Final review Flashcards
Objectives ORC
Operations
Reporting
Compliance
CRIME
Control environment
Risk assessment
Information & communication
Monitoring
Existing Control Activities
C = EBOCA
Ethics
Board oversight
Organizational structure
Competence
Accountability
R = SAFR
Specify objectives
Asses changes in the control environment
Fraud
Risk analysis
I = OIE
Obtain information
Internally communicate
Externally communicate
M = SOD
Separate &
Ongoing evaluations
Deficiency communication
E = CATP
Control
Activities
Technology
Policies and procedures
SSARS - Statements on Standards for Accounting and Review Services
(types, assurance for each type, independence for each type, opinion/conclusion/report?)
SSARS - preparation, compilation (of either historical OR proforma) & reviews of historical FS (of unaudited FS for nonissuers)
Statements on Standards for Accounting and Review Services codified in AR-C
Preparation- no assurance, no independence, no opinion/conclusion/report
Compilation- no assurance, no independence but must disclose if not, no opinion or conclusion but yes report
Review- limited (negative) assurance, independence required, no opinion but yes conclusion
SSAE - Statements on Standards for Attestation Engagements
(types, independence for each type, assurance for each type, opinion/conclusion?)
SSAE - agreed-upon procedures, review or examination of proforma projections/forecasts (anything that IS NOT historical FS)
Attest engagements - exam, review, or AUP (agreed upon procedures) on a subject matter or assertion about a subject matter - WRITTEN CONCLUSION/WRITTEN ASSERTION
AUP, forecasts/projections, proforma FS, compliance, MD&A, reporting on controls at a service organization
agreed upon procedures - independence required, no assurance, list of procedures and findings
review (not historical FS) - independence required, limited (negative) assurance, conclusion
examination (not historical FS) - independence required, reasonable (positive) assurance, opinion
Which standards apply to REVIEW engagements?
SSAE - applies to anything that’s not historical financials so applies to review of management assertions
PCAOB - applies to quarterly reviews/interim for issuers that have annual audit
SAS - applies to quarterly reviews/interim for NON-issuers that have annual audit
SSARS - applies to reviews for NON-issuers annual financial statements that do NOT also get audited
Which standards apply to an AUDIT of a NON-issuer?
SAS - Statements on Auditing Standards published by Auditing Standards Board is comprised of Generally Accepted Auditing Standards (GAAS)
performance principle (assurance)
reasonable assurance must be obtained about whether FS as a whole are free of material misstatement, whether due to fraud or error
reporting principle (opinion)
based upon the sufficient appropriate evidence obtained (auditor should issue a written report expressing an opinion or make a statement that an opinion cannot be expressed)
Government Auditing Standards conducted under Government Accountability Office (GAO)
Generally Accepted Government Auditing Standards GAGAS or “Yellow Book”
Single Audit Act threshold?
Type A vs Type B program?
single audit is divided into two areas: compliance and financial
Threshold of $750,000 is related to expenses, not revenues.
Type A program - federal program that exceeds a quantifiable amount of federal awards expended, then determined whether high or low risk
minimum coverage rule:
high risk - recipient that has high risk of noncompliance with federal laws and regulations; audit 40% of total awards expended
low-risk - recipient that has low risk of noncompliance with federal laws and regulations; audit 20% of total federal awards expended
Type B program - any program that doesn’t meet Type A requirement
AICPA Code of Professional Conduct: (“SPROID”)
- scope and nature of services principle
- public interest principle
- responsibilities principle
- objectivity & independence principle
- integrity principle
- due care principle
AICPA Code of Professional Conduct
Adverse threat
Advocacy threat
Familiarity threat
Management participation threat
Self-Interest threat
Self-review threat
Undue influence threat
member’s interests are in opposition of client (litigation)
member will promote client’s interests or position, lack of objectivity/compromise indep
member will be too sympathetic due to long close relationship
member will take on role of client mgmt
member could benefit from interest in or relationship with client
member will not appropriately evaluate results of previous judgment
member will subordinate judgment to client due to coercion or agression
AICPA Code of Professional Conduct
Independence Rule
-unpaid fees threat
-financial interest threat
-mutual funds threat
-retirement/savings account threat
-unpaid fees threat: compliance with independence rule would not/could not be reduced to acceptable level = impaired
-financial interest threat: direct or material indirect financial interest in client or firm employee or their immediate family own >5% of client’s securities = impaired
