Audit Midterm 4

Front 1

internal control (COSO)

Back 1

process to assure reliability of fin. reporting, compliance w/ laws and regs, & effectiveness and efficiency of operations

Front 2

limitations of IC

Back 2

reasonable, but not absolute assurance that control objectives will be achieved, human errors, mgmt overrides, and deliberate circumvention are all potential breakdowns

Front 3

COBIT

Back 3

control objectives for information and related technology - set of best practices for IT mgmt, generally accepted measures

Front 4

5 COSO components

Back 4

control environment
risk assessment
control activities
info and communication
monitoring

Front 5

control environment

Back 5

"tone at the top", foundation for all other IC components, includes org.-wide integrity, ethics, corp. governance, mgmt style, org structure, HR policies, etc.

Front 6

risk assessment process

Back 6

should consider external and internal events that may arise & adversely affect the entity's ability to initiate, record, and process fin. data consistent with F/S assertions

Front 7

control activities

Back 7

guts of IC system, can be manual or computerized.
key elements: design and operation/implementation of controls
3 processing levels: transaction, accounting estimates, adjusting & closing JEs

Front 8

control activities examples

Back 8

segregation of duties, physical access controls to safeguard assets, info processing controls, reconciliations/performance reviews

Front 9

information and communication

Back 9

AIS usually network of smaller systems, each processing a unique type of transaction
applications each have unique source documents-auditor develops understanding of how transactions are entered and controls for each application

Front 10

monitoring

Back 10

mgmt's ongoing & periodic assessment of quality of IC performance to determine whether controls need modification (essentially controls over controls-feedback system for other 4 components)

Front 11

mgmt vs auditor responsibilities (MGMT)

Back 11

identify risks that impact org., enact 5 components of IC, identify weaknesses in IC (deficiencies in design, operation, IC, or material weakness in IC)

Front 12

mgmt vs auditor responsibilities (auditor)

Back 12

understand and test IC to assess control risk, provide opinion on IC (for public COs), provide feedback to mgmt on IC weaknesses

Front 13

4 steps for auditor evaluation of IC

Back 13

1. obtain & document understanding of entity risks and 5 components of IC
2. make preliminary CR assessment
3. test controls for effectiveness (if appropriate or public CO)
4. evaluate results (& re-evaluate preliminary CR assessment)

Front 14

1. how to obtain an understanding of I/C

Back 14

top down approach:
examine CO level controls first
identify significant accounts and relevant assertions
identify points at which errors or fraud could occur
identify controls to test to prevent/detect misstatements

Front 15

audit procedures to help understand IC

Back 15

review of client docs/flowcharts
tour facilities/plants
interviews and questionnaires
walk-throughs and physical verification of controls where feasible
*review prior year's workpapers

Front 16

2. preliminary assessment of control risk

Back 16

weak, ineffective, or non-existent controls lead to high CR and thus cannot rely on IC-perform more substantive tests
low CR means auditor must test CR (for compliance) to make sure they are operating effectively

Front 17

moderate CR assessment

Back 17

best assessment, does not require control testing
can only be given if: org. had been audited by firm before w/ no IC problems, no significant changes in the system this year, CO is not public

Front 18

bridge workpaper

Back 18

helps auditors consider implication of IC strengths & weaknesses on their audit plan to test controls

Front 19

3. testing controls (examples)

Back 19

re-performance (calculations)
inspection of document for evidence of control (signature)
examination of supporting evidence (time cards)
inquiry & observation

Front 20

guidelines to consider when testing controls

Back 20

transaction controls (sampling techniques), TCs built into computer apps, monthly control procedures (ensure design is effective), YE controls (last qtr of year and 1st qtr of next year

Front 21

4. evaluate results of IC testing and update assessment

Back 21

if tests reveal weaknesses-increase substantive procedures. (if public CO, control weaknesses considered in terms of PCAOB defs)
Even 1 material weakness results in adverse opinion on IC
if testing indicates CR is low, substantive procedures can be reduced

Front 22

control deficiency

Back 22

exists when the design or operation of a control does not allow the CO to detect or prevent misstatements

Front 23

significant deficiency

Back 23

a control deficiency or combination of deficiencies in IC that is less sever than a material weakness, yet important enough to merit attention

Front 24

material weakness

Back 24

a control deficiency or combination of deficiencies such that there is a reasonable possibility that a material misstatement in the COs interim or annual F/S will not be prevented or detected

Front 25

private CO reporting results of IC

Back 25

mgmt: no requirements
auditor: summarize weaknesses and recommendations in mgmt letter

Front 26

public CO reporting results of IC

Back 26

mgmt: separate report required in 10k summarizing mat. weaknesses
auditor: identify sign. def. and mat. weaknesses, report findings to audit committee, provide separate IC audit opinion