Q6: 9.1, 9.2, 9.3, 9.4

When engaged to express an opinion about the effectiveness of a nonissuer's internal control over financial reporting, the auditor should

Obtain management's written representation acknowledging responsibility for establishing and maintaining internal control.

An auditor is auditing a mutual fund company that uses a transfer agent to handle accounting for shareholders. Which of the following actions by the auditor would be most efficient for obtaining information about the transfer agent's internal controls?

Review reports on the suitability of design and operating effectiveness of controls produced by the agent's own auditor.

Which of the following procedures should a user auditor include in the audit plan to create the most efficient audit when an audit client uses a service organization for several processes?

Review the service auditor's type 1 report.

Management of an issuer subject to SEC requirements requests the auditor to report on whether a previously reported material weakness in internal control continues to exist. The request comes 3 months after the annual audited financial statements and report on internal control were released.

The auditor may accept the engagement if management provides a statement that the identified material weakness no longer exists.

Which of the following statements about an auditor's communication of internal control related matters identified in an audit of a nonissuer is true?

The auditor should communicate significant internal control related matters no later than 60 days after the report release date.

Management may already know of the existence of significant deficiencies or material weaknesses in internal control. Which of the following is a true statement about the auditor's communication in this situation?

The auditor should communicate these control conditions in writing regardless of a decision by management and those charged with governance not to remedy them.

In an integrated audit of a nonissuer, an auditor should issue an adverse opinion on the effectiveness of an entity's internal control in which of the following situations?

A material weakness exists.

Which of the following is least likely indicative of a significant deficiency or material weakness in internal control?

A potential future internal control problem having no effect on the current period.

An auditor's report on an examination of internal control over financial reporting is least likely to be issued as a result of

A review of the annual financial statements of a large corporation.

The auditor's report expressing an opinion directly on the effectiveness of an entity's internal control over financial reporting should include all the following except

A statement that the entity's internal control is consistent with that of the prior year after giving effect to subsequent changes.

Which of the following matters is an auditor required to communicate to those charged with governance?

Adjustments that were suggested by the auditor and recorded by management that have a significant effect on the entity's financial reporting process.

During the audit of internal controls integrated with the audit of the financial statements, the auditor discovered a material weakness in internal control. The auditor most likely will express a(n)

Adverse opinion on internal control.

Which of the following best describes a CPA's engagement to report on an entity's internal control over financial reporting?

An attest engagement that results in issuance of an examination report relating to the effectiveness of internal control.

Which of the following statements about significant deficiencies and material weaknesses in internal control is true for an audit of a nonissuer?

An auditor may communicate significant deficiencies and material weaknesses during an audit or after the audit's completion.

Under the AICPA's auditing standards, which of the following statements about an auditor's communication of significant control deficiencies is true?

An auditor's report on significant control deficiencies should include a restriction on the use of the report.

Each of the following statements is correct regarding the likely sources of potential misstatements in an integrated audit of a nonissuer except

An evaluation of the entity's information technology risk and controls should be performed separately from the top-down approach.

To ensure that the audit report for an issuer is prepared in accordance with Section 404 of the Sarbanes-Oxley Act of 2002, the report must

Attest to and report on the internal control assessment made by the management of the issuer.

An auditor expresses an unmodified opinion directly on internal control over financial reporting after an examination integrated with a financial statement audit. As a result, the

Auditor believes that controls are effective.

Which of the following is true regarding significant deficiencies and material weaknesses in control for a nonissuer?

Auditors should communicate them to management and those charged with governance.

Snow, CPA, was engaged by Master Co., a nonissuer, to examine the effectiveness of Master's internal control over financial reporting as part of an integrated audit. Snow's report should state that

Because of inherent limitations, internal control may not prevent, or detect and correct, misstatements.

An auditor has withdrawn from an audit engagement of an issuer after finding fraud that may materially affect the financial statements. The auditor should set forth the reasons and findings in communication to the

Board of directors.

An auditor's written communication of internal control related matters identified in an audit would be addressed to "those charged with governance," which would include the

Board of directors.

Which of the following matters is an auditor required to communicate to those in the entity charged with governance? I. Disagreements with management about matters significant to the entity's financial statements that have been satisfactorily resolved II. Initial selection of significant accounting policies in emerging areas that lack authoritative guidance

Both I and II.

