SU 9: Internal Control Communications and Reports

Question 1

1.) Internal Control Com - Correct or Incorrect The communication should not refer to “our audit of f/s”

Answer 1

a. Incorrect – The communication should indicate that the purpose of the audit was to report on the f/s and provide assurance on internal control.

Question 2

2.) Internal Control Com - Correct or Incorrect The communication should not indicate that providing assurance is not the purpose of consideration of internal control

Answer 2

a. Correct –The communication should indicate that internal control was considered for the audit but not to express an opinion on internal control

Question 3

3.) Internal Control Com - Correct or Incorrect The communication should refer to “conformity with GAAP”

Answer 3

a. Incorrect – The communication relates to control deficiencies, not whether f/s are in conformity with GAAP

Question 4

4.) Internal Control Com - Correct or Incorrect The communication should not refer to deficiencies because such a reference is inconsistent with the expression of an unqualified opinion on the f/s

Answer 4

a. Incorrect – The purpose is to communicate significant deficiencies and material weakness. Thus, it is appropriate to refer to control deficiencies in communication

Question 5

5.) Internal Control Com - Correct or Incorrect The statement “can be expected to identify all deficiencies” is inappropriate

Answer 5

a. Correct – The AICPA’s illustrative written communication states that the consideration of internal control “was not designed to identify all deficiencies that might be significant deficiencies or material weaknesses”

Question 6

6.) The definition of a control deficiency need not be presented because the communication is about significant deficiencies

Answer 6

a. Incorrect – The AICPA’s illustrative written communication state the definition of control deficiency to place significant deficiencies in the correct context

Question 7

7.) Internal Control Com - Correct or Incorrect The phrase “does not allow the auditors, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis” is not appropriate.

Answer 7

a. Correct – The phrase should refer to “management or employees” not to “the auditors”

Question 8

8.) Internal Control Com - Correct or Incorrect The term “inconsequential” should not be used

Answer 8

a. Correct – The definition of significant deficiency does not include the term “inconsequential”

Question 9

9.) Internal Control Com - Correct or Incorrect The communication should define “material weakness”

Answer 9

a. Correct – The communication defines “material weakness” and, if relevant, “significant deficiency”

Question 10

10.) Internal Control Com - Correct or IncorrectThe report should state that significant deficiencies were identified but should not identify them

Answer 10

a. Incorrect – The specific significant deficiencies should be listed in the communication

Question 11

11.) Internal Control Com - Correct or Incorrect The communication need not suggest corrective actions be taken by the client

Answer 11

a. Correct – The AICPA’s illustrative written communication is silent as to corrective action.

Question 12

12.) Internal Control Com - Correct or Incorrect The restriction on the communication’s use is inappropriate because other parties ordinarily would receive the communication

Answer 12

a. Incorrect – The communication is intended for use by management, those charged with governance, and others within the organization. If the entity must provide such communication to a governmental authority, it should specifically refer to that authority. Moreover, it is not intended to be used and should not be used by anyone other than these specific parties.

Question 13

13.) Internal Control Com - Correct or Incorrect The communication should indicate whether the f/s audit resulted in an unqualified opinion

Answer 13

a. Incorrect – The communication need not identify the type of opinion that was expressed on the f/s

Question 14

14.) Internal Control Com - Correct or Incorrect The communication should indicate that the auditor is not responsible for updating the communication for events or circumstances occurring after the date of communication

Answer 14

a. Incorrect – the communication should not contain a statement about the auditor’s responsibility for updating the communication. The auditor has no such obiligation

Question 15

15.) Internal Control Com - Correct or Incorrect The communication may not be dated after the auditor’s report in f/s

Answer 15

a. Incorrect – The communication is best made at the audit report release date, but it should be made no later than 60 days after the audit report release date

Question 16

1.) Include or Exclude State the purpose of the audit was to express an opinion on the f/s, and to express an opinion on the effectiveness of internal control over financial reporting

Answer 16

a. Excluded, the purpose of the consideration of internal control in a f/s is to plan the audit

Question 17

2.) Include or Exclude Identify, if applicable, items that are considered to be material weakness

Answer 17

a. Included, the letter should identify any issues that are considered to be material weakness

Question 18

3.) Include or Exclude State that the auditor is not expressing an opinion on the effectiveness of internal control

Answer 18

a. Included, The letter should state that the auditor is not expressing an opinion on the effectiveness of internal control

Question 19

4.) Include or Exclude Include definition of significant deficiency

Answer 19

a. Included, the letter should state the definition of a significant deficiency

Question 20

5.) Include or Exclude Include definition of material weakness, where relevant

Answer 20

a. Included, the letter should state the definition of a material weakness if any were reported

Question 21

6.) Include or Exclude State that the auditor is expressing an unqualified opinion on the effectiveness of internal control

Answer 21

a. Excluded, the consideration of internal control in a f/s audit provides no assurance on internal control

Question 22

7.) Include or Exclude State that the communication is intended solely for management and external parties

Answer 22

a. Excluded, the letter should state that the communication is intended solely for management and those charged with governance and not to external parties

Question 23

8.) Include or Exclude Identify matters that are considered to be significant deficiencies

Answer 23

a. Included, the letter should identify the matters that are considered to be significant deficiencies.

