i-75 con't Flashcards
compilation paragraph in the report
-“management is responsible for the accompanying financial statements of x….”
-“we performed the compilation engagement in accordance with SSARS”
-“we did not audit or review the financial statements nor was required to perform any procedures…”
-“we do not express an opinion, a conclusion, nor provide any form of assurance on these financial statements”
who is a compilation engagement for?
non issuers
objective of a compilation
according to SSARS, the objective of a compilation is to apply accounting and financial report expertise to assist management in the presentation of financial statements and to report without attempting to provide any assurance that there are no material modifications that should be made to the financial statements in order for them to be in accordance with the framework
compilation of financial statements
-management of the company provides financial information the CPA puts into the form of financial statements
-engagement letter is mandatory but no management rep letter needed
-no real testing is done, no inquiries, no analytical procedures, and no assurance is provided by the CPA
-lowest level of work, independence is not required
compilation engagements - independence not required
-since no assurance is being provided, the CPA does not have to be independent of the reporting company
-however, if not independent, that fact must be disclosed
-footnotes can be left off entirely as long as that is not done to mislead the readers of the statements
-if footnotes are omitted, report must so indicate with an extra paragraph
-if not independent, the reason for lack of independence need not be given, but if given, all reasons for lack of independence must be disclosed
compilation engagement - required procedures
-CPA must know enough about the company, and the industry in which the client operates, to know the appropriate form of the financial statements and accounting principles
-CPA must read the financial statements and verify the math but no analytical procedures and no inquiries
-each page of the financial statements must be stamped “see accountant’s compilation report”
compilation engagement - “see accountant’s compilation report”
-each page of financial statements need to be marked
-SSARS does not require that the compilation report be printed on accountants letterhead
-signature of accountant or firm may be manual, printed or digital
-sep paragraphs may be used to emphasize any matter already discussed in the financial statements, such as going concern issues or sep events
compilation - special purpose framework - OCBOA
including an additional paragraph that:
-references management’s responsibility for determining the applicable financial reporting framework that is acceptable
-refer to a footnote in the financial statements (if the notes are included) that explains the basis of accounting and state that the special purpose framework is a basis of accounting other than GAAP
compilation - reporting on financial statements that omit all disclosures
-similar to a preparation engagement, if requested by the client, accountant may compile financial statements without disclosures provided the financials are otherwise in conformity with the framework
-the accountant may compile these statements provided, to the accountant’s knowledge, the omission is not intended to mislead any person who might be expected to use such financial statements
-accountants report clearly indicates the omission of footnotes by including an additional paragraph disclosing such omission
-this paragraph should state that if disclosures were included they might influence the users conclusions and should indicate that the financial statements are not designed for those who are uninformed about such omitted disclosures
date of compilation report
-date of the completion of the compilation
-date we type the report
compilation - going concern and sub events
-if an accountant becomes aware that there is a going concern uncertainty or that a sub event has occurred or there is noncompliance with laws and regs, they should request management to consider the effects on the financial statements, evaluate management conclusions and consider the effect of the matter on the compilation report
preparation of financial statements
-non attest service which the practitioner can perform as long as they are not also performing a review, compilation or audit on the same financial statements for the same period
-an engagement letter is required
-no assurance provided
-not subject to peer review if a prep engagement is the only type of engagement performed by a practitioner
-does not require a determination of whether the CPA is independent
preparation of financial statements - do you need a report?
