Key Flashcards For Audit Test #3

Front 1

Chapter 9

Back 1

Materiality and Risk

Front 2

Explain a little about planned detection risk and name the relationships PDR has with the other 3 audit risk components and its relationship with substantive evidence.

Back 2

PDR is the risk that audit evidence for a segment will fail to detect misstatements exceeding tolerable misstatement.

High PDR = Low chance of material misstatement
Low PDR = High chance of material misstatement

Relationships:
IR = Inverse
CR = Inverse
AAR = Direct
Evidence = Inverse

If AAR, IR, and CR are all low, then PDR should be high.

Front 3

Explain a little about inherent risk and name the relationships IR has with the other 3 audit risk components and its relationship with substantive evidence.

Back 3

IR is the measurement of the auditor's assessment of the likelihood that there are material misstatements due to error or fraud in a segment before considering the effectiveness of internal controls.

High IR = High chance of material misstatement (i.e. inventory account)
Low IR = Low chance of material misstatement

Relationships:
PDR = Inverse
CR = No relationship (but closely related)
AAR = No relationship
Evidence = Direct

Front 4

Explain a little about control risk and name the relationships CR has with the other 3 audit risk components and its relationship with substantive evidence.

Back 4

CR is the risk of a material misstatement in the financial statements arising due to absence or failure in the operation of relevant internal controls.

High CR = Internal controls aren't very good.
Low CR = Internal controls are effective.

Relationships:
PDR = Inverse
IR = No relationship (but closely related)
AAR = No relationship
Evidence = Direct

Front 5

Explain a little about acceptable audit risk and name the relationships AAR has with the other 3 audit risk components and its relationship with substantive evidence.

Back 5

AAR is the willingness of the auditor to accept that the financial statements contain a material misstatement after a clean (unqualified) audit opinion has been issued.

Acceptable audit risk is ordinarily set by the auditor during planning and is held constant for each major cycle and account.

High AAR = Safer client
Low AAR = indicates a risky client requiring more extensive evidence, assignment of more experienced personnel, and/or a more extensive review of audit files.

Relationships:
PDR = Direct
IR = No relationship
CR = No relationship
Evidence = Inverse

Front 6

Explain tolerable misstatement.

Back 6

When auditors allocate the preliminary judgment about materiality to account balances, the materiality allocated to any given account balance is referred to as tolerable misstatement.

Give low risk areas a higher tolerable misstatement since there is a lower risk of misstatement.

Tolerable misstatement does not affect audit risk, inherent risk, control risk, or planned detection risk yet the combination of the tolerable misstatement and the four risks will determine the amount of planned audit evidence.

Tolerable Misstatement has an inverse relationship with the amount of evidenced needed.

To maximize audit efficiency, the auditor should allocate less tolerable misstatement to accounts that can be verified by using low-cost audit procedures, such as analytical procedures, than to accounts that are more costly to audit.

Front 7

What is the formula for the audit risk model?

Back 7

PDR = AAR / (IR x CR)

Front 8

IR x CR is the formula for what?

Back 8

Risk of material misstatements.

It is the denominator of the audit risk model.

Front 9

What is the formula for the direct projection estimate of misstatement?

Back 9

Net misstatement of the sample / Total sampled x Total recorded population value = Direct projection estimate of misstatement

Example: $3,500 ÷ $50,000 × $450,000 = $31,500

Front 10

What is the formula for estimate total misstatement?

Back 10

Direct projection estimate of misstatement + estimated sampling error

Front 11

What are the 8 factors of inherent risk (IR)?

Back 11

1. Nature of client’s business
2. Results from previous audits
3. Initial vs. Repeat engagement
4. Related parties
5. Nonroutine transactions
6. Judgment required (to correctly record account balances or transactions
7. Makeup of population of sample
8. Management incentives (factors related to fraudulent financial reporting and factors related to misappropriation of assets)

Front 12

Where are IR and CR assessed?

Where is AAR assessed?

Back 12

IR and CR are assessed at the transaction cycle, account balance, or audit objective level.

AAR is assessed at the Financial Statement Level.

Front 13

What are the 3 factors of acceptable audit risk? What are the components of each?

