Final Audit Review Flashcards
SECTION 1
Section 1.3: Overview of Attestation Engagements
What is the purpose of Statement on Standards of Attestation Engagement (SSAE)?
- Attestation engagements are additional services that are the responsibility of another party, other than an audit, that a CPA performs
- An attestation engagement reports on subject matter other than traditional financial statements
- A party, who is not the practitioner, makes an assertion about whether the subject matter is measured or evaluated in accordance with suitable criteria
Section 1.4: Additional Professional Services
What services are included in personal financial planning services?
- Assisting the client to act on personal financial planning decisions
- Monitoring progress in achieving goals
- Updating recommendations and revising planning decisions
Section 1.5: Quality Control
Why would an engagement partner schedule a pre-audit conference with the audit team?
To provide guidance to the staff regarding such technical issues as the expected use of client personnel and the expectations of the audit team
SECTION 2
Section 2.1: Code of Professional Conduct
What is included in the AICPA Code of Professional Conduct?
- General ethical principles that are aspirational in character
- Set of specific, mandatory rules describing minimum levels of conduct a member must maintain
- All members should act in the best interest of the public
Section 2.1: Code of Professional Conduct
What are the threats in independence?
- Adverse Interest Threat
- Advocacy Threat
- Familiarity Threat
- Management Participation Threat
- Self-Interest Threat
- Self-Review Threat
- Undue Influence Threat
Section 2.1: Code of Professional Conduct
What is adverse interest threat?
The client is working against the CPA
Examples
* Is the client, or a officer, director or shareholder of the client, suing the Auditor?
* A claim is filed against the firm to get back insurance payments made to the client
* A lawsuit filed against the client, its officers and directors, and the auditor firm
Section 2.1: Code of Professional Conduct
What is advocacy threat?
The auditor advocates for the client. The auditor is more interested in the client’s interest or position that would impair their independence
Examples
* Performing forensic accounting services to the client who is in litigation
* Acting as an investment adviser for an officer, director or 10% shareholder of the client
* Underwriting or promoting a client’s shares
* Act as a registered agent for the client
* Endorses a client’s service or products
Section 2.1: Code of Professional Conduct
What is familiarity threat?
- The auditor has a long or close relationship with the client
- The auditor becomes too sympathetic to the client’s interest or accepts the client’s work without performing due diligence
Example
* An auditor’s immediate family or close relative is employed by the client
* An auditor’s friend is employed by a client
* A former employee of the audit firm is employed by the client in a key position
* The auditor has a close relationship with the office, director or a 10% shareholder of the client
Section 2.1: Code of Professional Conduct
What is management participation threat?
- The auditor will act on behalf of the client or assume client’s management responsibilities
- The auditor cannot act as the CEO of the company
Section 2.1: Code of Professional Conduct
What is self-interest threat?
The auditor benefits with a client or persons associated with client (think Enron)
Examples
* The auditor has a financial interest in the client, and the audit will have an affect on the fair value of the company
* The auditor’s spouse enters into employment negotiations with the client
* The auditor’s firm has a contingent fee arrangement with the client
* The majority of the auditing firm’s revenue is based on the financial health of the client
Section 2.1: Code of Professional Conduct
What is self-review threat?
- If the auditor performed the work, then there is no need to review it.
- The auditor may rely on the service performed when forming a judgement as part of the audit
Example
* The auditor creates the financial statements and then audits them in the same period.
* The auditor does bookkeeping for the client
* A partner in the auditor’s firm is also associated with the client’s company as an employee, officer, director or contractor
Section 2.1: Code of Professional Conduct
What is undue influence threat?
The client threatens to fire the firm because of a disagreement over accounting principles
Section 2.2: Independence
When is a CPA not independent?
- Preparing an actuarial report using assumptions not approved by the client
- The CPA owns investments that are material
- An investment held through a regulated mutual fund
- Determining which recommendations for improving internal control should be implemented for a non public attest client
Section 2.2: Independence
What is an example of an indirect financial interest
An investment held through a regulated mutual fund
Section 2.3: Integrity and Objectivity
What are the elements that underlies the development of an overall audit strategy?
Materiality and audit risk in determining the nature, timing, and extent of procedures to apply
Section 2.6: Other Responsibilities
What are some of the requirements for the Form of Organization and Name Rule?