-no report required
-does require a footer on each page of the financial statements that reads “no assurance is provided”
-prepared financial statements could then be distributed to the client or third party without a report
preparation of financial statements - requirements
-CPA must obtain knowledge and understanding of the entity’s reporting framework and significant accounting policies intended to be used in the prep of the financial statements
-as with other engagements, accountants can accept the engagement and then gain the knowledge
-prepare the financial statements using the records, documents, explanations and other info provided by management
-SSARS standards still apply
IT general controls - lack of audit trail
-paper audit trails are reduced in a computerized environment
-if a client processes most of its financial data in electronic form, without any paper documentation, audit tests should be performed on a continuous basis
-computer systems should be designed to supply electronic audit trails which are often as effective as paper trails
IT general controls - substantive testing not enough
-in an IT system, when there is no paperwork, substantive testing alone may not be sufficient
-an auditor would also have to do control testing several times during the year, to ensure that controls are in effect to prevent, deter and detect errors as they happen
IT general controls - increased errors and irregularities
-a disadvantage of IT is the opportunity for remote access to data in networked environments increases the likelihood of unauthorized access
-specific controls should exist to ensure that users can only access and update authorized data elements
IT general controls - breaches of security
-if system security is breached, the potential for damage is much greater than in a manual system
-computer disruptions may cause delay in recording transactions
IT general controls - decreased human involvement
-decreased human involvement in transaction processing results in decreased opportunities for observation
-errors or fraud may occur in the design
IT general controls - positives
-a computerized process treats similar transactions in the same way
-as a result, there is a focus on the accuracy of the programming process
-transactions processed similarly by the computer should result in less random error and as a result, accuracy is an advantage of a computerized process
-also in a computerized environment, there is more opportunity for data analysis and review, including integration of audit procedures in the application program themselves
-more opportunities to perform analytical procedures in a computerized environment than in a manual environment
-the use of computerized files should make it easier to update and reconcile the file
-as a result, it will be easier to compare recorded accountability with the physical count of the assets
IT general controls - definition
-system wide, pervasive controls over the IT system as a whole
-designed to ensure that an org’s IT control environment is stable
-if an auditor finds poor general controls, that casts a shadow of doubt over all the various systems; an auditor would then wonder if any computer generated report is reliable
-the auditor always starts by looking at the entity’s general controls, then moves on to application controls
controls over:
-access to data center and network operations
-systems software acquisitions, change and maintenance
-segregation of duties performed by analysts, programmers and operators
IT general controls - segregation of duty roles
-chief info officer (CIO): reports to CEO and oversees the IT department; accountable for the orgs hardware and software operations both existing as well as future systems
-application development: safeguard the applications that are being developed. applications development will create the application and maintain the application. the new application is created (code is written) in a test environment rather than. alive environment so that the existing application cannot be corrupted while the new application is being developed. once the new application program is created and tested and approved, once its ready to go live, its moved from the test to a live environment
-systems analyst (under application development)
-application programmer (under application development): writes the new application (code) in the test environment
-system administration and programming: operating
-computer operations
IT general controls - systems analyst
-systems analyst (under application development): analyzes and designs new applications and they lead teams of application programmers who complete the actual coding
-talk to end users about what the end user needs are in any new application and how to meet those needs; in this way, the systems analyst is a bridge between application programmer and end user
-if internally developed system, program built from scratch, the system analyst designs the overall application system and determines the type of network needed to support the system
-the analyst needs to provide documentation of the technical specifications of the new system; this is especially important if the analyst leaves the computer before the completion of the new application
-if the application program is purchased, the analyst role is a little different. the analyst installs the purchased application system and makes sure that the new system can talk to the existing system and the analyst can then provide training
IT general controls - application programmer
-a computer programmer is also known as an application programmer or software engineer or software developer, being responsible for writing or maintaining application programs
-if we designed our own application program, it’s the application programmer whose responsible for ensuring that it keeps working as it should and if we need to make changes or additions to the software, it’s the application programmer that would handle that
IT general controls - systems administration and programming
-this department maintains the computing infrastructure and computer hardware and grants access to system resources
-roles: maintain operating system and related hardware, new releases of the operating system and also new hardware updates like driver updates, installing those updates
-the role of the programmer requires they be in direct contact with the production programs and data, it is imperative they not have access to info about application programs or data files
