Performing Further Procedures & Obtaining Evidence Flashcards
audit evidence - sufficiency, appropriateness
sufficiency: measure of the quantity of audit evidence
appropriateness: measure of the quality of evidence; i.e. relevance and reliability in providing support for conclusions on which auditor’s opinion is based
if audit evidence or results of an audit procedures are inconsistent with other evidence or other audit procedure then auditor must determine whether modifications or additions to audit procedure are necessary to resolve such inconsistencies in or doubts about reliability of audit evidence
audit evidence - reasonable assurance
reasonable assurance: obtained when auditor has obtained sufficient appropriate evidence to reduce audit risk (risk that auditor expresses an inappropriate opinion when FS are materially misstated) to an acceptably low level
The (higher or lower?) the assessment of risk, the (more or less?) persuasive evidence is needed to respond to the risk.
The higher the assessment of risk, the more persuasive evidence is needed to respond to the risk.
As the quality of audit evidence (increases or decreases?), the need for additional corroborating audit evidence (increases or decreases?).
As the quality of audit evidence increases, the need for additional corroborating audit evidence decreases.
reliability of audit evidence: (when is it more reliable?)
1) audit evidence is more reliable when obtained from knowledgeable independent sources outside the entity
2) internally generated audit evidence is more reliable when the related controls are more effective
3) audit evidence obtained directly by auditor (observation of control) may be more reliable than that obtained indirectly or by inference (inquiry about control)
4) audit evidence is more reliable when exists in documentary form (paper, electronic)
5) original documents are more reliable than photo copies or facsimiles
reliability of information to be used as audit evidence is affected to varying degrees by the following attributes:
1) accuracy - info transferred from original medium to electronic or digitized format, reliability depends on controls over info’s transformation and maintenance
2) completeness - when significant amount of data is electronically initiated/recorded and is only available in electronic form, sufficiency and appropriateness of audit evidence usually depends on controls over accuracy and completeness
3) authenticity - when a document may not be authentic, additional audit procedures are necessary: confirming directly with 3rd party, using work of specialist to assess document’s authenticity
4) susceptibility to mgmt bias - (usually internally generated information) considered less reliable than information with less susceptibility to mgmt bias, auditor must exercise professional judgment to determine
a) ability of entity to influence external information source
b) mgmt’s selection of information for external source known to be favorably biased toward corroborating mgmt’s assertions of the information
c) external information, which is less likely to be subject to influence if provided to the public for free or to a wide range of users for payment/fee
The auditor should obtain audit evidence to draw reasonable conclusions on which to base the audit by performing audit procedures to: (what are risk assessment procedures, substantive procedures, tests of controls?)
1) risk assessment procedures: obtain understanding of entity and its environment, incl IC to assess risks of material misstatement at FS and relevant assertion levels
2) substantive procedures: tests of details or classes of transactions, account balances and disclosures, and substantive analytic procedures to detect material misstatements at the relevant assertion level
(audit procedures include: inspection of records or documents, inspection of tangible assets, observation, remote observation tools, inquiry, confirmation, recalculation, reperformance, analytical procedures (study of plausible relationships among financial and nonfinancial data))
3) tests of controls: test operating effectiveness of controls in preventing or detecting material misstatements at the relevant assertion level
substantive procedures include: FIVE CARROT CARS
footing
inquiry
vouching
examination
confirmation
analytical procedures
reperformance
reconciliation
observation
tracing
cutoff review
audit related accounts
subsequent events review
Reg S-K annual report on internal control over financial reporting
Regulation S‐K under the securities laws requires management to provide an annual report on internal control over financial reporting. In this report, management must make statements, or assertions, about
the entity’s internal control. One of these statements is whether or not the internal control over financial reporting is effective. Management’s discussion must include disclosure of any material weaknesses in the entity’s internal control.
Management is not permitted to conclude that the entity’s internal control is effective. The auditor must identify procedures to validate the completeness and accuracy of data and information obtained from management
If one or more material weaknesses are detected, more substantive audit test work will be required.
