Chapter 7

Types of reports on ICFR -qualified opinion

-ICFR is designed and operating effectively -only given if NO material weaknesses exist on the as of date NOTE: If a material weakness existed, but was remediated before the as of date and the audit was able to retest, then an unqualified opinion can be given

ICFR Defined

-PCAOB standards defines ICFR as a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP. Controls include procedures that 1. Pertain to the maintenance of records that fairly reflect transactions 2. Provide reasonable assurance that transactions are recorded as necessary in accordance with GAAP 3. Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition; use or disposition of the company's assets that could have a material effect on the financial statements

Performing an Audit of ICFR

-Planning 1. risk assessments, fraud risk 2. scaling (size and complexity) 3. using the work of others -Top-down, risk-based approach 1. entity level controls 2. significant accounts and their relevant assertions 3. likely sources of misstatement 4. key controls to be tested -test design and operating effectiveness -evaluate any identified deficiencies 1. consider potential for material misstatements 2. consider actual material misstatements that occurred -form an opinion on effectiveness of ICFR -documentation

An "integrated audit"

-each audit provides relevant information about the other. e.g. if the ICFR audit determines that controls over payroll are ineffective, this can inform the financial statement audit to use a substantive strategy, rather than a reliance strategy, in the payroll expense area -BUT each audit (and its supporting work papers) must also stand on its own. e.g. substantive testing of PPE in the financial statement audit finds no material misstatements. However, this does not mean that PPE controls are actually effective. The ICFR audit must still document and these these controls.

SOX Section 404 Requires the annual report of every public company to include information on internal controls Auditor's report

-issued by the same firm that audits the company's financial statements -gives the auditor's opinion on the effectiveness of ICFR (reasonable assurance; all material aspects) -small public companies (market cap<$75 million) are exempt from this requirement

SOX Section 404 Requires the annual report of every public company to include information on internal controls Management's report

-management accepts responsibility for the company's ICFR -assesses the effectiveness of ICFR (based on management's own evaluation and testing)

Elements of a Separate Auditor's Report on ICFR

1. Title 2. Addressee 3. Opinion on Internal Control Over Financial Reporting: -identifies IC framework used -gives opinion -paragraph referencing report on the financial statements 4. Basis for Opinion -Management's responsibility and auditor's responsibility -standards of the PCAOB; reasonable assurance, materiality -brief description of the audit 5. Definition and Limitation of ICFR -Defines ICFR -Acknowledges inherent limitations of ICFR 6. Auditor signature/city/report date

Material weakness

A deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented, or detected and corrected, on a timely basis.

Relevant assertion

A financial statement assertion that has a reasonable possibility of containing a misstatement or misstatements that would cause the financial statements to be materially misstated.

Internal control over financial reporting

A process designed by, or under the supervision of, the entity's principal executive and principal financial officers, or persons performing similar functions, and effected by the entity's board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.

Walkthrough

A transaction being traced by an auditor from origination through the entity's information system until it is reflected in the entity's financial reports. It encompasses the entire process of initiating, authorizing, recording, processing, and reporting individual transactions and controls for each of the significant processes identified.

Control deficiency

A weakness in the design or operation of a control such that management or employees, in the normal course of performing their assigned functions, fail to prevent or detect misstatements on a timely basis.

Control Deficiency

AS 2201 definition -a control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis Design deficiency: control is missing; or an existing control is not designed properly to achieve the intended result Operation deficiency: a properly designed control does not operate as designed, or the operator does not perform the control effectively

Significant Deficiency

AS 2201 definition -a deficiency (or combination) in ICFR that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting

Material Weakness

AS 2201 definition -a deficiency or combination of deficiencies in ICFR, such that there is a reasonable possibility that a material misstatement in the company's financial statements will not be prevented or detected on a timely basis probably= likely to occur reasonably possible= more than a remote likelihood

A primary advantage of using generalized audit software packages to the audit financial statements of an entity that uses an IT system is that the auditor may a. consider increasing the use of substantive tests of transactions in place of analytical procedures b. substantiate the accuracy of data through self-checking digits and hash totals c. reduce the level of required tests of controls to a relatively small amount d. access information stored on computer files while having a limited understanding of the entity's hardware and software features

Access information stored on computer files while having a limited understanding of the entity's hardware and software features

For the following, determine which type of opinion on ICFR as of 12/31/X1 should be given by the external auditor. During the audit of ICFR for Al and Larry Industries, the auditor noted several internal control deficiencies. The auditor determined that there is a reasonable possibility that any one of them could result in a misstatement that is significant, and believes there is a moderate likelihood that the deficiencies, individually or taken together, could result in a material misstatement.

