Audit 1 Chapter 7

market capitalization formula

# of shares issued * current price per share

steps to issuing a f/s audit

1) plan the audit 2) obtain an understanding of the client, its environment, and internal control 3) assess the risks of misstatement and design further audit procedures 4) perform further audit procedures 5) complete the audit 6) form an opinion and issue the report

Service Organization Controls (SOC)

SOC 1 - about controls over financial reporting SOC 2 - about data integrity, privacy, and security

two types of service auditor reports

Type 1 Type 2

fidelity bonds

a form of insurance where a bonding company agrees to reimburse an employer within limits for losses attributable to theft or embezzlement by bonded employees

general control

apply to all or multiple types of transactions

application control

apply to the processing of a single type of transaction

when they should speak to management:

as discovered but no later than 60 days following the report release date

incompatible duties

assigned duties that place an individual in a position to both perpetrate and conceal errors or fraud in the normal course of job performance. these violate the segregation of duties

if using work of internal auditors

communicated how the work will be used to those charged with governance

risk of misstatement

composed of inherent risk and control risk. helps define the nature, timing, and extent of further audit procedures

4: AIS

consists of the methods and records established to record, process, summarize, and report an entity's transactions and to maintain accountability for the related A/L/E. make sure all transactions are recorded and that you have a chart of accounts

material weakness

deficiency in i/c over financial reporting such that there is a reasonable possibility that a material misstatement of the company's f/s will not be prevented or detected on a timely basis. required to speak to management with management letter.

significant deficiency

deficiency in i/c over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting. required to speak to management with management letter.

3 classifications of issues in i/c

deficiency in internal control significant deficiency material weakness

redundant controls

duplicate controls that achieve a control objective (overlap)

deficiency in internal control

exists when the design or operation of a control does not allow management or employees in the normal course of performing their assigned functions to prevent or detect material misstatements on a timely basis. speak with management if it merits attention

if deviations are found...

expand the sample size

Enterprise Risk Management

focuses on how org can obtain maximum value for stakeholders by managing all risks and opportunities effectively. COSO issued a framework for it

transaction level risks

found within divisions, operating units, or functions of the organization

nature of tests of i/c

inquiries of appropriate client personnel, inspection of documents and reports, observation of the application of controls, and re-performance of the controls.

if relying on internal auditors

make sure you've evaluated their competency and objectivity, and that they're using a systematic and disciplined approach. examine their education, training, external audit experience, and who they report to (should be the audit committee)

general authorization

management establishes criteria for acceptance of a certain type of transaction

Type 2 report

management's description of a service org's system and the suitability of the design and operating effectiveness of controls

Type 1 report

management's description of a service org's system and the suitability of the design of controls

i/c written narrative

memoranda that describe the flow of transaction cycles, identify the employees performing various tasks, the documents prepared, the records maintained, and the division of duties. good because its very flexible. bad because it's hard to read

limitations of internal control

mistakes in the performance of controls can be due to misunderstanding instructions, mistakes of judgment, carelessness, distraction, or fatigue. also can be due to inappropriate management, cost restrictions, and human error.

i/c of a small company

more difficult than a larger company because it's harder to segregate duties.

if getting assistance from internal auditors

obtain written acknowledgement from management and those charged with governance that the internal auditors will be allowed to perform the work free from any interference.

transaction control activities

performed to check the accuracy, completeness, validity, and authorization of transactions. includes authorizations and approvals, verification, physical controls of assets and records, controls over standing data, reconciliations, and supervisory controls. other examples: following up, adhering to budgets, pre-numbered documents.

3: control activities

policies and procedures that help mitigate the risk that the org's objectives will not be met. includes performance reviews, transaction control activities, general controls and application controls, and segregation of duties

3 types of internal control

preventive, detective, and corrective

Section 404(b) of SOX

requires that the auditor attest to and report on internal control over financial reporting (have to do an integrated audit). only applies to public companies with a market capitalization of $75 million or more.

internal control allows us to:

safeguard assets, comply with laws/regs, operate efficiently and effectively, and record things properly

effective organizational structure

should separate responsibilities for authorization of transactions, record keeping for transactions, and custody of assets treasury- treasurer - authorization and custody of assets accounting function- controller - record keeping

corporate governance

the system by which companies are directed and controlled

walk through

tracing one or two transactions through each step of the transaction cycle. it's a way to see if i/c is being implemented. (not a way to document the controls)

specific authorization

transactions are authorized on an individual basis

ways you can use internal auditors

using their work as evidence (note that it's PBC) or getting assistance from them on the audit.

