Auditing Quiz 3 + Chapter 8

Front 1

Internal controls

Back 1

built in safeguards which, if implemented properly, will increase the likelihood that published financial statements are reliable, timely, and transparent

Front 2

5 COSO components of an entity's internal control

Back 2

1. The control environment
2. Management’s risk assessment
3. Information and communication
4. Control activities
5. Monitoring

Front 3

COSO: The control environment

Back 3

The overall attitude of management, the board of directors, and owners toward the importance of controls
No other control is enough without this

Front 4

COSO: The control environment: Factors

Back 4

1. Commitment to integrity and ethical values
2. Management and philosophy style (approach for business risk and attitudes towards financial reporting/accounting)
3. The board of directors
4. Management establishes clear reporting lines
5. Attract, develop, and retain competent individuals
6. Management and board must establish performance measures, incentives, and rewards

Front 5

COSO: The control environment: Factors
The board of directors are/must be

Back 5

o Independent from managers
o Oversees internal controls
o Interacts with internal and external auditors
o Asks management tough questions

Front 6

COSO: The control environment: Factors
Establishing clear reporting lines

Back 6

o Has a well-spaced organizational chart
o Employees know what they are accountable for

Front 7

COSO: The control environment: Factors
Performance measures, incentives, and rewards must

Back 7

o Reflect reasonable expectations, considering long and short term goals
o Reduce temptations
o Are aligned with fulfilling IC activity

Front 8

COSO: Management's risk assessment

Back 8

Management must identify and analyze risks relevant to financial statement preparation (changes that could affect ICS, fraud risk, etc.)

Front 9

COSO: Information and communication

Back 9

The organization uses relevant, quality information to support the functioning of internal control

Front 10

COSO: Information and communication: Factors

Back 10

• Information systems should identify, process (classify), value, and present all valid transactions in the appropriate accounting period
• Management should communicate employees’ roles and responsibilities about internal control over financial reporting

Front 11

COSO: Control activities

Back 11

Policies and procedures that help ensure management’s directives are carried out and designed to prevent and detect errors in accounting data (strengthens AIS)

Front 12

COSO: Control activities: Examples

Back 12

Performance reviews
Information processing controls - general and application controls
Physical controls - physical asset security
Segregation of duties

Front 13

These three duties should be segregated

Back 13

Authorization and approval of a transaction
Accounting, recording, and reconciling the transaction
Custody of or access to the related asset

Front 14

COSO: Monitoring

Back 14

an ongoing process of periodic assessment of internal control; an entity’s ability to check itself to make sure controls are effective over time

Front 15

Inherent limitations of IC systems

Back 15

Collusion
Management override
Human error and inconsistency

Front 16

Why evaluate internal controls?

Back 16

1. If it’s a public company, SOX Section 404 requires the auditor to issue a separate report on internal controls
2. To assess control risk

Front 17

Steps to evaluate internal controls

Back 17

1. Obtain understanding of internal controls for business processes and specific assertions
2. Document the understanding of internal control
3. Preliminary assessment of control risk (maximum or lower?)

Front 18

Steps to evaluate internal controls:
Obtain understanding of internal controls:
For each business process, do the following

Back 18

• Identify the types of misstatements that could occur
• Determine necessary controls to prevent and detect
• Determine whether designed and in place
• Identify weaknesses
• Design substantive procedures for weaknesses found
• Communicate weaknesses as reportable conditions

Front 19

Steps to evaluate internal controls:
Document the understanding of IC:
Sources

Back 19

(1) Study of the organizational structure
(2) Update from previous experience
(3) Inquiry of client personnel
(4) Study manuals, documents, and records
(5) Observation of activities and operations

Front 20

Steps to evaluate internal controls:
Preliminary assessment of control risk:
Choosing a strategy

Back 20

If control risk is maximum, don't rely on them and instead use more substantive testing
If control risk is low, you can use a reliance strategy

Front 21

Steps to evaluate internal controls:
Preliminary assessment of control risk:
Why would control risk be at maximum?

