Module 3

Question 0

AU-C 315 divides internal control into five components, what are they?

Answer 0

1- Control environment - sets the tone of the organization, influencing the control consciousness of its people

2- Risk Assessment - For financial reporting purposes an entity’s risk assessment is its identification, analysis, and management of risks relevant to the preparation of financial statements following GAAP. The following are considered risks that may affect an entity’s ability to properly record, process, summarize, and report financial data: (1) changes in the operating environment, (2) new personnel, (3) new information systems, (4) Rapid Growth, (5) New Technology (6) New lines, products, or activities (7) corporate restructuring (8) Foreign operations, (9) Accounting Pronouncements

3- Control Activities - The third component of internal control is composed of the various policies and procedures that help ensure that necessary actions are taken to address risks to achieving the entity’s objectives. Those Policies and Procedures include:
R Reviews (reviews of actual results against budgets)
I Information Processing (accuracy, completeness, authorization
P Physical controls - (physical security of assets and records)
S segregation of duties (separate authorization record-keeping and custody)

4- Information and Communication - methods and records established to record, process, summarize, and report entity transactions and to maintain accountability of the related assets and liabilities.

5- Monitoring - assesses the quality of internal control performance over time. Monitoring activities may be ongoing, separate evaluations, or a combination.

Question 1

How does COSO define Internal Control?

Answer 1

a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories;
a- reporting,
b- Operations
c- compliance

Question 2

The 2013 COSO internal control - Integrated framework provides 17 internal control Principles, what are they?

Answer 2

CONTROL ENVIRONMENT

• Demonstrate a commitment to integrity and ethical values
• Exercises oversight responsibility (by a board of directors that demonstrates independence from management)
• Established proper structures, reporting lines, authorities and responsibilities
• Demonstrates a commitment to competence
• Enforces accountability of individuals

RISK ASSESSMENT

• Specifies clear objectives
• Identifies and analyzes risk to achievement of its objectives
• Considers the potential for fraud in assessing risks.
• Identifies and assesses changes that could affect internal control

CONTROL ACTIVITIES

• Selects and develops appropriate control activities to mitigate risks to achievement of objectives
• Selects and develops general control activities over technology
• Deploys control activities that establish what is expected and place Policies into action.

INFORMATION AND COMMUNICATION

• Obtains or generates and uses relevant information to support internal control
• Communicates information internally to support internal control
• Communicates information externally to support internal control

MONITORING

• Conducts evaluation of whether components of internal control are present and functioning
• Evaluates and communicates internal control deficiencies in a timely manner to appropriate parties.

Question 3

What are assertions? and what are examples of assertions for account balances?

Answer 3

Assertions are management representations that are embodied in the transaction class, account balance, and disclosure components of financial statements

Assertions for account balances are: Existence, rights/obligations, completeness, and valuation/allocation.

Question 4

What are the limitations of internal control?

Answer 4

As we have suggested earlier, internal control provides reasonable, but not absolute, assurance that specific entity objectives will be achieved. Even the best internal control may break down due to:

1- human judgment in decision making can be faulty
2- breakdowns can occur because of human failures such as simple errors or mistakes
3- controls, whether manual or automated, can be circumvented by collusion
4- management has the ability to override internal control
5- cost constraints (the cost of internal control should not exceed the expected benefits expected to be derived)
6- custom, culture, and the corporate governance system may inhibit fraud, but they are not absolute deterrents.

Question 5

What is COSO?

Answer 5

Cimmittee of Sponsoring Organizations. IT is made up of various professional organizations, including the AICPA, institute of management accounting, others.. Its mission is to provide thought leadership through the development of comprehensive frameworks and guidance on enterprise risk management, internal control and fraud deterrence designed to improve organization performance and governance and to reduce the extend of fraud in organizations

Question 6

What did the Sarbanes-Oxley Act of 2002 do with regard to internal controls?