segregation of duties

1) no one person or department should have complete control of a transaction from beginning to end 2) if you have physical access to an asset, you should not have access to the accounting record or be allowed to authorize transactions for that asset ( separate authorizing transactions, recording transactions, and maintaining custody of assets)

internal control

a process, effected by the entity;s board of director, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the categories of operations, reporting, and compliance

corrective controls

control established to remedy control problems that are discovered through detective controls. ex: maintaining backup copies of key transactions to correct entry errors, disciplinary actions

compensating controls

control that reduces the risk that an existing or potential control weakness will result in a failure to meet a control objective. they're performed to detect (rather than prevent) the original misstatement from occurring. ex: short staffed so have manager review all entries to make up for lack of segregation

detective controls

controls designed to discover control problems soon after they occur. ex: policy requiring preparation of monthly bank statements, inventory counts

preventive controls

controls that deter control problems before they occur. avoiding occurrence of misstatements. ex: segregation of duties, requiring approval of period ending journal entries, passwords/locks

complementary controls

controls that function together to achieve the same control objective (work together)

Treadway Commission

created Committee of Sponsoring Organizations to study internal control. set definition and standards that transactions need to be timely, in the correct amount, accurately recorded, and properly disclosed.

i/c flowchart

diagram of procedures, division of responsibilities, sources and distribution of docs, and types and location of accounting records for each major transaction cycle. good for clear visual portrayal and effectiveness with little room for misunderstanding. bad because it doesn't flag weaknesses as obviously as does the questionnaire.

effects of FCPA of 1977

eliminated ignorance is bliss defense. assures all transactions are done with the knowledge of management. system of i/c is now required by federal law.

entity level risks

from external or internal factors, such as economic, regulatory, technology, or personnel factors

2: risk assessment process

have to determine risk tolerance (avoidance, reduction, sharing, or acceptance) and how risks could prohibit achieving objectives

integrated audit requirements

have to test all significant accounts up to the as of date. have to comply with COSO.

why test i/c?

have to test them if you rely on them (don't test them if they're bad because you won't rely on them). they help determining nature, timing, and extent of substantive testing.

info from gaining understanding of i/c will be used to:

identify types of potential misstatements, consider factors that affect the risks of material misstatements, and design tests of control and substantive procedures

when to test for i/c

if a process is changed, you have to test for i/c PCAOB- some evidence regarding operational effectiveness is required annually AICPA- testing required every third year if there hasn't been a change

procedures to assess risk within i/c

inquire personnel, observe controls, inspect documents, trace transactions

5: monitoring activities

process to assess the quality of internal control performance over time. internal audit function performs ongoing monitoring evaluations on a routine basis and

three ways to document understanding of i/c

questionnaire, written narrative, flowchart

Foreign Corrupt Practices Act of 1977

requires that under the jurisdiction of the SEC, to maintain a system of i/c that will provide reasonable assurance that: transactions are executed with the knowledge and authorization of management, transactions are recorded as necessary to permit the prep of f/s and accountability for assets, access to assets is limited to authorized individuals, and accounting records of assets are compared to existing assets t reasonable intervals and appropriate action is taken with respect to any differences.

five components of internal control

the control environment, the risk assessment process, control activities, the information system relevant to financial reporting and communication (AIS), and the monitoring activities

service organizations

provide processing services to companies (user entities) that decide to outsource a portion of their processing (payroll, etc). should go and ask to test their controls or use the service auditor's report.

Section 404(a) of SOX

requires each annual report filed with SEC to include a letter from management that states they acknowledge responsibility for establishing and maintaining adequate i/c over financial reporting. also provides assessment of internal control effectiveness with evidence as of the end of the most recent fiscal year.

1: control environment

the standards, processes, and structures that guide individuals in carrying out their duties that make up the foundation for i/c. includes commitment to integrity and ethical values, effective BOD, effective organizational structure, attracting/developing/retaining competent employees, and individual accountability

i/c questionaire

yes or no questions where no's are considered a weakness. good because weaknesses are easy to spot. bad because inflexible, prewritten, and it's not easy to document the compensating controls (what they're doing to combat the weaknesses)