-mutual funds threat: owns >5% of shares in diversified mutual fund, need to evaluate whether ownership is material indirect financial interest
-retirement/savings account threat: employee or immediate family member self-directs investments or has ability to supervise or participate = direct financial interest = impaired; if interest is defined benefit plan = not considered a financial interest unless they can direct or supervise or participate
AICPA Code of Professional Conduct
Independence Rule
Partnerships
LLC
Trust/estate
Partnerships: direct financial interest = impaired (limited partnership = indirect financial interest as long as no control/supervise/participate)
LLC: managing interest = direct financial interest = impaired; non-managing = indirect interest
Trust/estate: investment decision-making, >10% of client’s securities or total assets = impaired
AICPA Code of Professional Conduct
Independence Rule
-deposit accounts
-loans
-leases
deposits: no self-interest threat if balance is insured by state/fed gov deposit insurance, any uninsured is immaterial
loans: no self-interest threat if unsecured loan is immaterial to net worth or is a home mortgage or is a secured loan; or a collateralized auto loan, collateralized CSV of life insurance policy, cash collateralized loan
leases: must be an operating lease, terms comparable with other leases of similar nature
AICPA Code of Professional Conduct
Independence Rule
(simultaneous employment, honorary director/trustee, appraisal/valuation services, forensic accounting, witness, IA services, tax services)
simultaneous employment with client = independence impaired
honorary director or trustee = independence not impaired as long as position is clearly honorary (no voting)
appraisal, valuation, actuarial services = independence not impaired if service provided was solely for nonfinancial statement purposes, otherwise, independence is impaired
forensic accounting = litigation consultant (not impaired)
expert witness = impaired unless witness for a large group where client is small percentage of group and is not lead
internal audit services = impaired if client outsources IA function to covered member
tax services = not impaired as long as services are prep/submit/pay tax returns and covered member does not have control over client’s funds & client reviews/signs returns
PCAOB Ethics and Independence Rules
FORM AP - (Auditor Reporting of Certain Audit Participants)
filed with PCAOB for each new issuer audit and discloses: name of engagement partner, info of any other audit firm participating in audit whose work constituted at least 5% of total audit hours and aggregate info of any other firms whose participation was less than 5% of total audit hours
filing required no more than 35 days after audit firm files the audit report with SEC; for IPOs filing is required within 10 days after auditor's report is first included in a document filed with SEC
Government Accountability Office
Government Auditing Standards (GAGAS)
Independence of Mind
Independence in Appearance
Independence of mind: (professional judgment not compromised)
Independence in appearance: (professional skepticism not compromised)
Professional skepticism
IMPEDIMENTS & MITIGATIONS
impediments - inherent pressures (maintaining client relationships, keep costs down, avoid conflicts w/mgmt), inappropriate levels of confidence or trust in mgmt, personal bias, lack of training and expertise
mitigate with setting tone at top that emphasizes need for professional skepticism, maintaining promotion and compensation processes that enhance it, assigning personnel with appropriate background
Professional judgment
Professional judgment is the accumulated knowledge that an auditor gains through experience and training to make critical judgments in an objective, professionally skeptical manner. Overlaying this with professional and ethical standards results in ability to make informed decisions
“Communication to those charged with governance”
4 required communications
opinion
mgmt responsibilities
GAAS/reasonable not absolute
auditor responsibilities
1) auditor is responsible for forming and expressing an opinion about whether the financial statements that have been prepared by management with the oversight of those charged with governance are presented fairly, in all material respects, in conformity with the applicable financial reporting framework.
2) audit of FS does not relieve mgmt or those charged with governance of their responsibilities
3) auditor is responsible for performing the audit in accordance with generally accepted auditing standards and that the audit is designed to obtain reasonable, rather than absolute, assurance about whether the financial statements are free of material misstatement
4) auditor should communicate the auditor’s responsibility with respect to other information prepared by management that accompanies the audited financial statements.