-administrators: include database administrators, network administrator (ensure that all application devices link to the orgs networks and that the networks operate securely and continuously; monitoring and troubleshooting), web administrator (operate and maintain t he web serves), help desk personnel (answer help line calls and emails, resolve user problems, and obtain technical support and vendor support when necessary). each are responsible for management activities associated with the system that they control. they each grant access to their system resources usually with usernames and passwords. system admins should not be permitted to participate directly in these systems operations
-administrator: security admin ensures that all components of the system are secure form threats both internal and external. responsibilities include security of software and systems and granting appropriate access to systems via user authentication, password setup and maintenance. the security admin decides how frequently passwords need to be changed etc
IT general controls - computer operations
-operator: data entry, operate the computer run the program, execute the transaction
-data control clerk: control document flow, ensure that sensitive data is only handled by appropriate parties, schedule batches for data entry and editing, reconcile control totals
-file librarian: check files in and out only as necessary to support scheduled jobs, no access to live operating equipment or live data unless the data has been checked into the library, if a librarian has access to live application programs they could make changes to both live and archive copies fo the program and this would be a security risk bc the changes they make may not be detected
IT general controls - strict segregation
-computer operators (data entry personnel) should never be allowed to act as application programmers or system admin
-system programmers should never have access to application program documentation
-data admins should never have access to computer operations (live data)
-application programmers and systems analysts should never have access to computer operations (live data)
-application programmers and systems analysts should not control access to data, programs or computer resources
IT application controls - definition
-concern the accuracy, validity and completeness of data processing in specific application programs
three categories:
-input and origination controls
-processing and file controls
-output controls
IT application controls - input and origination controls
-ensure that transactions entered into the system are valid, complete and accurate
-ex: automate data entry, removing the manual input of data, thus growing the use of the term origination control to replace input control
IT application controls - automated data capture (scanning)
-involves data origination with scanners rather than manual data entry
-scanning with bar codes allows for automated data origination and reduces errors associated with manual data input
-the goals of automated data capture and scanning include accuracy, completeness, and efficiency of data
IT application controls - closed loop verification (OLRT systems)
-input control used in OLRT systems where entered data is used to display additional confirming data
-such a entering a zip code and the city and the state are displayed to confirm
-a business application would involve entering a customer number and having the rest of the data displayed to confirm
-the confirming data is already in the record and serves as an input control
-goals include efficiency, accuracy and completeness
IT application controls - control totals
-input application controls that where comparisons are made to verify that all of the data were input properly
-financial control totals involve dollar amounts
-non financial control totals do not involve dollar amounts, but has a record count or hash total
-used in batch processing (not online real time), group transactions, and sets them aside until its appropriate to go ahead and process those transactions
-some batch totals are financial, some non financial
IT application controls - input key verification
-re keying or the re entering of critical data
-when changing passwords, entering the new password a section time is an example
IT application controls - logic checks
-certain computer edit routines that function as a control to signal when erroneous data have been input into a system
-several types: limit tests, field and validity checks, missing data checks, and check digits
IT application controls - logic checks –> limit tests
-ensure that a numeric field does not excess a specified value
-there are some variations like range test and sign test
-range test goal: catch obvious data entry errors, test validity and accuracy
-sign test: numbers have to be of a certain sign/quality
IT application controls - logic check –> missing data check
-try to navigate from one data screen to another but you are prevented from going further because you didn’t enter all the required data on the screen you are on but you think you have it filled in until you see the pop upIT application controls
IT application controls - logic check –> field check
-ensures that the data entered into the field is the correct type
-alphabetic for names, numeric for zip code or SS
-used to make sure that the data entered in the correct number of characters
IT application controls - validity test
-compares the value entered in a field to a list of valid data values
-also known as valid code test
-important control to prevent the creation of fakes entities such as fake customers, fake employees, fake vendors
-ensures that each account code entered into the system is a valid code
IT application controls - check digit
-arithmetic manipulation of a numerical field that captures the info content of that field and then gets tacked onto the end of that numeric field, like a customer account
-designed to ensure that each account code entered into the system is both valid and correct
IT application controls - pre printed forms and pre formatted screens
-speed data entry and reduce errors
-if the input involves entering checks and the screen is pre formatted to already resemble a check, the data entry should be faster and should result in less errors
