Maxwell Review - AUD Flashcards
accepting the client - what is the main goal?
minimize the chance of associating with management lacking integrity
when accepting a new client, what do you need to consider?
-firm’s ability to meet deadlines
-staffing needs
-independence
-group audits
-size and complexity of the company
what are some preconditions to accepting a new client?
-assess whether applicable financial reporting framework (like US GAAP) is acceptable
-get a letter from management that recognizes its responsibilities for the audit
what are management responsibilities during an audit and when accepting a new client?
-preparation and fair presentation of the financial statements in accordance with US GAAP
-design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of the financial statements that are free from material misstatement, whether due to fraud or error
-providing the auditor access to information (like employees and documents)
what are auditor’s responsibilities during an audit?
-conducting an audit in accordance with GAAS
-informing the client of deficiencies in controls
what is an engagement letter?
a document to agree to the terms of the engagement between the auditor and the company’s management
-aka the contract for the audit
what is required to be included in the engagement letter?
-the objective and scope of the audit (aka saying something like “we will audit this year’s financial statements”)
-auditor and management responsibilities
-reasonable assurance (not all material misstatements might be detected)
-identify of the applicable financial reporting framework
-expected reports to be included (like the audited financial statements)
what is optional to be included in the engagement letter?
-fees for the audit
-involvement of other auditors (component auditors or specialists)
-plan to communicate with the predecessor auditor
-any additional communications the auditor will send (like a letter on the control deficiencies)
what should be excluded from the engagement letter?
-materiality
-specific procedures
-anything that would allow the client to manipulate the audit
what is a non issuer?
a private company
what is a issuer?
a public company
what is audit documentation?
-AU C 230
-known as working papers or work papers, which are documents for performing audit test work (like an excel spreadsheet)
-they belong to the auditor, not the client
two main purposes for audit documentation
-evidence for basis of the audit report (not to support financial statements)
-evidence that the audit was conducted according to the standards being followed (like GAAS)
what should be included in the audit documentation?
-the audit documentation should allow an experienced auditor with no previous connection to the audit to understand:
-nature, extent and timing of procedures
-results of procedure and evidence
-findings and issues
-conclusions reached
what information should be included in the working papers?
-who performed the audit work
-when it was performed
-who reviewed the audit work
-when the work was reviewed
what does sufficient documentation mean?
sufficient = enough = quantity
-before the audit opinion, there will be a statement saying “we believe that the audit evidence we have obtained is sufficient AND appropriate to provide a basis for our audit opinion”
what does appropriate documentation mean?
appropriate = relevant = quality
“we believe that the audit evidence we have obtained is sufficient AND appropriate to provide a basis for our audit opinion”
quality of audit evidence includes:
-(BEST) auditor’s direct observation (inventory observation)
-obtained directly from external parties (confirmations)
-prepared by external party then given by company (bank statements)
-(WORST) prepared by the client (trial balance)
what does nature, extent, and timing of procedures mean?
nature = what kind of test?
-ex: to test AP, we are going to perform a search for unrecorded liabilities
extent = how much testing?
-ex: do we need to test 20 invoices or 40?
-it’s possible to over audit a company
timing = should we perform year end test work or interim test work?
-depends on how reliable the company’s accounting system is (the more reliable, the more interim procedures we can perform)
what does it mean when there is a current file for audit documentation?
-documentation that changes every audit (only applies to the current year)
-ex: financial statements, working trial balance, confirmations, representation letters, attorney’s letters, bank statements
what does it mean when there is a permanent file for audit documentation?
-the documentation that applies to multiple years
-ex: debt agreements, company bylaws, stock certificates
what are audit tick marks?
tick marks can save the auditor time and space by explaining procedures performed in one centralized location
-have a legend to show what each symbol means
what is the working trial balance for?
