Auditing - Ch. 07 Auditing Internal Control Over Fin Reporting

Front 1

Describe Management responsibilities under Section 404 of SOX.

Back 1

- ACCEPT RESPONSIBILITY for the effectiveness of the entity's ICFR
- EVALUATE THE EFFECTIVENESS of the entity's ICFR using suitable control criteria
- SUPPORT THE EVALUATION with sufficient evidence, including documentation
- PRESENT A WRITTEN ASSESSMENT regarding the effectiveness of the entity's ICFR as of the end of the entity's most recent fiscal year (assessment must include DISCLOSURE of any MATERIAL WEAKNESSES in the company's IC over financial reporting identified by management.

Front 2

When is management not permitted to conclude that the company's IC over financial reporting is effective?

Back 2

When there are one or more material weaknesses in the company's IC over financial reporting.

Front 3

Describe Auditor responsibilities under Section 404 of SOX.

Back 3

- Audit management's assertion about the EFFECTIVENESS OF ICFR
- (AS 5) The audits of the financial statements and ICFR must be conducted in an integrated way (each audit provides info that is relevant to the other)

Front 4

Based on PCAOB definition of internal control over financial reporting (ICFR), who is responsible for the reliability of ICFR?

Back 4

CEO and CFO of the entity

Front 5

What is material misstatement?

Back 5

A material weakness in ICFR exists if there is some flaw within the company’s overall control system such that it is at least reasonably possible that a material misstatement in the company’s financial statements will not be prevented or corrected.

Front 6

PCAOB AS5 states that auditors must conduct the audits of the F/Ss and ICFR in an integrated way. What does this mean?

Back 6

Each audit provides the auditor with info relevant to the evaluation of the results of the other.

Front 7

What is the auditor's objective in an audit of ICFR (Internal Control over Financial Reporting)?

Back 7

To express an opinion on the EFFECTIVENESS of the company's internal control over financial reporting.

Front 8

What are ENTITY-LEVEL CONTROLS?

Back 8

Entity-Level Controls are internal controls that help ensure that management directives pertaining to the entire entity are carried out. (entire company)

Front 9

Give examples of Entity-Level Controls.

Back 9

1. Controls related to the CONTROL ENVIRONMENT
2. Controls related to MANAGEMENT OVERRIDE
3. Controls to MONITOR RESULTS OF OPERATIONS
4. Management's RISK ASSESSMENT PROCESS
5. Period-end FINANCIAL REPORTING PROCESS

Front 10

What is an INTERNAL CONTROL DEFICIENCY?

Back 10

Exists when the DESIGN or OPERATION of a control does not allow management or employees to prevent or detect misstatements on a timely basis.

Front 11

What is a DESIGN DEFICIENCY?

Back 11

A problem relating to either:
1. A CONTROL necessary to meet the relevant control objective IS MISSING; --OR--
2. An EXISTING CONTROL IS NOT PROPERLY DESIGNED so that, even if the control operates as designed, the CONTROL OBJECTIVE WOULD NOT BE MET.

Front 12

What are OPERATING DEFICIENCIES?

Back 12

Exists when:
1. A properly designed CONTROL DOES NOT OPERATE AS DESIGNED, --OR--
2. The PERSON performing the control POSSIBLY IS NOT TRAINED to perform the control effectively.

Hint 12

Ch. 7 Internal Control

Front 13

What is a SIGNIFICANT DEFICIENCY?

Back 13

A CONTROL DEFICIENCY, or combination of control deficiencies, in ICFR that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting.

Hint 13

Ch. 7 Internal Control

Front 14

What is a MATERIAL WEAKNESS?

Back 14

A deficiency, or combination of deficiencies, in ICFR, such that there is a REASONABLE POSSIBILITY that a MATERIAL MISSTATEMENT of the annual or interim financial statements will not be prevented or detected on a timely basis.

Hint 14

Ch. 7 Internal Control

Front 15

What are the situations that should be regarded as strong indicators that a material weakness exists?

Back 15

1. RESTATEMENT OF PREVIOUSLY ISSUED F/Ss to reflect the correction of a material misstatement
2. EVIDENCE OF MATERIAL MISSTATEMENTS (caught by the audit team) that were not prevented or detected by client's ICFR.
3. INEFFECTIVE OVERSIGHT of financial reporting process and ICFR by the entity's audit committee
4. INDICATION OF FRAUD (either material or immaterial) by senior management.