IT application controls - default values
-pre supplied data values within fields wherever possible such as today’s date already the default date for the check or for the sales order
-goal is efficiency and accuracy
IT application controls - batch processing
-transactions are inputted, set aside, then similar transactions are grouped together in batches in order to be processed the same way which increases speed of processing
-transactions with no errors are processed and transactions with errors are detected and rejected
-disadvantage is the time delay between data input and data processing
IT application controls - on line real time (OLRT) processing
-more common now then batch processing
-the minute the transaction happens, the master files are brought up to date
-used when transactions are high volume and allows for better customer service
IT application controls - processing controls
-ensure the master file is updated with accurate and complete data
IT application controls - processing controls –> logic test
-there may be certain logic checks with regard to processing time, where there is an upper limit on how much CPU time can be dedicated to the processing of any transaction
-if more time is needed for processing than what is allowed, the system is designed to flag the error as a time out
IT application controls - processing controls –> internal and external labels
-labels on removable storage that are read by computer system
-used primarily in batch processing
-on a thumb drive, an internal label would be attached as an indicator and the system would read it as protected data that should not be changed
-read only by the system and not by humans, allowing the update program to determine that the correct file is being used for the update process
-also known as electronic file identification
-external label: labels on removable storage that are readable by humans
IT application controls - processing controls –> checkpoint/restart controls
-should a program crash in the mist of a long processing application, these controls allow for various places along the processing to be a good re start without going all the way back to the beginning before resuming the processing
IT application controls - audit trail controls with transaction logs
-in an OLRT system, each transaction is written to a transaction log as the transaction is processed
-the transaction logs become an electronic audit trail allowing the transaction to be traced through each stage of processing
-electronic transaction logs constitute the principal audit trail for OLRT
-processing goals of transaction logs include accuracy, completeness, and validity of processing
-transaction logs are also important to an OLRT backup and recovery process
-having a transaction log will enable a system to determine where the data needs to be re processed
-if something went wrong in the master file, the last good transaction that was processed becomes the starting point for the bad transactions that need to be re processed
-a transaction log is vital for backup and recovery of OLRT since there is no paper trail
IT application controls - output control examples
-logic check
-upper limit on printing time
-upper limit on the number of pages allowed to be printed
IT application controls - hardware controls –> parity check
-a parity check/bit is an example of a self checking digit
-a digit is added to a string of numbers as a control to confirm that previous numbers are correct
-purpose of a check digit is to confirm that the previous numbers are correct, and are common in numeric recording systems
IT application controls - hardware control –> echo check
-verifies that transmission between devices is accurate by echoing back the received transmission from the receiving device, back to the sending unit
-sending data back for comparison with data originally sent is the verification control
IT application controls - hardware control –> read after write check
-verifies that data was correctly written to desk
-would be used for critical applications where the concern is data quality and integrity
-the data is written to a disk or to somewhere in the cloud, and then we re read the data and do a confirmation that exactly the same data was written as was originally read
-good control to make sure the disk or the device we are writing to has not been corrupted
computer assisted audit techniques - test data
-used by an independent auditor to test a client’s IT controls to see if those controls were working during the period under audit
-with test data, an auditor might request payroll checks for people with valid and also invalid employee numbers to determine how such transactions are handled by the client’s system
-auditor knows in advance how the results should be –> the client’s payroll system should process the payroll for those entries that contained valid employee numbers and the system should reject the request for the period with an invalid employee number
-the client’s system is offline at the time the test data is run but there is a risk
computer assisted audit techniques - challenges with test data
-even though the client’s system is offline, the auditor did request a check for a valid employee and that request should have been processed by the system, the challenge is that the auditor must make sure that the test data is not later included with the client’s payroll records, must be reversed out
-client is not running live payroll at the time of test but the records that are processed during the test data, if they are not reversed out, will become part of the permanent payroll record
-time consuming –> test data programs need to be tailor made by the auditor for each client’s computer applications
-special test data to test the payroll program and different test data to test the AP etc
-the auditor needs to determine that the application program tested was actually used by the client during the period to process data since the client is not using the system while we are performing test data, when was the last time they did use the system
computer assisted audit techniques - not all invalid conditions need to be tested for test data
-the auditor requested a check for an invalid employee
-another use of test data would be the auditor requesting two paychecks for the same employee
-if functioning properly, the payroll program should handle this error and not process the two paychecks but print out an error report
