Audit Chapter 7

To identify significant accounts and disclosures and their relevant assertions, the auditor assesses risk factors including ______. (3 factors)

- account size and composition - nature of the disclosure - susceptibility to misstatement

Which of the following statements are true about the financial statement and ICFR audits? (2 factors)

-Work must be planned to achieve both objectives. -They have different objectives

When companies use service organizations to process transactions, ______. (2 factors)

-both management and the auditor must consider the service organization activities -the service organization is considered part of the information and communication component of the entity's ICFR

In assessing material weaknesses in ICFR management must ______. (3 factors)

-identify financial reporting risks and related controls -evaluate evidence about the operating effectiveness of ICFR -consider which locations to include in the evaluation

In evaluating the risk of material misstatement due to fraud and the risk of management override of controls, the auditor should consider controls ______. (2 factors)

-over related party transactions -related to significant management estimates

test the nature of operating effectiveness with 4 things

1. inquiries 2. reperformance 3, observation 4. inspection of documents

two dimensions of the control deficiency

1. likelihood (reasonably possible) 2. magnitude (material, significant, or insignifiacnt

Unless a longer period of time is required, PCAOB standards require the auditor to retain audit documentation for the ICFR and financial statement audit for ______ years.

7

during the audit of internal controls for an issuer, the ultimate objective of testing the design effectiveness of internal controls is to...

Determine that the company's controls will satisfy the company's control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements, if they operate as prescribed.

t/f: the auditor should provide recommendations for improving internal control in the audit report.

FALSE

t/f: The financial statement amounts exposed to the deficiency is not a factor that might affect the likelihood that a control deficiency could result in a misstatement in an account balance

TRUE

Management's assessment of the entity's ICFR must be based on ______.

a recognized control framework

If one or more unremediated material weaknesses is identified, the auditor issues a(n) ______ opinion on the entity's internal control.

adverse

an _____ opinion is required if a material weakness is identified

adverse

To provide reasonable assurance, a control system, ______

allows for a remote likelihood of material misstatement

Management asserts that ICFR is effective ______.

as of the end of the fiscal year

If the auditor discovers fraud involving senior management while auditing ICFR, the auditor must communicate the matter directly to the ______.

audit committee

The primary purpose for obtaining an understanding of internal control during the audit of a nonissuer is to:

determine the nature, timing, and extent of further audit tests to be performed. these are the auditor's responsibilities under GAAS

Management may include additional information in its report on ICFR. In regards to such information the auditor should ______.

disclaim an opinion

In assessing financial reporting risks, management must evaluate ______. (2 factors)

entity-level controls & other pervasive elements of ICFR

When an entity has a material weakness, it should take steps to correct it, which is referred to as

remediation

the process of correcting a material weakness in the ICFR. if corrected before the "as of" date, there must be sufficient time for both management and the auditor to test the operating effectiveness of the control- if not, an adverse opinion will be issued

remediation

The most important fundamental component of an entity's internal control is...

the control environment

Section 404 of the Sarbanes-Oxley Act requires management to report on ______.

the effectiveness of internal control over financial reporting

signifies that the entity's internal control is designed and operating effectively (no material weakness)

unqualified opinion

The phrase "All material respects" means that the entity's ICFR ______.

is free of any material weakness

as the risk associated with control being tested increases, the external auditor should do ____ of the work

more

When compared to automated controls, manual controls should be subjected to ______ testing

more extensive

when an entity has effective ICFR, the auditor should be able to perform _______ testing of controls to assess control risk for all relevant assertions at a ___ _____

sufficient, low level

After auditing the effectiveness of an entity's internal control, an auditor issues a(n) ______ ______ if the entity's internal control is designed and operating effectively in all material respects.

unqualified opinion

requires an auditor to trace a transaction from each major class of transactions from origination through the entity's information system until it is reflected in the entity's financial reports.

walkthrough

In auditing a public company, Natalie, an auditor for N. M. Neal & Associates, identifies four deficiencies in ICFR. Three of the deficiencies are unlikely to result in financial misstatements that are material. One of the deficiencies is reasonably likely to result in misstatements that are not material but significant. What type of audit report should Natalie issue?

an unqualified report

When deciding on the extent of testing, the auditor should consider the ______. (3 factors)

nature of the control, frequency of operation, and importance of the control

When completing the audit of internal controls for an issuer, AS 2201 requires auditors to report on management's report on IC (yes/no) and an audit of IC (yes/no)

no, yes

in the audit of a ________, the audit team is required to obtain an understanding of IC to determine the nature, timing, and extent of further audit procedures to be performed and is only required to test controls of _____ _______ if they plan to rely on those controls to reduce substantive tests (chapter 6)

non-issuer, operating effectiveness

t/f: Overproduction by the manufacturing plant would probably not be considered an indication of a material weakness

true. Overproduction does not directly relate to a material misstatement of the financial statements but is an operational issue.

