Auditing & assurance services ch 5

When completing the audit of internal controls for an issuer, AS 2201 requires auditors to test:

Both operating and design effectiveness.

When completing the audit of internal controls for an issuer, the severity of an internal control deficiency depends on:

Both the magnitude of the potential misstatement resulting from the deficiency or the deficiencies and whether there is a reasonable possibility that the company's controls will fail to prevent or detect a misstatement of an account balance or disclosure.

Which of the following statements are correct? Multiple select question. Audit evidence for tests of controls should not be obtained during an interim period. For a sample to be representative, all items in the population have an opportunity to be selected. Tests of controls should be applied to samples executed throughout the period under audit. The audit team should never rely on tests from previous periods.

For a sample to be representative, all items in the population have an opportunity to be selected. Tests of controls should be applied to samples executed throughout the period under audit.

COSO internal control categories include: _____ of financial reporting _____ with applicable laws and regulations and ______ and ______ of operations.

Reliability of financial reporting Compliance with applicable laws and regulations Effectiveness and efficiency of operations

the probability that an entity's controls will fail to prevent or detect errors and frauds that would otherwise have entered the system

control risk

When either the design or operation of the control under consideration does not allow the entity's management or employees to detect or prevent misstatements in a timely fashion an internal control _____exists.

deficiency

An employee knowingly doing something to bypass the internal control system is an act of Blank______.

deliberate circumvention

a condition expressing whether controls would be expected to prevent or detect errors or fraud that could result in a material misstatement in the financial statements

design effectiveness

the activities that detect misstatements after they occur

detective controls

Section 302 of the Sarbanes-Oxley Act ______. Multiple select question. makes managers responsible for establishing a control environment requires management to assess the risks it wishes to control requires certain specific controls regardless of benefits versus costs makes internal auditors responsible for monitoring and maintaining control activities

makes managers responsible for establishing a control environment requires management to assess the risks it wishes to control

The COSO definition states that internal control is designed to provide ______ ______regarding the achievement of objectives in three categories

reasonable assurance

the concept that recognizes that the costs of control activities should not exceed the benefits that are expected from the control activities

reasonable assurance

A material weakness is a deficiency that results in a(n) ______ ______ that a material misstatement would not be prevented or detected on a timely basis.

reasonable possibility

The auditor should assess control risk for each relevant assertion by evaluating the evidence obtained from all sources, including

All of the choices are correct.

Which of the following is a device designed to help the audit team obtain evidence about the accounting and control activities of an audit client?

An internal control questionnaire.

According to the PCAOB, during the audit of internal controls for an issuer, the ultimate objective of testing the design effectiveness of internal controls is to

Determine that the company's controls will satisfy the company's control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements, if they operate as prescribed.

If the auditors encounter a significant scope limitation in evaluating an issuer's internal control over financial reporting, which of the following types of opinions on the effectiveness of the company's internal control over financial reporting would be appropriate?

Disclaimer of opinion.

Which report would not be appropriate for a public accounting firm to provide on financial reporting controls?

Disclaimer of opinion—significant deficiencies exist.

When completing the audit of internal controls for an issuer, the PCAOB requires the audit team to audit internal controls over:

Financial reporting.

The risk of material misstatement is composed of ______ risk and ______ risk

Inherent and control

Which of the following does not accurately summarize auditors' requirements regarding internal control? Issuer/Nonissuer

Test of Controls Yes/Yes

The most important fundamental component of an entity's internal control is

The control environment.

the opinion issued when the company has not maintained an effective internal control over financial reporting

adverse opinion on internal control over financial reporting

All entities recognize the need for a formalized process to identify, properly assess and ultimately manage factors, events, and conditions, known as,______ _______ that can prevent the organization from achieving its objectives

business risk

Two or more people working together to circumvent the internal control system is called ______ and it cannot be prevented by separation of duties.

collusion

Controls that are pervasive to the internal control system and the reliability of the financial statements as a whole are called ______ - level controls.

entity

Procedures related to internal control in an integrated audit performed under AS 2201 are ______ than those in a GAAS audit for a nonpublic entity.

far more extensive

the term used to describe an audit process that is designed to provide an opinion on both the financial statements and internal control system of an entity

integrated audit process

a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the reliability of financial reporting, the effectiveness and efficiency of operations, and compliance with applicable laws and regulations

internal control

a condition that exists when the design or operation of a control does not allow the entity's management or employees to detect or prevent misstatements in a timely fashion

internal control deficiency

a checklist of internal control-related questions used to gain and document an understanding of the client's internal control

internal control questionnaire

a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement would not prevented or detected on a timely basis

material weakness

a condition expressing whether a control is operating as designed and whether the person performing the control possesses the necessary authority and qualifications to perform the control effectively

operation effectiveness

the tracing of one or more transactions through the audit trail from initiation of the transaction to its inclusion in the financial statements

walkthrough

The five basic components of a properly designed internal control system as defined by COSO are: (1) control ______, (2) ______ assessment, (3) ______ activities, (4) ______ and (5) information and ______ .

