Ch 4: Management Fraud and Audit Risk

enterprise risk management (ERM)

"a process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives."

an asset amount that can be investigated and found to be false or questionable. the matter of finding and investigating the dangling credit is normally very difficult. It "dangles" off the books.

"dangling debit" theory

company sources

(1) reviewing the corporate charter and bylaws or partnership agreement, (2) reviewing contracts, agreements, and legal proceedings, and (3) reading the minutes of the meetings of directors and committees of the board of directors are all examples of what source of information for assessing risk

set a proper tone for the engagement

A secondary objective of the brainstorming discussions during risk assessment is to....

preliminary

According to auditing standards, analytical procedures must be applied in the ____stages of each audit.

1. direct effect noncompliance 2. indirect effect noncompliance

Auditing standards deal with what two types of noncompliance

1. Discussions with engagement personnel 2. Procedures to identify and assess risk 3. Significant decisions during discussion 4. Specific risks identified and audit team responses. 5. Explanation of why improper revenue recognition is not a risk. 6. Results of audit procedures, particularly procedures regarding management override 7. Other conditions causing auditors to believe that additional procedures are required. 8. Communications to management and those charged with governance, such as the audit committee.

Auditors must carefully document the risk assessment process in the workpapers to provide a record of the procedures performed. Items that must be documented include these:

1. develop an expectation 2. define a significant difference (percent difference that is considered reasonable) 3. compare expectation with recorded amount 4. investigate significant differences 5. document each of the preceding steps

Auditors should perform what five steps when completing analytical procedures

nature, timing, extent

Based on the allowable or planned level of detection risk (which is based on the assessment of IR and CR), auditors modify the ___, the ______, and the _____of further audit procedures.

fraudulent financial reporting

Because management fraud usually takes the form of deceptive financial statements, management fraud is sometimes referred to as....

2, 2

Because of the double-entry bookkeeping system, fraudulent accounting entries always affect at least ____ accounts and ____ places in financial statements.

general business source

Bloomberg Businessweek, Forbes, and Fortune are examples of what source of information for assessing risk

yes

Can an external auditor withdraw from an engagement if management and directors do not take satisfactory action after being notified of noncompliance?

embezzlement, larceny

Employee fraud can be classified as either _____ or ______.

1. the fraudulent act 2. the conversion of funds or property to the fraudster's use 3. the cover-up

Employee fraud consists of what three phases?

(1) the reporting objectives of the engagement and the nature of the communications required by auditing standards, (2) the factors that are significant in directing the activities of the engagement team, and (3) the results of preliminary engagement activities and the auditor's evaluation risk assessment.

In establishing the overall audit strategy, the auditor should take into account (3)

1. industry & external factors 2. nature of company 3. accounting principles and disclosures 4. objectives and strategies 5. measurement and analysis of financial performance

In the first step in the risk assessment process where you understand the company and its environment, what 5 things do you need to know

control

Managers build in controls to prevent errors in financial statements from happening, but they may not function as intended. this is known as ____ risk

1. company's organizational structure and management personnel 2. the sources of funding of the company's operations and investment activities 3. the company's significant investments 4. the company's operating characteristics, including its size and complexity 5. The sources of the company's earnings, including the relative profitability of key products and services, and key supplier and customer relationships.

Obtaining an understanding of the nature of the company includes understanding (5)

inherent risk, control risk

Risk of material misstatement (RMM) is comprised of.... (2)

business risks

Risks that could adversely affect companies' ability to achieve objectives and execute strategies are called....

1. internal environment 2. objective setting 3. event identification 4. risk assessment 5. risk response 6. control activities 7. information and communication 8. monitoring.

The ERM framework is composed of what eight elements

1, SEC

The Private Securities Litigation Reform Act of 1995 imposed another reporting obligation that when auditors believe an illegal act that is more than "clearly inconsequential" has or may have occurred, the auditors must inform the company's board of directors. when the auditors believe the illegal act has a material effect on the financial statements, the board of directors has ______ business day(s) to inform the ____

inform the organization's board of directors

The Private Securities Litigation Reform Act of 1995 imposed another reporting obligation that when auditors believe an illegal act that is more than "clearly inconsequential" has or may have occurred, the auditors must.....

detection risk

The likelihood that an error or fraud will not be caught by the auditor's procedures

effectiveness

The nature of the procedures refers to the overall ____ of further audit procedures in detecting misstatements.

significant, relevant disclosures

Using the audit risk model, the auditor adjusts detection risk for _____ accounts and _____

"The auditors communication with those charged with corporate governance"

What is SAS 114

Focuses on direct effect illegal acts

What is SAS 54

Consideration of fraud in a financial statement audit - must specifically assess the risk of material misstatement due to fraud for every engagement

What is SAS99?

