Internal Control - Concepts and Stds Flashcards
Analytical procedures used during risk assessment may enhance the auditor’s understanding of the client’s :
Analytical procedures used during risk assessment may enhance the auditor’s understanding of the client’s business and significant transactions and events that have occurred since the prior audit and also may help to identify the existence of unusual transactions or events and amounts, ratios, and trends that might indicate matters that have audit implications.
In assessing control risk, an auditor ordinarily selects from a variety of techniques, including
Auditors perform tests of controls to obtain evidence on the operating effectiveness of controls to assess control risk. Tests of controls include inquiries of appropriate entity personnel, inspection of documents and reports, observation of the application of the policy or procedure, and reperformance of the application of the policy or procedure.
AU-C 315 Assessing control risk
AU-C 315 indicates that assessing control risk may be performed concurrently during an audit with obtaining an understanding of internal control.
Assessment of Control Risk
- When Control Risk is assessed to be at Maximum No Internal Control testing is performed
- When Control Risk is below Maximum:
- Auditor tests Internal Controls
- Auditor evaluates Control Risk based on tests
- Auditor adjusts substantive tests accordingly
- Weaker Internal Control = More testing
- Stronger Internal Control = Less testing
AU-C 610 states that internal auditors may assist the CPA in:
AU-C 610 states that internal auditors may assist the CPA in obtaining an understanding of internal control, in performing tests of controls, and in performing substantive tests.
a basic tool used by the auditor to control the audit work and review the progress of the audit
audit plan aids in instructing assistants in the work and includes audit procedures to accomplish the objectives of the examination. Thus, it allows the auditor to control the audit work and to review the progress of the audit.
An auditor reviews a client’s accounting policies and procedures when considering planning matters, for what purpose?
Understanding of the client’s operations and business. Such information provides overall guidance to help an auditor understand the client’s operations and business
What judgments may an independent auditor share responsibility with an entity’s internal auditor who is assessed to be both competent and objective?
None
The auditor is required to make all significant judgments in the audit, including evaluating significant accounting estimates and determining the materiality of misstatements; other significant judgments include:
- assessing the risks of material misstatement
- evaluating the sufficiency of tests performed
- evaluating the going concern assumption
- evaluating the adequacy of disclosures
Can an independent auditor share responsibility with an entity’s internal auditor who is assessed to be both competent and objective
An independent auditor responsibility cannot be shared with the internal auditors for any judgments; the responsibility to report on the financial statements rests solely with the independent auditor
AU-C 265 compensating control
A compensating control is a control that lessens the severity of a deficiency (AU-C 265).
Components of Internal Control
The components of internal control:
- control environment,
- control activities,
- monitoring
- risk assessment
- information/communications are the components of internal control, but not inherent risk.
Inherent Risk is not part of internal control
CRIME
- Control
- Risk
- Info/Communications
- Monitoring
- Environment
Re-Testing Controls
Concerning current audit use of audit evidence about the operating effectiveness of controls obtained in prior year audits, professional standards allow the length of time permissable before retesting controls if the related controls are tested at least every third year.
Confirmations of Accounts Receivable
Confirmation of accounts receivable is a substantive test not a test of a control.
CONTROL ACTIVITIES
- Performance Reviews
- Information Processing
- Physical Controls
- Segregation of Duties
Control Environment Assessment
- Sets tone for the entire company
- How is Management Integrity/Ethics?
- Is Management Competent?
- Healthy Organizational Structure?
- Appropriate HR Policies?
- Authority/Responsibility Assignments?
- What is Managements’ Style?
- Riskier with a dominant, aggressive individual(s)
- Are the Board/Audit Committee Actively Involved?
Control Limitations
- Controls can’t stop collusion or bad judgment
- Management can override controls
- Cost vs. Benefit relationship of Internal Control
The ultimate purpose of assessing control risk is to contribute to the auditor’s evaluation of the risk that
Auditors are ultimately concerned with the existence of material misstatements in the financial statements.
An auditor assesses control risk because
An auditor uses the assessed levels of control and inherent risk to establish the level of detection risk that the auditor may accept.
An auditor assesses control risk because it
- Affects the level of detection risk that the auditor may accept
- Assessed levels of control risk and inherent risk are used to determine the acceptable level of detection risk for financial statement assertions.
audit risk = cr x ir x dr
An auditor assesses control risk because
An auditor uses the assessed levels of control and inherent risk to establish the level of detection risk that the auditor may accept.
Control risk should be assessed in terms of
AU-C 315 requires that control risk be assessed in terms of financial statement assertions
Controls Not Reliable
- Control Risk = Higher
- Aceptable Dection Risk = Lower
- Stop testing controls and do more substantive audit procedures
Controls Reliable
- Control Risk = Lower
- Aceptable Dection Risk = Higher
- Can continue substantive procedures for audit engagement as planned
Decision tables differ from program flowcharts in that decision tables emphasize
Logical relationships among conditions and actions. Decision tables include various combinations of conditions that are matched to one of several actions. In an internal control setting, the various important controls are reviewed and, based on the combination of answers received, an action such as a decision on whether to perform tests of controls is determined. Program flowcharts simply summarize the steps involved in a program.
Deficiencies in Internal Controls
If Internal Controls are deficient:
- Control Risk increases
- Scope of Substantive Procedures increases
- Detection Risk decreases
- Potential for Material Weakness
- resonable possibility that a material misstatement in F/s would not be found
Define control deficiency
A control deficiency is a condition in which the operation of a control does not allow management, or employees, in the normal course of performing their functions to prevent or detect misstatements on a timely basis—it does not explicitly consider likelihood of loss.
Documentation of Internal Control
Auditor must Document understanding of Internal
Control via:
- Memos
- Flowcharts (easy to follow)
- Questionnaires (easy to complete)
Five Components of Internal Control
- Control Environment
- Risk Assessment
- Control Activities
- Information and Communciation
- Monitoring
the function of internal control, from the viewpoint of the independent auditor, is to
function of internal control, from the viewpoint of the independent auditor, is to provide reasonable assurance that material misstatements may either be prevented or discovered with reasonable promptness, thus assuring the reliability and integrity of the financial records.
A government internal audit function is presumed to be free from organizational independence impairments for reporting internally when the head of the organization
Is removed from political pressures to conduct audits objectively, without fear of political reprisal . When the head of the organization is removed from political pressures, such independence may be obtained
How would an auditor of a nonissuer most appropriately respond to a heightened assessed risk of material misstatement?
Heightened assessed risk of material misstatement may result in:
- the assignment of more experienced staff and/or those with specialized skills to high-risk areas; examples of other responses include
- providing more supervision and emphasizing the need for professional skepticism
- incorporating additional elements of unpredictability into audit procedures
- increasing the overall scope of audit procedures.
If the independent auditors decide that the work performed by the internal auditor may have a bearing on their own procedures, they should consider the internal auditor’s
The AICPA’s Professional Standards require independent auditors to consider internal auditor’s:
- competence
- objectivity
- work performance
In an audit of financial statements, an auditor’s primary consideration regarding a control risk should be assessed in terms of :
control risk should be assessed in terms of financial statement assertions.
In comparison to the external auditor, an internal auditor is more likely to be concerned with
Operational auditing, a broader concept than included in financial statement audits, is more important to the internal auditor because it includes budgets and other control devices.
In obtaining an understanding of an entity’s internal control relevant to audit planning, an auditor is required to obtain knowledge about
- An auditor must obtain an understanding of an entity’s internal control sufficient for audit planning.
- An auditor must obtain an understanding that includes knowledge about the design of relevant controls and records and whether the client has placed those controls in operation