-this error report should go to the control team for follow up before processing will continue
-note that the auditor need not test for all invalid conditions, just one valid and one invalid
computer assisted audit techniques - integrated test facility
-similar to test data approach except that the test data is integrated into a system in the midst of live transactions
-test data can be introduced while the client is processing payroll usually bc the client’s system has created a hypothetical dummy database specifically for the test data to be run while live transactions are being processed
-test data is initially commingled with live data, so the challenge is to make sure that the test data is being fed into the dummy database and doesn’t corrupt the real files
-client operating personnel are usually unaware of the testing process
computer assisted audit technique - parallel simulation
-programs can be specifically developed for the application, bought as a packaged program or utility or produced by a generalized audit software package (GASP)
-auditor will re process the client’s actual data using the auditor’s own GASP
-software purchased or developed by the auditor should be able to obtain the same results as the client’s computer program
-the auditor then compares their results to those results obtained by the client’s computer
computer assisted audit techniques - limitations of parallel simulation
-time it takes to build an exact duplicate of the client’s system
-there could be incompatibility between the two systems and tracing any differences in the two sets of output back to the differences in the program may be difficult
computer assisted audit technique - generalized audit software packages (GASP)
-reconciling data from two sep files
-recalculating amounts and totals and selecting items for testing that meets certain criteria
-can be used to sort data in ascending or descending order, summarize data by customer account number, and make file comparisons of payroll details with personnel records
-allows an auditor to sample and test a much higher percentage of transactions which results in a more reliable audit
-require little or no technical knowledge about the client’s hardware or software features
-allow for reduction of audit time after initial use
computer assisted audit technique - customized audit software
-programs specifically written to access the files of a particular client
-disadvantage: they can only be used for a particular client where GASP cost may be amortized over many clients
limitations of computer assisted audit techniques
can’t replace human judgment
computer assisted audit technique - embedded audit module
-for systems that don’t have a permanent audit trail
-require that any audit take place while processing takes place
-routines that are built into the application program to perform an ongoing audit function
-built into the client’s application program when the program is being developed (with auditor participation) for use in ensuring that controls are operating effectively
-sections of an application program code that collect transaction data for the auditor
-allow the auditor to capture specific data as transactions are being processed
advantages and disadvantages of automated controls
-benefit: enhanced timeliness of info
-computer controls are appropriate for processing normal recurring transactions, high volume
-manual controls are more appropriate for the processing of unusual or nonrecurring transactions
-disadvantage: automated controls include the potential loss of data and the recording of unauthorized transactions
sampling - basic definition with sample size
-goal of a sample is to select enough items so that the sample is representative of the population
-knowing when does the same size have to be increased and when can the auditor get away with a smaller sample size is key to understand
sampling - evaluating the sample
-after a sample has been selected and analyzed, the auditor must evaluate the population based on the results of the sample
-based on the errors found in the auditor’s sample, is the control activity strong or week?
-is the client’s balance substantiated?
sampling for attributes definition
-auditor is testing controls hoping that the control passes the auditor’s test and control risk can be lowered
-done in internal control stage
-results in less substantive testing if control risk can be lowered
sampling for variables definition
-auditor is testing account balances looking for overstatement or understatement
-substantive testing
-where the auditor is sampling in order to substantiate appropriate dollar amounts
step 1 in determining the sample size - anticipate the actual error rate in the population
-in sampling for attributes, the auditor first specifies the problem being estimated and anticipates the actual error (or deviation rate)
-the auditor’s expected error rate is based on the difficulty of the task and how well the employees understood their role
sample size - changing the expected error rate
as the expected error rate rises, the sample size must be increased
step 2 in determining the sample size - tolerable deviation rate
-after the expected error rate has been anticipated, the auditor sets the highest error rate that could be present before the auditor would feel that the control activity was not reliable
-setting a limit for the tolerable error rate is based on auditor’s professional judgment
-for very significant controls, this rate will be low
-for less important controls, the auditor can afford for the rate to be higher
setting the tolerable rate
-the importance of the activity as well as the possible presence of other controls will both influence the auditor’s tolerable deviation (or error) rate
-as the tolerable deviation rate rises, the required sample size will decrease
step 3 in determining sample size - the allowable level of sampling risk
-in sampling, there’s always some chance that the sample will be misleading
-the auditor establishes how much risk is allowable that a sample will be different from the population
-auditor sets a limit for how reliable the sample needs to be, which is the confidence level
-the auditor doesn’t look at every item so in the end of the sample, it may not be representative of the total population
allowable level of sampling risk example