To identify significant accounts and disclosures and their relevant assertions, the auditor assesses risk factors including ______. (4 factors)

volume of activity, changes from prior periods, reporting complexities, & related party transactions

the best way to identify of potential sources of misstatements (trace transaction step-by-step from source doc, through accounting system, to F/S)

walkthroughs

Audit evidence supporting effective internal control must be obtained at the level of ______.

reasonable assurance

In evaluating the risk of material misstatement due to fraud and the risk of management override of controls, the auditor should consider controls over ______. (2 factors)

-significant, unusual transactions resulting in unusual journal entries -journal entries and adjustments made in the period-end financial close

Audit documentation related to the audit of internal controls must include ______. (3 factors)

-the extent of reliance on work performed by others -the scope of testing -the evaluation of deficiencies discovered

If a control deficiency is a material weakness, management must disclose it in its assessment of the effectiveness of ICFR, including ______. (3 factors)

-the nature of the material weakness(es) -management's current plans, if any, for remediating the weakness -its impact on the entity's financial reporting and its ICFR

If the financial reporting risks for a location are low and the entity has good entity-level controls, management may rely on _____ ______ _____ in conjunction with entity-level controls for its assessment

self-assessment processes

t/f: Auditors must make decisions regarding which locations to test based on the presence of entity-level controls and financial reporting risk.

true

t/f: ICFR audits must be integrated

true

t/f: The auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit.

true

t/f: The severity of a control deficiency depends on its likelihood and magnitude.

true

t/f: When testing, auditors should focus on key controls.

true

If a significant deficiency of material weakness exists because of the audit committee's ineffective oversight, the auditor must communicate the specific deficiency or weakness, in writing, directly to the ______.

BOD

When completing the audit of internal controls for an issuer, the severity of an internal control deficiency depends on... (2 factors)

Both the magnitude of the potential misstatement resulting from the deficiency or the deficiencies and whether there is a reasonable possibility that the company's controls will fail to prevent or detect a misstatement of an account balance or disclosure.

t/f: Identifying controls to be tested is an objective task that requires little professional judgment.

FALSE- it is a subjective task

The auditor ______ need to test all controls

does NOT

a process designed by, or under the supervision of, the company's principal executive and principal financial officers, or persons performing similar functions, and effected by the company's BOD, management, and other personnel to provide ______ assurance regarding the ______ of FR and the preparation of F/S for external purposes in accordance with GAAP and includes those policies and procedures that: -pertain to the _________ of records that in reasonable detail, ______ and fairly reflect the transactions and dispositions of the assets of the company -provide reasonable assurance that _______ are recorded as necessary to permit preparation of F/S in accordance with GAAP, and that receipts and expenditures of the company are being made only in accordance with ______ of management and directors of the company, and -provide reasonable assurance regarding prevention or _____ detection of unauthorized acquisition, use, or disposition of the company's assets that could have a material effect on the F/S

reasonable, reliability, maintenance, accurately, transactions, authorizations, timely

4 management responsibilities under 404

1. accept responsibility for the effectiveness of the entity's ICFR 2. evaluate the effectiveness of the entity's ICFR using suitable control criteria 3. support the evaluation with sufficient evidence, including documentation 4. present a written assessment regarding the effectiveness of the entity's ICFR as of the end of the entity's most recent fiscal year

test the extent by considering 3 things

1. nature of the control 2. frequency of operation 3. importance of the control

steps in the audit of the ICFR

1. plan the audit 2. identify controls 3. evaluate the design and test operating effectiveness (scope) 4. evaluate identified control deficiencies 5. form an opinion of the effectiveness (report)

when planning the audit of ICFR, consider 3 factors:

1. role of risk assessment and risk of fraud 2. scaling the audit 3. using the work of others

In auditing ICFR for a public company, Emily finds that the entity has a significant subsidiary located in a foreign country. Emily's accounting firm has no offices in that country, and the entity has thus engaged another reputable firm to conduct the audit of internal control for that subsidiary. The other auditor's report indicates that there are no material weaknesses in the foreign subsidiary's ICFR. What should Emily do?

