|
|
|
 |
|
1.3. Auditing & Attestation - Lecture |
|
|
|
|
|
|
|
|
|
|
|
Auditing & Attestation 3
Auditing & Attestation 3
1. Planning and supervision ................................................................................................
3
2. Fraud and illegal acts ...................................................................................................
25
3. Risk assessment ..........................................................................................................
36
4. Internal control ...........................................................................................................
44
5. Responding to assessed risks ........................................................................................
57
6. Appendix: Examples of fraud risk factors.........................................................................
66
7. Class questions ...........................................................................................................
69
A3-
2
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-3
A
OF THE
PPOINTMENTAUDITOR
P
S
REDECESSOR/UCCESSOR
C
OMMUNICATIONS
PLANNING AND SUPERVISION
I. INTRODUCTION
The first standard of fieldwork states:
"The auditor must adequately plan the work and must properly supervise any assistants."
Planning and supervision are continuous functions that last throughout the audit, although they may
be delegated by the in-charge auditor to other personnel. The earlier the auditor is appointed, the
more efficient the audit plan and performance can be.
In meeting the planning standard, the auditor should first obtain information about both the client
and the industry in which the client is functioning. Then, based on this understanding, the auditor
should make preliminary assessments of audit risk and materiality. Obviously, more work is
required to obtain information regarding a new client than for an existing client.
II. APPOINTMENT OF THE AUDITOR
A. AUDIT COMMITTEES
The audit committee of the client's board of directors is responsible for the
selection and appointment of the independent external auditor, and for reviewing the nature
and scope of the engagement. Thus, the auditor will have some interaction or
communication with the audit committee during the planning phase.
1. Sarbanes-Oxley Act
a. Under the Sarbanes-Oxley Act (generally applying to public companies), auditors
report to and are overseen by the client's audit committee.
b. The audit committee must pre-approve all services provided by the auditor.
c. Certain specified non-audit services (covered in Auditing & Attestation 2) are
prohibited.
2. Those Charged with Governance
The term "those charged with governance" refers to those who bear responsibility to
oversee the obligations, financial reporting process, and strategic direction of an entity.
This term is broadly interpreted to encompass the terms "board of directors" and "audit
committee."
B. TIMING
Although early appointment of the auditor allows the auditor to plan a more efficient audit, an
auditor is permitted to accept an engagement near or after year-end. The auditor should
consider whether late appointment will pose limitations on the audit that may lead to a
qualified opinion or a disclaimer of opinion, and should discuss such concerns with the client.
C. NEW CLIENT RELATIONSHIP: TALK TO PREDECESSOR AUDITOR
A predecessor auditor is one who is engaged to audit a prior financial
statement (even if the audit is not completed). In a new client relationship, it
is mandatory to make inquiries of the predecessor auditor. Client
permission is needed, however. If the client is unwilling to agree to this
procedure, the auditor should consider the implications and decide whether to accept the
engagement. The inquiries between the successor auditor and the predecessor auditor may
be oral or written.
Auditing & Attestation 3 Becker CPA Review
A3-
4 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
1. Before Acceptance
The successor auditor is required to make inquiries of the predecessor auditor
before
accepting an engagement. Inquiries should be made regarding:
a. Information that might bear on management integrity;
b. Disagreements with management over accounting principles, auditing
procedures, or other similarly significant matters;
c. The predecessor's understanding as to the reasons for the change of auditors;
and
d. Communication to management, the audit committee, and those charged with
governance regarding fraud, illegal acts by the client, and matters relating to
internal control.
2. After Acceptance
After
a. Making specific inquiries of the predecessor regarding matters that the successor
believes may affect the conduct of the audit, such as audit areas that have
required an inordinate amount of time or audit problems that arose from the
condition of the accounting system and records; and
b. Reviewing the predecessor's audit documentation. While the predecessor may
use judgment to decide the extent of access provided to the successor, review of
any documentation related to matters of continuing accounting and auditing
significance (e.g., contingencies, balance sheet accounts, etc.) would generally
be permitted.
acceptance, the audit may be facilitated by:
3. Successor Remains Responsible
The predecessor auditor should indicate that he or she is not responsible for the
sufficiency or appropriateness of the information in the audit documentation for the
successor auditor's purposes. In fact, while the successor auditor may consider
information obtained from the review of the predecessor's audit documentation, the
successor remains solely responsible for the audit work performed and the conclusions
reached during the current audit.
4. Discovery of Problems
If, during the course of an audit, a successor auditor uncovers potential problems
relating to the predecessor auditor's report, he or she should ask the client to arrange a
meeting (involving both auditors and the client) to resolve the matter. If the client's
management refuses to inform the predecessor auditor, or if the successor auditor is
not satisfied with the resolution, the successor auditor should consider the implications
on the current audit and whether to resign from the engagement.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-5
III. PRELIMINARY ENGAGEMENT ACTIVITIES
Prior to performing any significant audit activities, the auditor should consider whether or not to
continue the client relationship and the specific engagement. The auditor should also evaluate
compliance with ethical requirements.