Question 24

A service auditor’s report on internal control may be issued on management’s description of a service organization system and the suitability of the design of controls or management’s description of a service organization system and the suitability and operating effectiveness of controls. Which of the following is true about a type 1 report?

Answer 24

It should state that the auditor did not test the effectiveness of the controls.
A service auditor’s type 1 report should contain a statement that the auditor did not test the effectiveness of the controls.

Question 25

A service organization provides processing services for a client’s sales orders. Which of the following information is relevant when gathering data for the report on the service organization’s internal controls?

Answer 25

The service organization’s system calculates accounts receivable balances.
The auditor should obtain an understanding of the nature and significance of the services provided by the service organization and their effect on the user entity’s internal control relevant to the audit. The understanding should be sufficient to identify and assess the risks of material misstatement. By understanding how the service organization’s system calculates accounts receivable, the auditor can evaluate the associated internal controls.

Question 26

Firms subject to the reporting requirements of the Securities Exchange Act of 1934 are required by the Foreign Corrupt Practices Act of 1977 to maintain satisfactory internal control. Moreover, the Sarbanes-Oxley Act of 2002 requires that annual reports include (1) a statement of management’s responsibility for establishing and maintaining adequate internal control and procedures for financial reporting, and (2) management’s assessment of their effectiveness. The role of the registered auditor relative to the assessment made by management is to

Answer 26

Determine whether management’s report is complete and properly presented.
According to PCAOB AS 2201, the auditor must express (or disclaim) an opinion on the effectiveness of internal control. Moreover, if the auditor determines that elements of management’s annual report on internal control over financial reporting are incomplete or improperly presented, the auditor should modify his or her report to describe the reasons for this determination.

Question 27

Which of the following statements is true about an auditor’s communication to those charged with governance?

Answer 27

The auditor is required to inform those charged with governance about misstatements discovered by the auditor and not subsequently corrected by management.
The matters to be communicated to those charged with governance include uncorrected misstatements, other than those not accumulated by the auditor because they are clearly trivial. The auditor communicates uncorrected misstatements and the effect they may have, individually or aggregated, on the opinion. Furthermore, material uncorrected misstatements should be identified individually. Also, the auditor should communicate to those charged with governance the effect of uncorrected misstatements related to prior periods (AU-C 260).

Question 28

Under the AICPA’s auditing standards, which of the following statements about an auditor’s communication of significant control deficiencies is true?

Answer 28

An auditor’s report on significant control deficiencies should include a restriction on the use of the report
A communication of significant control deficiencies should (1) state that the purpose of the audit was to report on the financial statements, not to provide assurance on internal control; (2) give the definition of significant control deficiencies and material weaknesses; and (3) state that the report is intended solely for the information and use of those charged with governance, management, and others within the organization (or specified regulatory agency) and is not intended to be, and should not be, used by anyone other than the specified parties.

Question 29

AU-C 260 Com with those charged with Gov

Answer 29

1. ) Overview of planned scope and timing of audit
2. ) Auditor’s responsibility reasonable but not absolute assurance
3. ) Significant accounting policies
4. ) Sensitive accounting estimates
5. ) Uncorrected misstatements
6. )Aspects of entity accounting policies
7. ) Significant difficulties during the audit
8. ) disagreements with Mgmt
9. ) Other findings

Question 30

Registered firm under SOX 2002

Answer 30

1. ) Critical accounting policies
2. ) All alt treatments within GAAP discussed with mgmt
3. ) Ramifications of such treatments
4. ) Prefered treatment by firm

Question 31

Service auditors may report

Answer 31

1.) the fairness of managements description of controls and whether controls have been suitably designed (type 1)
2.) On operating effectiveness (type 2)
Note: the type 1 report should include a disclaimer of operating effectiveness

Question 32

Risk assessment underlies the examination process including determination of

Answer 32

1. ) significant accounts and disclosures
2. ) relevant assertion
3. ) Controls to test
4. ) evidence necessary to assess the effectiveness of a given control