Adverse opinion because the significant deficiencies identified produce moderately low risk of material misstatement within reasonably possible, this combination is considered a material weakness

For the following, determine which type of opinion on ICFR as of 12/31/X1 should be given by the external auditor. Able Corp's auditors found a material misstatement in the company's 12/31/X1 revenue account balance during their audit field work in January. The misstatement was brought to management's attention and was adjusted. Additionally, management immediately implemented some new controls over revenue in this area. Both management and the company's internal audit department tested the new controls and found them to be effective. Management has assured the auditors that this type of misstatement is not longer possible given the new controls in place.

Adverse opinion- ICFR -did not change misstatement before year-end -financial statements can be fixed so that an unqualified opinion can be rendered

Significant account or disclosure

An account or disclosure is significant if there is a reasonable possibility that the account or disclosure could contain a misstatement that, individually or when aggregated with others, has a material effect on the financial statements, considering the risks of both overstatement and understatement.

For each item, indicate the section of the report where the information would appear, or if the information would not appear in the report. The company's management is responsible for maintaining effective internal control over financial reporting...

Basis for opinion

For each item, indicate the section of the report where the information would appear, or if the information would not appear in the report. We conducted our audit in accordance with the standards of the public company accounting oversight board (US)

Basis for opinion

For each item, indicate the section of the report where the information would appear, or if the information would not appear in the report. A company's internal control over financial reporting includes those policies and procedures that pertain to the maintenance of records...

Definition and limitation of ICFR

For the following, determine which type of opinion on ICFR as of 12/31/X1 should be given by the external auditor. Rodriguez and Co. engaged their external auditors after the company's fiscal year end. Because of time constraints, the auditor was unable to perform a full audit of ICFR. The evidence was collected suggests that controls are strong, and the auditor doubts that any material weaknesses would have been detected if a full audit have been possible.

Disclaimer of opinion -must have sufficient and appropriateness evidence to conclude effectiveness of internal controls

For each item, indicate the section of the report where the information would appear, or if the information would not appear in the report. In our opinion, the financial statements reffered to above present fairly, in all material respects, the financial condition...

Does not appear in a separate report on ICFR

Material misstatement of a 12/31 account balance is detected by auditor in January. Company refuses to adjust financial statements

Impact on ICFR audit: Adverse opinion Impact on F/S audit: Adverse opinion

Material misstatement of a 12/31 account balance is detected by auditor in January. Company agrees to adjust financial statements.

Impact on ICFR audit: Adverse opinion Impact on F/S audit: Unqualified opinion

Material weakness in a control is detected in December and not remediated until January

Impact on ICFR audit: Adverse opinion Impact on F/S audit: Shift to substantive strategy for accounts affected

Material weakness in a control is detected in August. Company remediates and auditor retests before 12/31

Impact on ICFR audit: Unqualified opinion Impact on F/S audit: Shift to substantive strategy for accounts affected

For each item, indicate the section of the report where the information would appear, or if the information would not appear in the report. Nixon has an inadequate system for recording cash disbursements which could have presented the company from recording cash disbursements completely and properly

Material Weakness disclosure

For each item, indicate the section of the report where the information would appear, or if the information would not appear in the report. We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (US), the financial statements of Zinger Corp....

Opinion on Internal Control Over Financial

Additional Required Communications in an Audit of ICFR

Significant Deficiencies and Material Weaknesses -the auditor must communicate in writing to management and the audit committee all significant deficiencies and material weaknesses identified during the audit. This communication should be made prior to the issuance of the auditor's report on ICFR. Control deficiencies -in addition, the auditor should communicate to management, in writing, all control deficiencies identified during the audit and inform the audit committee when such a communication has been made

The Auditor's Report Format

The auditor's report on ICFR can be: -a separate report OR -combined with the report on the financial statements

Remediation

The process of correcting a material weakness as part of management's assessment of the effectiveness of ICFR

Safeguarding of assets

Those policies and procedures that provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the entity's assets that could have a material effect on the financial statements.

