Chapter 5 Auditing and Assurance Smartbook

COSO internal control categories include______of financial reporting and______with applicable laws and regulations.

reliability compliance

True or false: Document examination alone is never considered an adequate test of controls.

false

True or false: To achieve the specific objectives of each of the three goals, the COSO framework defines five components of a properly designed internal control system that work independently of each other to support the system's overall effectiveness.

false

An audit team's assessment of control risk as low ______.

may limit the use of substantive tests of details allows auditors to use smaller sample sizes implies controls are effective

Duties that should be separated are ______.

reconciliation recording authorization custody

The final assessment of control risk should ______.

assist in determining the list of substantive procedures required be coordinated with the final audit plan

Controls that are pervasive to the internal control system and the reliability of the financial statements as a whole are called ______ - level controls.

entity

The risk of material misstatement is composed of_____ risk and____ risk.

inherent control

An opinion of the entity's financial statements and a second opinion on management's assessment of the effectiveness of the entity's internal control over financial reported are issued as part of a(n)______

integrated audit

Regarding a client's internal control system, external auditors are ______.

primarily concerned with the financial reporting category

For all relevant assertions for each significant account and disclosure, the audit team begins by examining _____ -_____ controls that are pervasive to the internal control system and reliability of the financial statements as a whole

entity level

When audit teams reach the third phase of an evaluation of internal control they ______.

have set an acceptable rate of compliance for an activity to be considered effective have identified controls on which they intend to rely

Section 302 of the Sarbanes-Oxley Act ______.

makes managers responsible for establishing a control environment requires management to assess the risks it wishes to control

Using an automated test procedure designed to test all items in a population as a means to identify a violation of control activities is an example of ______testing.

exception

Flowcharts ______.

involve considerable time and effort have become a popular documentation method for auditors help the audit team assess the key control points in the process

All entities recognize the need for a formalized process to identify, assess and manage factors, events and conditions, known as_____ , that can prevent the organization from achieving it objectives.

business risks

Generally a reassessment of control risk ______.

can only go upwards

Comparing all customers' credit limits to the sum of their outstanding credit balance plus a potential sales transaction as a means of checking for potential over-limit conditions is an example of ______ testing.

exception

The audit team's decision that it would take more time to test the operating effectiveness of the control activities than it would take to perform the substantive tests necessary for a relevant assertion ______.

is equivalent to assessing control risk at 100%

After their understanding of the entity's internal controls have been documented, the audit team may choose not to perform tests on the operating effectiveness of the controls because ______.

it is less time consuming to conduct substantive tests the internal control system is too ineffective to rely on the cost of obtaining a low control risk assessment is high

Separation of duties ______.

prevents fraud that do not involve collusion prevents incompatible responsibilities forces different people or departments to deal with different facets of transactions

A well-functioning internal control environment requires ______.

supportive human resource policies and practices support as shown by management's philosophy and operating style competent individuals in financial reporting and oversight roles

If the audit-team decides an entity-level control sufficiently reduces a specific risk ______.

transaction-level controls related to that risk may not be needed

True or false: In today's environment, it is essential that organizations have a robust set of cyber security control activities in place and operating effectively.

true

According to professional standards, the audit team's evaluation of the sufficiency of management's control activities is ______.

always required

COSO developed a(n) ______ framework to facilitate the assessment and mitigation of business risks a company faces.

enterprise risk management

Performance reviews ______.

include the study of budget variances with follow up actions require management's active participation in the supervision of operations can help lower the risk of material misstatements

Combinations of duties that place a single person in a position to create and conceal misstatements due to errors or frauds in their normal job are _______ responsibilities

incompatible

An account's significance is based on its ______ risk.

inherent

The least persuasive type of control test evidence is _____

inquiry

Duties of the audit committee include ______.

oversight of the public accounting firm conducting the entity's audit overseeing the anonymous fraud hotline engaging legal council in the event of management fraud

When documenting their understanding of the internal control system, the audit team should consider questions related to ______

policies and procedures documentation and communicaiton information technology integration with the risk assessment process selection and development of control activities

In some sense, all controls can be thought of as ______ controls.

preventive

The key difference between document examination and _____ is that the former provides evidence employees completed the activity and the later provides evidence it was done correctly.

reperformance

The most persuasive type of control test evidence is

reperformance

A key factor in audit sampling is that, for a sample to be considered , all items in a population must have an opportunity to be selected.

representative

Internal control questionnaires ______.

tend to be inflexible make it less likely for the audit team to forget to cover an important point should be used in combination with other methods

In order to assess control risk below the maximum ______.

tests of controls must be performed

Controls that pertain to specific classes of entries, account balances and disclosures are called ______ - level controls.

transaction

The audit team identifies _____ - ____ controls that pertain to specific classes of entries, account balances and disclosures.

transaction level

A combination of personnel inquiry, operation observation and document examination while tracing a single transaction through the entire audit trail is a(n) _____

walkthrough

Physical access should be limited to authorized personnel. This limitation should include:

inventory payroll records securities

The acceptable rate of compliance for an internal control to be considered effective ______.

is a matter of professional judgment may be based on internal firm guidelines

Section 302 of the Sarbanes-Oxley Act ______.

is designed to ensure the proper "tone at the top" makes management responsible for monitoring, supervising and maintaining control activities allows managers to make their own judgments about the necessity of specific controls