Back 13

1. The degree to which external users rely on the statements.
a. Client's size
b. Distribution of ownership
c. Nature and amount of liabilities

2. The likelihood that a client will have financial difficulties after the audit report is issued.
a. Liquidity position
b. Profits (losses) in previous years
c. Method of financing growth
d. Nature of the client's operations
e. Competence of management

3. The auditor's evaluation of management's integrity.

Front 14

What are the 3 factors affecting materiality?

Back 14

1. Materiality is a relative rather than an absolute concept

2. Benchmarks are needed for evaluating materiality (i.e. net income before taxes = for profit companies)

3. Qualitative factors also affect materiality
a. Fraud is more important than an error of an equal amount.
b. Otherwise minor misstatements than have possible consequences arising from contractual obligations.
c. Misstatements that are otherwise immaterial may be material if they affect a trend in earnings.

Front 15

What are the 3 major difficulties auditor's face in allocating materiality to balance sheet accounts?

Back 15

1. Auditors expect certain accounts to have more misstatements than others.

2. Both overstatements and understatements must be considered.

3. Relative audit costs affect the allocation.

Front 16

The first two steps in applying materiality involve ______, and the last 3 steps involve ______.

Back 16

planning; performing audit tests

Front 17

The formula: 1 - AAR = ?

Back 17

Audit Assurance

Front 18

Chapter 11

Back 18

Fraud Auditing

Front 19

What are the two main categories of fraud?

Back 19

1. Fraudulent financial reporting

2. Misappropriation of assets

Misappropriation of assets is the most common fraud scheme, although the size of the fraud is much greater for fraudulent financial reporting.

Front 20

Explain fraudulent financial reporting.

Back 20

Fraudulent financial reporting is an intentional misstatement or omission of amounts or disclosures with the intent to deceive users.

Most cases involve the intentional misstatement of amounts, rather than disclosures.

Types of fraudulent financial accounting include earnings management and income smoothing.

Front 21

Explain misappropriation of assets.

Back 21

Misappropriation of assets is fraud that involves theft of an entity's assets.

In many cases, but not all, the amounts involved are not material to the financial statements.

The term misappropriation of assets is normally used to refer to theft involving employees and others internal to the organization.

Misappropriation of assets is normally perpetrated at lower levels of the organization hierarchy.

Front 22

What is earnings management? What is income smoothing?

Back 22

Companies may intentionally understate income when earnings are high to create a reserve of earnings or "cookie jar reserves" that may be used to increase earnings in future periods.

Earnings management involves deliberate actions taken by management to meet earnings objectives.

Income smoothing is a form of earnings management in which revenues and expenses are shifted between periods to reduce fluctuations in earnings.

Front 23

Explain the fraud triangle.

Back 23

The three conditions of fraud arising from fraudulent financial reporting and misappropriation of assets are referred to as the fraud triangle.

The 3 conditions are:

1. Incentives/Pressures.

2. Opportunities.

3. Attitudes/Rationalization.


In the fraud triangle, fraudulent financial reporting and misappropriation of assets share the same three conditions, but the risk factors differ.

Front 24

What are the risk factors for each condition under the fraud triangle for fraudulent financial reporting?

Back 24

1. Incentives/Pressures:

*Financial stability or profitability is threatened by economic, industry, or entity operating conditions.
*Excessive pressure for management to meet debt repayment or other debt covenant requirements.
*Management or the board of directors' personal net worth is materially threatened by the entity's financial performance.

2. Opportunities:

*Significant accounting estimates involve subjective judgments or uncertainties that are difficult to verify.
*Ineffective board of director or audit committee oversight over financial reporting.
*High turnover or ineffective accounting, internal audit, or information technology staff.
*Weak internal controls.
*Significant related-party transactions.

3. Attitudes/Rationalization:

*Inappropriate or ineffective communication and support of the entity's values.
*Known history of violations of securities laws or other laws and regulations.
*Management's practice of making overly aggressive forecasts

Front 25

What are the risk factors for each condition under the fraud triangle for misappropriation of assets?