-if 10% is viewed as the allowable level of sampling risk, that means that the auditor is okay being just 90% confident that the sample is reliable and actually represents the population
-the auditor can never be 100% confident that the sample represents the population because the auditor is not examining everything
-as the auditor wants to reduce the allowable level, let’s say to 5%, the need for reliability increases to 95% –> so the number of items needed for a representative sample will increase
sample size - 3 factors summed up –> based on auditor’s professional judgment
- auditor estimates actual error rate
- auditor sets limit for tolerable error rate
- auditor sets limit for allowable level of risk that sample is not presentative of the population
choosing the sample size
-after the actual error rate is estimated, and after the tolerable deviation rate is set, and after the allowance for sampling risk is set, the actual number of items in the sample can now be determined
-the actual number of items in the total population is not a factor in determining the sample size in sampling for attributes
-use a chart or a formula (the chart would have to be provided)
upper deviation rate
-wants to know how high the population error rate could be based on knowledge of the sample error rate (ex: 4 out of a 150 sample having errors)
-a chart is used to determine the highest expected rate for the population
-for example, a sample error rate (which will never be the sample as the error rate in the pop) of 4/150 = 2.6%, which might indicate, based on the chart, an upper deviation rate of 6%
-represents to the auditor the population error rate, basked on knowledge of the sample error rate
-if the upper deviation rate > tolerable rate, that means there is too many errors in the population and it’s not reliable
final step in sampling - compare upper deviation rate to tolerable rate
-compare the upper deviation rate to the tolerable rate to see if the control is effective
-the difference between the two is the allowance for sampling risk or precision (subtract the two), representing the closeness of the auditor’s sample results to the true (but unknown) population error rate
-if the upper deviation > tolerable, that is ineffective –> there would be too many errors in the population based on the sample results, meaning out assessment of control risk cannot be lowered, the control is not to be relied on and as a result, more substantive testing is needed
risk of assessing control risk too low
-auditor’s biggest fear
-ex: if the upper deviation rate is 4.3 and the tolerable rate is 5, the auditor will likely view the control as reliable
-as a result of relying on the control, the auditor will likely lower the assessment of control risk and perform less substantive testing
-this would be fine if the auditor’s sample was truly a representation of the total population
-since only a sample was taken, there’s a risk that the auditor’s sample was not a proper representation of the population
-if the population contained way more errors than the sample indicated, the auditor may assess control risk too low and therefore do less substantive testing when more substantive testing may be needed
-assessing control risk too low may result in the auditor giving an unmodified opinion on the financials due to not performing enough substantive tests
-for this reason, assessing control risk too low relates to the effectiveness of the audit since the audit would be ineffective
risk of assessing control risk too high
-saying that internal controls are bad when they really aren’t
-this would result in more substantive testing than needed
-it’s better to assess too high than too low
-assessing control risk too high relates to efficiency
-it results in an inefficient audit because too much time is spend on additional substantive procedures
variable sampling and the effects of population and sample size
-the population size has a direct effect on the sample size
**reminder - in attribute sampling, the population size has no effect on the sample size
variable sampling - estimating variability
-must rely on a bigger sample when the variability is higher
-the auditor does not set the variability of the population but rather has to make an estimation of it
-if the standard deviation (formula will be used) is larger than expected, the sample size will have to be increased
variable sampling - finding and extending the average
-the correct number of items is selected and the average size is determined for the sample
-that average is then used for the population as a whole to arrive at a single point estimation for the entire population
-ex: if a sample of 80 checks indicates an average of $90, then 100,000 checks would be estimated at a total of $9M
variable sampling - estimating the population misstatement
-the difference between the point estimation of the population and the client’s reported figure is the auditor’s estimation of the amount of misstatement in the population
-if the estimation is $9M and the actual client figure is $9.1M, then a $100,000 misstatement is projected
variable sampling - evaluating the projected misstatement
-if the estimated misstatement in the client figure is smaller than the auditor’s tolerable amount of misstatement, the test is viewed as supporting the client figure and less other testing is needed
-if the estimated misstatement is larger than the auditor’s tolerable amount of misstatement, the test did not support the client figure and more additional testing is required
variable sampling - mean per unit (MPU) estimation
-uses the average value of the items in the sample to estimate the true population value
-ex: if $250 if the average value times 2000 items in the population, the point estimate is $500,000; which is the average value of $250 per item projected onto the population of 2000 customer balances
-bell shaped curve is common with this
-use when perpetual records do not exist
-more sensitive to variability in the population, making the auditor stratify or divide the population into relatively similar groups
variable sampling - ratio estimation sampling
-take the ratio of the sample’s true value, to the client’s book value of the sample
-requires a smaller sample size than MPU
-only effective when the dollar amount of the differences between audit and book values is expected to be proportional to the book value
variable sampling - difference estimation
-focus is on how much of a mistake was made
