Audit Fainal

Front 1

Who has responsibility for internal controls?

Back 1

audit comitee

Front 2

COSO

Back 2

Committee on sponsoring activities

Front 3

3 things coso focuses on

Back 3

effectivness/efficiency of operations; financial reporting; compliance with laws/regs

Front 4

Five components of internal controls per COSO framework

Back 4

Control evironment; entity risk assesment; control activities; information and communication; monitoring activiites

Front 5

Control evironment

Back 5

sets the tone at the top of the organization

Front 6

Information processing controls: general

Back 6

controls that appy to entirety of companies it area

Front 7

information processing controls: application

Back 7

controls that relate to specifc it applications

Front 8

Effective of size on internal controls

Back 8

small companies are more likely to catch somehting since there is less going on; managemetn has more hands on responsibility; you can still use controls approach but it is harder

Front 9

Limitations of internal controls: ways controls can be beaten

Back 9

override; collusion; human error

Front 10

Documentiign understandign of internal controls (4)

Back 10

Flowcharts; narrative description; internal control questionarres; Procedures manual

Front 11

What happens if autidotr does not intend to rely on internal controls:

Back 11

set control risk at maximum and use substantive procedure

Front 12

As reliabiliyt of controls increases, substantive tests can _______

Back 12

decrease

Front 13

As risk and materiality increases, year end testing should ______

Back 13

increase

Front 14

If we do testing early we ___ to the end of the year

Back 14

roll it forward

Front 15

Greater the risk, ____ the testing; however_____

Back 15

later. It also makes sense to di it early to avoid any surprises

Front 16

When to test: allowance for bad debts

Back 16

high risk: do both early and late

Front 17

when to test: cash

Back 17

Should be tested later in the year because its fungible; its risky

Front 18

When to test: depreciation

Back 18

probably at the the beginnign because its less risky

Front 19

Service berearus

Back 19

third party provider; for example: they do payroll, fixed assets, bookeeping

Front 20

Service organizaiton control report: type 1 teests

Back 20

looked at controls and describes stystem; no opinion issued

Front 21

Service organization type 2 tests

Back 21

can also test controls

Front 22

Our responsibiliity relatign to service beraus

Back 22

if type 1 report or bad type 2 report, somebody has to go back in and do testing; If type 2 report the we can accept results of their audit; don’t have to reperform work done by service berueras

Front 23

Communication of I/C issues to client (non public compnay): material weakness

Back 23

Reasonable possibiliyt of material mistatement; has to be in writing to management and those charged with goveranance

Front 24

Communication of I/C issues to client (non public compnay): significant deficiency

Back 24

less severe than material weakness, but still merits consideration; has to be in writing to management and those charged with governance

Front 25

Communication of I/C issues to client (non public company)

Back 25

verbally communicate to management

Front 26

Amount that qualifies smaller company as execmpt from external audit of interanl control over financial reporting

Back 26

75 million

Front 27

Managemetns responsbility under 404 (4)

Back 27

1.accept responsibility for effectivenss of ICFR; 2. evaluate te effectivess of ICFR; 3:Support the evaluation with suffcient evidence; 4: present a written assesment regarding effectivenss of entitys ICFR as of the end of entitys most recent fiscal year

Front 28

Auditors responsiility under 404 and AS5

Back 28

1. must issue report on effectivenss as of end of the year; 2. must be done using an integrated audit approach; 3: must reach level of reasonable assurance

Front 29

who is responsible for overal implementation of ICFR

Back 29

Managemetn and board of directors

Front 30

Who is responsible for reliability of ICFR

Back 30

CEO and CFO

Front 31

Control deficiency: design

Back 31

control is missing or not designed well

Front 32

control deficiency: operating

Back 32

designed properly but not executed properly

Front 33

3 categories of magnitued

Back 33

material; not material but significant; not material or significatn

Front 34

Likliehood and magnitude chart: material weakness

Back 34

material and reasonably possible: report externally, to audit committee, and to management

Front 35

Likliehood and magnitude chart: significatn deficiency

Back 35

Not material but significant and reasonably possible: report to audit committee and management

Front 36

Likliehood and magnitude chart: control deficiency

Back 36

not material or significant and reasnably possible: report to management

Front 37

Managemetns evaluation process for evalluating ICFR (3)

Back 37

1.identify financial reporting risks and related controls; 2. consider which locations to include in the evaluation; 3. evaluate evidence about the operatign effectiveness of ICFR

Front 38

Integrated audit

Back 38

audit of ICFR and FS that does 3 things: planning of both are done together; has to be same audit firm; results of 1 are used to help with the other and vice versa

Front 39

Steps in audit of ICFR (5)

Back 39

1: planning; 2: idendity controls to test based on a top down risk based approacch; 3: test the design and effectiveness of selected controls; 4: evaluate identified control deficiencies; 5: form an opinion on the effectivness of ICFR

Front 40

planning:

Back 40

asses risk/fraud; scaling audit; using work of others

Front 41

Top down, risk based approach (4)

Back 41

identify entity level controls; identify signifcant accounts and disclosures and their relevant assertions; understand likely sources of mistatement; select controls to test (only test key controls)

Front 42

Timing of testing for genral and application controls

Back 42

must test general every year: test application controls in year 1, but don’t have to tests in future years as long as their has been no changes or problems

Front 43

what are control deficiiencies based on

Back 43

if a mistatemetn could occur, not if a mistatement did occur

Front 44

Remidiation

Back 44

management fixes the control deficiency in sufficient time so that management and auditors have time to test before end of year; key is not only that controll is fixed but it is tested to make sure it works