-at the beginning of the audit, the client will give the auditor a TB to show the ending balance of every account and accounting records
-TB given to the auditor will be the unadjusted balance
-while the auditor is going the test work, they will see if they need to do any reclass (changes one balance sheet balance for another balance sheet balance) or adjusting (affects NI and RE) entries
-then we get an adjusted balance that shows up on the year end financial statements
what is the max number of days in which a nonissuer’s auditor should complete the assembly of the final audit file following the report release date?
60 days
what is the max number of days in which an issuer’s auditor should complete the assembly of the final audit file following the report release date?
45 days
quality control key elements (6)
**the extent of quality controls depends on the firm’s size, nature of the practice, and cost-benefit considerations
-HR: competent recruitment, proper job roles, training
-client acceptance: avoid management lacking integrity
-leadership responsibility: tone at the top
-high level of performance: supervising, confidentiality of client info
-monitoring: peer review, wrap-up review, documenting and correcting errors
-ethical behavior: independent in fact and appearance
what is a peer review?
-implemented to check whether auditing firms are performing audits in accordance with auditing standards
-one CPA firm reviews another CPA firm every 3 years (AICPA members)
-after the review, a report is issued with the findings and conclusions
what is an audit strategy?
-a written document that outlines the scope of an audit, the objectives, timing, communications, preliminary materiality, high risk areas, planned resources, deliverables
-this is a high level strategy for the audit, no details
what questions do you ask in an audit strategy?
-do we need any specialists?
-do we need more staff?
-when does the client expect the finalized financial statements?
-should we do year end or interim testing?
-how many hours are we budgeting for the audit?
what is an audit plan?
-outlines the nature, extent, and timing of procedures
-is based off the audit strategy
-detailed plan for the audit
-required to be written
-need to include risk assessment
-need to have a list of the audit procedures and tests of controls
-roadmap for the audit
what are analytical procedures?
-we are required to perform analytical procedures in the planning phase
-part of the risk assessment process
-ex: ratio or trend analysis
understanding the client’s business and it’s industry - an overview definition
-no prior experience with the client’s business (entity) or its industry is required to accept a client
-after accepting, though, the auditor must understand both the client’s business and its industry
ways to understand the client’s business:
-take a tour of the business
-review prior year financial reports of the company
-learn about the client’s accounting approach
-inquire with the client personnel
ways to understand the client’s industry:
-review common industry guidelines
-review revenue recognition standards
how do you understand internal controls?
-for any audit, we are required to obtain an understanding of the company’s internal controls
-helps us to understand the business and perform risk assessment
-involves looking at the design (layout of the system and steps involved) and implementation (is this control actually being followed?) of internal controls
-does not involve testing the internal controls for operating effectiveness
when do we need to test internal controls for their operating effectiveness?
optional but if we want to rely on the controls, then we need to test (set control risk below high is an example of when testing would occur)
how do you document internal controls?
-flowcharts: symbolic charts to show the flow of controls
-questionnaire: a yes/no list with explanation of no answers
-narratives: a written description of the controls
what is the predecessor auditor?
-the prior auditor (so successor is the current/new auditor)
-if you are new to an audit (successor), then you must attempt communication with the predecessor
-you need to request permission from the client to communicate with the predecessor auditor (they don’t have to respond but you have to attempt communication)
the predecessor auditor should inquire about:
-management integrity
-accounting disagreements with management
-reasons for change
-fraud and noncompliance
-related parties and significant unusual transactions
changing from an audit to a lower level engagement:
-you can change from a audit to a review/compilation, or a review to a compilation
-the key is that you’re moving to a lower level engagement
-before changing, understanding the: reasons for request, effort required, and additional cost
-don’t refer to the original engagement in the audit report
when to consider withdrawing from an engagement:
-withdraw when there is a serious scope limitation
-ex’s: client refuses to allow correspondence with legal counsel, client wants to change level of engagement without a justified reason, client refuses to sign management representation letter
engagement partner responsibilities
-the engagement part is the ultimate person responsible for the audit
-responsible for: planning the audit, compliance with auditing standards, supervising the engagement team members
what should you do during the first year of auditing a company?