-requires a smaller sample size than MPU
-only effective when the auditor expects large numbers of under and over statements
variable sampling - larger sample sizes
result from:
-a larger expected amount of misstatements
-a smaller tolerable amount of misstatements
-a reduction in the allowable amount of sampling risk
-a higher amount of variability in the population
variable sampling - alternatives to reduce sample size –> stratification
-auditor is always looking to reduce sample size whenever possible
-auditor separates out the largest and smallest items to test them sep; the remaining items have a much smaller amount of variability and hence, a smaller sample is needed
-each group is treated as a sep population
variable sampling - alternatives to reduce sample size –> probability proportional to size sampling (PPS)
-the auditor picks individual dollars from the population rather than individual units
-larger dollar items have automatically a better chance of being selected
-this method increases the chance that bigger items (with potentially bigger errors) will be used in the sample
-stratification occurs nationally here, so variability is not a factor that the auditor must consider and the sample size is usually smaller than other sampling methods, which is considered an advantage of PPS over classical variable sampling
-useful to test for overstatement of receivables, existence assertion; not good for understatement and completeness
-negatives to PPS: zero balances, negative balances and understated balances require special design consideration because PPS is designed to test larger items
-useful when the auditor expects a low error rate
-also called dollar unit sampling
-advantages: smaller sample sizes and efficiency
variable sampling - PPS formula
-(reliability factor (most likely from a table)*population book value)/tolerable misstatement
-usually selected using systematic selection with a random start and then a specified sampling interval (every 90th dollar item is sampled, for ex)
-sampling interval = book value of pop / sample size
-sample size is based off of: population book value (AR book value), tolerable misstatement (net of any expected misstatements), and confidence (risk of incorrect acceptance, allowable level of sampling risk, confidence itself)
variable sampling - evaluation of a PPS sample
-for items having a book value, greater than or equal to the sampling interval, the projected misstatement is the actual misstatement in the sample item (no further projection)
-for items having a book value less than the sampling interval, the auditor would have to apply the tainting percentage, to the sample interval from which that account was selected
variable sampling - PPS disadvantages
-accounts with zero balances and negative balances have no chance of being selected so the auditor must make special arrangements to test them because the accounts with zero balance may be understated due to error or fraud
risk of incorrect acceptance
-with substantive testing, the auditor is trying to prove a dollar amount
-in sampling for variables, there is a risk that the sample may not be representative of the population (sampling risk)
-if the auditor’s sample looks good, few errors are found, the auditor would likely reach the conclusion that the account balance is fairly stated in all material respects
-if the sample was misleading, not a true rep of the population, the auditor would have incorrectly accepted
-tests effectivenss
risk of incorrect rejection
-in sampling for variables, there is a risk that the sample may not be representative of the pop (sampling risk)
-if the auditors sample looks bad, many errors in the sample, the auditor would probably reject the account balance as fairly stated in all material respects
-if the sample was misleading, not a true rep of the pop, the auditor would have incorrectly rejected
-tests efficiency, because more substantive testing than needed would be performed
inventory turnover
-COGS/avg inventory
-measures of the effectiveness of an entity’s inventory management
-higher is better
days in inventory
-ending inventory/(COGS/365)
-inventory conversion period measures to degree to which resources have been devoted to inventory to support sales
-lower is better because inventory is converted quickly
AR turnover
-net credit sales/avg receivables
-measures the number of times receivables are collected in one year
-higher is better
days sales in AR
-ending AR/(sales/365)
-lower is better because receivables are converted quickly into cash
operating cycle
-the time it takes to convert inventory into sales (receivables) and those same receivables into cash
-can be determined by taking the receivables collection period (lower is better) and adding the inventory conversion period (lower is better)
cash conversion cycle
-“net operating cycle”
-inventory + AR - AP
-aka, days to sell + days to collect - days to pay vendor
AP turnover
-COGS/avg AP
-lower is better
days in AP
-ending AP/(COGS/365)
-higher is better
-defer payment as long as you can
liquidity
-ability to pay short term obligations as they become due
working capital
-current assets minus current liabilities
-absolute value and measures the ability of a firm to meet short term obligations as they become due
-ex: if current assets are 100 and current liabilities are 60, WC is 40; the working capital ratio is 100/60 or $1.67:1
-that means there are 1.67 of current assets for every $1 of current liabilities
-WC will be positive when there are more current assets then liabilities, and that’s good unless the bank requires something else
ratio analysis
-development of quantitative relationships between various elements of a firm’s financial statements
-enables comparisons of firms of different sizes
liquidity solvency ratios
-measures a firm’s ability to meet its short and long term obligations
-current ratio & quick ratio
current ratio
CA/CL
quick ratio
(cash & cash equivalents + ST securities + receivables (net)) / CL
operational and efficiency ratios
-measure the efficiency of operations
-like sales in the numerator or COGS in turnover ratios
profitability ratios
measures operational results like NI in the numerator
leverage/equity ratios
-measures the magnitude of debt in the capital structure of the entity
-the more of the assets that are financed by debt, the more risk but the greater potential return
current ratio vs quick ratio