In an examination of internal control over financial reporting, which deficiencies in control should be communicated in writing to those charged with governance?

Both material weaknesses and significant deficiencies.

A secondary result of the auditor's understanding of internal control for a nonissuer is that the understanding may

Bring to the auditor's attention possible control conditions required to be communicated to the client.

Which of the following is not a role of the risk assessment in an integrated audit of a nonissuer?

Concluding on the effectiveness of a given control.

Payroll Data Co. (PDC) processes payroll transactions for a retailer. Cook, CPA, is engaged to issue a report on PDC's internal controls implemented as of a specific date. These controls are relevant to the retailer's internal control, so Cook's report may be useful in providing the retailer's independent auditor with information necessary to plan a financial statement audit. Cook's report should

Contain a disclaimer of opinion on the operating effectiveness of PDC's controls.

An auditor reports on an examination of the effectiveness of an entity's internal control over financial reporting. If the control criteria used are established by a regulatory agency, the report should

Contain a statement of restriction on use if the criteria have not been subjected to due process procedures and are appropriate only for a limited number of users.

The development of constructive suggestions to a client for improvements in its internal control is a

Desirable by-product of an audit engagement.

Computer Services Company (CSC) processes payroll transactions for schools. Drake, CPA, is engaged to report on CSC's controls implemented as of a specific date. These controls are relevant to the schools' internal control, so Drake's report will be useful in providing the schools' independent auditors with information necessary to plan their audits. Drake's report expressing an opinion on CSC's controls implemented as of a specific date should contain a(n)

Description of the scope and nature of Drake's procedures.

Dunn, CPA, is auditing the financial statements of Taft Co. Taft uses Quick Service Center (QSC) to process its payroll. Price, CPA, is expressing an opinion on management's description of the controls implemented and their suitability of design at QSC regarding the processing of its customers' payroll transactions. Dunn expects to consider the effects of Price's report on the Taft engagement. Price's report should contain a(n)

Description of the scope and nature of Price's procedures.

It would not be appropriate for the auditor to initiate discussion with the audit committee concerning

Details of the procedures that the auditor intends to apply.

Firms subject to the reporting requirements of the Securities Exchange Act of 1934 are required by the Foreign Corrupt Practices Act of 1977 to maintain satisfactory internal control. Moreover, the Sarbanes-Oxley Act of 2002 requires that annual reports include (1) a statement of management's responsibility for establishing and maintaining adequate internal control and procedures for financial reporting, and (2) management's assessment of their effectiveness. The role of the registered auditor relative to the assessment made by management is to

Determine whether management's report is complete and properly presented.

Which of the following disagreements between the auditor and management do not have to be communicated by the auditor to those charged with governance?

Disagreements of the amount of the LIFO inventory layer based on preliminary information.

Cain Company's management engaged Bell, CPA, to examine the effectiveness of Cain's internal control over financial reporting. Bell's report, which was accompanied by management's separate report presenting its written assertion about the effectiveness of internal control, described several material weaknesses and potential errors and fraudulent activities that could occur. Subsequently, management included Bell's report in its annual report to the board of directors with a statement that the cost of correcting the weaknesses would exceed the benefits. Bell should

Disclaim an opinion as to management's cost-benefit statement.

An auditor's communication with those charged with governance is required to include the

Discussion of disagreements with management about matters that significantly affect the entity's financial statements.

Which of the following matters would an auditor most likely consider to be a significant deficiency or material weakness to be communicated to those charged with governance?

Evidence of a lack of objectivity by those responsible for accounting decisions.

An auditor is conducting an integrated examination of internal control with the audit of a nonissuer's financial statements. In applying the top-down approach, the auditor first

Focuses on entity-level controls and then significant accounts.

Brown, CPA, has accepted an engagement to examine the effectiveness of the internal control over financial reporting of Crow Company (a nonissuer) and to issue a report on such examination. In what form does Crow present its written assertion about effectiveness? i. In a separate report that accompanies Brown's report ii. In a representation letter to Brown

I and II.

Which of the following issues related to internal control over financial reporting are required to be communicated in writing to management and those charged with governance? I. Deficiencies in internal control II. Significant deficiencies III. Material weaknesses

II and III only.