SEC form that requires an explanation of an organization's change of auditors

What is form 8-k

preliminary analytical procedures

When completing _______, auditors are required to develop an expectation about what an account balance should be and then compare that expectation to the recorded balance. When doing so, auditors typically use the prior-year balances as the starting point for their expectation for each account balance.

if noncompliance is "clearly inconsequential," and has impact on FS

When must an auditor respond to a client's noncompliance or suspected noncompliance?

matrix approach

When risk is measured qualitatively, how do firms multiply words to assess risk?

inherent

You can think of this risk as the susceptibility of the account to misstatement.

Business risk

_____ assessment makes auditors much more knowledgeable about their client's business and its environment. We should note that, even when taking a top-down approach that starts with an understanding of the risks faced by the client in executing its strategy within the industry, the audit team ultimately still has to focus its procedures on the key accounts and management assertions

business

a detailed understanding of the client's ______ risk is a precursor to assessing audit risk.

enterprise risk management (ERM)

a framework such as the one developed by the Committee of Sponsoring Organizations (COSO) to facilitate the assessment and mitigation of business risks that the entity faces.

Interviewing the entity's management, internal auditors, directors, the audit committee, and other employees

a required audit process that can bring auditors up to date on changes in the business and the industry. Such inquiries of client personnel have the multiple purposes of building personal working relationships, observing the competence and integrity of client personnel, obtaining a general understanding, and probing for problem areas that could harbor financial misstatements.

embezzlement

a type of employee fraud involving employees or nonemployees wrongfully misappropriating funds or property entrusted to their care, custody, and control, often accompanied by false accounting entries and other forms of deception and cover-up.

1. gather info from client acceptance and retention evaluation, audit planning, past audits and other engagements 2. perform analytical procedures 3. brainstorming 4. inquire of audit committee, management and others

after assessing internal controls over financial planning in the risk assessment process, what 4 things must be done to consider the risk of fraud (first 4 steps of 7)

significant accounts or disclosures

an account or disclosure that has a reasonable possibility of containing a material misstatement regardless of the effect of controls.

reasonableness

analytical procedures are _____ tests; auditors compare their expectation for each of the account balances with those recorded by management.

defalcation

another name for employee fraud, embezzlement, and larceny. Auditing standards also call it misappropriation of assets.

management

any fraud committed by _______ no matter how small is material

accounting estimates

approximations of financial statement numbers that are often included in financial statements.

no

are audit teams concerned with fraud that does not affect the financial statements?

yes

are auditors required to respond to a subpoena issued by a court or other agency (due to client confidentiality)

independent, outside members of the board of directors (those not involved in the company's day-to-day operations) who can provide a buffer between the audit firm and management.

audit committees are composed of...

1. inherent risk 2. control risk 3. detection risk

audit risk can be broken down into....

financial statements as a whole, each relevant assertion for significant accounts and disclosures

audit risk is evaluated for both the _____ and for _____

fraud risk

auditing standards require that auditors must presume that improper revenue recognition is a _____

significant

by definition, fraud risks are all _____ risks

no, it is conceptual

can auditors calculate the exact level of DR?

no

can auditors place complete reliance on internal controls to the exclusion of other audit procedures?

more

complexity of the transactions: does being more or less complex lead to higher percentage of errors?

risk response

component of the ERM framework that addresses how the organization will prevent or respond to the adverse conditions if they actually occur. The responses include management policies and procedures to eliminate, mitigate, or compensate for the risks identified.

control activities

component of the ERM framework that are policies and procedures to ensure that risk responses are appropriate given the circumstances and environment in which the organization operates.

monitoring

component of the ERM framework that includes regular management and supervisory activities over risk management activities to make sure they remain in place and operate effectively. (internal audit groups)

objective setting

component of the ERM framework that is management's responsibility to determine the goals and objectives of the organization.