- Any CPA owners that are included on the letterhead must be members
- All CPA owners must be members
Section 2.7: Other Pronouncements on Professional Responsibilities
What is one of the SEC guidelines for independence?
- Audit committees ordinarily must preapprove the services performed by accountants
- Approval must be either explicit or in accordance with detailed policies and procedures
- If approval is based on detailed policies and procedures, the audit committee must be informed, and no delegation of its authority to management is allowed.
- Preapproval of accountants’ services may be in accord with detailed policies and procedures rather than explicit
Section 2.7: Other Pronouncements on Professional Responsibilities
What does the PCAOB not have legal authority to do?
Prosecute violations by registered accounting firms
SECTION 3
Section 3.1: Pre-Engagement Acceptance Activities
What is usually communicated to management in an audit?
Arrangements that involve a predecessor auditor
Section 3.2: Planning an Audit
What is the purpose of performing risk assessment procedures?
- To assess the risk of material misstatement of financial statements
- Financial statement accounts that more than likely will have a misstatement
- Conditions that require an extension of audit tests
Section 3.2: Planning an Audit
What should be included in the audit plan?
- Nature, timing and extent of procedures
- Extent of risk of material misstatement
- Planned further audit procedures
- Procedures that relate to the financial statement assertions
- Other audit procedures required by GAAS and PCAOB
The auditor does not discuss the nature and timing of detailed procedures
Section 3.2: Planning an Audit
When is the audit plan developed?
- After the auditor has an understanding of the existing internal control
- After the auditor has established an overall audit strategy
Section 3.2: Planning an Audit
What details do management and the auditor usually agree upon when discussing the general audit strategy with the client’s management?
- Objective and scope of the audit
- Responsibilities of the auditor and management
- Inherent limitations of the audit and internal control
- Financial reporting framework
- Expected form and content of audit reports
- Schedules and analyses that the client’s staff should prepare
- The extent of involvement of the client’s internal auditors
Section 3.2: Planning an Audit
What inquries should be made to the predecessor auditor, and when should they be made?
Before Accepting the Engagement
* Integrity of management
* Disagreements with management
* Communications about fraud and noncompliance
* Any significant deficiencies or material weaknesses
* What is the reason for the change in auditors
After accepting the engagement
* Matters that may raise concerns regarding the reporting consistency with prior and current years
Section 3.3: Audit Risk and Materiality
What are judgmental misstatements?
- Judgmental misstatements occur when there are judgments of management about recognition, measurement, presentation, and disclosure.
- They include the selection or application of accounting policies that the auditor considers unreasonable or otherwise inappropriate.
Section 3.3: Audit Risk and Materiality
What does the auditor include when evaluating for uncorrected misstatements of an issuer?
- Prior years and misstatements detected in the current year that relate to prior years because the prior years affect the beginning balances of the current year’s financial statements
- Possible undetected misstatements
- Accumulated uncorrected misstatements are material
Section 3.3: Audit Risk and Materiality
What are extrapolations?
Extrapolations are projected identified misstatements in samples to the relevant population
Section 3.3: Audit Risk and Materiality
According to clarified standards, how is materiality referred to in the planning stages of an audit?
- Materiality in the planning stages of an audit is referred to as performance materiality
- The materiality is set by the auditor at less than the materiality for the financial statements as a whole
Section 3.3: Audit Risk and Materiality
What would an auditor tolerate when decreasing the amount of misstatements in a class of transactions?
- When the amount of misstatements that an auditor will tolerate decreases, that means that the risk of material misstatement increases
- Detection risk decreases
- The auditor will perform planned auditing procedures closer to the balance sheet date
Section 3.5: Audit Data Analytics and Analytical Procedures
How are the ratios interpreted?
Return on Assets
* Net Income/Average Total Assets
* The higher the ROA number, the better
Asset Turnover
* Sales/Average Total Assets
* The higher the asset turnover, the better a company uses its assets to generate revenue
Inventory Turnover
* A higher ratio tends to point to strong sales and a lower one to weak sales
Accounts Receivable Turnover
* A higher turnover ratio means payments quickly converts its receivables into cash
Times Interest Earned
* A higher times interest earned ratio means that the company presents less of a risk to investors and creditors in terms of solvency.