Front 16

Re: Written representations from Management related to audit of ICFR:
What issues does the representation document address?

Back 16

1. Mngmt is responsible for ESTABLISHING AND MAINTAINING effective ICFR.
2. Mngmt DID NOT RELY ON WORK performed by the auditor in forming its assessment of the effectiveness of ICFR.
3. Mngmt's CONCLUSION about the effectiveness of ICFR
4. Mngmt has DISCLOSED TO AUDITOR ALL DEFICIENCIES in the design or operation of ICFR
5. Descriptions of any CHANGES in ICFR

Front 17

Who signs the written representation from management?

Back 17

Members of management

Front 18

What should auditors do if management withholds the written representation letters?

Back 18

Failure to obtain written rep letters from mgmt (including mgmt's refusal to furnish them) constitutes a LIMITATION ON THE SCOPE of the audit sufficient to preclude an UNQUALIFIED OPINION.

Front 19

What are the possible types of internal control opinions and the situations in which each should be issued?

Back 19

1. UNQUALIFIED - No material weaknesses found (client's ICFR provides REASONABLE ASSURANCE that the controls are designed and operating effectively)
2. DISCLAIMER OF OPINION - audit team cannot perform all the procedures considered necessary (serious SCOPE LIMITATION)
3. ADVERSE OPINION - One or More material weaknesses found (conclusion: client has not maintained effective ICFR)
Report should include definition of material weaknesses and a description of all material weaknesses that have been identified.

Front 20

What are the 3 categories of Internal Control Deficiencies?

Back 20

1. Internal Control deficiency
2. Significant deficiency
3. Material weaknesses

Front 21

What is remediation of a material weakness?

Back 21

The process of correcting a material weakness in the ICFR.
--- If a material weakness is corrected before the "as of" date, there must be sufficient time for both management and the auditor to test the operating effectiveness of the control - if not, an ADVERSE OPINION IS STILL ISSUED.

Front 22

What are the requirements associated with the communication of the different types of INTERNAL CONTROL DEFICIENCIES?

Back 22

1. Auditor must communicate in WRITING to MANAGEMENT and the AUDIT COMMITTEE all SIGNIFICANT DEFICIENCIES and MATERIAL WEAKNESSES identified during the audit (AS 5)
2. Comm. should be made PRIOR TO THE ISSUANCE OF THE AUDITOR'S REPORT ON ICFR.
3. Auditor should communicate to MANAGEMENT, IN WRITING, ALL CONTROL DEFICIENCIES identified during the audit and inform the audit committee when such a communication has been made.

Front 23

What are the 2 options in creating Reports on Internal Control?

Back 23

1. Separate report on Internal Control
-- Opinion on F/Ss contained in separate audit report
-- Extra paragraph added to report on IC referencing opinion on F/Ss.
2. INTEGRATED AUDIT REPORT and REPORT ON IC
-- includes AUDITOR'S OPINIONS on (1) IC EFFECTIVENESS, and
(2) the FAIRNESS of the company's F/Ss.

Front 24

What are the types of controls for auditors' reports for service organizations?

Back 24

1. Type 1 - Controls PLACED IN OPERATION
2. Type 2 - Report on TESTS OF EFFECTIVENESS (necessary to meet SOX section 404 reqmts)

Front 25

What is the difference between a significant deficiency and a material weakness?

Back 25

(1) the LIKELIHOOD and
(2) the MATERIALITY that a potential (or actual) misstatement would not be detected on a timely basis.

Front 26

Failure to obtain written representations from management constitutes a limitation of the scope of the audit sufficient to preclude (keeps from) what type of opinion?

Back 26

Unqualified opinion

Front 27

In ICFR, what opinion is given when no material weaknesses are found?

Back 27

Unqualified opinion

Front 28

What opinion is given when the audit team cannot perform all the procedures considered as necessary? (SERIOUS SCOPE LIMITATION)

Back 28

Disclaimer of opinion

Front 29

What opinion is given when 1 or more material weaknesses are found?

Back 29

Adverse opinion