SSAEs - Integrated Audit (non issuer)

Question 1

The auditor’s basic responsibilities

Answer 1

the auditor should plan and perform the integrated audit to achieve the objectives of both engagements simultaneously; that is, design the tests of control to (1) obtain sufficient appropriate evidence to support the auditor’s opinion on internal control as of the period end and (2) obtain sufficient appropriate evidence to support the auditor’s control risk assessments for purposes of the audit of the financial statements.

Question 2

Top down approach

Answer 2

The auditor should (1) begin at the financial statement level; (2) use the auditor’s understanding of the overall risks to internal control; (3) focus on “entity-level controls” (e.g., the control environment, the entity’s risk assessment process, monitoring controls, etc.); (4) focus on accounts, disclosures, and assertions that have a reasonable possibility of material misstatement to the financial statements; (5) verify the auditor’s understanding of the risks in the entity’s processes (including “walkthroughs”); and (6) select controls for testing based on the assessed risk of material misstatement to each relevant assertion.

Question 3

Indicators of material weaknesses

Answer 3

(1) discovery of any fraud involving senior management; (2) restatement of previously issued financial statements to correct a material misstatement; (3) identification of any material misstatement during the audit that was not detected by internal control; and (4) ineffective oversight of reporting and controls by those charged with governance.

Question 4

Communication

Answer 4

1. Any identified material weaknesses and significant deficiencies—should be communicated in writing by the report release date. (For governmental entities only, the written communication must occur within 60 days of the report release date.)
2. Any lesser deficiencies—should be communicated in writing to management within 60 days of the report release date (and should inform those charged with governance of that communication).
3. Communicating an absence of deficiencies—the auditor should not issue any report stating that “no material weaknesses” (or that “no significant deficiencies”) were identified in an integrated audit.

Question 5

5 reasons to Modify the Auditor’s Report on ICFR

Answer 5

(1) if elements of management’s report are incomplete or improperly presented (add an explanatory paragraph); (2) if there is a scope limitation (either withdraw or disclaim an opinion); (3) if the opinion is based partially on the report of another auditor (component auditor); or (4) management’s report contains other additional information, such as commentary about corrective action taken (disclaim an opinion on the other information)
5. adverse opinion issued