Section 3.5: Audit Data Analytics and Analytical Procedures
What is the purpose of analytical procedures?
- Analytical procedures focus on the relationships between financial and nonfinancial data at a high level using simple and complex models
- The precision of the data is important to the auditor in determining on how to use analytical procedures as substantive procedures.
- Study of how elements of the financial data is expected to conform to a pattern that is based on the entity’s experience
- The auditor will determine the best analytical procedure to use for testing the nature of an assertion
Section 3.5: Audit Data Analytics and Analytical Procedures
What are considered analytical procedures?
- Review the sales trend to develop the expected sales rate
- Computing accounts receivable turnover
- Estimating payroll expense
Section 3.5: Audit Data Analytics and Analytical Procedures
How does an auditor determine whether to apply analytical procedures as substantive procedures or to perform tests of transactions and account balances?
The determination is whether the audit risk can be sufficiently reduced
Section 3.5: Audit Data Analytics and Analytical Procedures
What would cause an increase in the inventory turnover?
- Inventory is being stolen
- Constant sales and lower inventory also indicate higher turnover
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What are examples of misstatements?
- Inaccuracy of processing or obtaining financial data
- Omission of an amount or disclosure
- A disclosure is not presented
- Incorrect accounting estimate is made by misstake
- Unreasonable management judgments about accounting estimates
- Inappropriate selection or application of accounting policies that the auditor considers inappropriate
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What is the auditor’s responsibility regarding consideration of fraud in a financial statement audit?
Assess the risks of material misstatement due to fraud
Section 3.6: Consideration of Fraud in a Financial Statement Audit
What is the difference between incentive, rationalization and opportunity?
- Incentives are reasons for management to feel motivated to commit fraud
- Rationalization can relate to a person frequently justifying reasons for committing fraud
- Opportunities occur when company management will have the opportunity to take advantage of ineffective internal control procedures or override those controls in order to take advantage for their own self-interest
Section 3.6: Consideration of Fraud in a Financial Statement Audit
Why are new accounting requirements subject to being an incentive for fraudulent reporting?
Management may feel pressure to maintain financial stability while changing to the new accounting requirements
Section 4
Section 4.1: Using the Work of Internal Auditors
What would an auditor consider when assessing the competence and objectivity of an entity’s internal auditor?
- External quality reviews of the internal auditor’s activities
- Discussions with management personnel
- Previous experience with the internal auditor
- Assessing the organizational status of the director of internal audit
Section 4.3: Related Parties
What documents should be reviewed in order to identify a related party transaction?
- Minutes of board meetings and other committees
- Filings with regulators
- Conflict of interest statements
- Transactions with major customers, lenders and borrowers
- Accounting records for large or unusual transactions or balances
- Invoices of law firms
- Confirmations of compensating balance transactions
Section 4.3: Related Parties
What documents should be reviewed in order to determine a related party transaction?
- Evaluting management’s procedures
- Request from management the names of all the related parties
- Review SEC filings
- Names of all pension and other trusts
- Review shareholder listings
- Review prior year’s audit documentation
- Inquire predecessor auditor
- Review material investment transactions
Section 4.3: Related Parties
What documents should be examined in order to determine a related party transaction?
- Obtain an understanding of the business purpose or transaction
- Examine invoices, agreements, contracts and documents
- Is the transaction approved by governance
- Test for reasonableness
- Audits of interentity balances
- Inspect and confirm the transaferability and value of collateral
- Discuss significant information with intermediaries, such as banks or attorneys
- Confirm the transaction amount and terms, including guarantees and other significant data, with the other parties.
Section 4.4: Accounting Estimates and Fair Value
What are the auditor’s responsibilities for accounting estimates?
- Maintain an attitude of professional skepticism
- Review and evaluate the process used
- Determine if bias exists
- Communicate to those charged with governance about significant estimates
- Determine that all needed estimates have been developed
Section 4.4: Accounting Estimates and Fair Value
What are management’s responsibilities for accounting estimates?
- Take action on subjective as well as objective factors
- Determine that all needed estimates have been developed
- Maintain internal control over the process of development
Section 4.4: Accounting Estimates and Fair Value
What is most likely to be used in evaluating the reasonableness of an entity’s accounting estimates when an auditor considers whether assumptions are significant?
