Internal Control Concepts and Standards

Question 1

What is the purpose of performing a walkthrough?

Answer 1

Obtain some feedback as to whether the way the auditor has understood (and documented) the entity’s internal controls is consistent with the way the entity is actually processing such transactions.

Question 2

Define transaction cycle.

Answer 2

A group of essentially homogeneous transactions, that is, transactions of the same basic type.

Question 3

List the disadvantages of narratives (memos) to document the auditor’s understanding of internal controls.

Answer 3

1. Writing such a memo is rather unstructured, lacking a systematic approach;
2. It may be rather easy to overlook relevant internal control issues.

Question 4

List the advantages of narratives (memos) to document the auditor’s understanding of internal controls.

Answer 4

1. Tailored to client;
2. Can be as detailed or as general as desired;
3. Easy to prepare;
4. Easy to read.

Question 5

List the disadvantages of Internal Control Questionnaires (ICQs) to document the auditor’s understanding of internal controls.

Answer 5

1. These are generic and not tailored to any client specifically;
2. Irrelevant questions may annoy clients;
3. Client might conceal deficiencies by incorrect answers.

Question 6

List the advantages of Internal Control Questionnaires (ICQs) to document the auditor’s understanding of internal controls.

Answer 6

1. Can have a standard form for many clients;
2. Deficiencies are easily indicated by “no” answers.

Question 7

List the disadvantages of flowcharts to document the auditor’s understanding of internal controls.

Answer 7

1. Tedious and time consuming to initially prepare;
2. Might fail to recognize deficiencies by getting overly absorbed in details.

Question 8

List the advantages of using flowcharts to document the auditor’s understanding of internal controls.

Answer 8

1. Systematic approach with emphasis on important accounting records
2. Tailored to client
3. Fairly easy for others to review and understand
4. Easy to update from year to year.

Question 9

Identify 3 ways auditors might document their understanding of internal controls?

Answer 9

1. Flowcharts of transaction cycles;
2. Internal control questionnaires;
3. Narrative write-ups (memos).

Question 10

Identify 3 procedures an auditor might perform to obtain an understanding of internal controls?

Answer 10

1. Inquiry of appropriate personnel
2. Observation of client’s activities
3. Review entity’s documentation of internal controls.

Question 11

When should the auditor assess the design effectiveness of internal control?

Answer 11

In planning every audit under GAAS, as a basis for determining the nature, timing, and extent of further audit procedures.

Question 12

When should the auditor assess the operating effectiveness of internal control?

Answer 12

Whenever the auditor contemplates a reliance strategy (which means the same thing as “assessing control risk at less than the maximum level”) and only after performing the appropriate tests of control.

Question 13

Identify 2 reasons for assessing control risk at the maximum level.

Answer 13

1. The auditor believes that the design of internal control is ineffective; or
2. The auditor believes that reliance on internal control (and performing applicable tests of control) is not an efficient audit strategy compared to a wholly substantive audit approach.

Question 14

Identify 3 inherent limitations of internal controls?

Answer 14

1. Cost of controls should not exceed expected benefits
2. Mistakes may occur due to carelessness, fatigue, misjudgments, etc.
3. Segregation of duties may break down due to collusion or management override of internal controls.

Question 15

Identify 3 risk assessment procedures that might be used by an auditor to obtain an understanding of the entity and its environment, including its internal control.

Answer 15

1. Inquiries of management and others;
2. Observation and inspection;
3. Analytical procedures.

Question 16

What is meant by the term monitoring (as it relates to internal controls)?

Answer 16

The policies and procedures involving the ongoing assessment of the efectiveness of internal control over time.

Question 17

What is meant by the term control activities?

Answer 17

The policies and procedures that help ensure that management directives are carried out especially those related to (1) segregation of duties, (2) physical controls, (3) authorization of transactions, (4) performance reviews, and (5) information processing.

Question 18

What is meant by the term information and communication systems?

Answer 18

The policies and procedures related to the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities.

Question 19

What is meant by the term risk assessment?

Answer 19

The policies and procedures involving the identification, prioritization, and analysis of relevant risks as a basis for managing those risks.