Back 25

1. Incentives/Pressures:

*Personal financial obligations create pressure for those with access to cash or other assets susceptible to theft.
*Adverse relationships between management and employees with access to assets susceptible to theft motivate employees to misappropriate those assets.

2. Opportunities:

*Presence of large amounts of cash on hand or inventory items that are small, of high value, or are in high demand.
*Inadequate internal control over assets due to lack of the following:
-Appropriate segregation of duties or independent checks
-An approved vendor list to detect unauthorized or fictitious vendors
-Job applicant screening for employees with access to assets
-Mandatory vacations for employees with access to assets

3. Attitudes/Rationalization:

*Disregard for the need to monitor or reduce risk of misappropriating assets
*Disregard for internal controls by overriding existing controls or failing to correct known internal control deficiencies

Front 26

What does SAS 99 cover?

Back 26

Assessing fraud risk.

Professional skepticism:
-neither assumes that management is dishonest nor assumes unquestioned honest

Information and idea exchange sessions by the audit team are required by SAS No. 99.

SAS No. 99 does not specifically indicate which members of an audit engagement team must attend a brainstorming session.

Because fraud perpetrators are often knowledgeable about audit procedures, SAS No. 99 requires auditors to incorporate unpredictability into the audit plan.

Front 27

What are the 2 components of professional skepticism?

Back 27

1. Questioning mind

2. Critical evaluation of audit evidence

Front 28

What are the 5 sources of information gathered to assess fraud risks?

Back 28

1. Communications among audit team

2. Inquiries of management

3. Risk factors

4. Analytical procedures

5. Other information

Front 29

What is horizontal analysis? What is vertical analysis?

Back 29

Both are types of analytical procedures.

Horizontal:
*In horizontal analysis, the account balance is compared to the previous period, and the percentage change in the account balances for the period is calculated.


Vertical:
*In vertical analysis, the financial statement numbers are converted into percentages using a base; also called common size financial statements.
*Income statement base = each income statement amount is calculated as a percentage of sales.
*Balance sheet base = balances are calculated as a percentage of total assets.

Front 30

What are the 3 elements identified by the AICPA to prevent, deter, and detect fraud?

Back 30

1. Culture of honesty and high ethics.

2. Management's responsibility to evaluate risks of fraud.

3. Audit committee oversight.

Front 31

What are the 3 components of management's responsibility to evaluate risks of fraud?

Back 31

1. Identifying and measuring fraud risks.

2. Taking steps to mitigate identified risks.

3. Monitoring internal controls that prevent and detect fraud.

Front 32

What are the 3 types of auditor responses to fraud?

Back 32

1. Change the overall conduct of the audit

2. Design and perform audit procedures to address fraud risks

3. Design and perform procedures to address management override of controls

Front 33

Explain revenue and accounts receivable fraud risks.

What are the 3 main types of revenue manipulations?

Back 33

Revenue and related accounts receivable and cash accounts are especially susceptible to manipulation and theft.

More than half of financial statement frauds involve revenues and accounts receivable.


The 3 main types of revenue manipulations are:

1. Fictitious revenues
*The most egregious forms of revenue fraud involve creating fictitious revenues.

2. Premature revenue recognition
*Companies often accelerate the timing of revenue recognition to meet earnings or sales forecasts.

3. Manipulations of adjustments to revenues
*The most common adjustment to revenue involves sales returns and allowances.
*Companies may also understate bad debt expense, in part because significant judgment is required to determine the correct amount.

Front 34

What are the 2 most useful ways to detect warning signs of revenue fraud? Explain each.

Back 34

1. Analytical procedures
*Analytical procedures often signal revenue fraud, especially gross margin percentage and accounts receivable turnover.
*Fictitious revenue overstates the gross margin percentage and understates accounts receivable turnover.
*Premature recognition also overstates the gross margin percentage if the related cost of sales is not recognized.

2. Documentary discrepancies
*Fictitious transactions rarely have the same level of documentary evidence as legitimate transactions.

Front 35

What is lapping?

Back 35

Applying the payment from one customers account to the another customers account.

This takes place in the theft of cash receipts after a sale is recorded.

Front 36

Explain inventory fraud risks.