Answer 6

SOX created a variety of new regulations and eliminated a significant portion of the accounting profession’s system of self-regulation. Three important sections

SECTION 302 - Makes officers responsible for maintaining effective internal control, and requires the principle executive and financial officers to disclose all significant internal control deficiencies to the company’s auditors and audit committee.

SECTION 404 - Require that management acknowledge its responsibility for establishing adequate internal control over financial reporting and provide an assessment in the annual report of the effectiveness of internal control. Also requires that CPAs attest to managements report on internal control as part of the audit of the financial statements

SECITON 906 - Requires that management certifies reports filed with the SEC that the reports comply with the relevant securities laws and also fairly presented, in all material respects, the financial condition and results of operations of the company.

Question 7

What are the advantages and Disadvantages of using a Questionnaire to document an understanding of internal control?

Answer 7

Advantages

1- Easy to complete
2- Comprehensive list of questions make it unlikely that important portions of internal control will be overlooked
3- Weaknesses become obvious (generally those questions answered with a “no”)

Disadvantages
1- May be answered without adequate thought being given to questions
2- Questions may not “fit” client adequately

Question 8

What are the advantages and disadvantages of a memoranda or narrative documentation of understanding internal control?

Answer 8

Advantages

1- Tailor-made for engagement
2- Requires a detailed analysis and thus forces auditor to understand functioning of structure

Disadvantages

1- May become very long and time-consuming
2- Weaknesses in structure not always obvious
3- Auditor may overlook important portions of internal control.

Question 9

What are the advantages and disadvantages of the flowchart method of documenting the understanding of internal control?

Answer 9

Advantages

1- Graphic representation of structure
2- Usually makes it unlikely that important portions of internal control will be overlooked
3- Good for electronic systems
4- Not long working (as in case of memoranda)

Disadvantages

1- Time-consuming to prepare
2- Weakness in structure not always obvious.

Question 10

What is a decision table?

Answer 10

In addition to questionnaires, memoranda, and flowcharts auditor may prepare this tool to document their understanding of internal control. Decision tables are graphic methods of describing the logic of decisions. Various combinations of conditions are matched to on of several actions.

Question 11

What is a dual-purpose test?

Answer 11

It is a test that will test controls and details on the same transaction

Question 12

Perform tests of controls are used to test either the effectiveness of the design or operation of a control. What are some approaches used?

Answer 12

Inquiries of appropriate personnel
Inspection of documents and reports
Observations of the application of controls
Reperformance of the control by the auditor

Question 13

Is an auditor allowed to use the results of prior years tests of controls in the current audit?

Answer 13

PCAOB standards do not allow this.

Auditing standards allow this in limited circumstanes. If no significant changes have occurred in those controls, then they should test the operating effectiveness of such controls at lease once in every third year in an annual audit.

Question 14

Audits - Sarbanes-Oxley Act of 2002 created a requirement for an integrated audit of SEC registrants assurance about the fairness of financial statements and about the effectiveness of internal control over financial reporting. The financial statement audit portion of the integrated audit is similar to any other financial statement audit, but its integrated nature means that auditors rely much more on internal control and less on substantive procedures.

Answer 14

T

Question 15

What is the objective of audit of Internal control?

Answer 15

It is to express an opinion on the effectiveness of the company’s Internal Control:

1- To form a basis for such an opinion, the auditor should plan and perform the audit to obtain reasonable assurance about whether material weaknesses exist as of the date of management’s assessment
2- The existence of one ore more material weaknesses leads to a conclusion that IC is not effective

Question 16

What is a deficiency?

Answer 16

The design or operation of a control does not allow management or employees in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis (A Deficiency is also referred to as a control deficiency)

Question 16

What is a deficiency?

Answer 16

The design or operation of a control does not allow management or employees in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis (A Deficiency is also referred to as a control deficiency)

Question 17

What is a Significant deficieny?

Answer 17

A deficiency, or combination of deficiencies, in IC that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting

Question 18

What is a material weakness?

Answer 18

A deficiency, or combination of deficiencies, in IC such that there is a reasonable possibility that a material misstatement of the Company’s annual or interim financial statements will not be prevented or detected on a timely basis.

