Internal Control Flashcards

1
Q

If Internal Control is poor and a company’s accounting practices are sloppy - which risk is higher?

A

Control risk increases with poor Internal Controls and sloppy accounting practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

If Internal Control is poor - what is the effect on the audit?

A

Auditor will need to perform more testing and dig deeper into accounts in order to arrive at an opinion regarding the financial statements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does Internal Control provide reasonable assurance for?

A

Internal control provides reasonable assurance that:

Material misstatements will be prevented or detected

Reliability/integrity of financial statements will be preserved

Assets are protected against misuse

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is required in an audit of Internal Control under Sarbanes-Oxley?

A

Management must provide its assessment of Internal Control

auditor is required to audit internal control and express an opinion on the effectiveness of IC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the 3 objectives of Internal Control?

A

Reliability of Financial Reporting

Operational Efficiency/Effectiveness

Compliance with Law and Regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 5 components of Internal Control?

A

Control Activties

Risk Assessment

Information and Communication

Monitoring

Control Environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the purpose for a Control Environment assessment?

A

Sets tone for the entire company

Establishes the overall attitude, awareness and actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the components of the Control Environment?

A
Philisophy of Mgt
Humaran resources
Reporting capabilities/competencies
Authoirity and responsibility
Structure of the organization
Ethical values and integrity
Directors (Board of) participation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What happens when Control Risk is assessed to be at the maximum level?

A

Controls not operating effectively
RMM is increased
Internal Control not tested
Extensive substantive testing at year end

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What happens when Control Risk is below the maximum level?

A

Auditor tests Internal Controls.

Auditor evaluates Control Risk based on tests

Auditor adjusts substantive tests accordingly

Weaker Internal Control - More substantive tests

Stronger Internal Control - Less substantive tests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Describe some common examples of Control Activities.

A

Performance Reviews

Information Processing

Physical Controls

Segregation of Duties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What should an auditor understand with respect to Information and Communication on an audit?

A

How the company records, processes, summarizes, and reports financial data through:

  • effective information systems
  • identify and record all valid transactions
  • in the proper time period
  • at the proper amounts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How must an auditor document understanding of Internal Control?

A

Through written documentation such as Internal Control memos- flowcharts- and questionnaires

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the purpose of testing Internal Controls?

A

Auditor needs reasonable assurance that controls are functioning as designed and are effective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How often should controls be tested?

A

Controls should be tested at least every 3 years, if there have been no changes

If a control has changed from prior year, it should be tested in the current year audit

Controls mitigating significant risk should be tested annually

PCAOB does not permit rotational testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What happens if Internal Controls are deficient?

A

Control Risk increases

Scope of substantive procedures increases

Detection Risk decreases

Material Weakness - Reasonable possibility that a material misstatement in Financial Statements would not be found- more than a remote chance of occurrence

17
Q

What does Tracing test?

A

Tests Completeness

Starts with source document and traces forward to the journal entry.

18
Q

What does Vouching test?

A

Tests Existence.

Starts with a journal entry and searches for a voucher or source document to support the entry.

19
Q

What activities should be segregated?

A

authorization
bookkeeping
custody

20
Q

With respect to custody of assets - how should duties be segregated?

A

Employees who have custody of assets should not also RECORD those assets

Someone in charge of petty cash should not also control the petty cash records

Treasury Department (custodians) should NOT have record keeping duties

They control assets and should not be able to adjust any recording of those assets

21
Q

What are the limitations on internal control?

A

mistakes/human error/bad judgement

management override

collusion

22
Q

What is a Material Weakness?

A

a deficiency or combination of deficiencies such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis

a material weakness must be reported to the audit committee in writing

must continue to report until resolved

report if found, no need to actively search for

should be reported before report date release, but no later than 60 days after release date

can result in an adverse opinion (in a report on internal control)

23
Q

What is a Significant Deficiency?

A

a deficiency or combination of deficiencies less severe than a material weakness but important enough to merit attention by the audit committee (more than remote likelihood of material misstatement)

significant deficiencies must be reported to senior management in writing

must continue to report until resolved

report if found, no need to actively search for

should be reported before report date release, but no later than 60 days after release date

24
Q

What is a Control Deficiency?

A

the design or operation of a control does not allow the prevention or detection of a misstatement on a timely basis

25
Q

What must an auditor ask if using the work of third parties?

A

Are they competent?

Are they objective?

26
Q

What must an auditor understand with respect to internal auditors?

A

Auditor needs to understand the role of Internal Auditors within the organization because their work affects the audit plan

Responsibility for judgments about materiality or appropriateness of entries or estimates cannot be shared with third parties like Internal Auditors

Internal Auditors should be asked to do some of the legwork like preparing schedules or running reports

They should not be asked to make any decisions or judgments

27
Q

What is required in an examination of Internal Control under Sarbanes-Oxley?

A

CEO/CFO must disclose deficiencies

Management must provide assessment of Internal Controls

Management must certify Financial Statements

28
Q

What is the purpose of testing Internal Controls?

A

Auditor needs reasonable assurance that controls are functioning as designed and effective

Internal Control Testing should be strong as (IRON) so that nothing gets past them

Inquiry - Interview company personnel
Re-performance - Can it be replicated?
Observation - Watch the control be applied
INspection - Dig into the details/documents

If results are as expected - substantive procedures do not need to be adjusted

29
Q

What is the hierarchy of source docuemnts in the purchasing cycle?

A
purchase requisition
purchase order
receiving report
vendor invoice
voucher
check
purchasing journal
30
Q

What is the hierarchy of source docuemtns in the sales cycle?

A

sales oder
bill of lading
sales invoice
sales journal

31
Q

According to PCAOB, when will a control deficiency = significant deficiency?

A

weak controls over:

  • the selection and application of accounting principles that in conformity with gasp
  • anti fraud programs and controls
  • non routine and nonsystematic transactions
  • period-ending financial reporting process