Internal Factors & COSO

Question 1

RMM gets assessed at the…

Answer 1

1. F/S level
2. assertion level: risk that particular assertions relating to classes of transactions, account balances or disclosures are materially misstated

Question 2

RMM is assessed ___________ materiality

Answer 2

BEFORE (materiality guides an auditor in determining if an error during substantive testing represents RMM)

Question 3

under SOX, audit committee is required to….

Answer 3

be made up of independent members of the company’s BOARD OF DIRECTORS

Question 4

required risk assessment procedures include:

Answer 4

Analytical procedures: study of data comparisons and relationships using high-level data
Inquiries: of management and others within entity, including internal auditors
Inspection: of documents and records, such as authorization forms and procedures manuals
Observation: watching the application of manual controls

Question 5

the CEO and CFO of issuer must certify with reports filed with SEC:

Answer 5

1. reviewed annual/quarterly report (including financial statements)
2. believe financial information is fairly presented
3. are responsible for I/C
4. evaluated the effectiveness of I/C within the past 90 days
5. disclosed significant changes in I/C since its evaluation
6. disclosed fraud or significant deficiencies in I/C to auditor or audit committee

Question 6

framework for internal controls is Internal Control Integrated Framework developed by COSO with these 3 objectives:

Answer 6

1. Operational: effectiveness and efficiency of operations
2. Reporting: accurate and reliable financial and non financial reporting for internal/external purposes
3. Compliance: with laws and regulations

Question 7

What are the 5 components of the COSO I/C Framework

Answer 7

C.R.I.M.E.
1. Control activities
2. Risk assessment
3. Information and communication
4. Monitoring activities
5. control Environment

Question 8

what are control activities and the 4 sequence of steps?

Answer 8

primarily relate to risk reduction, technology controls and policies

1. Performance reviews: evaluate performance against criteria to investigate differences
2. Information processing: prevent processing info unless certain criteria are met
3. Physical controls: limit access to assets
4. Segregation of duties

Question 9

what is risk assessment ?

Answer 9

primarily relates to organizational objective, risk assessment (domestic/international), fraud and change management

polices and procedures which help ensure management directives/objectives are being carried out

Question 10

what is information and communication?

Answer 10

relates to the quality and flow of information within the entity and to outside parties and encompasses the controls to assure that management and employees have the information to perform their functions (directives communicated and being carried out)

Question 11

what are the 2 main principles of monitoring activities?

Answer 11

1. controls are assessed through ongoing and/or separate evaluations to determine if I/C components are operating effectively
2. evaluate and communicate I/C deficiencies to parties responsible for taking corrective action (BOD)

the most common and effective way to carry this out is via internal audit

Question 12

what is the control environment?

Answer 12

establishes integrity and ethical values in the organizational culture through the idea of TONE AT THE TOP

C.H.O.P.P.E.R.
Commitment to competence
Human resources policies/practices
Organizational structure
Participation of those charged with governance
Philosophy and operating style of management
Ethical values and integrity
Responsibiliy assignment

Question 13

COSO is the framework commonly used by auditing profession as the benchmark for internal controls of…

Answer 13

NON-ISSUERS

Question 14

substantive testing is used to ___________ a material misstatement

Answer 14

detect

Question 15

the extent of backup used each time with an ERP (enterprise resource planning) system is referred to as…

Answer 15

full, incremental and differential

Question 16

what is an integrated test facility?

Answer 16

a computer-assisted auditing technique (CAAT) by which auditors embed audit modules in the client’s IT system, insert simulated (fictitious) and actual transactions into the ITF during normal system processing to evaluate and continuously monitor effectiveness of application controls
done without client operating personnel being aware of test process

Question 17

what is parallel simulation?

Answer 17

processes actual client data using both the client’s and auditor’s programs

Question 18

what is the test data method?

Answer 18

tests controls in a client’s system at a time when client knows the system is not in use and uses fictitious data not actual client data

Question 19

what are the 4 types of segregation of duties?

Answer 19

Authorization: purchases
Recordkeeping: record functions
Custody: maintains assets treasurer
Comparison/reconciliation

Question 20

what is the record count?

Answer 20

represents the number of individual data records in a batch

Question 21

what is the hash total?

Answer 21

the total of amounts in a given data field within the record; it has no real meaning

Question 22

what are the 4 procedures for testing controls? (tests of controls are to determine if they are operating and can be relied on to reduce risk)

Answer 22

reperformance
inspection
inquiry
observation

Question 23

what are the functions of the test of controls for re-performance?

Answer 23

1. performing the control procedures (recalculations)
2. comparing test results with client results

Question 24

what are the functions of the test of controls for inspection?

Answer 24

1. examining documents and reports
2. obtaining evidence that control procedures are followed

Question 25

what are the functions of the test of controls for inquiry?

Answer 25

1. asking client personnel if they think control is effective
2. asking client how control is performed

Question 26

what are the functions of the test of controls for observation?

Answer 26

1. watching client’s employees perform control procedures
2. evaluating whether policies are followed

Question 27

GAAS requires understanding the external effects user entities (customer) have on service organization…

Answer 27

DURING AUDIT PLANNING