Question 20

What is meant by the term control environment?

Answer 20

The policies and procedures that determine the overall control consciousness of the entity, sometimes called “the tone at the top.”

Question 21

Define “internal control.”

Answer 21

A process - effected by those charged with governance, management, and other personnel - designed to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.

Question 22

What are the three objectives of internal control as identified in the definition of internal control?

Answer 22

1. Reliability of financial reporting
2. Effectiveness and efficiency of operations
3. Compliance with applicable laws and regulations.

Question 23

Identify the five interrelated components of internal controls.

Answer 23

1. Control Environment
2. Risk Assessment
3. Control Activities
4. Information and Communication systems
5. Monitoring

Question 24

Define the term “risk assessment procedures.”

Answer 24

Procedures performed to obtain an understanding of the entity and its environment, including its internal control.

Question 25

When must tests of control be performed?

Answer 25

When the auditor’s risk assessment includes an “expectation of the operating effectiveness of controls.” Note that this is frequently referred to as “relying” on internal control as a partial basis for the auditor’s conclusions, or “assessing control risk at less than the maximum level.”

Question 26

List some examples of appropriate responses by the auditor to risks of material misstatement at the financial statement level.

Answer 26

1. Assign more experienced staff to the engagement;
2. Provide closer supervision;
3. Use specialists;
4. Use more unpredictable audit procedures.

Question 27

What specific matters should the auditor document regarding the auditor’s assessment of the risks of material misstatement?

Answer 27

1. The discussion with key members of the audit team about the risks of material fraud and errors;
2. The major elements of the understanding of the five components of internal control;
3. The assessment of the risks of material misstatement (at the financial statement and relevant assertion levels) and the basis for that assessment; and
4. The risks identified and the related controls the auditor evaluated.

Question 28

What is the auditor’s responsibility for assessing the risk of material misstatement?

Answer 28

The auditor should identify and assess the risks of material misstatement (1) at the financial statement level and (2) at the relevant assertion level related to classes of transactions, account balances, and disclosures.

Question 29

Define the term “significant risks.”

Answer 29

Risks that the auditor believes require special audit consideration.

Question 30

What is meant by the term deficiency in operation?

Answer 30

When a properly designed control does not operate as designed, or when the person performing the control does not have the authority or competence to effectively perform the control.

Question 31

What is meant by the term deficiency in design?

Answer 31

When a control necessary to meet the control objective is missing, or when the control objective is not always met, even if the control operates as designed.

Question 32

Define “significant deficiency.”

Answer 32

A deficiency (or combination of deficiencies) in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

Question 33

Define material weakness.

Answer 33

A deficiency (or combination of deficiencies) in internal control such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented or detected and corrected on a timely basis.

Question 34

Describe the auditor’s requirements for communicating deficiencies in an entity’s internal controls?

Answer 34

1. The auditor must communicate in writing the significant deficiencies (including material weaknesses) identified in the audit;
2. The auditor may choose to communicate lesser matters, too.

Question 35

Describe the timing of the required communication of significant deficiencies in internal control.

Answer 35

Under AICPA professional standards, written communication is required no later than 60 days after the audit report release date (including matters communicated orally during the audit).

Question 36

What are the two ways the external auditor might use the work of an internal audit function?

Answer 36

1. To obtain audit evidence; and
2. To provide direct assistance.

Question 37

When using the work of the internal audit function to obtain audit evidence, what three matters should the external auditor evaluate?

Answer 37

1. Objectivity—the internal audit function’s organizational status and the objectivity of the internal auditors;
2. Competence of the internal auditors; and
3. Whether the internal audit function applies a “systematic and disciplined approach, including quality control.”

Question 38

When using the internal audit function to provide direct assistance, what two matters should the external auditor evaluate?

Answer 38

1. Objectivity—the internal audit function’s organizational status and the objectivity of the internal auditors; and
2. Competence of the internal auditors.

Question 39

Why isn’t a “systematic and disciplined approach, including quality control” a relevant consideration when the external auditor uses an internal audit function to provide direct assistance?

Answer 39

Because the work performed by the internal audit function is subject to the external auditor’s direction, supervision, and review.