A walkthrough is one procedure used by an auditor as part of the internal control audit. A walkthrough requires an auditor to a. tour the organization's facilities and locations before beginning any audit work b. trace a transaction from every class of transactions from origination through the entity's information system c.trade a transaction from each major class of transaction from origination through the entity's information system d. Trace a transaction from each major class of transactions from origination through the entity's information system until it is reflected in the entity's financial reports

Trace a transaction from each major class of transactions from origination through the entity's information system until it is reflected in the entity's financial reports

For the following, determine which type of opinion on ICFR as of 12/31/X1 should be given by the external auditor. During the audit of ICFR for Wood Corp., the auditor noted several internal control deficiencies. The auditor determined that there is a reasonable possibility that any one of them could result in a misstatement that is significant. The odds are extremely low that the deficiencies, individually or taken together, could result in a material misstatement.

Unqualified opinion

For the following, determine which type of opinion on ICFR as of 12/31/X1 should be given by the external auditor. George and Diana Corp's internal audit department identified a material weakness in the company's ICFR. The company corrected this weakness a few months before year-end, and management's assessment found the new controls to be effective. After testing the relevant revised controls, the auditor finds that they are effective, and believes there is adequate evidence that the controls were operating effectively at the client's year end.

Unqualified opinion -operating effectively as of year-end

From a separate financial statement opinion; paragraph referencing ICFR

We also have audited, in accordance with the standards of the PCAOB, Earthwear Clothiers' internal control over financial reporting as of December 31, 2018, based on the criteria established in Internal Control-Integrated Framework Issued in 2013 by the Committee of Sponsoring Organizations of the Treadway Commissions (COSO). Our report on Earthwear's internal control over financial reporting, dated February 15, 2019, expresses an unqualified opinion.

Significant deficiency

a control deficiency, or a combination of control deficiencies, that is less severe than a material weakness, but important enough to merit attention by those responsible for oversight of the company's financial reporting

AnnaLisa, an auditor for N. M. Neal & Associates, is prevented by the management of Lileah Company from auditing controls over inventory. Lileah is a public company. Management explains that controls over inventory were recently implemented by a highly regarded public accounting firm that the entity hired as a consultant and insists that it is a waste of time for AnnaLisa to evaluate these controls. Inventory is a material account, but procedures performed as part of the financial statement audit indicate the account is fairly stated. AnnaLisa found no material weaknesses in any other area of the entity's internal control relating to financial reporting. What kind of report should AnnaLisa issue on the effectiveness of Lileah's internal control? a. an unqualified report b. an adverse report c. a disclaimer of opinion d. an exculpatory opinion

a disclaimer of opinion

In auditing ICFR for a public company, Emily finds that the entity has a significant subsidiary located in a foreign country. Emily's accounting firm has no offices in that country, and the entity has thus engaged another reputable firm to conduct the audit of internal control for that subsidiary. The other auditor's report indicates that there are no material weaknesses in the foreign subsidiary's ICFR. What should Emily do? a. disclaim an opinion because she cannot rely on the opinion of another auditor in dealing with a significant subsidiary b. accept the other auditor's opinion and express an unqualified opinion, making no reference to the other auditor's report in her audit opinion c. accept the other auditor's opinion after evaluating the auditor's work and make reference to the other auditor's report in her audit opinion d. qualify the opinion because she is unable to conduct the testing herself and this constitutes a significant scope limitation

accept the other auditor's opinion after evaluating the auditor's work and make reference to the other auditor's report in her audit opinion

In auditing a public company, Natalie, an auditor for N. M. Neal & Associates, identifies four deficiencies in ICFR. Three of the deficiencies are unlikely to result in financial misstatements that are material. One of the deficiencies is reasonably likely to result in misstatements that are not material but significant. What type of audit report should Natalie issue? a. an unqualified report b. an adverse report c. a disclaimer of opinion d. an exculpatory opinion

an unqualified opinion

Computer-assisted audit techniques (CAATs)

computer programs that allow auditors to test computer files and databases

Entity-level controls

controls that have a pervasive effect on the entity's system of internal control; also referred to as company-level controls