Reasonable Possibility is either “Reasonably possible” or “Probable”

Question 19

What is a control objective?

Answer 19

A specific target against which to evaluate the effectiveness of controls. A control objective for IC generally relates to a relevant assertion and states a criterion for evaluating whether the company’s control procedures in a specific area provide reasonable assurance that a misstatement in that relevant assertion is prevented or detected on a timely basis.

Question 20

An Audit of internal control may be viewed as having the following structure?

Answer 20

1- Plan the audit
2- Use a top-down approach to identify controls to test
3- Test design and operating effectiveness of controls
4- Evaluate identified deficiencies
5- Wrap-up
6- Report on internal control

Question 21

The first step of audit over internal control is “Plan the Audit” what are the components?

Answer 21

• The opinion on internal control is as to whether internal control is effective at a point in time - the “as of date”
• Similar to a typical audit of financial statements, the auditor should obtain an understanding of the company’s industry, regulations affecting the company, the company’s business, and recent changes in operations and internal control
• Risk assessment underly’s the entire audit process
• Scaling the audit - Size and complexity affect how companies achieve control objectives.
• Addressing the risk of fraud:
  Controls that might address risk of fraud and management override includes controls over (a) significant, unusual transactions (b) JE’s and adjustments (c) Related-party transactions (d) significant management estimates (e) incentives or pressures of management to falsify or inappropriately manage financial results.
• Entity-level controls vary in nature and precision (Some entity level controls will allow that either more, reduce or not test additional controls related to risk

Question 22

The Second step of the Audit is to use a top-down approach to identify controls to test. What are the components?

Answer 22

• A Top-down approach beginning at the financial statement level, should be used to select controls to test.
• Entity level controls (Controls related to the control environment, controls over management override, company’s risk assessment process, centralized processing and controls, controls to monitor results of operations, controls to monitor other controls, controls over period-end financial reporting process, policies that address significant business control and risk management practices)
• The auditor should evaluate the period-end financial reporting process
• Identifying significant accounts and disclosures
  1- Consider (size and composition of account, susceptibility to misstatement, volume of activity, complexity, homogeneity of transactions, nature of account, accounting and reporting complexities, exposure to losses in account, possibility of significant contingent liabilities, related party transactions, changes from the prior period in accounts or disclosures
  2- The auditor should identify significant accounts and disclosures and their relevant assertions; relevant assertions include (existence or occurrences, completeness, valuation or allocation, Rights and obligations, Presentation and disclosure)
• To obtain a further understanding of the likely sources of misstatement, and as a part of selecting the controls to test, the auditor should achieve the following objectives (Understand the flow of transactions, verify that he or she has identified points at which a material misstatement could arise, identify controls implemented by management to address potential misstatements, Identify controls to prevent or detect unauthorized acquisition, use or disposition of assets that would result in material misstatement.
• Selecting controls to test - Test those that are important to a conclusion about whether company’s controls sufficiently address the assessed risk of misstatement for each relevant assertion, IT is not necessary to test redundant controls, unless redundancy is itself a control objective.

Question 23

The third step of an Audit on internal control is to test design and operating effectiveness of controls?

Answer 23

• Design effectiveness
• Operating effectiveness (procedures include inquiry, observation, inspection and reperformance) Walk-throughs may be used to test operating effectiveness. Walk-throughs involves following a transaction from origination through the company processes until it is reflected in the financial statements consists of a combination of inquiry, observation, inspection, and Re-performance.
• Auditors are not responsible for obtaining sufficient evidence to support an opinion about the effectiveness of each individual control; rather, their objective is to express an overall opinion on IC
• When the auditor identifies deviations from established controls s/he should determine the effect of the deviation on his/her assessment of the risk associated with the control and an operating effectiveness.
• The more extensively a control is tested, the grater the evidence obtained from the test.
• When the auditor obtains evidence about operating effectiveness at an interim date, s/he should determine what additional evidence is needed for the remaining period
• In subsequent year’s audits, the auditor should incorporate knowledge obtained during past audits of IC

Question 24

The fourth step in an audit plan is Evaluate Identified Deficiencies, what are the detials?