-review the predecessor auditor’s audit documentation
-perform specific audit procedures to obtain evidence regarding the opening balances
-beginning balance sheet accounts are important to verify (if beg balance is $10K, verify that to confirm ending balance will be accurate)
using the work of others - internal auditors
-an internal auditor (IA) is a company’s internal employee that performs internal audits
-they help better understand the company and reduces the amount of work the external auditors must perform
-they are not independent
-no judgements or estimates can be shared with IA
-they can help with any part of the audit
-best to use IA for areas with low estimates and complexity
-if the IA helps with a high risk area, the external auditor must not solely rely on their work
-the external auditor should always review work performed by the IA
-external auditor is the ultimate party responsible
-external auditors must test the IA’s competence and objectivity
internal auditor’s competence includes:
-the internal auditor’s abilities
-educational level and professional experience
-reviews the quality of the internal auditor’s working paper documentation
-looks at internal auditor’s compliance with professional standards
internal auditor’s objectivity includes:
-considers the company’s policies and organizational structure that limit internal auditor’s access
-asks the question, who does the internal auditor report to?
using the work of others - a specialist
-someone with special skills
-used when auditor believes that it is desirable or necessary
-the auditor doesn’t refer to the specialist’s work in the auditor’s report
-if the opinion is modified (adverse, qualified) due to the specialist’s work, then it’s optional to include reference to the specialist in the report
-if the auditor mentions the specialist in the auditor’s report, then the auditor must clarify that the specialist’s work does not reduce the auditor’s responsibility
-doesn’t have to be independent (they can have a relationship with the client)
with the work of a specialist, the external auditor should:
-assess the specialist’s experience
-understand the major methods and assumptions
-understand the objectives and scope of the specialist’s work
-evaluate the specialist’s work
using the work of others - IT auditor
-not considered a specialist
-must be independent
-considered a member of the engagement team
-must assess the impact of IT on the entity
-can use an IT auditor at any point during the audit
-work is reviewed by the engagement parter
what is a group audit?
-the audit of financial statements that contain the information of more than one component
-common ex: a parent company with multiple subsidiaries (group = parent, component = subs)
what does the group auditor do for a group audit?
-auditor responsible for the main financial statements
-review the component auditor’s work
-only allowed to mention the component auditor if the group auditor is not is not taking responsibility for the component auditor’s work
-if the group auditor mentioned the component auditor, then the group auditor states the component that was audited by the component auditor, along with the size of the component relative to the overall company
using the work of others - component auditor
-involves group audits and group auditors
-component auditor performs work for a component of an auditor (can be part of the group auditor’s firm or be completely unrelated)
-all auditors must be independent
-must assess the impact of IT on the entity
example of a group audit/component auditors
-parent company: disney –> audited by group auditor and firm with ultimate responsibility (deloitte)
-subsidiary: parks –> audited by a component auditor (EY)
-subsidiary: media –> audited by a component auditor (KPMG)
audit risk formula
inherent risk * control risk * detection risk
risk of material misstatement formula
inherent risk * control risk
what is quantitative risk
numbers
what is qualitative risk
words
inherent risk
-nature of the account or transaction
-the risk of an account before considering any internal controls are implemented
-high risk = more likely to contain a material misstatement
-considers complexity, estimates, volumes of transactions
control risk
-the risk that the company’s controls will not catch the misstatement in a timely manner
-assess as high if there is no operating effectiveness (meaning we test the controls and deem them as ineffective, or, we do not test the controls)
detection risk
-the risk that the auditors will not catch the misstatement
-only area the auditor has control over
-the auditors raise/lover detection risk through altering the nature, extent, and timing of audit procedures
-RMM increases, detection risk decreases (and vise versa)
what is audit risk?
-the risk that a material misstatement makes it onto the financial statements
-the company and auditors don’t detect the errors
financial statement level risks
-risks that apply to the financial statements as a whole
-risks pervasive to the entire company
-ex: management override, hiring a new CFO
assertion level risks
-risks applying to specific transactions, account balances, and disclosures
-transactions –> income statement items
-account balances –> balance sheet items
-disclosures –> footnotes
significant risks
-an item that not only has high inherent risk but is at the highest spectrum of inherent risk
-focuses on probability of a misstatement and whether a misstatement would be material
-every audit has at least one significant risk
-you can have a high inherent risk that is not significant (but can’t have a significant risk that is not high inherent risk)
-communicate significant risks to those charged with governance, verbally or in writing
-require test of details
factors to consider with significant risks
-risk of fraud
-complexity of transactions
-significant related party transactions
-amount of subjectivity
-significant unusual transactions
responses to risk
-each risk requires a response
-the higher the RMM, the greater the nature, extent, or timing of procedures
-substantive analytical procedures offer less assurance than a test of details does
-if an account balance, transaction, or disclosure is material, even if RMM is low, we are required to perform substantive procedures
-if fraud risk is present, test of details is required
-test of controls is necessary is the substantive procedure is not enough to support the audit opinion
fraud risk
-fraud: an intentional act involving deception
-different from an error because it’s intentional
-two types: fraudulent financial reporting, misappropriation of assets
fraudulent financial reporting fraud risk
-intentionally misstating the numbers
-has a larger financial impact than misappropriation of assets
-typically by upper management
misappropriation of assets fraud risk
-theft of assets
-typically by lower level employees
fraud triangle
-incentive: reason to commit fraud
-opportunity: a weak point in the company’s controls
-rationalization: justifying behavior
where is fraud normally mentioned in the auditor’s report?
-management’s responsibility for the financial statement
-auditor’s responsibility
auditing for fraud (AU-C 240)
-as auditors, theyre only concerned with how the fraud affects the financial statements
-any fraud is considered material
-auditors should always maintain an attitude of professional skepticism
-always considered a significant risk (management override of controls, overstatement of revenue)
-responding to risk of management override of controls (look at JE, review accounting estimates, review significant unusual transactions)
-auditors should inquire with the management and other employees (conduct fraud interviews)
-analytical procedures help to identify fraud risks
-report fraud one level above where the issue is
substantive procedures
-any kind of audit procedure that is not a test of controls
-includes both the test of details and analytical procedure
confirmations - type of test of details
-confirming a client’s assets
-ex: sending bank confirmations
observation - type of test of details
-viewing a process
-ex: observing a client’s inventory count
recalculation - type of test of details
-verifying that the auditor’s amount agrees to the client’s amounts
-ex: gain recalculation
reperformance - type of test of details
-reperforming a process to ensure the client performed it correctly
-ex: reperforming a bank rec
inspect assets - type of test of details
-looking at a client’s assets
-ex: inspecting a client’s fixed assets
inspect documents - type of test of details
-looking at a client’s documents
-ex: inspecting invoices for AP
substantive analytical procedure - type of substantive procedure
-using analytical procedures as a substantive procedure
-consider both financial and non financial data
-set expectations and compare that to actual results
analytical procedures
-ratio analysis, trend analysis, etc
-three parts: 1. required in pre audit phase: preliminary analytics in the planning phase; 2. optional in the audit test work: substantive analytical procedures; 3. required in the post audit phase: overall review analytics
test of details
-looks at the source of a balance
-how can I verify/corroborate what the client tells me?
