Risk Assessment Flashcards
Control Environment
The overall tone of the organization
Risk Assessment
Managements identification of risk
Information and Communications Systems
A mean of recording transactions and communicating resposibilities
Monitoring
Assessment of internal control performance over time
Existing Control Activities
Control Policies and procedures
Five Components of Internal Control
(C) Control Risk (R) Risk Assessment (I) Information and Commiunications (M) Monitoring (E) Existing Control Activities
“CRIME”
CPA is required to understand each element of “Crime” : as it relates to financial reporting
Information Technology Segregation of Duties
(C) - Control Team (O) - Operator (P) - Programmer (A) - Analyst (L) - Librarian
“COPAL”
Audit Process
- General Principles
- Engagement Acceptance
- Assess Risk & Plan Response
- Perform Procedures & Obtain Evidence
- Form Conclusions
- Reporting
Audit Planning
(N) - Nature (preliminary evaluation materiality, audit risk, internal control)
(E) - Extent (Scope of Audit, size and complexity, IT, prior experience)
(T) - Timing (deadlines, key dates,)
(C) - Completeness (account balances, trans, disclosure)
(O) - Cutoff (correct accounting period)
(V) - Valuation, Allocation, and Accuracy act. Balances (account balances, transactions)
(E) - Existence (Balance and trans exist)
(R) - Rights; Obligations
(U) - Understandability,Classification (disclosure is clearly expressed)
“COVER U”
Must be written and can be adjusted as time goes on.
Audit Evidence Hierarchy (Identifying Risk)
Remember your vowels!!! (A) - Auditors knows (E) - External Evidence (I) - Internal Evidence (O) - Oral Evidence (U) - Know it!
Audit Reporting (Private)
(M) - Management (R) Responsibility Paragraph
(D) - Design
(I) - Implementation
(M) - Maintenance
(R) Reports (E) Express (P) Plan (O) Obtain (R) Risk (T)Test "Internal Controls" (S) Statements
(C) Control (R) Reasonableness (A) Accounting (M) Management (E) Evaluating
“MR DIM REPORTS CRAME”
Is departure from US GAAP allowed if financial statements would be otherwise misleading?
Yes, departure from US GAAP is allowed if financial statements would be otherwise misleading.
Still issue unmodified/unqualified opinion.
Disclosure in the notes.
Professional Skepticism
is the recognition that circumstances may exist that cause the financial statements to be materially misstated.
Emphasis Of Matter Paragraph
- Going Concern
- Material justified change in accounting principal
- Material Misstatement in prior financial statements
- Special Purpose Framework
Special: Change in audit opinion could potentially be state in the emphasis of matters paragraph.
You can have a emphasis of matters paragraph with a un modified, modified, adverse, disclaimer
Other Matter Paragraph
- Restrict use of Report
- Prior financial statements audited by prior auditor has not been presented.
- Comparative financial statements where current year is audited but PP is not audited.
- Material inconsistency in other information
- Report of supplementary information within auditors report
- Refer to required Supplementary information
- report on compliance included in auditors report.
Special: Change in audit opinion could potentially be state in the emphasis of matters paragraph.
Explanatory Paragraph (Issuer/Public)
- Restrict use of Report
- Prior financial statements audited by prior auditor has not been presented.
- Comparative financial statements where current year is audited but PP is not audited.
- Material inconsistency in other information
- Report of supplementary information within auditors report
- Refer to required Supplementary information
- report on compliance included in auditors report.
Special: Change in audit opinion could potentially be state in the emphasis of matters paragraph.
