Chapter 07 - Auditing Internal Control over Financial Reporting

CHAPTER 7
AUDITING INTERNAL CONTROL OVER FINANCIAL
REPORTING
Answers to Review Questions
7-1 Following are managements and the auditors responsibilities under Section 404 o the
Sarbanes-!"le# Act o $00$%
&anagements Responsibilities
Accept responsibilit# or the eectiveness o the entit#'s ICFR(
)valuate the eectiveness o the entit#'s ICFR using suitable control criteria(
Support its evaluation with suicient evidence* including documentation(
+resent a written assessment o the eectiveness o the entit#s ICFR as o the
end o the entit#s most recent iscal #ear(
Auditors Responsibilities
,he auditor must plan and perorm the audit to obtain reasonable assurance about
whether the entit# maintained* in all material respects* eective internal control as
o the date speciied in management's assessment(
,he audit o internal control should be -integrated. with the inancial statement
audit* and should e"press an opinion on the eectiveness o the entit#s ICFR(
7- -/i0elihood. reers to the probabilit# that a misstatement will not be prevented or
detected( For a signiicant deicienc# or a material wea0ness to e"ist* the li0elihood o
such an occurrence must be either -reasonabl# possible. or -probable(.
-&agnitude. reers to the signiicance that the control deicienc# could have on the
inancial statements according to the 1udgment o a prudent oicial who considers the
possibilit# o urther* undetected* misstatements( I the auditors li0elihood assessment is
-reasonabl# possible. and i the magnitude o the deicienc# is assessed as -signiicant*.
then either a signiicant deicienc# or material wea0ness e"ists depending on the
magnitude o the potential eects o the deicienc# on the entit#s inancial statements(
7-! All o the ollowing controls would t#picall# be tested 2see ,able 7-$3%
Controls over initiating* authori4ing* recording* processing* and reporting signiicant
accounts and disclosures and related assertions embodied in the inancial statements(
Controls over the selection and application o accounting policies that are in
conormit# with 5AA+(
Antiraud programs and controls(
Controls* including I, general controls* on which other controls are dependent(
Controls over signiicant nonroutine and nons#stematic transactions* such as accounts
involving 1udgments and estimates(
)ntit#-level controls 2see ,able 7-63(
7-6
Chapter 07 - Auditing Internal Control over Financial Reporting
7-" &anagement and the auditor ma0e similar decisions deciding which locations or business
units to include or testing( ,hus* the choice o which locations to include in the
assessment o internal control is based on the presence o entit#-level controls and the
inancial reporting ris0 at each individual location or business unit( 7illis 8 Adams
provide the ollowing lowchart as part o its +olic# Statement on Identi#ing Signiicant
9usiness :nits or /ocations 2see the polic# statement or more details3%
7-$
;es
<o
<o
<o
<o
;es
;es
;es Are there speciic signiicant
ris0s=
Is the location or business unit
individuall# important=
Are there locations or business
units that are not important even
when aggregated with others=
<o urther action re>uired or
such units(
)valuate and test controls over
speciic ris0s(
)valuate documentation and test
signiicant controls at each
location or business unit(
Are there documented compan#-
level controls over this group=
)valuate documentation and test
compan#-level controls over this
group(
Some testing o controls at
individual locations or business
units is re>uired(
#u$ti-$o%&tion Testin' Consi(er&tion F$ow%)&rt
Chapter 07 - Auditing Internal Control over Financial Reporting
7-* ,he S)C allows considerable le"ibilit# to management in how it should document its
assessment( Reasonable support would include the basis or managements assessment*
such as documentation o the methods and procedures it utili4es to gather and evaluate
evidence( Such documentation would include the design o the controls management has
placed in operation to ade>uatel# address identiied inancial reporting ris0s* including
the entit#-level and other pervasive elements necessar# or eective ICFR( &anagement
is not re>uired to identi# and document ever# control in a process( ?ocumentation
should ocus on those controls management concludes are ade>uate to address the
entit#s inancial reporting ris0s( Such evidence or managements assessment ordinaril#
includes documentation o how management ormed its conclusion about the
eectiveness o the compan#s entit#-level controls and other pervasive elements o
ICFR that its control ramewor0 describes as necessar# or an eective s#stem o internal
control(
7-+ ,he steps in the auditors process or an audit o ICFR include 2see Figure 7-$3%
+lan the audit o ICFR(
Identi# controls to test using a top-down* ris0-based approach(
,est the design and operating eectiveness o selected controls(
)valuate identiied control deiciencies(
Form an opinion on the eectiveness o ICFR(
7-7 7hen evaluating the competence and ob1ectivit# o others* the auditor should consider
the ollowing actors 2see ,able @-$3%
Co,-eten%e.
,heir educational level and proessional e"perience(
,heir relevant proessional certiications and continuing education(
,heir audit policies* procedures* and chec0lists(
+ractices regarding the assignment o individuals to wor0 areas(
Supervision and review o their audit activities(
Aualit# o the documentation o their wor0* including an# reports or
recommendations issued(
)valuation o their perormance(
O/0e%tivit1.
,he organi4ational status o the individuals responsible or the wor0 o others in
testing controls* includingB
a( 7hether the testing authorit# reports to an oicer o suicient status to ensure
suicient testing coverage and ade>uate consideration o* and action on* the
indings and recommendations o the individuals perorming the testing(
b( 7hether the testing authorit# has direct access and reports regularl# to the board o
directors or the audit committee(
c( 7hether the board o directors or the audit committee oversees emplo#ment
decisions related to the testing authorit#(
7-@
Chapter 07 - Auditing Internal Control over Financial Reporting
+olicies to maintain the individuals' ob1ectivit# about the areas being tested* including
B
a( +olicies prohibiting individuals rom testing controls in areas in which relatives are
emplo#ed in important or internal control sensitive positions(
b( +olicies prohibiting individuals rom testing controls in areas to which the# were
recentl# assigned or are scheduled to be assigned upon completion o their
controls testing responsibilities(
7-2 ,he steps in the top-down* ris0-based approach to obtaining an understanding o ICFR
include%
Identi# entit#-level controls C 9ecause these controls have a pervasive eect on
ICFR* the auditor needs a thorough understanding o entit#-level controls( ,he two
ma1or categories o controls included here are% 263 the control environment and 2$3 the
period-end inancial reporting process(
Identi# signiicant accounts and disclosures and their relevant assertions ,o
complete this step* the auditor evaluates ris0 actors related to the inancial statement
accounts and disclosures( ,he ris0 actors include%
D Si4e and composition o the account(
D Susceptibilit# to misstatement due to errors or raud(
D Eolume o activit#* comple"it#* and homogeneit# o the individual transactions
processed through the account or relected in the disclosure(
D <ature o the account or disclosure(
D Accounting and reporting comple"ities associated with the account or disclosure(
D )"posure to losses in the account(
D +ossibilit# o signiicant contingent liabilities arising rom the activities relected
in the account or disclosure(
D )"istence o related-part# transactions in the account(
D Changes rom the prior period in account or disclosure characteristics 2ASF* $G3(
:nderstand li0el# sources o misstatement C In order to complete this step* the auditor
needs to do the ollowing%
D :nderstand the low o transactions related to the relevant assertions(
D Identi# the points within the entit#'s processes at which a misstatement C
including a misstatement due to raud C could arise that* individuall# or in
combination with other misstatements* would be material(
D Identi# the controls that management has implemented to address these potential
misstatements(
D Identi# the controls that management has implemented over the prevention or
timel# detection o unauthori4ed ac>uisition* use* or disposition o the compan#'s
assets that could result in a material misstatement o the inancial statements
2ASF* @43(
Select controls to test C ,able 7-4 shows actors the auditor should consider when
identi#ing controls to test(
7-3 ,he period-end inancial reporting process controls include procedures used to enter
transaction totals into the general ledgerH initiate* authori4e* record* and process 1ournal
entries in the general ledgerH record recurring and nonrecurring ad1ustments to the annual
7-4
Chapter 07 - Auditing Internal Control over Financial Reporting
and >uarterl# inancial statementsH and drat annual and >uarterl# inancial statements
and related disclosures(
,he auditors evaluation o the period-end inancial reporting process includes the inputs*
procedures perormed* and outputs o the processes the compan# uses to produce its
annual and >uarterl# inancial statements( ,he auditor should also consider the e"tent o
I, involvement in each period-end inancial reporting process element* who participates
rom management* the number o locations involved* t#pes o ad1usting entries* and the
nature and e"tent o the oversight o the process b# appropriate parties* including
management* the board o directors* and the audit committee(
7-14 7al0throughs help the auditor to conirm his or her understanding o control design and
transaction process low* to determine whether all points at which misstatements could
occur have been identiied* to evaluate the eectiveness o the design o controls* and to
conirm whether controls have been placed in operation( 7al0throughs t#picall# do not
provide evidence o the operating eectiveness o controls( A t#pical wal0through
involves observation* in>uir#* and inspection o documents(
7-11 ,he circumstances that should be regarded as indicators o a material wea0ness include
2see ,able 7-73%
D Identiication o raud* whether or not material* on the part o senior management(
D Restatement o previousl# issued inancial statements to relect the correction o a
material misstatement(
D Identiication b# the auditor o a material misstatement o inancial statements in the
current period in circumstances that indicate that the misstatement would not have
been detected b# the compan#'s internal control over inancial reporting(
D Ineective oversight o the compan#'s e"ternal inancial reporting and internal
control over inancial reporting b# the compan#'s audit committee 2ASF* IG3(
,hese circumstances are -red lags. or potential problems in the control environment(
9ecause the nature o the audit report depends on the signiicance o such wea0nesses*
the +CA!9 does not want them to be overloo0ed(
7-1 Remediation is when an entit# determines that it has a material wea0ness and ta0es steps
to correct it( I management corrects a material wea0ness beore the -as o. date* and
both management and the auditor can ade>uatel# test the operating eectiveness o the
control* management can assert that ICFR is eective(
7-1! ASF re>uires that the auditor appropriatel# document the processes* procedures*
1udgments* and results relating to the audit o internal control( ,he auditors
documentation must include the auditors understanding and evaluation o the design o
each o the components o the entit#'s ICFR( ,he auditor also documents the process used
to determine* and the points at which misstatements could occur within* signiicant
accounts* disclosures* and ma1or classes o transactions( ,he auditor must 1usti# and
document the e"tent to which he or she relied upon wor0 perormed b# others( Finall#*
7-F
Chapter 07 - Auditing Internal Control over Financial Reporting
the auditor must describe the evaluation o an# deiciencies discovered as well as an#
other indings that could result in a modiication to the auditor's report(
7-1" ,he auditors report contains an opinion on the eectiveness o ICFR based on the
auditors independent audit wor0( Similar to reports relating to the inancial statement
audit* the basic options or the opinions are un>ualiied* disclaimer* and adverse( <ote
that ASF does not allow or a >ualiied opinion(
7-1* ,he auditors un>ualiied opinion on the eectiveness o a clients internal control
signiies that the clients internal control is designed and operating eectivel# in all
material respects( Signiicant deiciencies relate to possible inancial statement errors that
are less than material* and thereore do not re>uire a departure rom an un>ualiied
opinion( A serious scope limitation re>uires the auditor to disclaim an opinion( An
adverse opinion is re>uired i a material wea0ness is identiied( Figure 7-4 illustrates the
t#pes o auditors reports and the circumstances leading to each(
7-1+ ,he auditor will issue an adverse opinion on the eectiveness o internal control i a
material wea0ness is identiied(
7-17 I the scope o the auditors wor0 is limited* the auditor ma# disclaim an opinion*
depending on the severit# o the limitation and whether or not management intentionall#
imposes it(
7-12 7hen a signiicant period o time has elapsed between the time period covered b# the
tests o controls in the service auditor's report and the date o management's assessment*
additional procedures should be perormed( ,he auditor should consider the results o
relevant procedures perormed b# management or the auditor* how much time has passed
since the service auditor's report* the signiicance o the activities o the service
organi4ation* whether errors have been identiied in the service organi4ation's processing*
and the nature and signiicance o an# changes in the service organi4ation's controls( As
these actors increase in signiicance* the need or the auditor to obtain additional
evidence increases(
7-13 5enerali4ed audit sotware 25AS3 includes programs that allow the auditor to perorm
tests on computer iles and databases( 5AS enables auditors to conduct similar computer-
assisted audit techni>ues in dierent I, environments( Custom audit sotware is generall#
written b# auditors or speciic audit tas0s( Such programs are necessar# when the entit#'s
computer s#stem is not compatible with the auditor's 5AS or when the auditor wants to
conduct some testing that ma# not be possible with the 5AS(
Some unctions that can be perormed b# 5AS are% 263 ile or database access* 2$3
selection o transactions that meet certain criteria* 2@3 arithmetic unctions* 243 statistical
anal#ses* and 2F3 report generation(
Answers to #u$ti-$e-C)oi%e Questions
7-I
Chapter 07 - Auditing Internal Control over Financial Reporting
7-13 d 7-7 c
7-4 b 7-2 a
7-1 c 7-3 c
7- c 7-!4 a
7-! c 7-!1 c
7-" b 7-! a
7-* d 7-!! d
7-+ d
5o$utions to Pro/$e,s
7-!2
a( ,he auditor must determine whether the restatements are signiicant or material
deiciencies( I material* an adverse opinion will probabl# be issued* otherwise an
un>ualiied report ma# be given( I the misstatement resulted in a restatement o the
inancial statements* the misstatement would li0el# be considered material(
b( I other controls over inancial reporting are present* the auditor ma# issue an
un>ualiied opinion( Jowever* i the deicienc# carries a high ris0 o material
misstatement* then an adverse opinion should be issued( In most cases when oversight
is considered seriousl# deicient* an adverse opinion would be issued(
c( ,he auditor would most li0el# issue an adverse opinion because o the importance o
the audit committee in the control process(
d( I the ineective monitoring component is a material deicienc#* then an adverse
opinion should be issued( !therwise* an un>ualiied opinion ma# be given( 9ecause
the auditor determined that an eective internal audit unction was critical to eective
monitoring* an adverse opinion would most li0el# be considered appropriate(
e( ,he signiicance o inancial raud b# the CF! is a material wea0ness and an adverse
opinion should be issued(
( ?epending on the amount o ris0 o material misstatement due to the ineective
control environment* the auditor will issue an adverse opinion or an un>ualiied
opinion( In most cases* an ineective control environment will result in an adverse
opinion because it is considered a pervasive entit#-level control(
g( 5iven the lac0 o managements concern or internal control* which can be
considered a control environment issue* an adverse opinion would most li0el# be
issued* depending on the nature and severit# and the combined eect o the
signiicant deiciencies that were let uncorrected(
7-!3
a( ,he auditor would most li0el# issue an un>ualiied opinion on the eectiveness o
internal control( Signiicant deiciencies do not necessitate an adverse opinion( In this
7-7
Chapter 07 - Auditing Internal Control over Financial Reporting
case* the li0elihood is e"tremel# low that the deiciencies ta0en individuall# or
together will result in a material misstatement* meaning that there is no material
wea0ness( I the signiicant deiciencies remain uncorrected in uture #ears* the
auditor ma# conclude that managements attitude toward internal control relects a
poor control environment and ma# issue an adverse opinion(
b( A disclaimer o opinion on the eectiveness o internal control because the auditor
has a scope limitation( ,he auditor must have suicient appropriate evidence to
conclude that the clients ICFR is eectiveBsurmising based on partial results does
not constitute a high level o assurance(
c( :n>ualiied opinion on the eectiveness o internal control( ,he audit o internal
control is -as o. the report date( In other words* so long as the auditor has suicient
evidence that the clients internal control was operating eectivel# as o the end o
the reporting period* an un>ualiied opinion can be e"pressed( ,his gives
management an opportunit# to remediate wea0nesses and avoid an adverse opinion so
long as enough time is let or management to reassess and or the auditor to retest
controls and obtain suicient competent evidence that controls were eective as o
the report date(
d( An adverse opinion with respect to eectiveness o ICFR( ,he presence o a material
wea0ness as o the report date necessitates an adverse opinion with respect to internal
control(
e( ,he auditor would most li0el# issue a disclaimer on the eectiveness o internal
control due to a scope limitation( ,he auditors inabilit# to collect suicient data to
assess the operating eectiveness o the control constitutes a scope limitation* and the
opinion should be modiied accordingl#( Jowever* ater the auditor completes testing
in the ollowing #ear and i controls were ound to be operating eectivel#* an
interim report on the eectiveness o internal controls could be issued(
( Adverse opinion on the eectiveness o internal control( 9ecause the signiicant
deiciencies identiied* ta0en together* produce a -moderatel# low. ris0 o material
misstatement in the inancial statements* this li0elihood assessment is within the
range o -reasonabl# possible*. and thus* this combination o deiciencies is
considered a material wea0ness.
7-K