to an acceptable level.
Evaluation and reevaluation of possible threats is an ongoing process during the audit since new information can arise, in fact, can change
What are the seven different types of threats to independence?
- Self interest.
- Self review.
- Bias.
- Familiarity.
- Undue influence.
- Management participation.
- Structural.
What is a self interest threat?
The threat that a financial or other interest will inappropriately influence an auditors judgment or behavior
What is self review threat?
The threat that an auditor or audit organization has provided non-audit services that will not appropriately evaluate the results of previous judgments made or services provided as part of the non-audit services when forming a judgment significant to a GAGAS engagement
What is a biased threat?
The threat that an auditor will, as a result of political, ideological, social, or other conviction, take a position that is not objective
What is the familiarity threat?
The threat that aspects of a relationship with management or personnel of an audited entity, such as a close or long relationship, or that of an immediate or close family member, will lead an auditor to take up position that is not objective
What is an undue influence threat?
The threat the influences or pressures from sources external to the audit organizations, will affect the auditors ability to make objective judgments
What is the management participation threat?
The threat that results from an auditors taking on the role of management, or otherwise performing management functions on behalf of the audited entity, which will lead an auditor to take a position is not objective
What is the structural threat?
The threat that an audit organizations placement with a government identity in combination with the structure of the government entity, being audited, will affect the audit organizations ability to perform work and report results objectively
What should auditors do if they conclude that the threats are not acceptably low level?
Determine whether appropriate safeguards can be applied to eliminate the threads or reduce them to an acceptable level
Yellow book requires auditors to evaluate threats, both quantitatively and quantitatively. If threats cannot be reduced to an acceptable level, auditors should decline to perform the audit or terminate, if the audit already started.
What are some non-audit services that impair an auditors ability to conduct GAGAS?
- Preparing accounting records, and financial statements
- Internal audit assistance, services provided by external auditors
- Internal control evaluation as a non-audit service
- providing IT services to an audited entity that relate to the period under audit
What should auditors do if they are required to provide non-audit services because of constitutional or statutory requirements that they have no control over, and they can neither implement safeguards to reduce the threat to an acceptable level, nor decline to provide, or terminate a non-audit service that is incompatible with engagement responsibilities?
Disclose the nature of the threat they could not be eliminated or reduced to an acceptable level and modify the GAGAS compliance statement
Determining how to modify the GAGAS compliance statement is a matter of professional judgment
How does yellow book define safeguards?
Actions or other measurements, individually, or in combination, the auditors and audit organizations, take to effectively eliminate threats to independence or reduce them to an acceptable level
There are some examples of safeguards for threats?
- Consulting, an independent third-party, such as a professional organization, a professional regulatory body, or another auditor to discuss the engagement issues or assess issues that are highly technical, or that require significant judgment
- involving another audit organization to perform or re-perform part of the engagement
- Having an auditor who is not a member of the engagement team review the work performed
- Removing an auditor from an engagement team when the auditors, financial or other interests or relationship pose threat to independence
What should an auditor do if they conclude no safeguards have or can be applied to sufficiently mitigate independence threats?
Independence is impaired, and thus the auditor should decline to perform the engagement or terminate the engagement if it has been started
What should auditors do before agreeing to non-audit services for an entity that the auditors are auditing or will audit?
Determine if the non-audit service creates a threat to independence either by itself or in conjunction with other non-audit services.
If threats cannot be mitigated, the auditors should decline to perform the non-audit service or decline to continue performing non-audit services
What are some steps auditor should take before undertaking and engagement to perform a non-audit service?
- Determine that the audited entity has designated a person with suitable skill, knowledge, or experience to oversee the non-audit engagement.
- Document consideration of the entity management ability to oversee and take responsibility for the non-audit engagement
- Obtain an agreement from entity management.
- Establish document auditors understanding with entity management.
What are some things that must be included on the agreement for non-audit services from entity management, and what they will do?
- assume all management responsibilities
- Oversee the non-audit services by designating, a specific person who possesses suitable skill, knowledge, or experience to oversee the non-audit engagement
- Evaluates the adequacy of the results of services provided
- Responsibility for the results of the services provided
What should auditors establish in document regarding their understanding with entity management?
- objectives of the non-audit service
- Services to be provided
- Audited entities acceptance of the responsibilities as discussed above
- Auditors responsibilities
- Any limitations on the provision of non-audit services?
What does yellow book identify as non-audit services that create threats that cannot be mitigated using safeguards and will automatically impair the auditors independence
- preparing accounting records, such as journal entries, approving/authorizing entity, transactions, preparing/changing source documents without manage approval
- providing internal audit services, such as setting internal audit policies/strategic direction, performing procedures that form internal control, such as changing employee, data access privileges, determining internal audit scope
- Providing or supervising ongoing monitoring procedures over an entities internal control
- Providing IT services
- providing appraisal, evaluation, actuarial services when the services involve subjectivity in the results are material to the financial statements
- Assuming management responsibility
a administering a benefit plan - Executive or employee recruiting
- Investment advisory, or management
What does yellow book stipulate regarding preparing year end these financial statements related to non-audit services
Auditors should conclude that preparing financial statements in their entirety from a client, provided trial balance, or underlying accounting records, create significant threats to auditors independence, and should document the threats and see words applied to eliminate and reduce threats to an acceptable level in accordance with paragraph 3.33 or declined to provide the services
In all situations related to threats, safeguards, and non-audit services, what are auditors required to do?
- document that identified threats, applied, safeguards, and whether threats have been effectively mitigated
- Document consideration of entity management ability to effectively oversee non-audit services provided
What type of non-audit services are always unlikely to be considered a significant threat?
typing, formatting, printing, binding financial statements
What does yellow book require about professional judgment?
Professional judgment includes exercising, reasonable care, and professional skepticism. Reasonable care includes acting diligently in accordance with applicable professional standards, and ethical principles. attributes of professional skepticism include a questioning mind, awareness of conditions that may indicate possible misstatement owing to error, war, fraud, and a critical assessment with evidence