Auditing Ch 6

After completing the preliminary phase of the review of internal control, the auditor decides not to rely on the system to restrict substantive procedures. Documentation may be limited to the auditor's

Understanding of the internal control.

In planning an audit of a new client, an auditor most likely would consider the methods used to process accounting information because such methods

Influence the design of internal controls.

As opposed to a manual control, an automated control

Should function consistently in the absence of program changes.

In a properly designed internal control system, the same employee may be permitted to

Sign checks and also cancel supporting documents.

The control environment component of internal control includes all of the following except

Access to computer programs

It is important for the CPA to consider the competence of the entity's employees because their competence bears directly and importantly upon the

Achievement of the objectives of the system of internal control.

If auditors conduct substantive procedures as of 10/31 for an entity with a 12/31 year-end

Additional tests likely will be performed in the remaining period

An auditor's primary consideration regarding an entity's internal controls is whether the policies and procedures

Affect the financial statement assertions.

In the audit of financial statements, an auditor's primary consideration regarding an internal control policy or procedure is whether the policy or procedure

Affects management's financial statement assertions.

The documentation of an auditor's understanding of internal controls

Can include any combination of narratives, questionnaires, or flowcharts.

Where computer processing is used in significant accounting applications, internal control activities may be defined by classifying control activities into two types: general and

Application

Before applying substantive procedures to the details of asset and liability accounts at an interim date, the auditor should

Assess the difficulty in controlling achieved audit risk for the remainder of the period.

Reports on service organizations typically

Assess whether the service organization's controls are suitably designed to achieve internal control objectives.

Which of the following statements concerning control risk is correct?

Assessing control risk and obtaining an understanding of an entity's internal controls may be performed concurrently.

A high detection risk strategy includes all of the following except

Audit work only completed at year-end.

Proper segregation of functional responsibilities in an effective system of internal control calls for separation of the functions of

Authorization, recording, and custody.

Of the following statements about an internal control system, which one is correct?

Because of the cost/benefit relationship, tests of controls may be applied on a test basis in some circumstances.

A customer intended to order 100 units of product Z96014, but incorrectly ordered 100 units of a nonexistent product Z96015. Which of the following controls most likely would detect this error?

Check digit verification.

Which of the following input controls is a numeric value computed to provide assurance that the original value has not been altered in construction or transmission?

Check digit.

A field test is a

Check on a field to ensure that it contains either all numeric or all alphabetic characters.

An auditor is least likely to test the internal controls that provide for

Classification of revenue and expense transactions by product line

Information and communication includes all of the following except:

Communicating price changes to customers

Assessing control risk at a lower level involves all of the following except:

Concluding that controls are ineffective.

Before applying substantive procedures to the details of accounts at an interim date (a date prior to the balance sheet date), an auditor should

Consider the availability of information at a later date that will be necessary for the auditor's procedures (e.g., electronic data).

An effective control environment

Creates a commitment to competence

General controls include all of the following except

Data validation controls.

The program flowcharting symbol representing a decision is a

Diamond.

Effective internal control in a small company that has an insufficient number of employees to permit proper division of responsibilities can best be enhanced by

Direct participation by the owner of the business in the recordkeeping activities of the business.

Audit evidence concerning proper segregation of duties ordinarily is best obtained by

Direct personal observation of the employees who apply the control activities.

In an audit of financial statements of a private company in accordance with generally accepted auditing standards, an auditor is required to

Document the auditor's understanding of the entity's internal control

Internal controls are not designed to provide reasonable assurance that

Embezzlement will be eliminated

An organizational structure is important for all of the following reasons except:

Ensuring a proper commitment to controls.

An auditor would most likely be concerned with internal control policies and procedures that provide reasonable assurance about the

Entity's ability to accurately process and summarize financial data.

In evaluating internal control, the auditor is basically concerned that the system provides reasonable assurance that

Errors and fraud have been prevented, or detected and corrected.

When an auditor increases the planned assessed level of control risk because certain control activities were determined to be ineffective, the auditor would most likely increase the

Extent of tests of details.

An entity's control activities include all of the following except:

External auditor's tests of controls.

A reliance strategy is used when control risk has been set at high. (T/F)

FALSE

Internal control consists of six components. (T/F)

FALSE

Once a level of control risk has been established, it cannot be changed. (T/F)

FALSE

The auditor must understand internal control before assessing inherent risk. (T/F)

FALSE

Auditors are most likely to gather audit evidence solely using substantive procedures

For nonrecurring, unusual transactions

An entity's IT infrastructure refers to

Hardware components.

Assessing control risk at a lower level most likely would involve

Identifying specific internal controls relevant to specific assertions.

The auditor's communication of material weaknesses in internal control for a nonpublic company is

Incidental to the auditor's objective of forming an opinion as to the fair presentation of the financial statements.

Which of the following most likely would not be considered an inherent limitation of the potential effectiveness of an entity's internal controls?

Incompatible duties.

A substantive strategy differs from a reliance strategy in that a substantive strategy includes

Increased implementation of detailed tests of transactions and balances.

Based on a study and evaluation completed at an interim date, the auditor concludes that no significant internal control weaknesses exist. The records and procedures would most likely be tested again at year-end if

Inquiries and observations lead the auditor to believe that conditions within the internal control system have changed.

To obtain evidential matter about control risk, an auditor selects tests from a variety of techniques including

Inquiry.

Which of the following procedures most likely would be included as part of an auditor's tests of controls?

Inspection.