internal environment

component of the ERM framework that is the "risk consciousness" of the organization and includes the organization's risk management philosophy and "risk appetite," its integrity and ethical values, and the environment in which it operates.

event identification

component of the ERM framework that is the identification of conditions and events that could adversely affect management's objectives. Supplier problems, poor weather conditions that can affect the trucks supplying the stores, and information system breakdowns are just several of the events that could adversely affect Walmart's ability to keep its stores' shelves stocked.

risk assessment

component of the ERM framework that is the systematic process for estimating the likelihood of adverse conditions occurring. Risks are assessed in terms of both likelihood and impact.

Information and communication

component of the ERM framework that links all components of the ERM. I

management fraud

deliberate fraud committed by management that injures investors and creditors through materially misstated information.

yes

do different types of accounts have different levels of risk for the same assertions (existence, valuation, etc)

yes

do professional auditing standards require auditors to let financial statement users know whether they have substantial doubts as to whether the client will able to survive into subsequent periods?

no, except that it should be "appropriately" low.

does the audit profession have an official standard for acceptable level of audit risk?

higher

dollar size of the account: does a higher account balance lead to a lower or greater chance of having errors or fraud in the account

yes

due to the fact that auditors are required to keep client information confidential, under AICPA auditing standards, can limited disclosures to outside agencies of frauds and clients' noncompliance be permitted.

horizontal analysis

during analytical procedures, many auditors start with comparative financial statements and calculate year-to-year changes in balance-sheet and income- statement accounts. this is known as....

vertical analysis

during analytical procedures, this is when auditors calculate common-size statements in which financial statement amounts are expressed as percent- ages of a base, such as sales for the income-statement accounts or total assets for the balance-sheet accounts

1. dollar size of the account 2. liquidity 3. volume of transactions 4. complexity of the transactions 5. subjective estimates

factors that have been suggested as being related to the susceptibility of accounts to misstatement or fraud (5)

10%, 100,000$

for companies that have not undergone any significant changes in operations, current year recorded amounts should be fairly similar to those of prior year. Because changes are not expected, auditors can identify any changes more than ______% AND _______$ as deserving additional attention

audit risk

giving an unmodified audit opinion when unknown material misstatements (whether due to errors, frauds, or noncompliance with laws or regulations that directly affect the financial statements) actually exist in the statements causes what type of risk?

vague, implausible, or inconsistent responses to inquiries can be a key indicator of the pervasiveness of the fraud. Similarly, problematic or unusual reactions such as refusal to cooperate, hostility, or management delays in responding to the auditors are often present in financial statement frauds.

how can management's response to follow up question be a key source of evidence

generally by examining more evidence

how can the auditor affect detection risk?

reviewing the board of directors' meeting minutes, making inquiries of key executives, and reviewing stock ownership records (5 percent ownership in the company is usually used as a good cutoff).

how do auditors identify related party relationships and transactions? (name a few methods) (3)

1. within one business day give the SEC the same report they gave the board of directors OR 2. resign from the engagement and, within one business day, give the SEC the report. If the auditors do not fulfill this legal obligation, the SEC can impose a civil penalty (e.g., monetary fine) on them.

if an auditor reports an illegal act that has a material effect on the financial statements to the board of directors and they board does not inform the SEC, the auditors must.... (2)

8-k

if the audit firm resigns or is fired for reporting client's fraud to an outside entity, the firm can cite these matters in the letter attached to SEC Form....

no, detection risk depends on and is planned for based on the assessment of the other risk factors.

is detection risk an independent judgement?

greater

liquidity: does greater or smaller account liquidity lead to being more susceptible to fraud?

relevant assertions

management assertions that have a reasonable possibility of containing material misstatements without regard to the effect of controls

direct effect noncompliance

noncompliance that produces direct and material effects on financial statement amounts (e.g., violations of tax or pension laws or government contracting regulations for cost and revenue recognition) that require the same assurance as errors and frauds (i.e., auditors must plan their work to provide reasonable assurance there are no material misstatements),

indirect effect noncompliance

noncompliance which refers to violations of laws and regulations that are not directly connected to financial statements (e.g., violations relating to insider securities trading, occupational health and safety, food and drug administration regulations, environmental protection, and equal employment opportunity).

