Audit Lecture 3

Question 1

Before the auditor accepts an engagement, what communication between the predecessor and the auditor should be made?

Answer 1

• Obtain client’s permission to make inquires of the predecessor auditor.
• Specific inquires include:
  
  • information that might bear on management’s integrity;
  • disagreements with management over accounting principles, auditing procedures, or other similarly significant matters;
  • the predecessor’s understanding as to the reasons for the change of auditors; and
  • communication to management, the audit committee, and those charged with governance regarding fraud, illegal acts by clients, and matters relating to internal control.

Question 2

After accepting the engagement, what communication between the auditor and the predecessor can be made?

Answer 2

The auditor may:

• Make specific inquiries regarding matters that may affect the conduct of the audit (e.g., audit problems).
• Review the predecessor’s audit documentation related to matters of continuing accounting and auditing significance.

Note that the auditor should not make reference to the work of the predecessor as the basis for the opinion.

Question 3

What should the auditor assess when considering the client acceptance and continuance policies?

Answer 3

The auditor should assess:

• The firm’s ability to meet reporting deadlines.
• The firm’s ability to staff the engagement.
• Independence.
• Integrity of client management.
• The group engagement’s team ability to obtain sufficient appropriate audit evidence.

Question 4

What topics should be included in the agreement to audit engagement terms?

Answer 4

An understanding should include:

• Objectives and the scope of the audit
• Management’s responsibilities
• The auditor’s responsibilities
• The inherent limitations of the engagement
• Identification of the applicable financial reporting framework
• Reference to the expected form and content of any reports.

An engagement letter may also refer to other matters, such as timing, client assistance, fees and billing, etc.

Question 5

What is the purpose of an engagement letter?

Answer 5

The purpose of the agreement is to reduce the risk of misunderstanding. Note that an engagement letter documenting the understanding is a requirement under PCAOB standards.

Question 6

Name the six main financial statement assertions for nonissuers and issuers.

[COVERU and CEO APROVED]

Answer 6

Nonissuer: (COVERU)

• Completeness;
• CutOff;
• Valuation, allocation and accuracy;
• Existence and occurance;
• Rights and obligations;
• Understandability and classification

Issuer: (CEO APROVED)

• Completeness;
• Existence;
• Occurance;
• Allocation;
• Presentation;
• Rights;
• Obligations;
• Valuation;
• E;
• Disclosure

Question 7

Name the relevant assertions for “transactions and events.”

Answer 7

• Completeness
• (Proper Period) Cutoff
• Accuracy
• Classification
• Occurrence

Question 8

Name the relevant assertions for “account balances.”

Answer 8

• Completeness
• Allocation and Valuation
• Rights and Obligations
• Existence

Question 9

Name the relevant assertions for “presentation and disclosure.”

Answer 9

• Completeness
• Understandability and Classification
• Rights and Obligations, and Occurrence
• Valuation and Accuracy

Question 10

What is the audit strategy?

Answer 10

The audit strategy outlines the scope of the audit engagement, the reporting objectives, timing of the audit, and required communications, and the factors that determine the focus on the audit. The audit strategy also includes a preliminary assessment of materiality and tolerable misstatement.

Question 11

Define materiality and tolerable misstatement.

Answer 11

Materiality is the amount of error or omission that would affect the judgement of a reasonable person. The auditor uses judgement to set the inital levels of materiality (including materiality for the financial statements as a whole, performance materiality, and materiality for particular classes of transactions, account balances, and disclosures), and to revise them appropriately throughout the audit.

Tolerable misstatement is the maximum error in a population that the auditor is willing to accept. Tolerable misstatement is the application of performance materiality to a particular sampling procedure.

Question 12

Is an auditor required to have prior experience with a client’s business or industry before accepting an engagement?

Answer 12

No, the auditor is not required to have prior experience with a client’s business or industry before accepting an engagement. However, once an engagement has been accepted, the auditor must obtain an understanding of the client’s industry and business. For example, an auditor may obtain an understanding by attending conferences or reading appropriate publications.

Question 13

What is an audit plan?

Answer 13

A written audit plan (required for every audit) is a listing of audit procedures that the auditor believes are necessary to accomplish the objectives of the audit. The audit plan typically follows development of the audit strategy.