Deviations from past experiences
Section 5
Section 5.1: Introduction to Internal Control
What are the types of inherent limitations of internal control?
- Faulty human judgment
- Simple errors or misstakes
- Management override
- Cost-benefit considerations
- Losses
- Lawsuits and other contingencies
- Violations of laws and regulations
- Warranties
- Theft
Override by a low-level employee is not considered an inherent limitation
Section 5.2: Internal Control Components
What are the components of a control environment?
“THE CROP”
* Those charged with governance (aka Tone at the Top)
* Human Resources polices and practices. Assignment of authority and responsibility
* Ethical and Integrity Values (including hiring personnel)
* Committment to competence
* Responsibility and Accountability. Removing incentives that increase the probability of dishonest or unethical acts (i.e. bonuses for high rate of growth revenues)
* Organizational structure
* Philosophy and operating style of Management
Section 5.2: Internal Control Components
What are the components of control activities?
- Performance reviews
- Information processing
- Physical controls
- Authorization
- Segregation of Duties
- Performance indicators
Section 5.2: Internal Control Components
What are the components of Risk Assessment in Internal Control?
- Identify risks relevant to the preparation of the financial statements
- Estimate their significance
- Assess the probability
- Decide about responses to them
- Corporate restructurings may cause a change in the level of risk in the entity
Section 5.2: Internal Control Components
What are the components of Monitoring internal control?
- Monitoring ongoing activities (i.e. supervision)
- The actions of internal auditors
- Consideration of communications from external parties (i.e. customer complaints)
Section 5.2: Internal Control Components
What are the components of the Information System of Internal Control?
- Physical and hardware components
- Software
- People
- Procedures
- Data
Section 5.3: Understanding Internal Control
What understanding of an entity’s information system should an auditor obtain?
- Processes used to prepare significant accounting estimates
- Classes of significant transactions
- How the transactions are recorded
- If the transactions are electronic or manual
- How the transactions are captured
- Controls over journal entries
- Design of the controls included in the internal control components
Section 5.3: Understanding Internal Control
What are the steps in performing risk assessment procedures to evaluate the design of relevant controls and determine if they have been implemented?
“DADE”
* Determine whether the relevant controls are capable of preventing, or detecting and correcting, material misstatements and have been implemented
* Assess the risks of material misstatement
* Design further audit procedures
* Evaluate the operating effectiveness of relevant controls.
Section 5.3: Understanding Internal Control
What are the risk assessment procedures an auditor should do to evaluate the design of relevant controls?
- Inquiries
- Observations
- Inspection of documents and reports
- Tracing transactions
Section 5.3: Understanding Internal Control
What is the primary purpose of an auditor to trace several transactions through the control process?
To determine whether the controls have been implemented
Section 5.5: Internal Control and Information Technology
What is included in general controls?
- Controls over operations are effective and efficient
- The procedures used to acquire, test, develop, etc.
- Access of the equipment and data
- Documenting and approving programs and changes to programs
- Control over data center and network operations
- Systems software acquisition and maintenance
- Access security
- Application system acquisition, development, and maintenance.
Section 7
Section 7.1: Purchases Responsibilities/Organizational Structure
What is the systems process for purchases and payables?
- Inventory Control: Authorizes a purchase requisition to the purchasing and accounts payable departments.
- Purchasing: Creates a purchase order based on the requisition with the approved vendor.
- Receiving: Receives a blind copy of the purchase Order
- Vendor: Receives the purchase order
- Vendor: Ships Goods
- Receiving: Receives the goods and compares the information on the packing slip with the purchase order
- Receiving: Creates a receiving report
- inventory Control: Updates inventory records based on receiving report.
- Accounts Payable (Vouchers Payable): Receives receiving report and enters information in the A/P file for payment.
Section 7.1: Purchases Responsibilities/Organizational Structure
What are the responsibilities of the accounts payable (vouchers payable) department for effective internal control?
Matching the vendor’s invoice against the corresponding purchase order and receiving report.
Section 7.1: Purchases Responsibilities/Organizational Structure
What would be the segregation of duties in accounts payable to avoid potential areas of fraud?
- Cash disbursements
- Vendor invoice verification
Section 7.1: Purchases Responsibilities/Organizational Structure
What are the responsiblities of the purchasing agent?