Answer 24

• Although the audit is designed to identify material weaknesses, any deficiencies the auditor has identified should be considered, the severity of the deficiency depends on (1) whether there is reasonable possibility that the control will fail to prevent or detect a misstatement or (2) the magnitude of the potential misstatement
• Details on evaluating deficiencies
  (a) Factors affecting the magnetite include Financial statement totals & Volume of activity exposed
  (b) The maximum amount that an account balance can be overstated is generally the recorded amount, while understatements can be larger
  (c) The auditor should consider the effect of compensation controls which might detect such a misstatement, if an adequate compensation control exists, the deficiency is not a material weakness
  (d) The auditor need not identify a material, misstatement for a deficiency to be considered a material weakness– rather, there should be a reasonable possibility of a material misstatement
• What are indicators of material weakness
  (1) Identification of fraud, whether or not material, on the part of senior management
  (2) Restatement of previously issued financial statements to reflect a correction of a misstatement
  (3) Identification by the auditor of a material misstatement that would not have been detected by the company’s IC
  (4) Ineffective oversight of external reporting and IC by the audit committee

Question 25

Step 5 of the Audit is about the Wrap-up of the audit, what does it contain?

Answer 25

• The auditor should perform an opinion
• written representations from the client should be obtained
• Communicating certain matters
  (1) Material weaknesses - Communicate, in writing, to management and the audit committee prior to issuing the audit report on IC
  (2) Significant deficiencies - Communicate, in writing, to management and the audit committee
  (3) Significant deficiencies and deficiencies (those that are not material weaknesses) Communicate in writing to management and inform the audit committee when such a communication has been made
  (a) significant deficiencies and deficiencies previously communicated to management in writing by the audit, internal auditors, or other in the organization, need not be repeated to management
  (b) Significant deficiencies that are not corrected and were previously communicated to the audit committee should be recommunicated. The auditor may re-communicate them by referring to the prior communication.
  (4) The auditor should not issue a report stating that no significant deficiencies or deficiencies were noted during the audit.

Question 26

The last (sixth) step of the Audit on internal control is on the “Report on Internal Control” What are the components of the report?

Answer 26

• Report should include
  (1) Title with word ‘independent’
  (2) Statement that management is responsible for IC
  (3) Identification of management’s report on IC
  (4) Statement that the auditor’s responsibility is to express an opinion on IC
  (5) Statement that the auditor’s responsibility is to express an opinion of IC
  (6) Definition of IC
  (7) Standards of PCAOB require auditor to plan and perform audit to obtain reasonable assurance
  (8) Audit includes obtaining an understanding of IC, assessing risk that a materiel weakness exists, testing and evaluating the design and operating effectiveness of IC, and performing other necessary procedures
  (9) The auditor believe the audit provides reasonable basis for his/her opinion
  (10) Paragraph on inherent limitation of IC
  (11) Auditor’s opinion on whether company maintained effective IC
  (12) Manual pr printed signature of firm
  (13) City and State of firm
  (14) Date of report
• Separate reports on the financial statements and IC or a combined report are acceptable
• Report date – no earlier than the date on which auditor has obtained sufficient competent evidence to support opinion
• Material weaknesses result in an adverse opinion
• The auditor should inquire of management as to any subsequent events affecting IC and should obtain written representation

Question 27

What are the major differences between PCAOB standard 5 and AT 501?