Question 14

What should be included in each step of the audit plan?

[We cast our NET over the audit!]

Answer 14

Each step of the audit plan should set out the procedures in detail, specifying the nature, extent, and timing of the work to be performed and including a reference to the assertion under consideration.

Nature

Extent

Timing

Question 15

List the three types of audit procedures and tell why each is used.

Answer 15

Risk assessment procedures–to obtain an understanding of the entity and its environment, including its internal control.

Test of controls–to evaluate the operating effectiveness of internal control in preventing or detecting material misstatements.

Substantive procedures–to detect material misstatements in the financial statements.

Question 16

What are the responsibilities of assistants when there are disagreements?

Answer 16

Assistants have a responsibility to exercise due professional care and to observe the standards of fieldwork. They should bring any disagreements with the conduct of the audit to the attention of the auditor-in-charge.

The assisstant also has the right to document the disagreement, and, if necessary, to disassociate from the opinion.

Question 17

What factors does the external auditor have to assess if he or she plans to use the internal auditors to provide direct assistance?

Answer 17

The external auditor has to assess the internal auditor’s objectivity and competence.

Note that the external auditor remains solely responsible for the audit report, and may not share judgment responsibility with the internal auditor.

Question 18

What factors does the external auditor have to assess if the external auditor would like to use the work of the internal auditor function to reduce the extent of substantive procedures?

Answer 18

The external auditor needs to assess the competence and objectivity of the internal audit function. In addition, the external auditor should assess whether the internal audit function applies a systematic and disciplined approach.

Question 19

Provide some examples of factors that the external auditor may consider when assessing the competence of the internal auditors.

Answer 19

The following factors may be considered by the external auditor when assessing the competence of internal auditors:

• Education of internal auditors
• Professional certification of internal auditors
• Experience of internal auditors
• Performance evaluations of internal auditors
• The audit plan, audit procedures, and quality of internal audit documentation

Question 20

Provide some examples of factors that the external auditor may consider when assessing the objectivity the internal auditors.

Answer 20

The following factors may be considered by the external auditor when assessing the objectivity of internal auditors:

• Organization level to which the internal auditor reports
• Policies prohibiting audits of areas where the internal auditor lacks independence
• Whether any constraints or restrictions are placed on the internal audit function by management or those charged with governance (e.g., restictions on communicating findings to external auditor)

Question 21

Provide some examples of factors that the external auditor may consider when assessing whether the internal audit function applies a systematic and disciplined approach.

Answer 21

The following factors may considered by the external auditor when assessing whether the internal audit function applies a systematic and disciplined approach:

• The existence, adequacy, and use of documented interal audit procedures or guidance conering such areas as risk assessments, work programs, documentation, and reporting.
• The application of appropriate quality control policies and procedures or quality control requirements in standards set by relevant professional bodies for internal auditors.

Question 22

For what decisions must the external auditor not share responsibilities with the internal auditors?

Provide some examples.

Answer 22

The external auditor is required to make all significant judgments and may not share responsibility with internal auditors for significant judgments. Significant judgement include:

• Assessing the risks of material misstatement
• Evaluating the sufficiency of test performed
• Evalutating the significant accounting estimates
• Determining materiality
• Determining the type of audit opinion

Question 23

Should an auditor refer to the work of a specialist in the auditor’s report?

Answer 23

Generally, in the case of an unmodified opinion, no reference is made to the work of a specialist. If, however, the auditor decides to express a modified opinion due to the work of the specialist, reference to the specialist may be made. The auditor may need the permission from the specialist before making reference to the specialist.

Under the ISAs, the auditor is required to obtain permission from the specialist before making reference to the specialist in the report.

Question 24

Under PCAOB standards, what factors affect the nature and extent of the necessary planning activities?

Answer 24

• The size and complexity of the company
• The auditor’s previous experience with the company
• Changes in circumstances that occur during the audit

Question 25

According to PCAOB standards, what factors indication less complex operations?

Answer 25

* Fewer business lines * Less complex business processes and financial reporting systems * More centralized accounting functions * Extensive involvement of senior management in day-to-day operations * Fewer levels of managment

Question 26

The engagement partner is responsible for:

Answer 26

* Planning the audit * Supervising the work of engagement team members * Complying with relevant audit standards

Question 27

What factors determine the nature, extent and timing of supervision?