extent

refers to the number of tests performed

timing

refers to when the further audit procedures take place.

audit risk (AR) = inherent risk (IR) x control risk (CR) x detection risk (DR)

risk model formula

general business sources, company sources, information from Client Acceptance or Continuance Evaluation, Audit Planning, Past Audits, and Other Engagements, preliminary analytical procedures

sources of information for assessing risks includes (4)

more

subjective estimates: do subjective measurements have more or less errors and fraud than objective measurements?

fraud

the act of knowingly making material misrepresentations of fact with the intent of inducing someone to believe the falsehood and act on it and, thus, suffer a loss or damage.

information risk

the probability that the information distributed by an entity will be materially false and misleading

brainstorming

the risk assessment process includes required audit team _____ sessions in which critical audit areas are discussed.

audit strategy memorandum

the scope, timing, and direction for auditing each relevant assertion based on the results of the audit risk model

employee fraud

the use of fraudulent means to misappropriate funds or other property from an employer. It usually involves falsifications of some kind: using false documents, lying, exceeding authority, or violating an employer's policies.

detection risk

there is an inverse relationship between RMM and ______ risk (the greater the risk of material misstatement, the lower the detection risk that auditors could allow in order to maintain the level of audit risk with which they feel comfortable.)

related parties

those individuals or organizations that can influence or be influenced by decisions of the company, possibly through family ties or investment relationships

significant risks

those risks that require special audit consideration because of the nature of the risk or the likelihood and potential magnitude of misstatement related to the risk.

avoid it, control it and share it (can also just accept it)

three basic ways that management can mitigate risk are (3)

white collar crime

type of crime that is the misdeeds of people who wear ties to work and steal with a pencil or a computer terminal.

larceny

type of employee fraud that is simple theft; for example, an employee misappropriates an employer's funds or property that has not been entrusted to the custody of the employee.

errors

unintentional misstatements or omissions of amounts or disclosures in financial statements.

higher

volume of transactions: does a higher or lower volume in transactions lead to a higher percentage of errors or fraud?

examining more transactions, performing extended procedures, including targeting tests toward higher risk areas, performing more tests of transactions at year-end rather than at interim points, and gathering higher quality evidence.

what are some responses to significant risks? (5)

1. invalid transactions are recorded 2. valid transactions or disclosures are omitted from the FSs 3. Transaction or disclosure amounts are inaccurate 4. transactions are classified in the wrong accounts 5. transaction accounting an posting are incorrect 6. transactions are recorded in the wrong period 7. disclosures are incomplete or misleading

what are the 7 categories of misstatements

assess risk factors, respond (re substantive procedures, specialists, etc), communicate

what are the last three steps of the risk assessment process?

auditors view all activities in a client's organization first in terms of risks that threaten the attainment of strategies and objectives and then in terms of management's plans and processes to mitigate the identified risks (for example, by using the ERM framework).

what is a top-down approach to risk assessment?

limited to performing specified audit procedures that may identify noncompliance with those laws and regulations that may have a material effect on the financial statements, making inquiry of management and those charged with governance, and inspection of correspondence with relevant licensing or regulatory authorities

what is an auditor's responsibility for detecting indirect-effect noncompliance?

understand the company and its environment

what is the first step in the risk assessment process?

understand internal control over financial reporting

what is the second step in the risk assessment process?

information from client acceptance and retention evaluation, audit planning and other engagements

what is the third step in the risk assessment process?

cash flow analysis

what time of analysis is good for detecting issues regarding going concern?

inherent

when results of events and transactions are recorded through information processing where errors and frauds can occur resulting in misstated financial statements, this is _____ risk

going concern (whether the company can remain a going concern)

whether the client will able to survive into subsequent periods is called _____

directly to those charged with governance, usually the entity's audit committee of its board of directors. (never inconsequential and should be reported)

who should frauds involving senior managers or employees with significant internal control roles (along with any frauds that cause material misstatement in the financial statements) be reported to?

management at least one level above the people involved

who should minor frauds be reported to?

no

with the risk model/ formula, can auditors estimate inherent risk to be zero and omit other evidence-gathering procedures? AR = IR (=0) x CR x DR = 0