Module 3: Internal Control and Control Risk - Key Terms

Question 1

What are assertions?

Answer 1

Representations by management, explicit or otherwise, that are embodied in financial stmts, as used by auditor to consider the diff. types of potential misstmts that may occur.

Question 2

What is control risk?

Answer 2

Risk that material misstmt that could occur in an assertion about a class of transaction, account balance, or disclosure and that could be material, either ind. or when aggregated, will not be prevented, detected and corrected in timely basis by entity’s internal control

Question 3

What is a deficiency in internal control?

Answer 3

Exists when design or operation of a control does not allow management or employees, in normal course of performing their assigned functions, to prevent, or detect and correct misstmts on timely basis.

Question 4

When does a deficiency in design exist?

Answer 4

When a control necessary to meet the control objective is missing or an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met.

Question 5

When does a deficiency in operation exist?

Answer 5

When a properly designed control does not operate as designed or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.

Question 6

What is the Foreign Corrupt Practices Act 1977?

Answer 6

Fed. legislation prohibiting payments to foreign officials for the purpose of securing business. Requires all SEC jurisdiction companies to maintain a system of IC to provide reasonable assurance that transactions are executed only with the knowledge and authorization of management.

Question 7

What is Internal Control?

Answer 7

A process, effected by those in governance, management, and other personnel - designed to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with laws and regulations. Internal control over safeguarding of assets against unauthorized acquisition, use or disposition may include controls relating to financial reporting and operations objectives.

Question 8

What is the Internal Control checklist?

Answer 8

On of several methods of describing internal control in audit working papers. Checklists are usually designed so that NO answers prominently identify weaknesses in IC.

Question 9

What is an Internal Control Flow Chart?

Answer 9

A method of describing internal control in audit working papers. A symbolic representation of a system or series of procedures with each procedure shown in sequence.

Question 10

What is an internal control questionnaire?

Answer 10

A method of describing internal control in audit working papers. May either ask open ending questions, yes/no (similar to the checklist)

Question 11

What is an internal control narrative?

Answer 11

Method of describing internal control in audit working papers. A written summary of IC for inclusion in audit working paper - generally a memo

Question 12

What is material weakness?

Answer 12

A deficiency, or combo of deficiencies, in IC, such that there is a reasonable possibility that a material misstatement of fin. stmts will not be prevented, detected and corrected

Question 13

What is a report on management’s description of a service org’s sysstem and suitability of the design of controls? (TYPE 1 REPORT)

Answer 13

1. Management’s description of service org’s system 2. Written assertion by management of service org about whether, in all material respects, and based on suitable criteria: (1) Management’s description of service org’s system fairly presents service org’s system that was designed and implemented as of a specified date (2) controls related to control objectives stated in description were suitably designed to achieve those control objectives as of the specified date 3. Service auditor’s report that expresses an opinion on the matters

Question 14

What is a report on management’s description of a service org’s system and suitability of the design and operating effectiveness of controls? (TYPE 2 REPORT)

Answer 14

1. Management’s description of the service org’s system 2. Written assertion by management of the service org, about whether in all material respects, and based on suitable criteria, (1) description of service org’s system fairly presents the service org’s system that was designed and implemented THROUGHOUT the specified period (2) Controls related to control objectives stated in description of service org’s system were suitable designed THROUGHOUT specified period to achieve those objectives (3) Controls related to control objectives stated in description of the service org’s system operated EFFECTIVELY throughout the specified period to achieve those control objectives 3. Service auditor’s report that: (1) expresses an opinion about matters (2) includes a description of the service auditor’s test of controls and the results

Question 15

What are the primary differences between TYPE 1 REPORT and TYPE 2 REPORT?

Answer 15

1. A Type 2 report deals with controls over a time period (often a year), while Type 1 reports deal with controls at a point in time 2. Only Type 2 report addresses operating effectiveness

Question 16

What is the Sarbanes Oxley Act of 2002? (SOX)

Answer 16

Set of reforms that strengthened penalties for corporate fraud, restricted the types of consulting CPAs could perform for audit clients, and created the PCAOB (Public Accounting Oversight Board) to oversee CPAs and public accounting firms

Question 17

What is a service auditor?

Answer 17

A practitioner who reports on controls at a service organization.

Question 18

What is a service organization?

Answer 18

An organization or segment of an org that provides services to user entities that are likely to be relevant to user entities’ internal control as it relates to financial reporting.

Question 19

What is a service organization’s system?

Answer 19

The policies and procedures designed, implemented and documented by management of org to provide user entities with services covered by service auditor’s report. Management’s description of the service org’s system identifies the services covered, the period to which the description relates, the control objectives specified by management or an outside party, the party specifying the control objectives and the related controls

Question 20

What is a significant deficiency?

Answer 20

A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

Question 21

What is a substantive procedure?

Answer 21

An audit procedure designed to DETECT material misstatements at the assertion level. Compare tests of details (classes of transactions, account balances, and disclosures) and substantive analytical procedures.

Question 22

What are “those charged with governance?”

Answer 22

The person(s) or organization(s) with responsibility for overseeing the strategic direction of the entity and the obligations related to the accountability. This includes overseeing the financial reporting process. They may include, management personnel (examples: executive members of a governance board or an owner manager)

Question 23

What is “tests of controls?”

Answer 23

An audit procedure designed to evaluate the operating effectiveness of controls in preventing or detecting/correcting material misstatements at the assertion level

Question 24

What is the user auditor?

Answer 24

An auditor who audits and reports on the financial statements of a user entity

Question 25

What is a user entity?

Answer 25

An entity that uses a service org and whose financial statements are being audited

Question 26

What is a walk-through?

Answer 26

A procedure in which an auditor follows a transaction from origination through company’s processes, including information systems, until it is reflected in the company’s financial records, using the same docs and info tech that company personnel use. Walkthrough procedures usually include a combo of inquiry, observation, inspection or relevant doc, and reperformance of controls