Answer 27

* The size and complexity of the entity * The nature of the work assigned to each engagement team member * The assessed risk of material misstatement * The qualifications of the assistants

Question 28

Distinguish between the three types of material misstatements.

Answer 28

The three types of material misstatements are: * Factual misstatements: Misstatements about which there is no doubt. * Judgmental misstatements: Management and the auditor have judgement differences on accounting estimates or the application of accounting policies. * Projected misstatements: This represents the auditor's best estimate of misstatements in populations, by projecting misstatements in an audit sample to the population from which the samples were drawn.

Question 29

What is audit risk? List and define two elements of *audit risk*.

Answer 29

**Audit risk** is the risk that the auditor may unknowingly fail to modify appropriately the opinion on the financial statements that are materially misstated. It comprises: * Risk of Material Misstatement--The risk that the financial statements are materially misstated. * Detection Risk--The risk that the auditor will not detect a material misstatement that exists in a relevant assertion.

Question 30

State the audit risk model including the relationship of detection risk to substantive tests.

Answer 30

AR = RMM x DR ## Footnote Where: RMM = Risk of Material Misstatement DR = Detection Risk There is an inverse relationship between RMM and DR. As the acceptable level of detection risk increases, the assurace required from substantive tests decreases. As the acceptable level of detection risk decreases, the assurance required from substantive testing must increase.

Question 31

What are the two components of the risk of material misstatement?

Answer 31

**Inherent Risk**: The susceptibility of a relevant assertion to a material misstatement assuming there are no related controls. **Control Risk**: The risk that a material misstatement that could occur in a relevant assertion will not be prevented or detected (and corrected) on a timely basis by the entity's internal control.

Question 32

Provide some examples of factors that would *increase* inherent risk.

Answer 32

Some examples of factors that would tend to increase inherent risk include: * Technological developments that make a product obsolete * A lack of working capital * A decline in overall industry or economy * High volume transactions * Complex transactions * Amounts of derived from estimates

Question 33

How may the auditor obtain more assurance from substantive procedures?

Answer 33

The auditor may obtain more assurance from substantive procedure by: * changing the nature of substantive tests from a less effective to a more effective procedures (e.g., a direct test toward independent parties outside the entity rather than toward parties or documentation inside the entity). * changing the extent of substantive tests (e.g., using larger sample sizes). * changing the timing of substantive tests (e.g., performing substantive tests at year-end rather than at the interim).

Question 34

What is the difference between *error* and *fraud*? State the auditor's responsibility to detect errors and fraud.

Answer 34

An error is an intentional misstatement or omission of amounts or disclosures in the financial statements. Fraud is an intentional action that results in misstatements or omissions of financial information with the intent to deceive financial statement users. The auditor must plan and perform and audit (using due care and professional skepticism) to provide reasonable (not absolute) assurance about whether the financial statements are free of material misstatement, whether due to errors or fraud.

Question 35

Name two types of fraud.

Answer 35

* Fraudulent financial reporting * Misappropriation of assets, or defalcation

Question 36

What fraud risk factors are generally present when fraud occurs?

Answer 36

The three conditions that generally are present when fraud occurs are: * incentives/pressures; * opportunity; and * rationalization/attitude. The auditor identifies and evaluates these fraud risk factors as part of assessing the risk of material misstatement due to fraud.

Question 37

When analyzing fraud risk, which four attributes should the auditor consider?

Answer 37

The auditor should consider the following fraud risk attributes: * Type of risk * Significance of risk * Likelihood of the risk * Pervasiveness of the risk

Question 38

How should an auditor report noncompliance of a law or regulation assuming: 1) it has a material effect n the financial statements; 2) there is sufficient evidence; or 3) the client refuses to accept a modified report?

Answer 38

**Scenario 1**: If not adequately reflected in the financial statements, a qualified opinion or adverse opinion should be issued. **Scenario 2**: If unable to obtain sufficient evidence of a suspected noncompliance, a qualified opinion or disclaimer of opinion should be issued. **Scenario 3**: If the client refuses to accept a modified report, the auditor should withdraw from the engagement and contact, in writing, those charged with governance.