What is the main type of inventory fraud?

Back 36

Inventory is often the largest account on many companies' balance sheet, and auditors often find it difficult to verify the existence and valuation of inventories. As a result, inventory is susceptible to manipulation by managers who want to achieve certain financial reporting objectives. Because it is also usually readily saleable, inventory is also susceptible to misappropriation.

The main type of inventory fraud is fictitious inventory.
*Many large companies have varied and extensive inventory in multiple locations, making it relatively easy for the company to add fictitious inventory to accounting records.

Front 37

What is the main way to detect warning signs of inventory fraud? Explain it.

Back 37

The main way to detect warning signs of inventory fraud is through analytical procedures.

*Analytical procedures, especially gross margin percentage and inventory turnover, often help uncover inventory fraud.
*Fictitious inventory understates cost of goods sold and overstates gross margin percentage, as well as lowering inventory turnover.

Front 38

How is the use of inquiry used?

What are the 3 types of inquiries?

Back 38

Inquiry can be an effective audit evidence gathering technique.

The 3 types of inquiries are:

1. Informational inquiry
*Used to obtain info about facts and details that the auditor does not have, usually about past or current events or processes.
*Often used when gathering follow-up evidence about programs and controls or other evidence involving a misstatement or suspected fraud uncovered during the audit.
*Uses open ended questions about details, events, processes, or circumstances.

2. Assessment inquiry
*Used to corroborate (compare) or contradict prior information.
*Often starts inquiry with broad, open ended questions.
*Common to compare management responses to earlier inquiries by asking questions of other employees.

3. Interrogative inquiry
*Used to determine if the individual is being deceptive or purposefully omitting disclosure of key knowledge of facts, events, or circumstances.
*Often confrontational
*Questions that seek a yes or no response

Front 39

What do auditing standards require of the auditor when he/she suspects fraud?

What are 2 types things auditors use in this situation?

Back 39

When the auditor suspects that fraud may be present, auditing standards require the auditor to obtain additional evidence to determine whether material fraud has occurred.

2 ways auditors do this is:

1. Audit software analysis

2. Expanded substantive testing.

Front 40

What is one of the strongest internal corporate governance mechanisms over senior management?

Back 40

The audit committee of the board of directors.

Front 41

Chapter 13

Back 41

Overall Audit Strategy and Audit Program

Front 42

In developing an overall audit strategy, auditors use _____ to determine whether the financial statements are fairly stated.

Back 42

5 types of tests.

Front 43

What are the 5 types of tests used?

Back 43

1. Risk assessment procedures (not a test)

2. Tests of Controls

3. Substantive tests of transactions

4. Analytical Procedures

5. Substantive tests of details of balances.


Risk assessment procedures are performed to assess the risk of material misstatement in the financial statements. The auditor performs the other 4 tests in response to the auditor's assessment of risk of material misstatements. The combination of these 4 types of further audit procedures provides the basis for the auditors opinion.

Front 44

Explain Risk Assessment Procedures.

Back 44

Collectively, procedures performed to obtain an understanding of the entity and its environment, including internal controls, represent the auditor's risk assessment procedures.

A major part of the auditor's risk assessment procedures are done to obtain an understanding of internal control. Theses procedures focus on the design and implementation of internal control and are used to assess control risk for each transaction-related audit objective.

Required in all audits to assess the risk of material misstatement.

Front 45

Explain Tests of Controls

Back 45

When control policies and procedures are believed to be effectively designed, the auditor assess control risk at a level that reflects the relative effectiveness of those controls. To obtain sufficient appropriate evidence to support that assessment, the auditor performs tests of controls.

Front 46

Explain Substantive Tests of Transactions

Back 46

Substantive Tests of Transactions are used to determine whether all 6 transaction-related audit objectives have been satisfied for each class of transactions.

Auditors can perform tests of controls separately from all other tests, but it's often more efficient to do them at the same time as substantive tests of transactions.

Front 47

Explain Analytical Procedures

Back 47

Analytical procedures involve comparisons of recorded amounts to expectations developed by the auditor.

Accounting standards require analytical procedures to be used during the planning and completion phases of the audit.