-confirming, observing, recalc/reperform, inspecting
tracing vs vouching
-tracing/matching documents: tests for completeness (source document to financial records)
-vouching: tests for existence (financial records to source documents)
test of controls
-must understand a company’s internal controls (design and implementation)
-test controls to evaluate their operating effectiveness so we can rely on controls
-test to decrease control risk and increase detection risk
-test when substantive procedures don’t properly address a risk of material misstatement
four types of test of controls
-reperformance
-inspection
-inquiry
-observation
-once tests are over, the auditor will either rely (when effective) or not rely (not effective = high control risk) on the controls
materiality
-looking for a material misstatement, which are misstatements that will influence users of the financial statements (owners, investors, creditors)
-def. by FASB: the omission or misstatement of an item in a financial report is material if, in light of surrounding circumstances, the magnitude of the item is such that it is probable that the judgment of a reasonable person relying upon the report would have been changed or influenced by the inclusion or correction of the item
-establish materiality in planning phase, yet we can raise or lower it through the audit (considering both quantitative and qualitative factors)
materiality at two levels
-financial statements as a whole
-transactions, account balances, and disclosures
materiality benchmarks
% of revenue
% of total assets
-they track the size of a company and how much activity it has
factual - type of misstatement
-no doubt about the misstatement
-supporting documentation is available
-ex: the company omitted an invoice from its AP balance
judgmental - type of misstatement
-misstatement due to judgments (accounting estimates)
-ex: the company’s allowance for doubtful accounts balance is too low
projected - type of misstatement
-projecting the errors in a sample onto the population
-ex: we selected 10 invoices out of 100 and discovered a $10,000 misstatement; therefore, we project that in the entire population there is a $10,000 misstatement
performance materiality
-we provide reasonable assurance, not absolute
-we aren’t testing 100% of the company
-amount less then overall materiality (materiality at the financial statement level)
-to reduce the chances that the aggregate of the misstatements we haven’t detected exceeds materially as a whole, calculate 50-75% of overall materiality
-for a low risk client, choose a higher threshold (high risk, low threshold)
tolerable misstatement
-materiality for each area of a company
-calculated by applying a % of performance materiality (usually 10, 15, or 20%)
-high risk (AP) = low threshold (low risk (fixed A) = high threshold)
trival/unimportant misstatement
-misstatements that are so small, we do not care about them
-found by taking a % of overall materiality
-we will not add up trival misstatements (no JE, not additional documentation)
management assertions
-claims of what is true
existence (BS) and occurrence (IS) assertion
-claim that everything is real/exists
-the balances exist; the transactions have actually occurred
-important for asset accounts
completeness assertion
-claim that everything that should have been recorded has been recorded
-nothing is left out of the financial statements
-important for liability accounts
classification assertion
-is it recorded in the correct account?
rights (A) and obligations (L) assertion
-who does it belong to?
-the company has the rights to the assets, and is required is pay obligations
cutoff assertion
-events have been recorded in the correct accounting period
-important for transactions occurring near year end
valuation, allocation, and accuracy assertion
-is it recorded for the correct amount?
understandability and presentation assertion
-are the footnotes clear enough?
what type of audit is performed for a public company (issuer)?
integrated audit (as a result of SOX)
what does an integrated audit include?
-auditing (expressing an opinion) the financial statements
-auditing (expressing an opinion) the operating effectiveness of internal control over financial reporting
what two audit repots are issued for integrated audits
-report of financial statements
-report on internal control over financial reporting
what auditing and accounting standards do issuers use
PCAOB for auditing standards
GAAP for accounting standards
when testing the controls for an issuer, what date do you use
specific date; date of audited financial statements
in a public audit, should all deficiencies be in writing?