Accept the other auditor's opinion after evaluating the auditor's work and make reference to the other auditor's report in her audit opinion.

True or false: Auditors of publicly traded companies must issue a report that accepts responsibility for establishing and maintaining adequate ICFR.

FALSE- management must issue the report

t/f: Controls to monitor the inventory taking process is an entity-level control

FALSE. it is not

under section 404, the auditor must audit and report on the effectiveness of ________. the auditor is required to conduct an ______ audit of the entity's _____ and its F/S because each audit provides the auditor with information relevant to the evaluation of the results of the other

ICFR, integrated, ICFR

If a material weakness cannot be corrected and/or properly tested before the "as of" date, ______.

both management and the auditor should issue a report that the ICFR is not operating effectively

If the auditor fails to obtain written representations from management, the auditor ______ opinion of ICFR.

can NOT issue an unqualified

Written representations from management related to the audit of ICFR include management ______. (2 factors)

conclusion about the effectiveness of the entity's ICFR as of a specified date & responsibility for establishing and maintaining effective ICFR

____ ____ _____ is a substantive test, not a test of a control's operating effectiveness.

confirmation of balances

In addition to material weaknesses and significant deficiencies, the auditor should communicate, in writing, to management all ______ deficiencies identified during the audit

control

when the design or operation of the control does NOT allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis

control deficiency

A control deviation caused by an employee performing a control procedure that he or she is not authorized to perform is always considered a

deficiency in operation

'' When a control necessary to meet the relevant control objective is missing, a(n) _____ ______ exists

design deficiency

test _____ _________ of control and test and evaluate the ____ _____

design effectiveness, operating effectiveness

Significant deficiencies and material weaknesses must be communicated to an entity's audit committee because they represent significant deficiencies in the _____ or _____ of internal control

design or operation

A control deficiency exists when the _____ or ______ of a control does not allow management or employees to prevent or detect misstatements on a timely basis.

design, operation

a serious scope limitation requires the auditor to ____ or ______ an opinion

disclaim, withdraw

AnnaLisa, an auditor for N. M. Neal & Associates, is prevented by the management of Lileah Company from auditing controls over inventory. Lileah is a public company. Management explains that controls over inventory were recently implemented by a highly regarded public accounting firm that the entity hired as a consultant and insists that it is a waste of time for AnnaLisa to evaluate these controls. Inventory is a material account, but procedures performed as part of the financial statement audit indicate the account is fairly stated. AnnaLisa found no material weaknesses in any other area of the entity's internal control relating to financial reporting. What kind of report should AnnaLisa issue on the effectiveness of Lileah's internal control?

disclaimer of opinion

If the auditors encounter a significant scope limitation in evaluating an issuer's internal control over financial reporting, which of the following types of opinions on the effectiveness of the company's internal control over financial reporting would be appropriate?

disclaimer of opinion because scope limitation exists

If the auditor believes that additional management information in its report of ICFR contains a material misstatement of fact the auditor should immediately ______.

discuss the matter with management

these are all _____ ______ controls: - within control environment - over management override - risk assessment process - centralized processing - monitor results of opertaions - monitor other controls - over period-end FR process - policies that address significant business controls

entity-level

those that permeate an organization and have a significant impact on how it achieves its FR and disclosure objectives

entity-level controls

Section 404 of the Sarbanes-Oxley Act requires that management report on the effectiveness of its internal control over _____ ______

financial reporting

The risk that a misstatement could result in a material misstatement of the financial statements is called a(n) _____ _______ risk

financial reporting

When completing the audit of internal controls for an issuer, the PCAOB requires the audit team to audit internal controls over:

financial reporting

controls of significant & unusual transactions, controls over JEs and adjustments made in period-end, controls over related party transactions, controls related to significant management estimates, and controls to mitigate incentives for management to inappropriately manage financial results are all controls of importance in terms of...