- Approves the appropriate vendor
- Receives a requisition request once inventory levels fall below the reorder point
- Enters the invoice information into the invoice program to test the information against that in the open purchase order file
- Receives the invoice from vendor and enters invoice information into the invoice program
Section 7.1: Purchases Responsibilities/Organizational Structure
What is considered the best evidence of the transfer of accountability for incoming material from the receiving department to other departments or activities?
An authorized signature on the transfer form
Section 7.4: Payroll Responsibilities/Organizational Structure
What internal control activities most likely would prevent direct labor hours from being charged to manufacturing overhead?
- Time tickets should specifically identify labor hours as direct or indirect
- Compare daily journal entries with the factor labor summary
Section 7.6: Other Cycles
What test of controls would be included for raw materials in production?
- Examine prenumbered requisitions for proper authorizations, quantities, descriptions and dates
- Reperformance of relevant activities and client controls
- Examining material requisitions
Section 7.6: Other Cycles
Which controls are appropriate for property, plant, and equipment?
- Detailed property records and physical controls over assets
- Written policies for capitalization and expenditure and review of application of depreciation methods
- Proper authority for acquisition and retirement of assets
Disposal of fully depreciated assets is not a control
Section 7.6: Other Cycles
What is the most important control over acquisitions of property, plant, and equipment?
- Using a budget to forecast and control acquisitions and retirements
- This control will alert management to any transactions that are unusual, appear unnecessary, or are unauthorized.
SECTION 8
Section 8.1: Assessing Risks of Material Misstatement (RMMs)
Why may an auditor not place a reliance on controls for some assertions?
- The auditor believes that the controls are likely to be ineffective
- Performing only substantive procedures would effectively reduce audit risk to an acceptably low level
Section 8.2: Auditor’s Response to Risks
What audit procedures should be combined with other audit procedures when testing the operating effectiveness of controls?
From Most Effective to Least Effective:
* Reperformance of a control
* Inspection of relevant documentation
* Observation
* Inquiry (Combined with other audit procedures i.e. observation and inquiry, etc.)
Inquiry alone does not provide sufficient, appropriate evidence to support a conclusion about the effectiveness of a control.
Section 8.2: Auditor’s Response to Risks
What is the difference between test of controls and test of details?
Test of Controls:
* Testing that controls are operating effectively
* Overreliance is considered
* Yes or No answer
Test of Details:
* Testing for specific management assertions
Section 8.2: Auditor’s Response to Risks
What are included in test of controls?
Reperformance
Observation
Section 8.2: Auditor’s Response to Risks
What procedures are used in tests of controls?
- Tracing
- Examining
- Reperforming
Section 8.2: Auditor’s Response to Risks
What are test of details?
- The auditor assesses the risks of material misstatement at the financial statement and relevant assertion levels to design and perform further audit procedures
- Tests of details are substantive procedures
- They should be performed for all relevant assertions related to each material transaction class, balance, and disclosure
- The auditor’s objective is to obtain sufficient appropriate evidence to form an opinion on whether statements are materially misstated
Section 8.2: Auditor’s Response to Risks
What are examples of overall responses to assessed RMM?
- Professional skepticism
- Increased supervision
- Assignment of staff with more experience and expertise
- Greater unpredicability of audit procedure choices
- Changing nature, timing and extent of audit procedures
Section 8.2: Auditor’s Response to Risks
What are the components of the Nature, Extent and Timing of substantive testing?
- Nature: The auditor takes a more effective approach to testing (change in controls, change the level of the test from negative confirmations to positive confirmations)
- Extent: The extent is the amount. The auditor increases the quantity of the testing (i.e. the balance on the account is larger)
- Timing: The auditor changes the timing of the substantive test (i.e. interim inventory count to end of year count)
Section 8.2: Auditor’s Response to Risks
What will an auditor normally find in performing tests of controls?
The rate of deviations in the sample exceeds the rate of error in the accounting records
Section 8.2: Auditor’s Response to Risks
What should an auditor do if the audit risk is low?
- Detection risk is low
- Risk of Material Misstatement is high
- A lower acceptable level of audit risk indicates a need for more persuasive audit evidence
Section 8.2: Auditor’s Response to Risks
Why should an auditor decide to perform only substantive procedures for certain assertions?