Analytical procedures may also be performed to audit an account balance.

The 2 most important purposes of analytical procedures in the audit of an account balance are to:
1. Indicate possible misstatements in the financial statements.
2. Provide substantive evidence.

Analytical procedures done during planning typically differ from those done in the testing phase.

Auditing standards state that analytical procedures are a type of substantive test (substantive analytical procedures), when they are performed to provide evidence about an account balance.

Front 48

Explain Tests of Details of Balances

Back 48

Tests of details of balances focus on the ending general ledger balances for both balance sheet and income statement accounts, with the primary emphasis being on balance sheet accounts.

performed in response to the auditor's assessment of the risk of monetary misstatements in the financial statements

Examples include:
*Confirmation of customer balances for accounts receivable
*Physical examination of inventory
*Examination of vendors' statements for accounts payable.

Tests of ending balances are essential because the evidence is usually obtained from a source independent of the client, which is considered highly reliable.

Auditors perform detailed tests of the ending balances for sales and accounts receivable.

The most costly test to perform.

Front 49

What are substantive tests?

Back 49

They are procedures designed to test for dollar misstatements (monetary misstatements) that directly affect the correctness of financial statement balances.

Auditors rely on 3 types of substantive tests:

1. Substantive tests of transactions

2. Substantive analytical procedures

3. Tests of details of balances



Auditing standards state that analytical procedures are a type of substantive test (substantive analytical procedures), when they are performed to provide evidence about an account balance.

Front 50

What are the relationships between the further audit procedures and the audit risk model?

Back 50

Test of controls = Control risk

Substantive tests of transactions = Control risk and Planned detection risk

Analytical procedures = Planned detection risk

Tests of details of balances = Planned detection risk

Front 51

What tests apply to transactions? What test apply to ending balances?

Back 51

Transactions are audited by test of controls, substantive tests of transactions, and analytical procedures.

Ending balances are audited by analytical procedures and tests of details of balances.

Front 52

What is the evidence mix?

Back 52

To obtain sufficient appropriate evidence in response to risks identified through risk assessment procedures, auditors employ a combination of the four remaining types of tests. This combination is often called the evidence mix.

Front 53

Auditors follow a 4 step approach to reduce the assessed control risk. What are the 4 steps?

Back 53

1. Apply transaction-related audit objectives to a class of transactions.

2. Identify key controls and make a preliminary assessment of control risk.

3. Design tests of controls (audit procedures, sample size, items to select, timing)

4. Design substantive tests of transactions (audit procedures, sample size, items to select, timing)

Front 54

List the relationships between further audit procedures and evidence.

Back 54

Tests of controls = Inspection, observation, inquiries of the client, reperformance

Substantive tests of transactions = Inspection, inquiries of the client, reperformance, recalculation

Analytical procedures = Inquiries of the client, analytical procedures

Tests of details of balances = physical examination, confirmation, Inspection, inquiries of the client, reperformance, recalculation


*Key notes:

*Only analytical procedures deal with analytical procedure evidence.
*All 4 tests deal with inquiries of the client.
*Only tests of controls deals with observation.
*Only tests of details of balances deal with physical examination and confirmation.

Front 55

What are the 4 phases of the audit process? Which audit objective goes with each? What tests go with each?

Back 55

Phase 1: Plan and design and audit approach
*No audit objectives
*Risk assessment procedures

Phase 2: Perform tests of controls and substantive tests of transactions
*Transaction-related audit objectives
*Procedures to obtain an understanding and tests of controls; Substantive tests of transactions

Phase 3: Perform analytical procedures and tests of details of balances
*Balance-related audit objectives
*Analytical procedures
*Tests of details of balances

Phase 4: Complete the audit and issue the audit report
*Presentation and disclosure-related audit objectives
*Analytical procedures
*Tests of details of balances

Front 56

Chapter 10

Back 56

Internal Control, Control Risk, and Section 404 Audits

Front 57

Management typically designs systems of internal controls to accomplish what 3 broad objectives?

Back 57

1. Reliability of financial reporting

2. Efficiency and effectiveness of operations

3. Compliance with laws and regulations

Front 58

What are the 2 key concepts that underlie management's design and implementation (policy and use) of internal control?