Back 21

• No control pertinent to that assertion
• Controls are not perceived to be good
• Testing controls is not considered to be cost-effective (it may be cheaper to do more substantive testing instead)

Front 22

Forms of document understanding (with pros and cons)

Back 22

1. Narrative description
Advantage: rigor of analysis
Disadvantage: difficulty for reviewer to follow
2. IC questionnaire/checklist
Advantage: easy to complete; comprehensive
Disadvantage: tendency toward cursory review
3. IC flowchart
Advantage: easy to review; visual depiction
Disadvantage: hard to get in-depth understanding

Front 23

Audit risk model

Back 23

AR = IR * CR * DR

Front 24

Test of controls

Back 24

Performed to provide support for lower level of CR assessment

Front 25

Procedures used as a test of controls

Back 25

- Inquiry
- Inspection of documents, reports, electronic files
- Observation of application of control
- Walkthroughs – tracing transaction through system
- Reperformance of application of control

Front 26

How do strong ICs reduce the cost of substantive tests

Back 26

Nature – replace a costly test like confirmations with less costly test like analytical procedures
Timing – move timing of test to interim period
Extent – reduce sample size or number of tests

Front 27

Communication of internal control within public and private companies

Back 27

Public company – the auditor issues a separate report on the effectiveness of internal controls
Private company – the auditor does not have to perform a separate auditor of the internal controls, but the auditor may discover control deficiencies during the audit

Front 28

What challenges does a sophisticated IT system present for an auditor?

Back 28

• audit trails may only exist electronically (no printed copies)

• program errors may cause uniform transaction errors programmed controls may have to make up for lack of adequate segregation of duties and manual review
• detecting unauthorized access may be difficult (especially for real time systems)

Front 29

Two general approaches to auditing computer-based systems

Back 29

1. Auditing "around" the computer - extensive testing of the inputs and outputs of the IT system and little or no testing of processing
2. Auditing "through" the computer - testing computer hardware and software (input and processing phases)

Front 30

Categories of control in an IT environment

Back 30

General controls - relate to all parts of the computerized system
Application controls - relate to one specific use of the system; controls that help ensure the completeness and accuracy of transaction processing, authorization, and validity in specific applications

Front 31

General control areas to test

Back 31

• Segregation of duties within IT function (rotation of operator duties & mandatory vacations)
• Systems development and documentation (with internal audit participation in design)
• Access Controls to prevent unauthorized access to computer rooms, systems, programs, and files
• Review of operating systems control log to ensure no unauthorized activities
• Back-up files at off-site locations

Front 32

Application control areas to test

Back 32

• Make sure all transactions are recorded, and recorded only once, and that errors are rejected and corrected before they’re reentered
• Programmed edit checks help ensure accuracy

Front 33

How to test application controls

Back 33

CAATs (computer assisted auditing techniques)

Parallel simulation - the auditor writes a computer program that mimics part of the client’s system; the auditor’s program is used to process actual client data on client hardware and results are compared

Front 34

Types of CAATs

Back 34

1. Generalized audit software
2. Custom audit software
3. Test data

Front 35

Generalized audit software:
What was it developed for?
What does it provide?

Back 35

o Developed to allow auditors to perform similar CAATs in different IT environments
o Software provides a high-level computer language to allow tests of clients’ files and databases

Front 36

Drawbacks of custom audit software

Back 36

expensive to develop, takes a long time to develop, and limited functions

Front 37

How to use test data CAATs

Back 37

o Involves a series of fictitious transactions containing intentional errors
o Auditor examines the results and determines whether the errors were detected by the system

Front 38

Drawbacks of test data CAATs

Back 38

1. Could mix up fictitious and actual data
2. Preparation of test data examining all aspects of the application is difficult
3. Auditor doesn't know that the program being tested is the one actually used in the routine process

Front 39

Generalized audit software examples

Back 39

File or data access – reads and extracts data from a client’s computer files or databases for further audit testing
Selection operators – select from files or databases transactions that meet certain criteria
Arithmetic functions – perform a variety of arithmetic calculations on transactions, files, and databases
Statistical analysis – provide functions supporting various types of audit sampling
Report generation – prepares various types of documents and reports

Front 40

How to mitigate increased risks associated with sophisticated IT systems

Back 40

• Effective documentation of systems, programs, and program changes
• Password security
• Computer Editing
• Computer log of all activities
• Backup files