Standard Audit Procedures to obtain evidence
(C) Confirmation
(F) Footing, Cross Footing, Recalculation “Valuation”
(“A Vowel” - Auditor Knows)
(I) Inquiry (“O Vowel” - Oral Evidence)
(V) Vouching (“I Vowel” - Internal Evidence)
(E) Examination/Inspection (“A Vowel” - Auditor Knows)
(C) Cutoff Review “No Back Dating” (“I Vowel” - Internal Evidence)
(A) Analytical Procedures (“A&I Vowel”)
(R) Reperformance (A Vowel)
(R) Reconciliation (I Vowel)
(O) Observation (A Vowel)
(T) Tracing “Expenses & Liabilities are not understated” (I Vowel)
(W) Walk-through (A&O Vowel)
(A) Audit Related Accounts simultaneously (I Vowel)
(R) Representation Letter (I Vowel)
(S) Subsequent Events Review (All Vowels)
1. Contingencies
2. Unrecorded Liabilities
3. Disclosures
“C FIVE CARROT WARS”
Remember the Facebook game Farmville.
Substantive Procedures
$$$$$ lets test the money
- Transactions Total
- Account Balances
- Disclosures
Vouching
Risk of overstatement -Revenue -Assets Testing for existence/occurrence "Moving Down"
Example: start vouching with the sales journal (financial statements) to invoice
Tracing
Risk of understatement -Expenses -Liabilities Testing for completeness/coverage "Moving Up"
Example: start tracing with the shipping doc to invoice to sales journal(financial statements) to audit sales
Sampling
Rule 1: Always assume that the population being sampled is normally distributed, that is, it can be described by a “normal” or “bell shaped curve” (Central limit theorem)
Rule 2: For the estimates that the CPA makes about the population to have mathematical validity, the samples have to be unrestricted and randomly selected, which means that:
- every item in a population must have an absolutely equal chance of being selected .
- The CPA cannot use “Bias” in deciding which items will be selected. No substitute items may be used. (Only area where CPA does not use judgement)
Rule 3: If the sample is large enough and is randomly selected, the sample will likely have the same statistical characteristics (mean and standard deviation) as the underlying population; that is, it will be representative of the population.
Rule 4: Standard deviation is a measure of “variability” which refers to the range of values within the population. (Sample Risk)
“Variability=Uncertainty=Larger sample size”
Does statistical sampling eliminate the need for auditing judgment?
No, Judgment is required to set many of the parameters and to evaluate the overall results.
Attribute Sampling
Most common in TESTING CONTROLS (Yes or NO MCQ)
Testing for specific characteristics (seeking errors) IC.
Variables Sampling
Estimating the dollar value of the population, substantive testing
Risk of incorrect acceptance (Beta Risk, sample results fail to identify an existing material misstatement)
Risk of incorrect rejection (Alpha Risk, lack of efficiency, sample results mistakenly indicate a material misstatement)
Sampling Risk
probability that sample is wrong
Non Sampling Risk
- use wrong audit procedures
- improperly evaluate evidence/results
Tolerable Deviation Rate
tolerable mistakes = risk of misstatement
Deviation Rate VS Tolerable Rate
The deviation rate in the sample is the auditors best estimate of the deviation rate in the population from which it was selected.
Select the Sample (Rule 2)
most common random election
systematic selection - same day every month
block (cluster) sampling - ok if has random start
Evaluate the Sample Results (Rule 3)
Sample deviation rate (+) Allowance for sampling risk = upper deviation rate.
Sampling Exam Trick
examiners sometimes try to trick candidates into using the sample deviation rate (instead of the upper deviation rate) in drawing conclusions about a population. Always consider worst case scenario.
Elements of CPA Firms Quality Controls - identified by Statement on Quality Control Standards (SQCS)
- leadership responsibilities for quality within the firm
- relevant ethical requirements
- acceptance and continuance of client relationships and specific engagements
- human resources
- engagement performance
- monitoring
Can a CPA firm disclose the names of its audit clients?
A CPA firm may disclose name of clients but the disclosure may not suggest that the client may be experiencing financial difficulties.
Control Environment
the foundation of a business is its people and the environment
Risk Assessment
organizations must set objectives to identify, analyze, and mange risk
Control Activities
Policies and procedures are needed to make sure control objectives are effectively carried out.
Information and communication
organizations should create and use information and communication systems to plan, conduct, manage, evaluate, and control their operations.
Monitoring Activities
information systems and internal control policies and procedures are monitored and modified as needed.