Which of the following controls would most likely be testing during an interim period? a. controls over non-routine transactions b. controls over period-end financial reporting process c. controls that operate on a continuous basis d. controls over transactions that involve a high degree of subjectivity

controls that operate on a continuous basis

Entity-level controls can have a pervasive effect on the entity's ability to meet the control criteria. Which one of the following is not an entity-level control? a. controls to monitor results of operations b.management's risk assessment process c. controls to monitor the inventory taking process d. the period-end financial reporting process

controls to monitor the inventory taking process

A control deviation caused by an employee performing a control procedure that he or she is not authorized to perform is always considered a a. deficiency in design b. deficiency in operation c. significant deficiency d. material weakness

deficiency in operation

For each item, indicate the section of the report where the information would appear, or if the information would not appear in the report. ...projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate...

definition and limitations of ICFR

Types of reports on ICFR -adverse opinion

if material weakness exists on the as of date

Types of reports on ICFR -disclaimer

if there was a serious cope limitation

If the financial reporting risks for a location are low and the entity has good entity-level controls, management may rely on which of the following for its assessment? a. documentation and test controls over specific risks b. self-assessment processes in conjunction with entity-level controls c. documentation and test entity-level controls over the entire entity d. selective control test at that location

self-assessment processes in conjunction with entity-level controls

Significant deficiencies and material weaknesses must be communicated to an entity's audit committee because they represent a. material fraud or illegal acts perpetrated by high-level management b. disclosures of information that significantly contradict the auditor's going concern assumption c. significant deficiencies in the design or operation of internal control d. potential manipulation or falsification of accounting records

significant deficiencies in the design or operation of internal control

Which of the following statements concerning control deficiencies is true? a. the auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit b. all significant deficiencies are material weaknesses c. all control deficiencies are significant deficiencies d. an auditor must immediately report material weaknesses and significant deficiencies discovered during an audit to the PCAOB

the auditor should communicate to management, in writing, all control deficiencies in internal control identified during the audit

The Sarbanes-Oxley Act of 2002 requires management to include a report on the effectiveness of ICFR in the entity's annual report. It also requires auditors to report on the effectiveness of ICFR. Which of the following statements concerning these requirements is false/ a. the auditor should evaluate whether internal controls over financial reporting are designed and operating effectively b. management's report should state its responsibility for establishing and maintaining an adequate internal control system c. management should identify material weaknesses in its report d. the auditor should provide recommendations for improving internal control in the audit report

the auditor should provide recommendations for improving internal control in the audit report

Which of the following is not a factor that might affect the likelihood that a control deficiency could result in a misstatement in an account balance? a. the susceptibility of the related assets or liability to loss or fraud b. the interaction or relationship of the control with other controls c. the financial statement amounts exposed to the deficiency d. the nature of the financial statement accounts, disclosures, and assertions involved

the financial statement amounts exposed to the deficiency

Which of the following most likely represents a weakness in internal control of an IT system? a. the system analyst reviews output and controls the distribution of output from the IT department b. the accounts payable clerk prepares data for computer processing and enters the data into the computer c. the systems programmer designs the operating and control functions of programs and participates in testing operating systems d. the control clerk establishes control over data received by the IT department and reconciles control totals after processing

the systems programmer designed the operating and control functions of programs and participates in testing operating systems

When auditors report on the effectiveness of internal control "as of" a specific date and obtain evidence about the operating effectiveness of controls at an interim date, which of the following items would be the least helpful in evaluating the additional evidence to gather for the remaining period? a. any significant changes that occurred in internal control subsequent to the interim date b. the length of the remaining period c. the specific controls tested prior to the "as of" date and the results of those tests d. the walkthrough of the control system conducted at interim

the walkthrough of the control system conducted at interim

Audit data analytics

using analysis, modeling, and visualization to discover and analyze patterns, anomalies, and other information in data in the context of the audit