-a high current ratio, current assets relative to current liabilities seems great but might not tell the real story
-there could be some trouble behind the scenes that the CR actually hides and therefore a better indication of liquidity rather the CR might be the quick ratio or acid test, which uses the most liquid assets in the numerator
-the result of the quick ratio or acid test ratio is expected to be lower compared to the CR because not all CA are used in the numerator of the acid test ratio, but all CL are used in the denominator
acid test ratio
-uses only the most liquid CA –> cash, AR, marketable ST securities
-the CA not considered liquid enough to be in the quick ratio are inventory and prepaid expenses bc if a firm was to need cash immediately, creditors don’t want the debtor’s inventory in satisfaction of the debt
common size balance sheet
-covering a point in time
-can compare two companies of different sizes by using total assets as the base
-divide each item on the BS by total assets and that way you can compare
-you can then compare each item on the BS relative to the TA value
-size of the company becomes irrelevant
common size income statement
-covering a period of time
-usually the basis that’s used is sales
times interest earned ratio
-another measure of liquidity/solvency
-measure of a firm’s ability to meet current interest expense given the current level of earnings
-NI + int exp + inc tax exp / int exp
-numerator is EBIT/int exp
-measures if current earnings can cover the firm’s interest cost for the period, and banks would be concerned with the debtor’s ability to pay interest on the borrowed funds
activity ratios
-more operational
-measure efficiency, like the turnovers
return vs turnover
-return = have NI in the numerator and measure profitability
-turnover = does not measure profitability and therefore will not feature NI but rather sales or COGS in the numerator, measuring efficiency
return on assets
NI / total assets
return on equity
NI / total equity
transaction effects on ratios
-if the numerator increases, the ratio increases
-if the numerator goes down, the ratio falls
-if the denominator falls, the ratio increases
-if the denominator increases, the ratio decreases
comparative statements
-financial statements are being reported for last year and this year
-the report date for the audit of the most recent financial statements is used
-the auditor updates the auditor report on the financial statements previously issued
-update can mean reaffirm the previous year’s opinion or it can mean change the original opinion as a result of changed conditions or info coming to the auditor’s attention during the CY engagement
comparative statements - different auditors
-a reporting company will occasionally change independent auditors
-if comparative statements are presented, the predecessor auditor may have reported on the previous statements while the successor has audited the current statements
comparative statements - both audit reports shown
-when different statements are reported that had different auditors, the reporting company can decide that both reports should be attached
-if previous auditor is asked to allow the reprinting of the earlier opinion, certain actions must be taken by the previous auditor before permission can be granted
-predecessor should obtain a rep letter from management at or near the date of re issuance to help ensure that no new info indicates the presence of misstatements in the old statements
-ask management if they are aware of anything that you, the old auditor, missed, whether any of the previous management representations need to be modified and whether there have been any subsequent events requiring adjustments to or disclose in the financial statements
-predecessor auditor should obtain a rep letter from the successor auditor stating that no new info has been found by the successor which indicates the presence of MM in the previous year’s financial statements
-old auditor doesn’t review evidence gathered by the new auditor that relates to the new year
comparative statements - is last year’s report still appropriate?
-predecessor auditors may reissue their report on financial statements as long as the report is still appropriate
-however, the current presentation of the prior period statements or the occurrence of subsequent events may make the previous report inappropriate
-in deciding whether to reissue their report, the predecessor auditor’s should: read the old statements being distributed to make certain that they have not been changed and read the new statements to make sure there are no inconsistencies that might signal misstatements in the old statements
comparative statements - dates of reissued report (unrevised)
-if the old auditor’s report is unrevised, use the original report date in any reissue of the previous report, since the predecessor auditor had limited knowledge of the former client’s current status
comparative statements - dates of reissued report (revised)
-if the auditor reissues the audit report at the client’s request, the auditor should use the original report date on the reissued report
-only if the original audit report is revised, would the auditor dual date the report
-use of a subsequent date implies that the auditor has done additional work beyond last year’s audit
comparative statements - only current audit report shown
-when a successor auditor does not present the predecessor auditor’s report, the successor auditor should express an opinion on the current period financial statements only and indicate in an OM paragraph that the financial statements of the prior period were audited by a predecessor auditor
-the predecessor auditor should not be named unless the practice of the predecessor was acquired or merged with the successor
comparative statements - OM paragraph when PY audit report is not shown
-the type of opinion expressed by the predecessor auditor is shown
-if the opinion was modified, the reasons for the modification are given
-the successor auditor indicates the nature of any additional paragraphs like any emphasis or Om paragraphs included in last year’s report
-the date of the predecessor auditor’s report (date of last year’s report) is in the current report
-even if the predecessor’s opinion was unmodified, still need an OM para in this year’s report to show last year’s opinion
-predecessor auditor is not named