“Communication to those charged with governance”
Internal controls and control deficiencies
Control deficiencies identified during the audit that upon evaluation are considered significant deficiencies or material weaknesses should be communicated in writing to management and those charged with governance as a part of each audit
Statement on Quality Control Standards (SQCS) 8 - A Firm’s System of Quality Control “HELPME”
1) HR (recruiting, hiring practices, professional development)
2) Engagement & acceptance (policies and procedures on services performed)
3) Leadership (tone at top)
4) Performance (guidance on supervision, review)
5) Monitoring
6) Ethics (policies and procedures that spell out ethics)
Developing overall engagement strategy - 4 things that help determine amount, timing and supervision of resources
1) determine characteristics that define scope (basis for reporting, industry-specific reporting requirements, entity’s locations)
2) determine reporting objectives of engagement to plan timing of audit, nature of communications requirements and key dates for expected communications
3) consider important factors that determine focus of audit team’s efforts (materiality levels, preliminary areas for potential misstatements, financial reporting developments)
4) determine nature/timing/extent of resources necessary to perform engagement
audit plan MUST HAVE these 3 things in order to achieve audit objectives:
1) description of nature/extent/timing of planned risk assessment procedures sufficient to assess risks of material misstatement
2) nature/extent/timing of planned further audit procedures for each material class of transactions/account balances/disclosure
3) other audit procedures to comply with GAAS
developing detailed plan for attest engagement
1) while detailed plan not required, accountant should prepare /retain sufficient documentation to allow engagement teams/partners to satisfy supervision/review/QC responsibilities
2) accountant should determine nature/extent/timing of planned procedures in order to achieve engagement objectives
auditor should identify the relevant factors that define the nature of an entity, and document the procedures performed to obtain that understanding. In particular, that understanding establishes a frame of reference within which the auditor plans the audit and exercises professional judgment about assessing risks of material misstatement of the financial statements and responding to those risks throughout the audit.
this helps:
1) establish materiality and reevaluate that throughout the audit
2) consider appropriateness of chosen accounting policies and adequacy of disclosures
3) identify special areas of consideration might be necessary
4) develop expectations when performing analytical procedures
5) design and perform further audit procedures to reduce audit risk
6) evaluate sufficiency/appropriateness of audit evidence obtained
auditor should obtain understanding of entity’s IT systems infrastructure and document procedures to obtain understanding of…
a) description of functions of system
b) change control process
c) security evaluation
d) system documentation should be reviewed for completeness, accuracy, timeliness
attestation engagements: what is attestation risk? Does it apply to AUP?
the risk that the accountant expresses an inappropriate opinion or conclusion, as applicable, when the underlying subject matter or subject matter information (or assertion) is materially misstated.
Attestation risk is not applicable to an agreed‐upon procedures engagement, as the design of procedures in that type of engagement is the responsibility of the specified party(ies).
whether a control is relevant to financial reporting?
whether and how a control prevents, detects, corrects material misstatement in either classes of transactions, account balances, or disclosures
identifying internal controls relevant to financial reporting - accounting review and engagements SSARS (preparation, compilation, review)
preparation - does not require the accountant to be independent. The accountant is not required to verify the accuracy or completeness of the information provided by management or otherwise gather evidence to express an opinion or conclusion on the financial statements.
compilation engagement is a no‐assurance engagement. There is no expectation that the accountant would obtain an understanding of internal control in this type of engagement. The accountant only needs to be able to have competence and capabilities to read the financial statements for obvious departures from the applicable financial reporting framework.
review engagement provides limited assurance. There is no requirement in a review to obtain a specific understanding of the design of internal controls
IT general controls apply when?
apply to all aspects of IT function BEFORE TRANSACTIONS ARE PROCESSED (vs. application controls that operate at the process level and apply to processing transactions)
outside controls that provide protection for applications and mitigate:
risk of system crash
risk of unauthorized processing
risk of unauthorized master file updating
risk of unauthorized change to application software
IT general controls - 6 types
1) admin of IT function (tone at the top, control environment)
2) segregation of duties
3) system development (segregation of roles)
4) physical and online security
5) backup and contingency planning
6) hardware controls (to detect system failure)
IT general controls - system development (ARC segregation of duties can protect you from a “flood” of problems)
System development (purchase and/or develop/test software) (“authorization”)
system analysts - architect designs system
programmers - create/write the program, document it (cannot be user of system - violation of segregation of duties)
Operations (“recording/record keeping”)
Librarian - program moves from programmer to librarian , who controls the use of the program and does not release it back to the programmers when they need to make changes
network administrator - maintains network, supports all users using network
computer operators - import data into the computer system
Data control (“custody”)
database admin - “hold keys”, super user logins and all data for company (cannot have access to operations or system development - violation of segregation of duties)
IT application controls (what are they and what do the controls surround?)