The Committee of Sponsoring Organizations (COSO) of the Treadway Commission issued a document in 1992 that has been embraced by numerous organizations, including the AICPA and the GAO. That document is titled

Internal Control--Integrated Framework.

A CPA's understanding of internal control in a financial statement audit of a nonissuer

Is usually more limited than that made in an examination of internal control integrated with an audit of financial statements.

In an integrated audit of a nonissuer, if an auditor concludes that a material weakness exists as of the date specified in management's assertion, the auditor should take which of the following actions?

Issue an adverse opinion.

In identifying matters for communication with an entity's audit committee, an auditor most likely would ask management whether

It consulted with another CPA firm about accounting matters.

AU-C 402, Audit Considerations Relating to an Entity Using a Service Organization, applies to a financial statement audit of an entity that uses services of another organization as part of its information system. For this purpose, the user auditor may need to obtain a service auditor's report. Which of the following is a true statement about a service auditor's report?

It should include an opinion.

A service auditor's report on internal control may be issued on management's description of a service organization system and the suitability of the design of controls or management's description of a service organization system and the suitability and operating effectiveness of controls. Which of the following is true about a type 1 report?

It should state that the auditor did not test the effectiveness of the controls.

Lake, CPA, is auditing the financial statements of Gill Co. Gill uses the EDP Service Center, Inc., to process its payroll transactions. EDP's financial statements are audited by Cope, CPA, who recently issued a report on EDP's internal control. Lake is considering Cope's report on EDP's internal control in assessing control risk on the Gill engagement. What is Lake's responsibility concerning making reference to Cope as a basis, in part, for Lake's own unmodified opinion?

Lake may not refer to Cope under the circumstances above.

In reporting on an examination of an issuer's internal control over financial reporting, an auditor should include a paragraph that describes the

Limitations inherent to all internal control.

Green, CPA, is auditing the financial statements of Ajax Co. Ajax uses the DP Service Center to process its payroll. DP's financial statements are audited by Blue, CPA, who recently issued a report on DP's policies and procedures regarding the processing of other entities' transactions. In considering whether Blue's report is satisfactory for Green's purposes, Green should

Make inquiries about Blue's professional reputation.

Which of the following circumstances would be inappropriate for the auditor to communicate to those charged with governance?

No significant deficiencies in internal control exist that would affect the financial statements.

In the audit of a nonissuer, the auditor reports on the effectiveness of an entity's internal control over financial reporting. Which of the following is not a condition of that engagement?

Management provides assurance that limitations inherent to internal control have been eliminated.

Section 404 of the Sarbanes-Oxley Act of 2002 requires each annual report of an issuer to include which of the following?

Management's assessment of the effectiveness of internal control over financial reporting.

In communicating with those charged with governance, the auditor must decide whether to communicate with the audit committee or the client's entire board of directors. Which of the following considerations will be least relevant to this decision?

Management's preference.

The activities of the user entity and the service organization have a high degree of interaction. The user auditor

Need not test the service organization's internal control if the user entity has effective controls related to service organization processing.

An issuer who is an accelerated filer subject to the Securities Exchange Act of 1934 is required to include in its annual report an auditor's opinion on whether internal control over financial reporting was

Properly designed and operated effectively.

The Sarbanes-Oxley Act of 2002 (SOX) requires management of issuers to do all of the following except

Provide a statement that the board approves changes in internal control procedures.

An audit client has substantial assets held in a trust that is managed by the trust department of a bank. Which of the following actions by the auditor is the most efficient way to obtain information about the trust department's internal controls?

Rely on the trust department's audit report on internal controls placed in operation and their operating effectiveness.

When reporting to the audit committee on conditions relating to an entity's internal control observed during an audit of a nonissuer's financial statements, the auditor should include a

Restriction on the use of the report.

During consideration of internal control in a financial statement audit, an auditor is not obligated to

Search for significant deficiencies in the operation of internal control.

In obtaining an understanding of an issuer's internal control, an auditor does all the following except

Send confirmations to customers.

Which of the following statements is true about the auditor's communication of a material weakness in internal control?

Suggested corrective action for management's consideration concerning a material weakness need not be communicated to the client.