Front 41

Two types of intentional misstatements

Back 41

1. Fraudulent financial reporting
2. Misappropriation of assets

Front 42

Fraudulent financial reporting

Back 42

• Manipulation or falsification of accounting records or documents
• Misrepresenting (or omission of) events, transactions, and significant information
• Intentionally misapplying accounting principles (GAAP)
• Usually committed by management to deceive financial statement users

Front 43

Misappropriation of assets

Back 43

• Involves theft of the company’s assets and includes:
o Defalcation
o Embezzlement
o Stealing assets
o Causing the entity to pay for goods or services not received
• Usually committed by employees against the entity

Front 44

SAS 99 Fraud Triangle's three sides

Back 44

opportunities, incentives/pressure, and attitude/realization

Front 45

Risk factors related to incentives/pressures to commit fraud

Back 45

Financial stability, growth, or profitability are threatened by:
• Economic conditions
• Industry conditions
• Entity’s operating conditions
Excessive pressure for management to meet 3rd party expectations and company targets
Management’s personal financial position is highly dependent on entity’s financial performance

Front 46

Risk factors related to opportunities to commit fraud

Back 46

• Nature of the industry
Ineffective monitoring of management
• Complex or unstable organizational structure
• Inadequate internal controls

Front 47

Risk factors related to attitudes/rationalizations to commit fraud

Back 47

• Weak ethical standards for management behavior and poor communication channels for reporting inappropriate behavior
• Non-financial management’s excessive participation in selection of accounting principles and estimates
• Known violations of laws and/or rules by management or board
• Excessive interest by management in maintaining or increasing stock price or earnings
• Management history of committing to unrealistic or aggressive forecasts
• Management history of justifying inappropriate accounting based on materiality

Front 48

Audit of ICFR (internal control over financial reporting performed in conjunction with an audit of financial statements)

Back 48

a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP

Front 49

ICFR controls include procedures that:

Back 49

1. Pertain to the maintenance of records that fairly reflect the transactions and dispositions of the assets of the company.
2. Provide reasonable assurance that transactions are recorded in accordance with GAAP.
3. Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company’s assets.

Front 50

Control deficiency

Back 50

exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis (not material or significant)

Front 51

Control deficiency: Design deficiency exists when

Back 51

1. A control necessary to meet the relevant control objective is missing OR
2. An existing control is not properly designed so that even if the control operates as designed, the control objective is not always met

Front 52

Control deficiency: Deficiency in operation exists when

Back 52

1. A properly designed control does not operate as designed OR
2. When the person performing the control does not possess the necessary authority or qualification to perform the control effectively

Front 53

Material weakness

Back 53

a deficiency or combination of deficiencies in ICFR, such that there is a reasonable possibility that a material misstatement of the entity's annual or interim f/s will not be prevented or detected on a timely basis

Front 54

Significant deficiency

Back 54

a control deficiency (CD) or combination of CDs in ICFR that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting (not material but significant)

Front 55

Statistical sampling

Back 55

uses the laws of probability to select and evaluate the results of an audit sample, thereby permitting the auditor to quantify the sampling risk for the purpose of reaching a conclusion about the population

Front 56

Nonstatistical sampling

Back 56

relies on the auditor’s judgment to determine sample size (typically of comparable size to a statistically based sampling approach), select the sample

Front 57

Advantages and disadvantages of statistical sampling

Back 57

Advantage: more quantitative and precise; efficient
Disadvantage: more costly training

Front 58

Attributive sampling

Back 58

used to estimate the proportion of a population that possesses a specified characteristic. It is more appropriately used for tests of controls.

Front 59

Variable sampling

Back 59

uses normal distribution theory to estimate the dollar amount of misstatement for a class of transactions or an account balance. Variable sampling is more appropriately used for substantive testing.

Front 60

Risk of incorrect rejection

Back 60

the risk that the sample supports the conclusion that the control is not operating effectively when it actually is or that the recorded account balance is materially misstated when it is not materially misstated.

Front 61

Risk of incorrect acceptance

Back 61

the risk that the sample supports the conclusion that the control is operating effectively when it is not or that the recorded account balance is not materially misstated when it is materially misstated.