With this report, the entity must include an attestation report from a public accounting firm registered with the Public Company Accounting Oversight Board (PCAOB). The attestation report provides an opinion on the
effectiveness of the entity’s internal control over financial reporting. As issuers are required to have their financial statements audited as well, the auditor integrates the two
audits (audit of internal control over financial reporting and audit of the financial statements).
Do controls sufficiently address risks of material misstatement?
What to consider -
controls over significant unusual transactions, particularly late or unusual JEs
controls over JE made at year end
controls over related party transactions
controls related to significant estimates
controls that mitigate incentives for and pressure on mgmt to falsify or manage financial results
to integrate the audit of IC over financial reporting and the audit over the financial statements, auditor should design testing of controls to accomplish the objectives of both audits simultaneously:
a) to obtain sufficient evidence to support the auditor’s opinion on internal control over financial reporting as of year‐end and
b) to obtain sufficient evidence to support the auditor’s control risk assessments for purposes of the audit of financial statements.
Obtaining sufficient evidence to support control risk assessments of low for purposes of the financial statement audit ordinarily allows the auditor to reduce the amount of audit work that otherwise would have been necessary to provide an opinion on the financial statements.
auditor should design sufficient tests of controls to obtain sufficient appropriate audit evidence that the controls are operating effectively throughout the period of reliance, considering following factors:
frequency of performance of control
length of time relied upon the effectiveness of control
relevance and reliability of audit evidence obtained to support control preventing/detecting/correcting material misstatements at relevant assertion level
extent that audit evidence is obtained from tests of other controls related to the relevant assertion
extent to which auditor plans on relying on the operating effectiveness of the control in the assessment of risk
expected deviation from control
When the auditor has determined that it is not possible or practicable to reduce the risks of material misstatement at the relevant assertion level to an acceptably low level with audit evidence obtained only from substantive procedures, should perform tests of controls to obtain audit evidence about their operating effectiveness.
If auditor plans to rely on controls that have not changed since they were last tested, the auditor should test the operating effectiveness of such controls at least once in every third audit (while a shorter period of reliance may be necessary).
In considering whether it is appropriate to use audit evidence about the operating effectiveness of controls obtained in prior audits and, if so, the length of the time period that may elapse before retesting a control, the auditor should consider:
1) effectiveness of other elements of IC, incl control environment, entity’s monitoring of controls, entity’s risk assessment
2) risks arising from characteristics of control, incl whether control is manual or automated
3) effectiveness of IT controls
4) effectiveness of control and application of the control by entity, incl nature and extent of deviations in application of control in tests during prior audits
5) whether lack of change in particular control poses risk due to changing circumstances
6) risk of material misstatement and extent of reliance on control
The (more or less?) the auditor relies on the operating effectiveness of controls in the assessment of risk, the (greater or lesser?) is the extent of the auditor’s tests of controls. In addition, as the rate of expected deviation from a control (increases or decreases?), the auditor should (increase or decrease?) the extent of testing of the control.
The more the auditor relies on the operating effectiveness of controls in the assessment of risk, the greater is the extent of the auditor’s tests of controls. In addition, as the rate of expected deviation from a control increases, the auditor should increase the extent of testing of the control.
auditor bias:
1) availability bias -
2) confirmation bias -
3) overconfidence bias -
4) anchoring bias -
5) automation bias -
auditor bias:
1) availability bias - tendency to place more weight on events or experiences at top of mind or more readily available than those not
2) confirmation bias - tendency to place more weight on information that corroborates an existing belief
3) overconfidence bias - tendency to overestimate one’s own ability to make accurate assessment of risk or other judgments or decisions
4) anchoring bias - tendency to use initial piece of information as anchor against which subsequent info is inadequately assessed
5) automation bias - tendency to favor output generated from automated systems, even when human reasoning or contradictory information raises questions about whether such output is reliable or fit for purpose
8 types of legal evidence:
1) best evidence (provides primary evidence) - examination of cash receipts to prove evidence of collectibility; reconciling shipping records to recorded sales provides evidence about completeness of recirded revenues
2) secondary evidence (cannot be relied upon)
3) direct evidence (no presumptions or inferences are required)
4) circumstantial evidence (doesn’t directly prove existence of primary fact)
5) conculsive evidence (does not directly provide existence of primary fact)
6) corroborative evidence (additional evidence of a different character)
7) opinion evidence (based on seeing or hearing; expert opinion permitted)
8) hearsay evidence (second-hand evidence; not admissible)
AUDIT RISK =
AUDIT RISK = (INHERENT RISK X CONTROL RISK = RISK OF MATERIAL MISSTATEMENT) X (ANALYTIC PROCEDURES X TESTS OF DETAILS = DETECTION RISK)
RMM higher = DR lower/higher?