(1) control environment (2) risk assessment (3) control activities (4) monitoring (5) information and communication

The purpose of separating the duties of hiring personnel and distributing payroll checks is to separate the

Authorization of transactions from the custody of related assets.

True or false: For audits of internal control, the audit team must understand and evaluate internal controls for the entire period.

F

a subcommittee of the board of directors that is generally composed of three to six "outside" members of the organization's board of directors

audit committee

a report required by the Sarbanes-Oxley Act that provides an opinion on the effectiveness of the entity's internal control over financial reporting

auditor's report on internal control over financial reporting

those factors, events, and conditions that could prevent the organization from achieving its business objectives

business risk

an audit procedure that can be used as both a test of controls and a substantive test

dual-purpose test

When planning the audit of internal controls for an issuer, the audit team should:

identify significant accounts, locations, and relevant assertions.

Gaining an understanding of internal controls should start by identifying ______ accounts and disclosures and their ______ ______

significant; relevant assertions

the controls that are persuasive to the financial statements taken as a whole

entity-level controls (ELCs)

Comparing all customers' credit limits to the sum of their outstanding credit balance plus a potential sales transaction as a means of checking for potential over-limit conditions is an example of ______ testing.

exception

An account's significance is based on its ______ risk.

inherent

When a properly designed control is either ignored or inappropriately applied, a(n) Blank______ has occurred.

operating deficiency

maintaining a good business reputation, ensuring a positive return on investment, increasing market share, promoting new product innovation, and using assets effectively and efficiently

operations category

In most audits of large entities, control risk assessment contributes to audit efficiency, which means that

Auditors will be able to reduce the cost of substantive procedures by an amount more than the control evaluation costs.

Once the auditor detects a control deficiency, which of the following steps must he or she take first?

Evaluate the severity of the deficiency on the auditor's control risk assessment for that assertion.

True or false: The audit team is only required to communicate significant deficiencies and material weaknesses in internal control that come to their attention during the performance of a PCAOB audit for an issuer.

F

When testing a control activity's operating effectiveness, procedures the auditor performs to test operating effectiveness would likely include

Inquiry of appropriate personnel and reperformance of the control activity.

A material weakness is a situation in which

It is reasonably possible that a material misstatement would not be detected on a timely basis.

If the auditor plans to assess control risk at less than the maximum and rely on controls, and the nature, timing, and extent of further audit procedures are based on that lower assessment, the auditor must

Obtain evidence that the controls selected for testing are designed effectively and operated effectively during the entire period of reliance.

Which of the following would probably not be considered an indication of a material weakness?

Overproduction by the manufacturing plant.

Effectiveness of audit procedures would be reduced by

Performing procedures during the interim period as opposed to at the fiscal year-end date.

Matters that could affect the necessary extent of testing for a control activity as it related to the degree of auditor reliance on a control activity would not include the following:

The relevance and reliability of the audit evidence to be obtained to test the operating effectiveness of a control activity.

The foundation for all other components of internal control is the ______ ______.

control environment

Section 302 of the Sarbanes-Oxley Act ______. Multiple select question. allows managers to make their own judgments about the necessity of specific controls is designed to ensure the proper "tone at the top" makes management responsible for monitoring, supervising and maintaining control activities stipulates criminal penalties for the Board of Directors of firm's issuing materially misleading financial statements

allows managers to make their own judgments about the necessity of specific controls is designed to ensure the proper "tone at the top" makes management responsible for monitoring, supervising and maintaining control activities

Flowcharts ______. Multiple select question. can be helpful in identifying missing controls are easy to evaluate after they are completed are time-consuming to construct must be created from scratch for every audit

can be helpful in identifying missing controls are easy to evaluate after they are completed are time-consuming to construct

AS 2201 encourages the audit team to use the work of internal auditors but the audit team must evaluate their ______ and ______ and perform some tests of their work.

competence and objectivity

to ensure compliance with laws and regulations that affect the entity

compliance category

Specific actions a client's management and employees take to help ensure management's directives are carried out are called ______ ______.

