Not specifically linked Flashcards
Questions that we would ask component auditors (subsidiaries)
ISA 600: component auditors
Weaknesses in a system
- Authorisation and approval
- Sound personnel practices
- Signing without assurance of physical control
- Docs do not agree to each other
Masterfile controls
- Strict password controls are in place
- Password should have at least 6 characters, not be displayed on the screen & checked regularly - Access should be restricted
- All amendments should be authorized
- All amendments should be automatically sequentially logged by the system
- Timeout facility where is automatically shuts down after 5 min inactivity.
- Should shut down after 3 failed log in attempts
- Should not be write access to the log of the masterfile amendments
- MAF should be cross referenced to the credit application
Audit opinion –> based on final materiality
- Why is it a misstatement
- What is the misstatement
- Quantitatively (> final materiality) vs qualitatively (NOCLAR)
- Factual (amount is given), Judgmental/projected (estimated usually from sampling)
- Pervasive (affects the financial statements as a whole or only a single line item in then financial statements)
- Request management to adjust (no = disagreement with management despite the auditor having sufficient and appropriate audit evidence that it is not in line with IFRS)
- Audit opinion
Audit opinion (subsequent events)
- Event occurred on… it’s a subsequent event
- Conditions existed before/after year end, thus adjusting vs non-adjusting
- Implications for IAS 10 –> Disclose or include amount in AFS.
- Adequately disclosed/adjusted by management -> qualified AO with emphasis of matter paragraph
- Not adequately adjusted/disclosed = go into misstatement format from QvsQ
Conclude: qualified, unqualified, adverse
Business risks
- MM may not comply with relevant L&R regarding … (personnel info) = legal liability and penalties
- Unauthorised access to computer system = loss of confidential data
- Fictitious customers may be created where we never receive payment from customers = financial loss
- Business continuity risk if system crashes = financial loss
- Transactions occur online = loss of data/ inadequate audit trail
Weaknesses in IT control environment (Give scenario examples)
- Weak enforcement of integrity and ethical values because there’s no remedial action taking place where behavior is inappropriate
- Lack of competence -> lack of training
- Lack of participation by those charged with governance
- The board does not accept overall responsibility of governance (who has full control of everything?)
- MM operating style does not enforce sound controls which is evidenced by how..
- No segregation of duties
- Strict policies are not in place
Application controls
- Employee should use a unique username and password to log into the system
- Password controls: Mix of letters, changed regularly, unique/random
- Read-only access
- Exception reports should be generated based on automated controls: Validity check, reasonableness check, limit check
What should be considered before assigning you to be audit manager
- Understanding of the audit engagement
- Knowledge in the industry your auditing
- Understanding of the audit standards and related regulations
- Technical expertise in accounting and auditing dealing with (complex accounting eg FOREX)
- Ability to apply professional judgement
- Understanding of the firms quality control procedures
- Independence from the company that you’re auditing.
Overall audit plan
Nature:
- Because of the nature of the client, cannot use sub-procedures alone, therefore, CAATs are necessary
Timing
Focus on performing tests at/after year end due to the increased risk
Extent
- The extent of sub-procedures and manual TOC performed should be increased
- The extent of automated TO will not be affected because of the computerized process being consistent
Ethical considerations for the integrity of MM before accepting the auditi
XYZ is part of the key manangement personnel, and his ingrity should be considered (list everything that he’s done & if a threat is identified)
Business reputation is sound -> ABC focuses on….
Basically, when thinking about things you need to consider before the audit, use ISQM 1:
For integrity: A68 as a huide
Main points are behavious of key management personnel (integrity should be considered) -> what did they do and do they impact CPC (If CPC lay it out)
Also think about clients operations or business practices (reputation): what are they doing for the community?
What are general controls?
Everything that the company does not have control over. Includes access controls, controls over the staff (attitude, division of duties, confidential info, skills and competence and board review) + integrity and ethics.