Which of the following statements is true about an auditor's communication to those charged with governance?

The auditor is required to inform those charged with governance about misstatements discovered by the auditor and not subsequently corrected by management.

When an auditor is to conduct an audit of a service organization, what considerations should the auditor make in the planning stages regarding internal controls of the organization?

The auditor should determine whether management has adequately described complementary user controls.

Which of the following statements is true about significant deficiencies identified in an audit?

The auditor should identify those significant deficiencies considered to be material weaknesses.

An auditor is required to establish an understanding with a client regarding the services to be performed for each engagement. For an auditor of a nonissuer, this understanding generally includes

The auditor's responsibility for ensuring that management and those charged with governance are aware of any significant deficiencies or material weaknesses in control that come to the auditor's attention.

Which of the following is a true statement concerning an attest engagement to examine an entity's internal control over financial reporting?

The responsible party evaluates the effectiveness of internal control.

Which of the following best describes the responsibility of an auditor of a private entity with respect to significant deficiencies and material weaknesses under AU-C 265, Communication of Internal Control Related Matters Identified in an Audit?

The communication by the auditor must be in writing.

Which of the following is true about the auditor's communication with those charged with governance?

The communication should be a two-way discourse between the auditor and those charged with governance.

A CPA had previously communicated a significant control deficiency in connection with an audit of prior financial statements of a nonissuer. As of the current audit date, the deficiency has not been corrected. What communication should be made by the CPA?

The condition should be reported.

Which of the following matters is an auditor not required to communicate to an entity's audit committee?

The degree of reliance the auditor placed on the management representation letter.

When planning an engagement to examine the effectiveness of the entity's internal control in an integrated audit of a nonissuer, a practitioner would least likely consider which of the following factors?

The evaluation of the operating effectiveness of the controls.

An auditor would least likely initiate a discussion with a client's audit committee concerning

The maximum dollar amount of misstatements that could exist without causing the financial statements to be materially misstated.

In the integrated audit of an issuer, which of the following would not be considered an entity-level control?

The outside auditor's assessment process of internal auditor competence and objectivity.

Which of the following matters should an auditor communicate to those charged with governance?

The process used by management in formulating sensitive accounting estimates.

When communicating significant deficiencies in internal control noted in a financial statement audit of a nonissuer, the communication should indicate that

The purpose of the audit was to report on the financial statements, not to provide assurance on internal control.

An auditor is auditing internal control in conjunction with the audit of financial statements for an issuer. The auditor is considering the appropriate materiality level for planning the audit of internal control. Relative to the materiality level for the audit of the financial statements, materiality levels for the audit of internal control are

The same.

Which of the following representations should not be included in a written report on internal control related matters identified in an audit under the AICPA's auditing standards?

There are no significant deficiencies or material weaknesses in the design or operation of internal control.

During the planning phase of an audit, an auditor is identifying matters for communication to those charged with governance. The auditor most likely would ask management whether

There were changes in the application of significant accounting policies.

Which of the following statements is true about an auditor's communication with those charged with governance?

This communication should include disagreements with management about audit adjustments, whether or not satisfactorily resolved.

Which of the following statements is true about an auditor's communication with those charged with governance?

This communication should include management changes in the application of significant accounting policies.

Which of the following best describes a CPA's responsibility to report on an issuer's (public company's) internal control over financial reporting?

To examine the effectiveness of its internal control.

An auditor (the user auditor) may decide to make use of another auditor's (the service auditor's) report on internal control at a service organization that provides certain services to the user auditor's client. When the client's transactions flow through the service organization's accounting system, consideration of internal control may be necessary. The most efficient approach is often to obtain a service auditor's report. Which of the following is a true statement about the relationship of the user and service auditors?

When reporting on an audit of financial statements, the user auditor should not refer to the service auditor's report if the opinion is unmodified.

The audit of internal control over financial reporting should test

design effectiveness: yes operating effectiveness: yes

The auditor of an issuer must express an opinion on the effectiveness of internal control. The opinion should be expressed

as of a specified date: yes for a specified period of time: no

In an audit engagement, should an auditor communicate the following matters to those charged with governance?

auditor's judgments about the quality of the client's accounting principles: yes issues discussed with management prior to the auditor's retention: yes