All of the following are significant deficiencies except:

Inventory is highly subject to obsolescence

Factors that the auditor should consider as increasing the effectiveness of the audit committee include all of the following except whether:

It is comprised almost exclusively of members of management, ensuring detailed knowledge of the company's operations.

After obtaining an understanding of internal controls and assessing control risk of an entity, an auditor decided not to perform tests of controls for purposes of the audit. The auditor most likely decided that

It would be inefficient to perform tests of controls that would result in a reduction in planned substantive procedures.

Management philosophy and operating style most likely would have a significant influence on an entity's control environment when

Management is dominated by one individual.

Management's attitude toward aggressive financial reporting and its emphasis on meeting projected profit goals most likely would significantly influence an entity's control environment when

Management is dominated by one individual.

A primary purpose of internal controls is to

Meet objectives of maintaining reliable documents and records and accurate financial reporting.

Potential benefits of an entity's controls in an IT environment include all of the following except:

More accurate accounting estimates

For a complex IT system, auditors are least likely to use which of the following when documenting their understanding of internal controls?

Narratives.

For certain controls, such as segregation of duties, documentary evidence may not exist. An auditor would most likely test the procedures by

Observation and inquiry.

A procedure that would most likely be used by an auditor in performing tests of control activities that involve segregation of functions but which leave no transaction trail is

Observation.

Which of the following procedures most likely would provide an auditor with evidence about whether an entity's internal control is suitably designed to prevent or detect material misstatements?

Observing the entity's personnel applying the controls.

As part of gaining an initial understanding of internal control, an auditor is required to do all of the following except:

Obtain knowledge about the operating effectiveness of the internal control.

Assume that an auditor estimates that 10,000 checks were issued during the accounting period. If an IT application control which performs a limit check for each check request is to be subjected to the auditor's test data approach, the sample should include

One transaction

A well-prepared flowchart should make it easier for the auditor to

Perform walkthroughs.

An advantage of using systems flowcharts to document information about internal control instead of using internal control questionnaires is that systems flowcharts

Provide a visual depiction of the entity's activities.

The basic concept of internal control that recognizes the cost of internal control should not exceed the benefits expected to be derived is known as

Reasonable assurance.

Walkthroughs usually involve all of the following audit procedures except:

Reperformance.

A flowchart is most frequently used by an auditor in connection with the

Review of the entity's internal controls.

The auditor should consider all of the following when deciding whether substantive procedures will be performed at an interim date except:

Scheduling conflicts in the audit firm that make interim testing more convenient.

During consideration of internal control in a financial statement audit of a nonpublic company, an auditor is not obligated to

Search for significant deficiencies in the operation of internal control.

In obtaining an understanding of an entity's internal control in a financial statement audit of a nonpublic company, an auditor is not obligated to

Search for significant deficiencies in the operation of the internal control

Significant deficiencies are matters that come to an auditor's attention that should be communicated to an entity's audit committee because they represent

Significant design flaws in internal controls or poor implementation of internal controls.

When documenting an entity's internal control, the independent auditor sometimes uses a systems flowchart, which can best be described as a

Symbolic representation of a system or series of sequential processes.

Which of the following is a general control that would most likely assist an entity whose systems analyst left the entity in the middle of a major project?

Systems documentation.

A substantive strategy is used when control risk has been set at high. (T/F)

TRUE

Internal control includes monitoring of controls. (T/F)

TRUE

One of the risks associated with internal control from IT is potential loss of data. (T/F)

TRUE

Tests of controls must be performed if control risk is set at a lower level. (T/F)

TRUE

The concept of internal control includes IT systems and manual systems. (T/F)

TRUE

The extent of an entity's use of IT can affect any of the components of internal control. (T/F)

TRUE

The independent auditor selects several transactions in each functional area and traces them through the entire system, paying special attention to evidence about whether or not the control activities are in operation. This is an example of a(n)

Test of controls.

A limit test is a

Test to ensure that a numerical value does not exceed some predetermined value.

Which of the following audit tests would be regarded as a test of controls?

Tests of the signatures on canceled checks to the board of directors' authorizations

After the auditor has prepared a flowchart of the internal controls surrounding sales and evaluated the design of the system, the auditor would perform tests of controls on all control activities

That the auditor plans to rely on.

The concept of reasonable assurance in the context of an entity's internal controls recognizes that

The costs of some controls may be too high to implement in relation to potential benefits.

The risk assessment component of internal control refers to

The entity's identification and analysis of risks relevant to achievement of its objectives

Proper monitoring within an internal control framework may include all of the following except:

The internal revenue service.

Which of the following is not a characteristic of a batch processed computer system?

The posting of a transaction, as it occurs, to several files, without intermediate printouts

When communicating internal control-related matters noted in an audit of a nonpublic company, an auditor's report issued on significant deficiencies should indicate that

The purpose of the audit was to report on the financial statements and not to provide assurance on internal control.

While substantive procedures may support the accuracy of underlying records, these tests frequently provide no affirmative evidence of segregation of duties because

The records may be accurate even though they are maintained by persons having incompatible functions.

An IT specialist is least likely to be necessary when

The system has not changed from the prior year.

The independent auditor should acquire an understanding of the internal audit function as it relates to the assessment of control risk because

The work performed by internal audit personnel may be a factor in determining the nature, timing, and extent of the independent auditor's procedures

As the acceptable level of detection risk increases, an auditor may change the

Timing of substantive procedures from year-end to an interim date.

The normal sequence of documents and operations on a well-prepared systems flowchart is

Top to bottom and left to right.