control activities

the specific actions taken by a client's management and employees to help ensure that management directives are carried out

control activities

Integrity, ethical values and competence of the entity's people are all ______ ______ factors

control environment

the situations in which auditors cannot provide assurance on the effectiveness of internal control over financial reporting; issued when a significant scope limitation exists

disclaimer of opinion on internal control over financial reporting

For all relevant assertions for each significant account and disclosure, the audit team begins by examining ______ ______ controls that are pervasive to the internal control system and reliability of the financial statements as a whole.

entity level

Using an automated test procedure designed to test all items in a population as a means to identify a violation of control activities is an example of ______ testing.

exception

producing reliable financial reports and safeguarding assets

financial reporting category

Separation of duties Blank______. Multiple select question. forces different people or departments to deal with different facets of transactions prevents fraud that do not involve collusion increases the chance of innocent errors being overlooked prevents incompatible responsibilities

forces different people or departments to deal with different facets of transactions prevents fraud that do not involve collusion prevents incompatible responsibilities

After understanding and documenting internal control, the audit team should be able to ______.

make a preliminary assessment of control risk

Combinations of duties that place a single person in a position to create and conceal misstatements due to errors or frauds in their normal job are termed ______ responsibilities.

incompatible

an entity's system, usually built on some type of technological platform that has been designed to produce the information necessary for the entity to operate and control its business operations

information system

______ ______ ______ are designed to help the audit team obtain evidence about the control environment of a client organization.

internal control questionnaires

a report required by the Sarbanes-Oxley Act that states that management is responsible for establishing and maintaining adequate internal control over financial reporting, identifies the framework management uses to evaluate the effectiveness of the entity's internal control, and provides management's assessment of the effectiveness of the entity's internal control

management's annual report on internal control over financial reporting

The focus of AS 2201 is to determine whether a(n) ______ ______ exists at the end of the year being reported on. If it does, the entity's internal control over financial reporting cannot be considered effective.

material weakness

The magnitude of the potential misstatement that could occur and would not be detected on a timely basis is the primary difference between a(n) ______.

material weakness and significant deficiency

The audit team: Multiple select question. generally makes recommendations to management regarding ways to improve internal control. must communicate significant deficiencies and material weaknesses identified during the audit. communicates internal control issues to help management carry out internal control monitoring responsibilities.

must communicate significant deficiencies and material weaknesses identified during the audit. communicates internal control issues to help management carry out internal control monitoring responsibilities.

the audit documentation that describes the environmental elements, the accounting system, and the control activities in an entity's internal control

narrative description

the activities that prevent misstatements before they occur

preventive controls

Common monitoring controls include Blank______. Multiple select question. quality assurance review of the internal audit department regular management and supervisory control activities analysis of and follow up items that might by indicative of a control failure self-assessments by management regarding the tone they set

quality assurance review of the internal audit department analysis of and follow up items that might by indicative of a control failure self-assessments by management regarding the tone they set

An assertion that has a reasonable possibility of containing a material misstatement is considered to be a(n) ______ assertion

relevant

When control activities do not lend themselves to automated testing, the audit team is likely to use audit ______ to test the population.

sampling

A deficiency in internal controls that is less severe than a material weakness yet important enough to merit attention from those charged with governance is a(n) ______ ______

significant deficiency

a deficiency or a combination of deficiencies in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance

significant deficiency

the detailed audit and analytical procedures designed to detect material misstatements in account balances and footnote disclosures

substantive procedures

Common monitoring controls include Blank______. Multiple select question. supervisory review of controls periodic evaluation of controls by internal audit external auditor inquiries of internal auditors and the audit committee self-assessments by boards regarding the effectiveness of their oversight

supervisory review of controls periodic evaluation of controls by internal audit self-assessments by boards regarding the effectiveness of their oversight

Internal control questionnaires ______. Multiple select question. tend to be inflexible make it less likely for the audit team to forget to cover an important point should be worded so that "yes" answers are always good should be used in combination with other methods

tend to be inflexible make it less likely for the audit team to forget to cover an important point should be used in combination with other methods

reliability of financial reporting effectiveness and efficiency of operations compliance with applicable laws and regulations

three objectives of internal control

Professional standards recognize that to make effective decisions, managers must have access to _____ ,_____ , and _____ information

timely, reliable, and relevant

the controls that relate to specific classes of transactions, account balances, and disclosures

transaction-level controls

If the audit-team decides an entity-level control sufficiently reduces a specific risk Blank______.

transaction-level controls related to that risk may not be needed

the report issued when no material weaknesses in internal control over financial reporting are identified and no scope limitations on the audit of internal control exist

unqualified opinion on internal control over financial reporting