yes, even if it’s not significant or a material weakness
audit report for issuers
-opinion
-basis for opinion
-critical audit matters
what are critical audit matters
-requirement for an issuer’s audit report
-similar to key audit matters for a private company
-use for areas that are material to the financial statements and involve challenging, subjective, complex judgements
what’s the explanatory paragraph
-any paragraph we add to the basic audit report
-there is NOT an emphasis of matter or other matters paragraphs for issuers
audit report for internal control over financial reporting
-opinion
-basis for opinion
-definition and limitation of internal control over financial reporting
modifications of opinions for internal control audit
-no qualified opinions
-a material weakness requires the auditor to issue an adverse opinion
-major scope limitations cause either disclaimer of opinion or withdrawing from the engagement
what is an interim review for a public company
-the SEC requires issuers to issue a reviewed quarterly financial statement (10Q)
-review is conducted under PCAOB and includes an evaluation of internal controls
-each page of the financials need to include the wording “unaudited”
what is an interim review for a private company
-optional review
-covered by GAAS standards
-no need to evaluate internal controls
does SOX apply to public or private companies
mainly public
what is SOX sec 404
requires public companies to have their internal controls audited
what is an audit committee
-specifically dedicated to the company’s audit process
-consists of individuals already on the board of directors
-must include at least one financial expert
-members must be independent, cannot receive consulting fees
requirements to be a financial expert (need to meet one)
-experience in internal controls
-experience in GAAP
-experience on other audit committees
-experience auditing financial statements
definition of the PCAOB
a non profit corporation that is responsible for overseeing the auditing process of public companies
what does the PCAOB do
-set new accounting standards
-inspects audits performed by public accounting firms
-provides accountability for the auditing industry
-SEC has authority over the PCAOB
governmental audits
-follows GAGAS (generally accepted government auditing standards; yellow book)
-must follow both GAAS (private) and GAGAS (government)
-accountability is important for governments
governmental audit elements
-financial statements (test and express opinion)
-internal control over financial reporting (just test, no opinion)
-compliance with laws and regulations (test and express opinion)
-internal control over compliance (just test, no opinion)
governmental audit details
-for the internal control over financial reporting testing, we present the results of the tests
-when looking at compliance issues, we may need to communicate with outside parties
-we are required to describe the scope of the auditor’s testing of compliance with laws and regulations and internal control over financial reporting
single audits
-an audit for recipients of federal financial assistance (>$750,000)
-determined by the single audit act and 2 CFR 200
-must conform to both GAAS and GAGAS, plus additional requirements
-called “single” because we have to consider every single major program and report on it (and then set unique materiality levels for each major program)
single audit procedures
-compliance audit of federal awards for each major program (test and express opinion)
-we provide a schedule of findings and questioned costs
cash assertions when auditing cash
-existence (most important), rights and obligations, valuation allocation and accuracy, cutoff
cash risks when auditing cash
-typically a high fraud risk
-cash is stolen (misappropriation of assets)
-cash is intentionally overstated (why existence assertion is important)
-not all cash accounts are on the GL (completeness assertion)
-cash is misstated due to errors in the bank rec (valuation allocation and accuracy)
-two fraud opportunities: lapping and kiting
lapping
-misappropriation of assets (theft)
-when an employee takes a customer’s payment, then covers it up with the next customer’s payment
-steal from customer 1, use customer 2’s payment to pay off customer 1’s AR balance
-safeguards against lapping (use a lockbox, make employees take regular vacations)
kiting
-fraudulent financial reporting (misstating accounting records)
-cash is recorded in two bank accounts at once
-at the end of the year, we transfer $5,000 from account A or account B (for A, we dont record the cash disbursement and for B, we don’t record a deposit in transit) –> balance shown in two places
-safeguard against kiting by creating a bank transfer schedule
procedures for auditing cash
cash confirmations, bank recs, bank transfer schedule
cash confirmations
-assertions that confirmations test: existence, rights and obligations, valuation allocation and accuracy, completeness
-requirements for resending confirmations: send 1st confirmation, if no reply then send 2nd confirmation, if still no reply then perform alternative procedures
testing the bank rec
making sure that:
-the deposits in transit and outstanding checks clear the bank account in the next period
-there are not any old outstanding checks
-the ending cash bal is accurately calculated
steps for the bank rec
-footing the bank rec and list of outstandinf checks (does it all add up?)
-agreeing the beginning rec bal should agree to the bank statement
-verifying that the deposits in transit and outstanding checks cleared in the next month’s statement
-bank confirmation agrees to the bank statement baalnce