- The auditor believes that the controls are not relevant to the assertions
- Testing of controls may be inefficient
Section 8.2: Auditor’s Response to Risks
What shold an auditor do when the client does not have any procedure manuals or flowcharts?
Adopt a substantive approach
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of the Test Data Approach?
Advantages
* This approach directly tests specific controls
* The auditor can create a dummy transaction specifically designed to test the transaction
Disadvantages
* Test processing is done at only one moment in time, but not throughout the year with the system.
Secton 8.3: Assessing Risk in a Computer Environment
What is the difference between an Integrated Test Facility (ITF) and the Test Data Approach?
- ITF requires the auditor to create a dummy record within the client’s actual system
- Test data approach has the auditor create a set of dummy transactions for testing a particular transaction
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of Integrated Test Facility?
Advantages
* It tests the actual program in operation.
Disadvantages
* It requires considerable coordination.
* The dummy transactions must be purged prior to internal and external reporting.
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of the Embedded Audit Module?
Advantages
* It permits continuous monitoring of online, real-time systems.
Disadvantages
* Audit hooks must be programmed into the operating system and applications program.
Secton 8.3: Assessing Risk in a Computer Environment
What are the advantages and disadvantages of parallel simulation?
Advantages
* Since the testing does not occur with the actual system, the transactions throughout the period may be processed and the results can be compared with the client’s results.
* Provides Assurance that edit checks have been applied during the period.
Disadvantages
* Cost of obtaining the program and the coordination effort required to obtain transactions to reprocess.
Secton 8.3: Assessing Risk in a Computer Environment
How does an auditor obtain evidence that user identification and password controls are functioning as designed?
Examine a sample of password holders and access authority to determine whether they have access authority incompatible with their other responsibilities
SECTION 9
Section 9.1: Communicating Internal Control Related Matters Identified
What should be included in the communication of significant control deficiencies?
- Purpose of the Audit was to report on the financial statements, not to provide assurance on internal control
- Definition of Significant Deficiency
- Definition of Material Weakness
- Report of any significant deficiencies or material weaknesses
- Restricted Report
Section 9.1: Communicating Internal Control Related Matters Identified
What is the level of importance between a significant deficiency and a material weakness
A material weakness is more severe than a significant deficiency
Section 9.1: Communicating Internal Control Related Matters
What is a design deficiency?
The control is operating effectively
* Is the control satisfying the objective?
* Can the control prevent, detect or correct fraud or errors that can result in a material misstatement?
* Is there documentation regarding the operation?
* Is the control operating when observing the performance?
Section 9.1: Communicating Internal Control Related Matters
What are the questions to identify an design deficiency?
How do these controls look on paper?
Were they designed to complete the objective?
Procedures to Test to I/C Design:
* Walkthrough
* Inquiry
* Observe
* Inspect documentation
Section 9.1: Communicating Internal Control Related Matters
What is an operating deficiency?
Are the controls working as intended?
Procedures to test I/C Operating Controls:
* Observation
* Inspection of documentation
* Recalculation and reperformance of the control (This is the most persuasive test)
Section 9.1: Communicating Internal Control Related Matters
What are examples of internal control operational failures?
- Failure to reconcile accounts
- Management override of internal controls
Section 9.2: The Auditor’s Communication with Governance
What matters is an auditor required to communicate to those charged with governance?
Adjustments that were suggested by the auditor and recorded by management that have a significant effect on the entity’s financial reporting process.
Section 9.3: Reporting on an Entity’s Internal Control
What are examples of entity-level controls?
- Control environment
- Controls over management override
- Monitoring results of operations
- Controls over period-end financial reporting process
- Monitoring other controls
- Risk assessment process
Section 9.3: Reporting on an Entity’s Internal Control
When would an auditor issue an adverse opinion in a report on internal control?
- When a material weakness is discovered
- The auditor believes that the internal control is not effective
Section 9.3: Reporting on an Entity’s Internal Control
What would an auditor evaluate when planning an engagement to audit the effectiveness of the entity’s internal control in an integrated audit of a nonissuer?
- Preliminary judgments about the effectiveness of internal control
- Type of available evidence pertaining to the effectiveness of the entity’s internal control
- Extent of recent changes in the entity and its operations