Narrative descriptions tend to be ______.

most efficient for audits of small businesses

Tests of controls ______.

must be performed to obtain evidence that controls can be relied on

The audit committee ______.

must have one member who is a financial expert members must all be financially literate is a subcommittee of the board of directors

A method for documenting the audit team's understanding of internal controls that describes all environmental elements, the accounting system and all control activities is called a(n) _____

narrative description

Internal control questionnaires ______.

are somewhat unique for each organization can be useful in detecting internal control weaknesses help the auditing team obtain evidence about the control environment

The audit team must adjust the substantive procedures accordingly in order to obtain enough evidence to mitigate the risk of material misstatements to a low level for the relevant assertions being tested if the assessment of control risk is ______.

moderate

Flowcharts ______.

should flow from left to right and top to bottom must be understandable to an audit supervisor should include narrative explanations

Gaining an understanding of internal controls should start by identifying _____accounts and disclosures and their_____ .

significant relevant assertions

A well-functioning internal control environment requires ______.

appropriate assignment of authority and responsibility top management with sound integrity and ethical values clear and unambiguous reporting lines

Duties of the audit committee include ______.

approving nonaudit services provided by the external auditor appointing the public accounting firm conducting the entity's audit compensating the public accounting firm conducting the entity's audit

Flowcharts ______.

are easy to evaluate after they are completed can be helpful in identifying missing controls are time-consuming to construct

Duties that should be separated are the _____to execute _____transactions,____ transactions, _____of assets involved in the transactions and periodic ____ of existing assets to recorded amounts.

authority recording custody reconciling

When testing controls, the audit team often uses ______ about the existence of the activity and then corroborate the evidence by observing the control activities are actually being performed

inquiry

The four methods of testing controls are ____ , ____ ,document examination and _____

inquiry observation reperformance

External auditors complete an audit on the financial statements and one on internal control as part of a(n)

integrated audit

Section 404 of the Sarbanes-Oxley Act requires an entity's annual report to include a statement that ______.

management is responsible for establishing and maintaining adequate internal control over financial reporting identifies the framework used as a benchmark for evaluating the entity's internal control effectiveness

The risk assessment element of the COSO framework is ______ responsibility.

management's

When gaining an understanding of internal controls, assertions should ______.

only be considered if they are relevant

Whether a control is working as designed and whether the person performing the control has the authority and qualifications to perform the control is referred to as _____

operating effectiveness

Internal control is a set of policies and procedures designed to achieve management objectives in three different categories. Maintaining a good business reputation and increasing market share are objectives of the_____ category.

operations

True or false: An understanding of the design of controls or how they are intended to function provides the audit team complete evidence as to the operating effectiveness of controls.

false

The assessment of risk of material misstatement at the assertion level is completed to give the audit team a basis for planning the audit and determining the _____, _____, and ______of further audit procedures to be conducted for the financial statement audit.

nature time extent

Which of the following statements are correct?

For a sample to be representative, all items in the population have an opportunity to be selected. Tests of controls should be applied to samples executed throughout the period under audit.

Which of the following statements are correct?

If a control activity has high risk, more persuasive evidence is needed. It may be more efficient for the auditor to choose not to rely on controls.

Which of the following statements are correct?

Spreadsheet "errors" can pose risks to an entity's internal control system. Using and accounting for prenumbered documents helps support the completeness assertion.

Specific actions a client's management and employees take to help ensure management's directives are carried out are called _____

control activities

Integrity, ethical values and competence of the entity's people are all________ factors

control environment

The foundation for all other components of internal control is the____

control environment

Whether the controls over financial reporting, if operating as they should, would be expected to prevent or detect errors or fraud that could result in a material misstatement in the financial statements is determined by ______

design effectiveness

When a single audit test produces both control testing and substantive testing evidence, it is called a(n) _____ test

dual purpose

An audit procedure that selects recorded payroll entries to vouch payroll to time cards and calculate the correct dollar amount of payroll is an example of a ______.

dual-purpose test

COSO internal control categories include ____and____ of operations

effectiveness efficiency

When documenting their understanding of the internal control system, the auditor should consider if the client has taken full advantage of their existing technological platform by using ______ control activities whenever it is efficient and effective.

entirely automated

True or false: Periodic management reviews are critically important to demonstrate that controls are operating in an effective manner.

false

The professional standards require the auditor to gain an understanding of the client's risk assessment process related to ______.

financial reporting risks fraud risk

Each member of the audit committee must be financially _____ and one member must be a financial ______

literate expert

After understanding and documenting internal control, the audit team should be able to ______.

make a preliminary assessment of control risk

Management may not be able to conclude that the entity's internal controls over financial reporting is effective if any _______exist.

material weaknesses

The preliminary assessment of control risk ______.

may be made after understanding and documenting internal control includes identifying activities explicitly designed to support reliable financial statement reporting

Procedures that prevent misstatements before they occur are ____ controls which are preferable to _____ controls that find misstatements after they occur.

preventive detective

To be considered appropriate audit evidence, an audit sample must be ______.

representative of the population being sampled from a population that covers the entire period of reliance

The five basic components of a properly designed internal control system as defined by COSO are: (1) control environment, (2) ______assessment, (3) _____activities, (4) and (5) information and _____.

risk control monitoring communication