Question 39

Why is the auditor required to obtain an understanding of the entity and its environment?

Answer 39

To assess the risk of material misstatement and to make informed judgements about other audit matter such as: * Materiality and tolerable missstatement * The entity's selection and application of accounting procedures * Areas that require special audit consideration * Design and performance of further audit procedures

Question 40

What steps should the auditor perform in assessing and responding to risk:

Answer 40

1. Obtain an understanding of the entity and its environment, including its internal control. 2. Assess the risk of material misstatement. 3. Respond to the assessed level of risk by designing further audit procedures based on this assessment. 4. Test internal controls to evaluate their operating effectiveness. 5. Perform substantive tests. 6. Evaluate the sufficiency and appropriateness of audit evidence obtained.

Question 41

What risk assessment procedures should the auditor use to obtain an understanding of the entity and its environment?

Answer 41

Risk assessment procedures include: * Inquiry * Analytical procedures * Observation and inspection * Risk assessment discussion

Question 42

What factors should be examined when obtaining an understanding of the entity and environment?

Answer 42

When obtaining an understanding of the entity and environment, the auditor should understand: * Industry, regulatory, and other external factors * The nature of the entity * Objectives, strategies, and business risks * The entity's financial performance * Internal control * The company's selection and application of accounting principles (issuer audits--PCAOB standards)

Question 43

What are analytical procedures?

Answer 43

Evaluations of financial information made by a study of plausible relationships among both financial and nonfinancial data (e.g., ratio analysis). Note: Analytical procedures are required in the planning and final review phases of the audit. They also may be used (but are required) in substantive testing.

Question 44

For what purposes are analytical procedures used in the audit planning phase?

Answer 44

Analytical procedures are used in planning the audit to understand the client's business and to identify unusual transactions and events, amounts, ratios, or trends that might represent specific risk relevant to the audit.

Question 45

What are the objectives of internal control?

Answer 45

* To promote efficiency and effectiveness of operations * To ensure reliable financial reporting * To encourage compliance with applicable laws and regulations

Question 46

What are some inherent limitations of internal control?

Answer 46

**Errors** may be made in the performance of control procedures. **Collusion** provides a way to bypass controls related to segregation of duties. Top management can **override** internal controls.

Question 47

What are the five components of internal control? [**CRIME**]

Answer 47

**C**ontrol environment **R**isk assessment **I**nformation and communication systems **M**onitoring **E**xisting control activities

Question 48

Why is the control environment particularly important to internal control?

Answer 48

The control environment sets the tone of an organization, influencing the control consciousness of its employees, and providing the foundation for the other components of internal control.

Question 49

What factors are included in the control environment?

Answer 49

* Communication and enforcement of integrity and ethical values * Management's commitment to competence * Participation of those charged with governance * Management's philosophy and operating style * Organizational structure * Assignment of authority, responsibility, and accountability * Human resource policies and practices

Question 50

Describe the "risk assessment" component of internal control.

Answer 50

Risk assessment is an entity's identification and analysis of risks to achievement of its objectives with respect to financial reporting. Risk assessment involves identification, analysis, and management of business risks relevant to the preparation of financial statements.

Question 51

What functions are served by an entity's information system with respect to financial reporting?

Answer 51

* Identify and record all valid transactions. * Describe transactions in a timely manner and in sufficient detail to allow proper classificiation. * Measure and record the proper monetary value of transactions. * Determine and ensure proper recording of transactions and events in the appropriate time period. * Present transactions and related disclosures properly in the financial statements.

Question 52

What functions should an auditor understand about an entity's communication system with respect to financial reporting?

Answer 52

* The methods used to communicate roles, responsibilities, and significant matter related to financial reporting. * Communications between management and those charged with governance, and between management and external parties.

Question 53

What activities may be considered part of the monitoring component of internal control?