Answer 27

• PCAOB refers to this an an “audit”, while AT 501 refers to it as an “examination”
• Both standards are structured about reporting on internal control at a point of time “AS OF”. AT 501 also allows an auditor to examine effectiveness of internal control for a period of time
• Both standards provide for reporting on the subject matter (Internal control), but AT 501 also allows for reporting on management’s assertion/ However, when a material weakness exists in an AT 501 engagement, the auditor should report on the subject matter.
• Both standards require that the auditor not issue a report stating that no significant deficiencies exists, but only AT 501 explicitly requires that no such report be issued stating that no material weaknesses were identified during the examination.
• The stage referred to “Wrapping-up” by PCAOB is “concluding procedures” by AT 501
• The reports issued on IC are very similar, but differ that that PCAOB 5 states that the audit was conducted in accordance with standards of the PCAOB. While AT 501 states that the examination was conducted in accordance with attestation standards established by the AICPA

Question 29

What is directional testing?

Answer 29

Basic idea is testing from a source document forward to recorded entries

Testing from the source document to a recorded entry is a test of Completeness ( Used to detect understatement) - ALSO KNOWN AS TRACING

Testing from a recorded entry back to a source document is a test of existence (Used to detect overstatement) - ALSO KNOWN AS VOUCHING

Question 30

What three duties should always be segregated for good internal control?

Answer 30

Authorization
Record-keeping
Custodianship

Question 31

What are the MAJOR CONTROLS for the sales, receivables, and Cash Receipts Cycle?

Answer 31

Sales

• Credit granted by a credit department
• Sales orders and invoices pre-numbered and controlled
• Sales returns are presented to receiving clerk who prepares a receiving report which supports pre-numbered sales return credit memoranda

Accounts Receivable

• Subsidiary ledger reconciled to control ledger regularly
• Individual independent of receivable posing reviews statements before sending to customers
• Monthly statement sent to all customers
• Write-offs approved by management official independent of record-keeping responsibility (Treasurer is appropriate)

Cash Receipts

• Cash receipts received in mail listed by individuals with no record-keeping responsibility (Cash goes to cashier, remittance advices go to accounting)
• Over-the-counter cash receipts controlled (Cash register tapes)
• Cash deposited daily
• Employees handling cash are bonded
• Lockbox, a post office box controlled by the company’s bank at which cash remittances from customers are received. The bank collects customer remittances, immediately credits the cash to the company’s bank account, and forwards the remittance advices to the company.
• Bank reconciliations prepared by individuals independent of cash receipts record-keeping

Question 32

What are the Major Controls for the Purchases, Payables, and Cash Disbursements cycle?

Answer 32

PURCHASES

• Pre numbered purchase orders used
• Separate purchasing department makes purchases
• Purchasing personnel independent of receiving and record-keeping
• Suppliers monthly statements compared with recorded payables

ACCOUNTS PAYABLE

• Accounts payable personnel independent of receiving and record-keeping
• Clerical accuracy of vendor’s invoices tested
• Purchase order, receiving report, and vendor’s invoice matched

CASH DISBURSEMENTS

• pre-numbered with a mechanical check protector used
• two signatures on large check amounts
• Checks signed only with appropriate support (purchasing order, receiving report, vendor’s invoice) Treasurer signs checks and mails them
• Support for checks canceled after payment
• voided checks mutilated, retained and accounted for
• Bank reconciliations prepared by individual independent of cash disbursements record-keeping
• Physical control of unused checks

Question 33

What are the Major Controls for the inventory and production cycle?

Answer 33

• Perpetual inventory records for large dollar items
• Pre-numbered receiving reports prepared when inventory received; receiving reports accounted for
• Adequate standard cost system to cost inventory items
• Physical controls against theft
• Written inventory requisitions used
• Proper authorization of purchases and use of pre-numbered purchase orders

Question 34

What are the major personnel and Payroll controls?

Answer 34

• Segregation: Time-keeping, payroll preparation, Personnel, Paycheck Distribution
• Time Clocks are used where possible
• Job time tickets reconciled to time clock cards
• Time clock cards approved by supervisors (overtime, and regular hours)
• Treasurer signs paychecks
• Unclaimed paychecks controlled by someone otherwise independent of payroll function (locked up and eventually destroyed if not claimed)
• Personnel department department promptly sends termination notices to the payroll department

Question 35

What are the major controls of the Financing area?

