Final Review Part II Flashcards
Planning an Audit
- industry knowledge
- business knowledge
- determine information technology on the audit
- tour facility
- determine the timing
- determine areas where there is a greater risk of material misstatement
Audit Strategy
- establish overall audit strategy
- preliminary assessment of materiality
- outlines the scope of engagement
- reporting objectives
- the timing of the audit
- required communications
can be modified in responses to new info
Audit Plan
- must be written
- NET
- risk assessment procedures
- further audit procedures (test of controls and substantive procedures)
- other audit procedures
can be modified in responses to new info
After accepting the engagement (part of audit planning)
- recent trends occurring in the industry
- the risk of material misstatement surrounding various FS assertions
Not relevant information
client’s understanding as to the appropriate opinion on the current year’s FS
Internal Control
- provide assurance that an entity’s objectives will be achieved
- objectives: reliability of financial reporting/effectiveness and efficiency of operations/compliance with applicable laws and regulations
Internal Control = CRIME (Risk Assessment)
- management identifies, analyzes, and manages risks that affect the entity’s ability to accomplish its major objectives
- new products
- rapid growth
- other changes
Internal Control = CRIME (Information and Communication)
- all transactions are recorded and complete
- detailed enough to provide adequate financial reporting disclosures
- communication among management, employees, charged with governance, and external parties
Internal Control = CRIME (Monitoring)
- assess the quality of the internal control structure
- make necessary corrections
Internal Control = CRIME (Existing Control Activities)
- PAID TIPS
- prevent and detect the risk of lying, stealing, and cheating
SOC 1
addresses a company’s IC over financial reporting
SOC 2
examination of controls of a service organization over privacy, confidentially, processing integrity, availability, and security
Type 1
- design of control
- help the auditor understand the control
Type 2
- design of control and test of operating effectiveness
- help the auditor understand the control
- reduce the assessed level of control risk
Auditing around the computer = manual
- simple batch systems with a good audit trail
- risk = insufficient paper-based evidence and insufficient audit procedures
Auditing through the computer = CAAT
- transaction tagging
- embedded audit modules: collects transaction data for the auditor/auditor must be involved
- test data: the result is already known/invalid #/excess pay rate/excess hours
- integrated test facility: commingled with live data
- parallel simulation: audit reprocess data and compare the result with the client file
- generalized audit software packages: allow the auditor to perform tests of controls and substantive tests directly on the client’s system
Test data
processed by the client’s computer programs under the auditor’s control
Control risk assessment procedure
inquiry, inspect, observation, and reperformance
Understanding IC
- obtaining an understanding of IC
- determine whether IC has been implemented
allowed, not required = evaluate operating effectiveness of controls
Benefits - computerized environment (IT)
- improve consistency
- greater management supervision
Presumed Fraud Risk
- improper revenue recognition
- management override of controls
Audit procedures to address fraud risk
- discuss with appropriate people
- identify specific fraud
- assess fraud risk and develop an appropriate response
- document
- evaluate audit evidence regarding fraud
Fraud brainstorming session
- significant decisions reached
- how and when the discussion occurred
- audit team members who participated
Fraud
- error and fraud deserved the same amount of attention
- ineffective controls
- justification of fraudulent behavior
- existence of all 3 fraud risk factors is not an absolute indication that fraud has occurred
Obtaining an understanding of control
- evaluating the design of controls and determining whether they have been implemented
PCAOB: require the auditor to obtain an understanding of the company’s selection and application of accounting principles
Control Risk assessed below maximum
controls appear to be implemented
Risk assessment discussion
consideration of the risk of management override of controls
Inherent Risk
- new guidance
- hedge activities
- fixed asset
- entity keeps a large amount of cash on hand
- do not require to use estimates
Control Risk
- control
- a system not password protected
- supervisory oversight
Detection Risk
auditor plans/will obtain
Increase RMM
- internal auditor reports to top management rather than the audit committee
- ## turnover
Decrease RMM
- separate headquarter
Significant Risk
Inherent risk at high level
The overall response to increase in FS level risk
- increase the level of supervision
Materiality Definition
- the amount of error or omission that would affect the judgment of a reasonable person
(make a preliminary judgment) - specific amount
- qualitative and quantitative
- smallest level of misstatement
- XXX expected change in the economy XXX
- impacted by factors (FS benchmarks, final results, industry)
Tolerable Misstatement
- deals with sampling
- uncorrected and undetected misstatements goes up, tolerable misstatement goes down
Using the work of others
- consider their competence and objectivity
- systematic and disciplined approach (quality control policies and documented internal audit procedures)
Using the work of others - specialist
- complex and challenging issues
- auditor should review the work of the specialist
evaluate the adequacy
obtain knowledge of the specialist’s qualification
Competency and Objectivity
- discussion with management personnel
- external quality reviews of the internal auditor’s work
- previous experience with the internal auditor
Related Party Transactions
- disclosure in accordance with GAAP
Accounting Estimates
- appropriate practices are used to develop estimates
- reasonable
- GAAP
- properly disclosed
- management bears the responsibility for making reasonable estimates and including them in the FS
FV Measurements
- management is responsible for making FV measurements and disclosures in accordance with GAAP