fraud deterrence and detection

composed of the audits of IC and the F/S. the conrol testing impacts the substantive audit procedures. also, the results of the substantive procedures are considered in the evaluation of IC

integrated audit of F/S and IC

Controls that operate on a continuous basis would most likely be tested during a ______ period

interim

test the timing of operative effectiveness with

interim v.s. "as of" date

in the audit of ________, the audit team is required to evaluate and express an opinion on the effectiveness of the entity's ICFR. in this evaluation, the audit team focuses on whether a ______ ________ in ICFR exists at the _______ _____ ______ being reported on. if a _________ ______ exists, the entity's ICFR CANNOT be effective

issuer, material weakness, end of year, material weakness

the auditor does not need to test ___ controls- only those important to the auditor's conclusion about whether the entity's controls sufficient;y address the assessed risk of misstatement to each relevant assertion

key

The severity of a control deficiency depends on ______.

likelihood & magnitude

Reports accepting responsibility for establishing and maintaining adequate ICFR are issued by ______ of public companies

management

in addition, the auditor should communicate to ______ in writing, all control deficiencies identified during the audit and inform the audit committee when such a communication has been made

management

during the F/S audit or an integrated audit, the auditor obtains written representation from _____ related to the audit of F/S or ICFR. failure to obtain this constitutes a _______ of ________ of the audit sufficient to preclude/prevent an unqualified opinion

management, limitation of scope

Fill in the blank question. A deficiency in ICFR, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis is defined as a(n) _______ ______ by the PCAOB

material weakness

a deficiency, or combination of them, in ICFR, such that there is a reasonable possibility that a material misstatement of the annual or interim F/S will NOT be prevented or detected on a timely basis

material weakness

a situation in which it is reasonably possible that a material misstatement would not be detected on a timely basis

material weakness

identification of fraud, restatement of previously issued F/S to reflect the correction of a material misstatement, evidence of MM that are not prevented or detected by the client's internal controls, and ineffective oversight of the company's FR and ICFR by the audit committee are all strong indicators of _______ _______

material weakness

Evidence about the operating effectiveness of controls at service organizations that are relevant to management's assessment and the auditor's opinion ______.

may be obtained by performing tests or obtaining a service auditor's report

The auditor's written communication about control deficiencies may indicate ______.

only that no material weaknesses were identified

When completing the audit of internal controls for an issuer, AS 2201 requires auditors to test which two factors

operating and design effectiveness

If a misstatement is detected by substantive procedures, the auditor should consider whether the control deficiency might affect the _______ on the audit of ICFR

opinion

Management's internal control assessment process involves special consideration of ______.

safeguarding assets & service organizations

the auditor should document the _______, ________, ________, and ________ relating to the audit of ICFR

processes, judgements, procedures, and results

section 404 of SOX requires managements of ______ _______ companies to issue a report that accepts responsibility for establishing and maintaining "adequate" internal control over FR and assert whether ICFR is effective as of the end of the fiscal year

publicly traded

A material weakness is a deficiency or combination of deficiencies in ICFR such that there is a(n) ______ possibility that a material financial statement misstatement will not be prevented or detected on a timely basis.

reasonable

An unqualified opinion regarding the effectiveness of the entity's ICFR provides ______ assurance that the entity's controls are designed and operating effectively in all material respects as of the balance sheet date.

reasonable

The COSO definition of ICFR is designed to provide ________ assurance regarding the reliability of financial reporting and GAAP financial statement presentation

reasonable

A major premise of AS 2201 is that _____ ______ underlies the entire audit of ICFR

risk assessment

risk factors to identify _____ _____: - size and composition of account - susceptibility to misstatement - volume of activity - nature of the account - account and reporting complexities - exposure to losses in the account - possibility of significant contingent liabilities - existence of related party transactions - changes from the prior period in account or disclosure characteristics

significant accounts

the auditor must communicate in writing to management and the audit committee all significant deficiencies and material weaknesses identified during the audit. the communication should be made prior to the issuance of the auditor's report on ICFR

significant deficiencies and material weaknessess

a control deficiency or a combination of them, in ICFR that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting

significant deficiency

When auditors report on the effectiveness of internal control "as of" a specific date and obtain evidence about the operating effectiveness of controls at an interim date, which of the following items would be the least helpful in evaluating the additional evidence to gather for the remaining period?

the walkthrough of the control system conducted at interim

True or false: The COSO definition of ICFR includes reasonable assurance regarding the safeguarding of assets.

true

t/f: Auditors are required to evaluate the severity of each control deficiency.

true

t/f: Auditors must evaluate whether to test preventive controls, detective controls or a combination of both.

true