Application controls - **controls that surround the applications themselves **
designed for each software specifically
manual or automated controls - input, processing, and output controls
IT application controls - INPUT CONTROL
info entered correctly: check digit, pull down list, validity check, limit test
IT application controls - PROCESSING CONTROL
data processed correctly: sequence test, validation test, data reasonableness test, completeness test
IT application controls - OUTPUT CONTROL
detect errors after processing data: reconcilement, review for reasonableness by knowledgeable employees
Preventative controls
qualified personnel, adequate training
segregating duties to prevent fraud
controlling physical access and system access (key cards, passwords, biometrics)
Detective controls
QC
reconcilement
Corrective controls
backup copies
procedures to correct errors
DR plan
computer emergency response team (CERT) to react to security breaches and take corrective action timely
-determine problem exists
-contain the problem quickly to minimize damage
-identify why problem occurred
-repair damage and correct problem (restore backup, reinstall corrupted program)
-determine prevention in future
-determine whether to prosecute perpetrator
SOC 1 vs SOC 2 reports (implications of using a 3rd party service provider)
SOC 1 report addresses internal controls over financial reporting, the SOC 2 report focuses on operational and compliance controls
Type 1 report provides a report of procedures / controls an organization has put in place as of a point in time.
Type 2 report has an audit period and provides evidence of how an organization operated its controls over a period of time.
limitations of controls
human judgment, human failures
lack of understanding of purpose of control
collusion
mgmt override**mitigation/detection: examine JEs and other adjusting entries for evidence of possible misstatement due to fraud; review accounting estimates for biases that could result in misstatement due to fraud; evaluate business rationale for significant unusual transactions
segregation of duties not possible due to small number of employees
fraud triangle
opportunity
pressure (earnings)
rationalization
assessing fraud on other types of engagements (SSARS - compilation, review)
Compilation engagements provide no assurance. There is no responsibility on the part of the practitioner to perform any procedures to identify or respond to fraud risk.
Review engagements provide limited assurance. Inquiry, analytics, and other procedures are designed and performed to provide limited assurance, which is substantially less than the reasonable assurance expressed in an audit.
Discuss with appropriate parties; ask they bring in legal or regulatory, obtain legal advice, communicate with regulator
In a review, if the accountant becomes aware of any actual, suspected, or alleged fraud or noncompliance with laws or regulations affecting the subject matter, the accountant should communicate (either written or oral) the matter as soon as practicable to the appropriate level of management
assessing fraud on other types of engagements (SSAE/attestation - AUP, review of anything not historical FS, examination)
attestation engagement - Examination engagements require an assessment of attestation risk, similar to financial statement audits, to provide reasonable assurance whether any material modifications should be made to the underlying subject matter in order for it to be in conformity with stated criteria.
In both examination and review engagements, the accountant should make inquiries of appropriate parties to determine whether they have knowledge of any actual, suspected, or alleged fraud
In an agreed‐upon procedures engagement, the design of procedures is the responsibility of the specified party(ies). Those procedures may or may not include fraud‐related procedures.
assessing risk of material misstatement - risk assessment procedures
Risk assessment procedures:
1) inquiries of mgmt
2) analytical procedures
3) observation and inspection
assessing risk of material misstatement - risk assessment procedures - analytical procedures
analytical procedures applied at two phases of all audits:
1) initial planning stages to help plan nature, timing, extent
2) overall review of financial information in the final review stage of audit
analytical procedures should focus on:
1) enhancing auditor’s understanding of client’s business and transactions and events that have occurred since last audit
2) identify areas that represent specific risks relevant to audit
identify unusual transactions, amounts, events
auditor should develop expectations of relationships reasonably expected to exist
assessing risk of material misstatement - risk assessment procedures - observation and inspection
observation of entity activities and operations
inspection of documents, records
reading mgmt reports
physical observation of premises
auditor should remain alert when inspecting records or documents for arrangements or other information that may indicate the existence of related party relationships or transactions that management has not previously identified or disclosed to the auditor (bank and legal confirmations, BOD/AC meeting minutes)
3 relevant assertion items TAP
Transactions
Account Balances
Presentation and Disclosure
Assertions: COVERU
Completeness
Offs (cut)
Valuation, allocation, & accuracy
Existence & Occurrence
Rights and Obligations
Understandability & Classification