Front 62

Assessing control risk too high

Back 62

Risk of incorrect rejection

Front 63

Assessing control risk too low

Back 63

Risk of incorrect acceptance

Front 64

Sampling risk error types

Back 64

Type 1: auditor erroneously thinks he found a problem; audit efficiency is reduced
Type 2: auditor erroneously thinks no problems exist; audit effectiveness is reduced

Front 65

Sampling errors

Back 65

result when the sample drawn is not representative of the population and that, as a result, the auditor will reach an incorrect conclusion about the account balance or class of transactions based on the sample

Front 66

Nonsampling errors

Back 66

result when the auditor reaches an erroneous conclusion for any reason that is not related to sampling risk
(ex: failure to recognize errors or the selection of ineffective procedures)

Front 67

Desired confidence level

Back 67

the probability that the true but unknown measure of the characteristic of interest is within specified limits

Front 68

Tolerable deviation rate

Back 68

the maximum deviation rate from a prescribed control that the auditor is willing to accept without altering the planned assessed level of control risk

Front 69

Expected population deviation rate

Back 69

the deviation rate that the auditor expects to exist in the population

Front 70

Stratified sampling

Back 70

Items in the population are divided into two + subpopulations which are each sampled

Front 71

Auditor decision process

Back 71

1. Project the sample results to the population
2. Add an amount for sampling risk (use judgment for nonstatistical sampling and math for statistical sampling)
3. The total amount (upper deviation rate/upper misstatement rate) should be compared with tolerable deviation rate/tolerable misstatement

Front 72

Sampling for tests of controls

Back 72

used in the evaluation of the client's internal controls

Front 73

Sampling for tests of details of balances

Back 73

the acceptability of the monetary balance of an account

Front 74

Sampling for substantive tests of transactions

Back 74

used in the evaluation of the monetary correctness of transactions

Front 75

Test of controls: Tolerable deviation rate

Back 75

Tests of transactions and balances: Tolerable misstatement

Front 76

Test of controls: Expected deviation rate

Back 76

Tests of transactions and balances: Expected misstatement

Front 77

Test of controls: Computed upper deviation rate

Back 77

Tests of transactions and balances: Upper misstatement limit

Front 78

Test of controls: risk of assessing control risk too low

Back 78

Tests of transactions and balances: Risk of incorrect acceptance

Front 79

Computed upper deviation rate =

Back 79

Sample deviation rate (number of exceptions or deviations actually found in the sample / number of items in the sample)
+ Appropriate allowance for sampling risk

Front 80

Considering sampling error, if computed upper deviation rate < tolerable deviation rate

Back 80

the auditor can conclude that the controls can be relied upon (use assessed level of CR)

Front 81

Considering sampling error, if computed upper deviation rate > tolerable rate

Back 81

Check definitions of deviations
Review deviations to make sure they're deviations
Expand sample
Increase planned assessed level of control risk and extend substantive tests

Front 82

In control testing, sampling risk errors (Type 1 and Type 2) are

Back 82

the risk of assessing control risk too high and the risk of assessing control risk too low

Front 83

Tolerable misstatement

Back 83

the amount of misstatement that may exist in an account balance without causing the financial statements to be materially misstated
Note: form an opinion AS A WHOLE

Front 84

Expected misstatement

Back 84

the amount of misstatement that the auditor expects to find

Front 85

Upper misstatement limit (UML) =

Back 85

Projected misstatement (a point estimate of the total misstatement in the population estimated from the misstatements found in the sample)
+ appropriate allowance for sampling risk

Front 86

Considering sampling error, if upper misstatement limit < tolerable misstatement

Back 86

accept the conclusion that the book value is not misstated by a material amount

Front 87

Considering sampling error, if upper misstatement limit > tolerable misstatement

Back 87

book value is not acceptable and the auditor should:
wait until other test areas are complete
expand audit tests in specific areas
increase sample size
adjust the account balance
request the client correct the population
refuse to give an unqualified opinion

Front 88

In substantive testing, sampling risk errors (Type 1 and Type 2) are

Back 88

the risk of rejecting the account balance as correct when it is correct and the risk of accepting the account balance as correct when it is misstated