if risk of material misstatement is higher it means that the acceptable level of detection risk should be lower; more substantive procedures needed
RMM lower = DR lower/higher?
if risk of material misstatement is lower it means that the acceptable level of detection risk can be higher; less substantive procedures are necessary
inherent risk =
control risk =
detection risk =
inherent risk = RMM in company’s process; control risk = MM not detected by company’s IC procedures; detection risk = MM not detected by auditor during audit
sample size too low = risk of assessing control risk too ___?
sample size too low = risk of assessing control risk too high
sampling risk -
sampling risk - possibility that conclusions about a test of controls or substantive test would be different if test had been applied to the entire population rather than the test sample.
what is complement to sampling risk?
complement to sampling risk is confidence or reliability - if auditor accepts 5% sampling risk, the reliability/confidence level is 95%
sampling risk varies _______? to sample size - (greater or smaller?) the sampling risk you’re willing to accept, the (larger or smaller?) the sampling size needs to be
sampling risk varies INVERSELY to sample size - greater the sampling risk you’re willing to accept, the smaller the sampling size needs to be
nonsampling risk -
nonsampling risk - all aspects of audit risk that are not due to sampling:
1) failure to properly define audit population
2) failure to clearly define nature of audit exception
3) failure to recognize an error when one exists in the sample
4) failure to evaluate sample findings properly
Statistical sampling -
Statistical sampling - laws of probability can be used to make statements about a population. For a sampling plan to be statistical, the following two requirements must be met:
a) sample must be statistically selected (eg random number table selection)
b) sample results must be mathematically evaluated
statistical sampling examples
random: random number table or computer generated
systematic: interval, random starting point with uniform interval (as long as no pattern to bias)
Nonstatistical sampling -
Nonstatistical sampling - any sampling plan that does not meet all the rigorous requirements of statistical sampling
nonstatistical sampling examples
haphazard - no conscious bias
block sampling - contiguous population items (all invoices processed on a certain date)
discovery sampling - use when expected occurrence rate is near zero, designed to yield sample size large enough so if auditor is wrong at least one occurrence will be produced, used to search for very critical characteristic that might indictae more serious issue
mean -
standard deviation -
normal distribution/distribution of sample means -
standard error of the mean =
mean - A measure of central tendency that is obtained by totaling all the values and dividing by the number of items
standard deviation - measures the extent to which the values of the items are spread about the mean.
normal distribution/distribution of sample means - shape of distribution is normal if sample size is large enough; distribution is centered at the population mean; standard error of the mean = estimated population standard deviation (SD) divided by square root of the sample size
Variable sampling (substantive procedures) -
Variable sampling - substantive procedures (analytical procedures - evaluations of financial information through analysis of plausible relationships among both financial and non-financial data, tests of details - collect evidence that balances, disclosures, and underlying transactions associated with FS are correct)
AUDIT RISK = (INHERENT RISK X CONTROL RISK = RISK OF MATERIAL MISSTATEMENT) X (ANALYTIC PROCEDURES X TESTS OF DETAILS = DETECTION RISK)
factors that increase sample sizes:
factors that increase sample sizes:
1) larger population monetary amount (note that number of sampling units has no effect)
2) decreased tolerable misstatement
3) higher risk of material misstatement
4) fewer/no other relevant substantive procedures (detection risk not satisfied by other procedures)
5) increased size or frequency of expected misstatement