Answer 53

The monitoring process may include: * Management and supervisory activities * Separate internal control evaluations * The internal audit function * Evaluation of communications with external parties

Question 54

Name some control activities that are relevant to an audit. [**PAID TIPS**]

Answer 54

* **P**renumbering of documents * **A**uthorization of transactions * **I**ndependent checks to maintain asset accountability * **D**ocumentation * **T**imely and appropriate performance reviews * **I**nformation processing general and application controls * **P**hysical controls for safeguarding assets * **S**egregation of duties

Question 55

What functions should be segregated? [Segregation of duties is your **ARC** to protect against a flood of troubles]

Answer 55

**A**uthorizing transactions **R**ecording transactions Maintaining **C**ustody of related assets

Question 56

Why does an auditor obtain an understanding of the client's internal control?

Answer 56

An auditor obtains an understanding of internal control to evaluate the design of controls and determine whether they have been implemented, to assess the risk of material misstatement, and to design the nature, extent, and timing of further audit procedures.

Question 57

When are a service organization's services considered to be part of an entity's information system?

Answer 57

A service organization's services are considered to be part of an entity's information system when those services affect the initiation, execution, processing, or reporting of the user company's transactions.

Question 58

What two types of reports may a service auditor provide, and what is the difference in how the user auditor may use them?

Answer 58

The service auditor may provide a: * Report on Management's Description of the Service Organization's System and the Suitability of the Design of Controls (Type 1 Report). This report does not support a reduction in the assessed level of control risk. OR * Report on Management's Description of Service Organization's System and the Suitability of the Design and Operating Effectiveness of Contols (Type 2 Report). This report may support a reduction in the assessed level of control risk.

Question 59

What steps should the auditor take in designing the nature, extent, and timing of further audit procedures?

Answer 59

The auditor uses his or her understanding of the entity and environment, including internal control, to: * Identify types of potential material misstatements. * Consider the factors that affect the risk of material misstatement. * Design tests of controls, when applicable. * Design substantive procedures.

Question 60

What are the three ways in which an auditor should respond to assessed risk?

Answer 60

The auditor should respond to assessed risk in three ways: * An overall response, to address risk at the FS level. * A response at the relevant assertion level. * A response to significant risks.

Question 61

What is a significant risk?

Answer 61

A **significant risk** is one that requires special audit consideration. The following factors may be indicative of a significant risk: * Nonroutine, unusual or complex transactions. * Business risks that may result in material misstatement. * Fraud risk. * Signficant related party transactions. * Accounting estimates or other subjective measurements of financial information. * Accounting principles that are subject to different interpretations.

Question 62

What are the documentation requirements surrounding the auditor's assessment of risk?

Answer 62

The auditor should document the: * Discussion among the audit team. * Understanding of the entity and its environment, including its internal control. * Assessment of the risks of material misstatement. * Basis for the risk assessment. * Identified risks and related controls evaluated.

Question 63

What are the two approaches an auditor may use to respond to identified risks at the relevant assertion level?

Answer 63

* **Substantive approach**--Only substantive test are used, either because there are no effective controls, or because it would not be effectient to test the operating effectiveness of controls. * **Combined approach**--Tests of the operating effectiveness of control and tests of substantive procedures are both used.

Question 64

When are tests of internal controls performed in a financial statement audit?

Answer 64

When the auditor's risk assessment is based on the assumption that controls are operating effectively; OR When substantive procedures alone are insufficient, such as when there is a significant amount of electronic processing.

Question 65

How does the auditor's assessment of the risk of material misstatement affect substantive procedures?

Answer 65

* The auditor's determination that the risk of material misstatement is high necessitates a greater level of assurance from substantive procedures, which may be obtained by varying, the nature, extent, or timing of such procedures. * The auditor's determination that the risk of material misstatement is low allows a reduction in the assurance required by substantive procedures. This too may be accomplished by varying the nature, extent, or timing of such procedures.

Question 66

What are the documentation requirements surrounding the auditor's response to assessed risk?

Answer 66

The auditor should document the: * Overall response addressing assessed risk at the FS level. * Nature, extent, and timing of further audit procedures. * Linkage of further audit procedures with assessed risk at the relevent assertion level. * Results of audit procedures. * Conclusions reached regarding the use of prior period evidence.

Question 67

Under PCAOB standards, what factors are relevant to the conclusion that sufficient evidence has been obtained?

Answer 67

* The significance of uncorrected misstatements and the likelihood of their having a material effect on the financial statements * The results of audit procedures performed * The auditor's risk assessment * The appropriateness of the evidence obtained