Answer 35

• Debt and equity transactions are properly approved by the company’s board of directors
• An independent trustee handles bond transactions
• A Stock registrar and a stock transfer agent handle capital stock transactions
• Canceled stock certificates are defaced to prevent their re-issuance

Question 36

What are the major investment controls frequently missing in CPA exam questions?

Answer 36

• Segregation of duties among the individuals authorizing purchases and sales of securities, maintaining custody of the securities, and maintaining the records of securities
• Use of an independent agent such as a stockbroker, bank or trust company to maintain custody of securities
• Securities not in the custody of the independent agent maintained in a bank safe-deposit box under the joint control of the treasurer and one other company official; both individuals should be present to gain access
• Registration of securities in the name of the company
• Detailed records of all securities and related revenue from interest and dividends
• Periodical physical inspection of securities by individuals with no responsibility for their authorization, custody, or record-keeping for investments

Question 37

Property, Plant, and Equipment major controls frequently missing in CPA exam questions

Answer 37

• Major asset acquisition are properly approved by the firm’s board of directors and properly controlled through capital budgeting techniques
• Detailed records are available for property assets and accumulated depreciation
• written policies exist for capitalization vs expensing decisions
• Depreciation properly calculated
• Retirements approved by an appropriate level of management
• Physical control over assets to prevent theft
• Periodic physical inspection of plant and equipment by individuals who are otherwise independent of property plant and equipment

Question 38

What is a control deficiency? and if found, is it required to be communicated to Management? to those charged with governance?

Answer 38

A Control deficiency it is a design or operation of control that does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis.

Yes, it is required to report it to management
No, it is not required to be reported to those charged with governance

Question 39

What is a significant deficiency? and if found, is it required to be communicated to Management? to those charged with governance?

Answer 39

A significant deficiency is less severe than a material weakness, yet important enough to merit attention to those charged with governance

Yes, it is required to be disclosed to both management, and those charged with governance.

Question 40

What is a material weakness? and if found, is it required to be communicated to Management? to those charged with governance?

Answer 40

A material weakness is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected on a timely basis

Yes it is required to be reported to management, and those charged with governance

Question 41

Handout on control deficiencies illistrated that following communication requirements:

Answer 41

1- Required to the extent that they come to your attention
2- Must be WRITTEN to management AND those charged with governance
3- Show significant deficiencies and material weaknesses AND potential effects on the financial statements
4- Not required to give recommendations
5- Cannot write that “no significant deficiencies found” buy may write “no material weaknesses found”
6- Other communication to management about other deficiencies noted (other than significant deficiencies or material weaknesses) may be written or oral

Question 42

AU-C 265 requires auditors to communicated significant deficiencies and material weaknesses to management. This report should be written, and is generally referred to as a “by-product” of the audit, what are some of the written requirements?

Answer 42

Should include:

1- Purpose of consideration of IC was to express opinion on Financial statements and not an opinion on IC
2- Auditor is not expressing an opinion on IC
3- Consideration of IC not designed to identify all significant deficiencies or material weaknesses
4- Definition of material weakness and significant deficiency
5- Separately describe significant deficiencies and material weaknesses identified
6- Indication that the communication is for management, those charge with governance and others within the orgnization, IT SHOULD NOT BE USED BY OTHERS

Question 43

AU-C discusses the effect of internal audit function on the CPA’s audit. It states that internal auditors have two primary effects on the audit what are they?

Answer 43

(1) Their existence and work may affect the nature, timing, and extent of the audit procedures and (2) CPA’s may use internal auditors to provide direct assistance in performing procedures

the CPA should assess both the competence and objectivity of internal auditors

Competence - is evaluated by considering education, experience, professional certification, audit policies, and various work policies

Objectivity - is assessed by considering organizational status within the company, and policies for assuring that internal auditors are objective with respect to the areas being tested.

Question 44

Reports on Processing Transactions by Service organizations

Answer 44

Service organizations often rely on controls of other organizations and as such often obtain from their CPA’s a report on those elements of internal controls that are relevant to the users and their auditors