Front 45

What happens if management refueses to give written representations

Back 45

we have to issue a disclaimer of opinon - a scope of the audit issue

Front 46

Why type of report to give if a control or significant deficiency

Back 46

modificaiton based on type of defficiency: unqualified opinion

Front 47

what type of report ot give if a material weakness

Back 47

modification based on type of defficiency: adverse opinion

Front 48

what type of report to give if a minor effect

Back 48

modification based on scope limitation: unqualified

Front 49

what type of report to give if more than minor effect

Back 49

modification based on scope limitation: disclaim opinion or withdraw

Front 50

can you have an adverse opinon on controls, but an unqualified opinon of financial statement:

Back 50

sure, as long as you are abble to audit around weakness

Front 51

Professionalism

Back 51

acting in a manner consistent of what is expected from a CPA, lawyer, etc

Front 52

Sources for private company audits

Back 52

AICPA; ISB

Front 53

sources for public company audits

Back 53

PCAOB; ISB; SEC

Front 54

Principles of professional conduct

Back 54

Ideal attitudes and behaviors; general and not enforceable

Front 55

Rules of conduct

Back 55

minimall acceptable standarsds; specifcally enforcabel

Front 56

Interpretations and rulings

Back 56

detailed interpreatations and awers to questions regarding rules of conduct; not specifically enforceable, but departures must be justified

Front 57

Covered Member

Back 57

a member that is on the engagement team; in a postion to influce the endgagement; a parter who rprives more than 10 hours of nonattest servicese; a partern in the office in which the lead engagement partner practices; the firm

Front 58

Indirect fianncial interests

Back 58

may be a problem if covered member owns more than 5% of mutual fund; If less than 5% its ok

Front 59

Are blind trusts considered direct financial interst

Back 59

yes

Front 60

4 circumsatncese in which loans arent considered direct financial interest

Back 60

car loan/lease (collateralized by vehicle; CSV of insruance policly (collateralized by policy); cash deposit at lending institution (collateralized by deposit account); credit card (10,000) kept current at month end

Front 61

are mortages allowed?

Back 61

no

Front 62

Rules: client emplyee moves to audit firm that does audit

Back 62

cannon be on engagement team until the engagement doesn’t include any period of former employer; basically cant audit own work

Front 63

Rules: CPA moves to client (non public company, key position)

Back 63

must completely dissasocited self with firm

Front 64

Rules: CPA moves to client (public company, key position)

Back 64

must wait one year cooling off period; you can resign form firm and take year off, or tell firm your plans and ask to get taken off the engagement

Front 65

rules: not going to key postion

Back 65

just dissociate self

Front 66

What is key position

Back 66

any position where you have an impact on financial statement or oversight role

Front 67

rules: considering leave

Back 67

have to telll firm if your talking to client about a job

Front 68

Non audit service that impair independece

Back 68

never be in position to audit own work; never serve as advoacge for management; acutarial, lega, expert, management, internal audit

Front 69

Independence rules for taxes

Back 69

can do tax returns for audit clients; cannot do it for key indivduals or do tax shelter consulting

Front 70

5 year rule

Back 70

5 years on and 5 years off for partners

Front 71

communication with audit committee

Back 71

meet at least once every quarter; discuss all critical accountign policies

Front 72

Rule 301

Back 72

limit sicrumstances where you can disclose client info without client persmission: supoena or court order; comply with disciplanry; disclosure for GAAP; buying or sellign acccoutning practice

Front 73

elevator rule

Back 73

don’t talk about info in public places

Front 74

same firm rule

Back 74

If its not your client your not a covered member; you cant talkk about client with someone in you rfirm if you don’t have same client

Front 75

quality control review non public company

Back 75

once every 3 and ahalf yers

Front 76

quality contorl review public companies:

Back 76

if your firm does over 100 audits: once a year; if your firm does less than 100 audits: once every 3 years

Front 77

2 categories of law auditors can be held liable under

Back 77

common and staturory

Front 78

elements of negligence

Back 78

dutry to conform; breach; direct connection; client had to suffer damages

Front 79

libaility to clients

Back 79

breach of contract and negligence

Front 80

liability to 3rd partys (typically investors)

Back 80

Negligence; musst 1st prove standing

Front 81

privity

Back 81

no liability unless there is a contract

Front 82

near privity

Back 82

contactj with auditor

Front 83

Forseen 3rd party

Back 83

followed by most states; peoples whos reliance is forseen; shareholders don’t qualify

Front 84

reasonably forseen 3rd party

Back 84

never followed

Front 85

Fraud/ gross negligence - must prove 5 things

Back 85

false representation; accoutnant knew it was false; knew thrid party would rely on it; 3rd party relied on it; 3rd party did relie on it

Front 86

Joint and several

Back 86

whoever is more at fault pays full damages

Front 87

SEC act of 1933

Back 87

realte to filing of new secrities; must prove they suffered a loss by investement; financial staemetns contain an error

Front 88

SEC act of 1934

Back 88

regulagees ongoing reporting of already registerred securities; client/firm can be held liabilie for making false staetmetns; can be held laiabile if material erro and plaintiff lied and damages based on lie and sceienter was present

Front 89

Private securities litigation reform act of 1995

Back 89

proportionate liabilityy; prohibit phising expeditions

Front 90

securitieis litigation unifrom statnadars act of 1998

Back 90

cannon make claims in federal court that belong in stae court

Front 91

sox act 404

Back 91

CEO, CFO, and auditors must annualy sign off on ICFR

Front 92

RICo act

Back 92

can be fined triple damages