Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Audit > SU 06 Internal Control > Flashcards

SU 06 Internal Control Flashcards

1
Q

What are an auditors options as their response to assessed risk?

A
  • Tests of controls
  • Substantive Procedures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What do tests of controls consist of

A
  • assessing controls over processes
  • assessing the control environment overall
  • assessing the operating effectiveness of controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What affects the operating effectiveness of internal controls

A

Overall their value in reducing RMM

  • are they designed well
  • are they implemented and operating properly
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are substantive procedures

A

audit procedures designed to produce evidence that may be used in court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What circumstances may indicate increased risk

A
  • changes in overall operating environment
  • new personnel
  • new/ revamped IT
  • rapid growth
  • new technology
  • new business models-products-activities
  • corporate restructuring
  • expanded foreign operations
  • new accounting pronouncements
  • new
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Is an auditor required to assess internal controls?

A

Yes - part of SOX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Internal control components

A

C.R.I.M.E

  • Control activities
  • Risk assessment
  • Information and communication systems
  • Monitoring
  • Environment (control environment)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who is responsible for internal controls

A

Client management / governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the auditor’s responsibility in regard to internal controls

A

have the responsibility for assessing their existence/ management assertions about them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Control activities include

A
  • performance reviews
  • general vs application controls
  • physical controls
  • segregation of duties
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which duties must be segregated

A

authorization from recording from custody

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is the difference between general and application controls

A
  • General controls are over the whole system - controls at the business level
  • application controls are built into specific applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Objectives of internal controls

A

1) to prevent or detect financial statement misstatements
2) to control operational objectives
3) to control compliance objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Limitations of internal controls

A
  • human judgement is faulty
  • collusion may circumvent controls
  • management may override controls
  • impossible to create perfect controls (esp not at reasonable cost)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Levels of internal controls

A
  • entity level (general and application controls)
  • transaction/ assertion level controls (address specific FS issues)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What might transaction/ assertion controls address

A
  • CAPE CROC asssertions
  • transactions and account balances
  • IS & BS balances
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Types of entity-level controls

A
  • organizational structure
  • clear assignment of authority and responsibility
  • adequate segregation of duties
  • IT planning in alignment with business strategy
  • compliance with licensing , laws, and regulations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Classes of internal controls

A
  • Automated vs Manual
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

classes of automated controls

A
  • IT General Controls (ITGC)
  • IT Application controls
  • IT-dependent manual controls
20
Q

Types of IT General Controls

A
  • data center & network
  • system software acquisition, change, and maintenance
  • program change
  • access
  • application system acquisition, development, & maintenance
21
Q

Preventive controls

A
  • designed to stop errors before they occur
  • often generate error messages/ alerts
  • leave no documentary trail?
  • informed by “WCGWs”
22
Q

WCGSs

A

What can go wrong

23
Q

Detective controls

A

Designed to catch fraud or errors after functions or transactions occur
- also informed by WCGWs
- important they can detect & intervene in a timely manner
- often use IT application controls for detection
- often built in as a post-processing procedure
- can be applied to each transaction or to batches

24
Q

Preventive vs detective control

A
  • preventive more frequent, more dependent than IT, but also generally more cost effective
  • preventive produces less evidence than detective
  • auditors tend to focus on detective due to the larger amount of evidence
25
Q

Internal control functionalities

A

may be:
- complementary
- redundant
- compensation

26
Q

Complementary internal controls

A

Two or more controls working together for the same objective

27
Q

Redundant internal controls

A

two or more controls working separately for the same objective

28
Q

Compensating internal controls

A

One control works to offset the lack of / weakness in another control

29
Q

Types of tests of controls

A

inquiry (never sufficient alone)
inspection
observation
re-performance

30
Q

Benchmarking as a test of controls

A

comparing current results with previous audit results

31
Q

Service organizations

A

Organization that provides services to the client such that the service org’s services and controls are part of the client’s information system and relevant to financial reporting

32
Q

Type 1 service auditor’s report

A

reports on controls implemented

opinion only on the the description of controls and suitability of the design to the environment

33
Q

Type 2 service auditor’s report

A

Report on controls implemented AND test of operating effectiveness of internal controls

34
Q

Are service auditor’s reports ever referred to in audit reports?

A

NEVER in an unmodified opinion (do not relieve auditor of liability)

may be referenced in modification of opinion but must indicate reference does not reduce liability

35
Q

Risk assessment for service organizations

A
  • must assess the degree of interaction between the service org and client (user) High = user initiates all processes, low = service org initiates, processes transactions independently
  • must get written representations from service org’s management
36
Q

Requirement for management documentation of IC

A

must provide a written assessment

37
Q

Requirement for auditor response to IC

A

Must issue opinion on:
- management assessment of IC
- Actual effectiveness of IC

Must also communicate to management any material weaknesses and significant deficiencies discovered in the course of the audit

38
Q

Significant deficiencies

A

Issues with internal controls that do not rise to the level of materiality

39
Q

Internal control risks in IT

A
  • system availability
  • volatile transaction trails
  • lack/ decrease in human involvement
  • uniform processing (errors repeated)
  • unauthorized access
  • data vulnerability
  • reduction in segregation of duties
40
Q

Major types of application IT controls

A
  • input controls
  • processing controls
  • output controls
41
Q

When does data analytics outperform sampling

A
  • when appropriate data is available, relatively clean and doesn’t require significant manipulation to be usable
  • when the population is large
  • when the auditor has a good understanding of the underlying business processes
42
Q

Why does the XBRL requirement increase IC issues

A
  • increased outsourcing for programming
  • new software/ programming –> potential errors
  • additional data manipulation
  • requires additional control tests/ disclosures
43
Q

Ways to document internal control assessments

A
  • systems flowcharts
  • questionnaires
  • narrative memoranda
  • decision tables
  • checklists of procedures
  • data analytics
44
Q

System flowchart

A

overview of inputs, processes, outputs

45
Q

Program flowchart

A

specific steps in computer programs

46
Q

Document flowchart

A

tracks flow of documents through an entity

47
Q

Management letter

A

prepared by the audit team
provided to board of directors
includes required internal control assessment
lists significant deficiencies and material weaknesses

Audit (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions