Compensating control

a control elsewhere in the system that offsets the absence of a key control

Control deficiency

deficiency in the design or operation of controls that does not permit company personnel to prevent
or detect and correct misstatements on a timely basis

Control risk matrix

a methodology used to help the auditor assess control risk by matching key internal controls and
internal control deficiencies with transaction-related audit objectives

Embedded audit module approach

a method of auditing transaction processed by IT whereby the auditor embeds a module in the
client's application software to identify transactions with characteristics that are of interest to the
auditor; the auditor is then able to analyze these transactions on a real-time, continuous basis as
client transactions are processed

Flowchart

a diagrammatic representation of the client's documents and records and the sequence in which
they are processed

Generalized audit software (GAS)

computer programs used by auditors that provide data retrieval, data manipulation, and reporting
capabilities specifically oriented to the needs of auditors

Internal control questionnaire

a series of questions about the controls in each audit are used as a means of indicating to the auditor
aspects of internal control that may be inadequate

Key controls

controls that are expected to have the greatest effect on meeting audit objectives

Management letter

an optional letter written by the auditor to a client's management containing the auditor's
recommendations for improving any aspect of the client's business

Material weakness

a significant deficiency in internal control that, by itself or in combination with other significant
deficiencies, results in a reasonable possibility that a material misstatement of the financial
statements will not be prevented or detected

Narrative

a written description of a client's internal controls, including the origin, processing, and disposition of
documents and records, and the relevant control procedures

Parallel simulation testing

an audit testing approach that involves the auditor's use of audit software, either purchased or
programmed by the auditor, to replicate some part of a client's application system

Procedures to obtain an understanding

procedures used by the auditor to gather evidence about the design and implementation of specific
controls

Significant deficiency

a control deficiency, or a combination of control deficiencies, that is less severe than a material
weakness, but important enough to merit attention by those responsible for oversight of the
company's financial reporting

Test data approach

a method of auditing and IT system that uses the auditors' test data to determine whether the
client's computer program correctly processes valid and invalid transactions

Tests of controls

audit procedures to test the operating effectiveness of controls in support of reduced assessed
control risk

Walkthrough

the tracing of selected transaction through the accounting system to determine that controls are in
place

Describe the 4 steps performed by the auditor when obtaining an understanding of i.c. and assessing
control risk.

As illustrated by Figure 12-1, there are four phases in the process of

understanding internal control and assessing control risk. In the first

phase the auditor obtains an understanding of internal controls, which

includes an understanding of their design and whether they have been

implemented. Next the auditor must make a preliminary assessment of

control risk (phase 2) and perform tests of controls (phase 3). The auditor

uses the results of tests of controls to assess control risk and to ultimately

decide planned detection risk and substantive tests for the audit of financial

statements, which is phase 4.

What is the purpose of a control risk matrix?

The purpose of a control risk matrix is to assist the auditor in assessing

control risk at the transaction level. The control risk matrix identifies existing

controls and deficiencies for each audit objective in the transaction cycle,

making it easier for the auditor to assess control risk for each transactionrelated
audit objective.

What 4 types of procedures are used by auditors to test whether i.c. are operating effectively?

The four types of procedures used by auditors to test whether internal

controls are operating effectively are (1) inquiring of appropriate personnel

regarding the operation of controls; (2) examine documents and records

when there is a trail of evidence that the control is/is not operating (e.g., a

supervisor's signature on a time card); (3) observe control-related activities

in process, preferably at various points throughout the year, and (4)

reperform control activities performed by the client.

Why are the financial statement audit findings relevant to the auditor's opinion on the effectives of
i.c. over financial reporting?

The financial statement audit findings are relevant to the auditor's opinion on

the effectiveness of internal controls over financial reporting because the

auditor may or may not identify misstatements during the audit. If the auditor

identifies material misstatements during the audit that were not prevented or

detected by the client's internal controls, this would indicate a potential

material weakness in internal controls. Any identified misstatements would

indicate a potential control deficiency or significant deficiency.

Explain the dif in the requirements for reporting on the effectiveness of i.c. over financial reporting
for integrated audits versus financial statement-only audits.

Auditors are required to perform integrated audits, an audit of the financial

statements coupled with an audit of internal control over financial reporting,

on audit engagements of large publicly traded companies (accelerated

filers). For integrated audits, the auditor issues an opinion on the

effectiveness of internal control in addition to the opinion on the financial

statements. As a result, the level of understanding and the extent of testing

of internal controls need to be sufficient to express an opinion on the

effectiveness of internal controls. For financial statement-only audits, the

auditor does not issue an opinion on the effectiveness of internal controls,

but rather the focus is on understanding controls that are relevant to the

audit in order to identify and assess the risks of material misstatement.

What is the auditor's responsibility for obtaining an understanding of i.c.? How does that
responsibility differ for audits of public and nonpublic companies?

The auditor's responsibility for obtaining an understanding of internal

control for a large public company, when an opinion is issued on the

effectiveness of internal controls, is significantly greater than the understanding

necessary when the auditor is solely expressing an opinion on the financial

statements. To express an opinion on internal controls for a large public

company, the auditor obtains an understanding of controls for all significant

account balances, classes of transactions, and disclosures and related

assertions in the financial statements. In contrast, for an audit of a nonpublic

company or a smaller public company, the auditor will obtain an understanding

of internal controls that are relevant to the financial statement audit in order to

assess the risks of material misstatement. Thus, the level of understanding of

internal controls required for the audit of internal controls exceeds the level

required for an audit of only the financial statements.

CPA thinks ok to obtain understanding of i.c. halfway through audit after familiar with client's
operations and way system actually works. Explain approach.

Maier is correct in her belief that internal controls frequently do not

function in the manner they are supposed to. However, regardless of this,

her approach ignores the value of beginning the understanding of internal

control by preparing or reviewing a rough flowchart or other internal control

descriptions. Obtaining an early understanding of the client's internal control will

provide Maier with a basis for a decision about further audit procedures and

sample sizes based on assessed control risk. By not obtaining an

understanding of internal control until later in the engagement, Maier risks

performing either too much or too little work, or emphasizing the wrong areas

during her audit.

What is a walkthrough of i.c.? What is its purpose?

In a walkthrough of internal control, the auditor selects one or a few

documents for the initiation of a transaction type and traces them through the

entire accounting process. At each stage of processing, the auditor makes

inquiries and observes current activities, in addition to examining completed

documentation for the transaction or transactions selected. Thus, the auditor

combines observation, inspection, and inquiry to conduct a walkthrough o finternal control. PCAOB
auditing standards require the auditor to perform at

least one walkthrough for each major class of transactions.

Describe how the nature of evidence used to evaluate the control environment differs from the
nature of evidence used to evaluate control activities.

For many control activities, documentation of their performance is more

objectively evaluated in contrast to the evaluation of the control environment.

Due to the nature of the subcomponents that constitute the control

environment, such as integrity and ethical values and commitment to

competence, the nature of evidence used to evaluate the control environment

may differ somewhat from the nature of evidence used to evaluate control

activities. While auditors examine similar types of evidence to assess both the

control environment and control activities, they often perform more extensive

inquires and observation to assess the design and implementation of control

environment subcomponents, such as the entity's code of conduct and

whistleblowing system, so they can evaluate whether employees understand

those policies and procedures, and to gain a sense as to the overall ethical tone

and perception of management's integrity. Because of the more judgmental

nature of many of the control environment subcomponents, auditors often make

numerous inquiries and perform extensive observation of client personnel in the

performance of policies and procedures to evaluate those subcomponents of

the control environment. While inquiry and observation may also be performed

to evaluate control activities, auditors frequently inspect documentation that

demonstrates a control activity was performed, such as examining signatures

on documents or matching of documentation supporting a transaction, and they

often reperform certain client performed procedures, such as the calculation of

a transaction amount.

Distinguish a significant deficiency in i.c. from a material weakness in i.c. how will presence of 1
significant deficiency affect an auditor's report on i.c. under PCAOB standards? How will the presence
of 1 material weakness affect an auditor's report on i.c. under PCAOB standards?

A significant deficiency exists if one or more control deficiencies exist

that are less severe than a material weakness, but important enough to merit

attention by those responsible for oversight of the company's financial

reporting. A material weakness exists if a significant deficiency, by itself or in

combination with other significant deficiencies, results in a reasonable

possibility that internal control will not prevent or detect material financial

statement misstatements. The presence of one significant deficiency that is not

deemed to be a material weakness may not affect the auditor's report. In that

instance, the auditor's report on internal control over financial reporting would

contain an unqualified opinion. However, if the deficiency is deemed to be a

material weakness, the auditor must express an adverse opinion on the

effectiveness of internal control over financial reporting.

Distinguish the auditor's responsibility for testing controls in an integrated audit of a public company
from the responsibility to test controls in an audit of a nonpublic company.

The extent of controls tested by auditors for an integrated audit of a large

public company, in which the auditor will express an opinion on internal control,

is significantly greater than the extent of testing solely to express an opinion on

the financial statements. To express an opinion on internal controls for a large

public company, the auditor obtains an understanding of and performs tests of

controls for all significant account balances, classes of transactions, and

disclosures and related assertions in the financial statements. In contrast, the extent of controls
tested by an auditor of a nonpublic

company or a smaller public company is dependent on the auditor's

assessment of control risk. Whenever the auditor assesses control risk below

maximum, the auditor must perform tests of controls to support that control risk

assessment. The auditor will not perform tests of controls when the auditor

assesses control risk at maximum. When control risk is assessed below the

maximum, the auditor designs and performs a combination of tests of controls

and substantive procedures. Thus, for a nonpublic company or smaller public

company, the tests of controls vary based on the auditor's assessment of

control risk.

During the prior-year audits of McKimmon, Inc., a private company, the auditor did tests of controls
for all relevant financial statement assertions. Some of the related controls are manual while others
are automated. Describe the extent to which the auditor can rely on tests of controls performed in
prior years.

Auditing standards indicate that reliance can be placed on controls that

were tested in a prior year, except for controls that mitigate significant risks,

which must be tested in the current year. Controls should be tested at least

every three years, and whenever there is a significant change in the control.

Continued reliance on the effectiveness of automated controls is appropriate if

the auditor is satisfied that general controls over the computer applications are

adequate to identify any changes to computerized processes. The ability to rely

on prior year tests of automated controls is due to the systematic nature of ITbased

procedures. That is, once an automated control is programmed to perform

correctly, it should continue performing in that manner until the underlying

software program is changed. In contrast, controls performed manually are

generally tested each year because there is always a risk of human error

occurring in the performance of a manual control.

The auditor's risk assessment procedures identified several risks that the auditor deems to be
significant risks. Several internal controls exist that are designed to mitigate the risks identified.
Describe the auditor's responsibilities for considering those controls in the current audit

When the auditor's risk assessment procedures identify significant

risks, the auditor is required to test the operating effectiveness of controls that

mitigate these risks in the current year audit, if the auditor plans to rely on those

controls to support a control risk assessment below 100%. Thus, tests of

controls are required in the current year audit for those controls the auditor

plans to rely on to reduce control risk. The greater the risk, the more audit

evidence the auditor should obtain that controls are operating effectively.

Your client has outsourced the majority of the accounting info system to a 3-rd parry data center.
What impact does that have on your audit of the financial statements?

The fact that your client has outsourced the majority of its accounting

information system to a third-party data center does not change your professional

responsibilities. One of the principles underlying auditing standards requires the

auditor to obtain an understanding of internal controls in all audits. Thus, the

auditor would need to perform procedures to obtain information to provide an

understanding of internal controls that may reside at the data center. The

auditor would benefit greatly from a service auditor's report, if one is available.

Because the client has outsourced a majority of the accounting information

system, the auditor is likely to identify controls that may support lower assessments

of control risk that must be tested. Either the auditors may decide to conduct

their own testing of those controls or they may be able to obtain a service auditor's Report on
Management's Description of a Service Organization's System

and the Suitability of the Design and Operating Effectiveness of Controls

(referred to as a Type 2 report).

How does the auditor use info obtained from the control risk assessment and testing of controls to
plan audit procedures

The auditor uses the control risk assessments and the results of tests

of controls to determine the appropriate level of detection risk and the nature

and extent of substantive tests for the audit engagement. The auditor links the

control risk assessments at the transaction level to the balance-related audit

objectives for the accounts affected by the transaction cycles, and also to the

presentation and disclosure audit objectives.

If the auditor assesses control risk as high for a transaction-related audit objective, what does that
imply for detection risk and the level of substantive testing?

If the auditor assesses control risk as high for a transaction-related

audit objective, then in order to maintain a desired level of audit risk, the auditor

will need to set a lower level of detection risk. A lower level of detection risk in

turn means more extensive substantive testing.

What 2 conditions must be present for the auditor to issue an unqualified opinion on i.c. over
financial reporting? What type of condition will cause the auditor to issue a qualified or disclaimer of
opinion on i.c. over financial reporting?

The auditor may issue an unqualified opinion on internal control over

financial reporting when two conditions are present:

there are no identified material weaknesses as of the balance

sheet date; and

there have been no restrictions on the scope of the auditor's work.

A scope limitation is the condition that would cause the auditor to

express a qualified opinion or a disclaimer of opinion on internal control over

financial reporting. This type of opinion is issued when the auditor is unable to

determine if there are material weaknesses, due to a restriction on the scope of

the audit of internal control over financial reporting or other circumstances

where the auditor is unable to obtain sufficient appropriate evidence.

Explain how control risk assessment differs for an integrated audit versus a financial statement-only
audit.

The most significant difference in the assessment of control risk for

integrated audits versus financial statement-only audits is that control risk may

be assessed at maximum for some or all audit objectives for nonpublic

companies receiving a financial statement-only audit. Public companies, even

relatively smaller ones, are expected to have effective internal controls for all

significant transaction cycles and accounts. Thus, it is likely control risk will be

set as low for public companies, whereas that is not necessarily the expectation

for nonpublic companies.

Explain what is meant by auditing through the computer, and describe the challenges and benefits of
this approach in an audit of a client that uses IT extensively to process accounting info.

"Auditing through the computer" represents an audit approach whereby

the auditor tests the design and operating effectiveness of internal controls

embedded in applications that are only available electronically to determine the

extent to which the controls are effective and can be relied upon. In this case,

the auditor can use the computer controls to reduce control risk. Three common

approaches to assessing controls include the test data approach, parallel simulation or using
embedded audit modules. Assessing controls embedded in

computerized information can be challenging in complex systems and auditors

often obtain assistance from information systems specialists. In addition, there

is often no paper trail associated with controls embedded in information

systems, which can make it difficult to test operating effectiveness. The benefit,

however, is that once a computerized application control is determined to be

operating effectively through one of the three approaches mentioned above, the

auditor does not need to test a sample of transactions in order to rely on

controls.
Explain what is meant by the test data approach. What are the major difficulties with using this
approach? Define parallel simulation with audit software and provide an example of how it can be
used to test a client's payroll system.

The test data approach involves processing the auditor's test data using

the client's computer system and the client's application software program to

determine whether the computer-performed controls correctly process the test

data. Because the auditor designs the test data, the auditor is able to identify

which test items should be accepted or rejected by the computer. When using

this approach the auditor should assess the following:

How effectively does the test data represent all relevant conditions

that the auditor wants to test?

How certain is the auditor that the application programs being tested

by the auditor's test data are the same programs used by the client

throughout the year to process actual transactions?

How certain is the auditor that test data is effectively eliminated

from the client's records once testing is completed?

Parallel simulation with audit software involves the auditor's use of an

auditor-controlled software program to perform parallel operations to the

client's software by using the same data files. Because the auditor's software is

designed to parallel an operation performed by the client's software, this strategy is

referred to as parallel simulation testing. Parallel simulation could be used in the

audit of payroll by writing a program that calculates the accrued vacation pay

liability for each employee using information contained in the employee master

file. The total liability calculated by the auditor's software program would then

be compared to the client's calculation to determine if the liability for accrued

vacation pay is fairly stated at year-end.