Back 58

1. Reasonable Assurance

2. Inherent Limitations
*collusion
*management overriding (i.e. to improve earnings)

Front 59

What is collusion?

Back 59

An act of two or more employees who conspire to steal assets or misstate records

Front 60

What does Section 404 of the Sarbanes-Oxley Act (SOX) pertain to?

Back 60

The audit of internal controls over financial reporting

Front 61

Section 404 of SOX requires management of all public companies to issue an internal control report that includes what 2 things?

Back 61

1. A statement that management is responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting.

2. An assessment of the effectiveness of the internal control structure and procedures for financial reporting as of the end of the company's fiscal year.


Management must also identify the framework used to evaluate the effectiveness of internal control (usually COSO).

Front 62

Management's assessment of internal control over financial reporting consists of what 2 key aspects?
Explain management's section 404 reporting responsibilities.

Back 62

1. Evaluating the design of internal control over financial reporting.
*Are controls designed and put in place to prevent or detect material misstatements in the financial statements?

2. Testing the operating effectiveness of the controls.
*Are the controls operating as designed?
*Does the person performing the control posses the necessary authority and qualifications to perform the control effectively?
*Management must document test results.
*Management must disclose any material weakness.
*Even if only one material weakness is present, management must conclude that the company's internal control over financial reporting is not effective.

Front 63

Auditors are primarily about what 2 controls dealing with internal controls?

Back 63

1. Controls over the reliability of financial reporting
*The financial statements may not correctly reflect accounting frameworks such as AAP or IFRS if the controls affecting the reliability of financial reporting are inadequate.

2. Controls over the classes of transactions
*Auditors emphasize internal control over classes of transactions rather than account balances because the accuracy of accounting system outputs (account balances) depends heavily on the accuracy of inputs and processing (transactions).


Section 404 of SOX requires that the auditor report on the effectiveness of internal control over financial reporting.

Front 64

What is COSO?

Back 64

The internal control framework used by most U.S. companies is the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control - Integrated Framework.

Front 65

What are COSO's 5 components of internal control that management designs and implements to provide reasonable assurance that its control objectives will be met?

Back 65

1. Control environment
2. Risk assessment
3. Control activities
4. Information and communication
5. Monitoring

Front 66

Explain Control Environment.

Back 66

The control environment consists of the actions, policies, and procedures that reflect the overall attitudes of top management, directors, and owners of an entity about internal control and its importance to the entity.

The control environment serves as the umbrella for the other 4 components. Without an effective control environment, the other 4 are unlikely to result in effective internal control, regardless of their quality.

The 7 most important control sub components of control environment are:

1. Integrity and Ethical Values
2. Commitment to Competence
3. BOD and Audit Committee Involvement
4. Management Philosophy and Operating Style
5. Organizational Structure
6. Assignment of Authority and Responsibility
7. Human Resource Policies and Procedures.

Front 67

Explain Risk Assessment.

Back 67

Risk assessment for financial reporting is management's identification and analysis of risks relevant to the preparation of the financial statements in conformity with appropriate accounting standards.

Important to company (different than auditor’s risk assessment, but somewhat closely related)

Provides direction for needed internal controls

Front 68

Explain Control Activities.

Back 68

Control activities are the policies and procedures, in addition to those included in the other 4 components, that help ensure that necessary actions are taken to address risks to the achievement of the entity's objectives.

The control activities generally fall into the following 5 types:

1. Adequate Separation of Duties
2. Proper Authorization of Transactions and Activities
3. Adequate Documents and Records
4. Physical Control over Assets and Records (use physical precautions)
5. Independent Checks on Performance

Front 69

What are the 4 general guidelines for adequate separation of duties?

Back 69

Separation of:

1. The custody of assets from accounting
2. The authorization of transactions from the custody of related assets
3. Operational responsibility from record-keeping responsibility
4. IT duties from user departments

Front 70

Concerning proper authorization of transactions and activities, what are the 2 types of authorizations?

Back 70

1. General Authorization

*Management establishes policies and subordinates are instructed to implement these general authorizations by approving all transactions within the limits set by the policy.


2. Specific Authorization

*Applies to individual transactions. For certain transactions, management prefers to authorize each transaction. Example: the authorization of a sales transaction by the sales manager for a used-car company.

Front 71

To have adequate documents and records, documents and records should be...

Back 71

1. Prenumbered consecutively
2. Prepared at the time the transaction takes place
3. Designed for multiple use when possible
4. Constructed in a manner that encourages correct preparation

Front 72

What are independent checks on performance (key term = independent checks).

Back 72

The last category of control activities is the careful and continuous review of the other 4 categories, often called independent checks or internal verification.

Front 73

Explain Information and Communication.

Back 73

The purpose of an entity's information and communication system is to initiate, record, process, and report the entity's transactions and to maintain accountability for the related assets.

Front 74

Explain Monitoring.

Back 74

Monitoring activities deal with ongoing or periodic assessment of the quality of internal control by management to determine that controls are operating as intended and that they are modified as appropriate for changes in conditions.

Front 75

What are the 4 phases in the "process for understanding internal control and assessing control risk"?

Back 75

1. Obtain and document understanding of internal control design and operation.

2. Assess control risk.

3. Design, perform, and evaluate tests of controls.

4. Decide planned detection risk and substantive tests.

Front 76

Auditors commonly use what 3 types of documents to obtain and document their understanding of the design of internal control? Explain each of the 3.

Back 76

1. Narratives
*A written description of a client's internal controls.

2. Flowcharts
*A diagram of the client's documents and their sequential flow in the organization

3. Internal Control Questionnaires
*Asks a series of questions about the controls in each audit area as a means of identifying internal control deficiencies.

Front 77

What is a walkthrough?

Back 77

In a walkthrough, the auditor selects one or a few documents of a transaction type and traces them from initiation through the entire accounting process.

Front 78

What is an assessment of control risk? What is a control risk matrix?

Back 78

After obtaining an understanding of internal control, the auditor makes a preliminary assessment of control risk as part of the auditor's overall assessment of the risk of material misstatement.

Many auditors use a control risk matrix to assist in the control risk assessment process at the transaction level. The purpose is to provide a convenient way to organize assessing control risk for each audit objective.

Front 79

What are key controls?

Back 79

When identifying existing controls, the auditor should identify and include only those controls that are expected to have the greatest effect on meeting the transaction-related audit objectives. These are called key controls.

Front 80

What are the 3 levels of evaluating the absence of internal controls that auditing standards define?

Back 80

1. Control deficiency
*exists if the design or operation of controls does not permit company personnel to prevent or detect misstatement on a timely basis in the normal course of performing their assigned functions.

2. Significant deficiency
*Exists if one or more control deficiencies exist that is less severe than a material weakness, but important enough to merit attention by those responsible for oversight of the company's financial reporting.

3. Material weakness
*Exists if a significant deficiency, by itself or in combination with other significant deficiencies, results in a reasonable possibility that internal control will not prevent or detect material financial statement misstatements on a timely basis.

Front 81

What are compensating controls?

Back 81

A compensating control is one elsewhere in the system that offsets the absence of a key control.

Front 82

What are management letters?

Back 82

The form of communication, often in a separate letter, where auditors identify less significant internal control-related issues, as well as opportunities for the client to make operational improvements.

Not mandatory, but auditors generally prepare them as a value-added service of the audit.

Front 83

What are the 3 types of Auditor's Reports on internal controls?

Back 83

1. Unqualified –no material weakness and no scope limitation

2. Adverse –material weaknesses exist

3. Qualified or disclaimer -has a scope limitation

Front 84

Differences in evaluating, reporting, and testing internal control for nonpublic companies compared to public ones.

Back 84

1. No requirement for an audit of internal control over financial reporting in a nonpublic company.

2. The most important difference in a nonpublic company i assessing control risk is the assessment of control risk at maximum for any or all control-related objectives when internal controls for the objective or objectives are nonexistent or ineffective.

3. The auditor will not perform tests of controls when the auditor assesses control risk at maximum because of inadequate controls.