A. CONSIDER WHETHER OR NOT TO CONTINUE THE CLIENT RELATIONSHIP AND THE
SPECIFIC ENGAGEMENT
1. Assess the Auditability of the Client
The auditor should assess the auditability of the potential client. Factors to be
considered include:
a. The Integrity of Management
Concerns about management's integrity may increase the likelihood of financial
statement misrepresentation.
b. The Availability and Adequacy of the Client's Accounting Records
(1) The auditor should determine whether sufficient appropriate audit evidence
is likely to be available to support an opinion on the financial statements.
(2) The auditor should determine whether management maintains an
adequate internal control environment sufficient to provide reliable financial
reporting.
c. The Ability of the Auditor to Perform the Audit after Consideration of:
(1) The auditor's knowledge of the client's industry and the possible need for a
specialist.
(2) The auditor's independence of the client.
(3) Scope limitations.
(4) Staffing needs of the engagement.
(5) The auditor's ability to comply fully with the Code of Professional Conduct.
d. The Nature and Scope of the Engagement
Since applicable professional standards, requirements, responsibilities, and
limitations vary with the nature and scope of an engagement, the auditor must
consider if an audit provides appropriate scope or if the nature of the
engagement should be something other than an audit.
2. Assess Business Risk
a. Client's Business Risk
The client's business risk is the risk that events may occur that will negatively
impact the company. In the extreme case, a high level of business risk might
make the client less desirable from an audit perspective, since it increases
certain fraud risk factors.
b. CPA's Business Risk
The CPA's business risk is the risk that the engagement will not prove to be
profitable, and is also considered in determining whether or not to accept an
engagement.
A
UDITABILITY
Auditing & Attestation 3 Becker CPA Review
A3-
6 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
U
NDERSTANDING
W
ITH THE CLIENT
B. EVALUATE COMPLIANCE WITH ETHICAL REQUIREMENTS
1. Independence
The auditor should consider whether or not the necessary independence has been
maintained.
2. Quality Control Policies and Procedures
As part of the pre-acceptance phase of any engagement, the accountant must
document compliance with the firm's quality control policies and procedures regarding
acceptance or continuance of clients and engagements.
IV. ESTABLISHING AN UNDERSTANDING WITH THE CLIENT
An understanding with the client should be established for services to be performed for
each engagement, and this understanding should be documented through a written
communication with the client. If the auditor believes an understanding with the client has
not been established, he or she should decline to accept or perform the engagement.
PASS KEY
An engagement letter is a presumptively mandatory requirement (i.e., it is required in most circumstances).
A. REASONS FOR UNDERSTANDING
An understanding reduces the risk that either the auditor or the client may misinterpret the
needs or expectations of the other party. For example, an understanding reduces the risk
that the client may inappropriately rely on the auditor to:
1. Protect the entity against certain risks (e.g., defalcations) or
2. Perform certain functions (e.g., establishing and maintaining effective internal control
over financial reporting) that are the client's responsibility.
B. COVERAGE
The understanding may include overall audit strategy, but typically would not include specific
audit procedures (unless those procedures were requested by the client).
The understanding should include:
1. Objectives of the Engagement
a. The objective of the audit is the expression of an opinion on the financial
statements. The financial statements should be identified (i.e., name of entity,
year-end, and statements to be audited).
2. Management's Responsibilities
a. Management is responsible for:
(1) The entity's financial statements (and tax returns), and the selection and
application of accounting policies.
(2) Establishing and maintaining effective internal control over financial
reporting.
(3) Identifying and ensuring that the entity complies with the laws and
regulations applicable to its activities, and preventing/detecting fraud.
(4) Making all financial records and related information available to the auditor.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-7
(5) Providing the auditor with a letter, at the conclusion of the engagement,
that confirms certain representations made during the audit.
(6) Adjusting the financial statements to correct material misstatements
identified by the auditor.
(7) Affirming to the auditor in the representation letter that the effects of any
uncorrected misstatements are immaterial (both individually and in the
aggregate) to the financial statements taken as a whole.
3. Auditor's Responsibilities
a. The auditor is responsible for conducting the audit in accordance with generally
accepted auditing standards (GAAS), which require:
(1) That the auditor obtain reasonable assurance (rather than absolute
assurance) about whether the financial statements are free of material
misstatement, whether caused by error or fraud.
(2) That the auditor obtain an understanding of the entity and its environment,
including its internal control, sufficient to assess risk and to design
appropriate auditing procedures.
b. If, for any reason, the auditor is unable to complete the audit or is unable to form
or has not formed an opinion, he or she may:
(1) Decline to express an opinion, or
(2) Decline to issue a report as a result of the engagement.
4. Limitations of the Engagement
a. Since an auditor obtains only reasonable assurance, a material misstatement
may remain undetected.
b. An audit is not designed to detect error or fraud that is immaterial to the financial
statements.
c. An audit is not designed to provide assurance on internal control, or to identify
significant deficiencies.
(1) The auditor is, however, responsible for ensuring that those charged with
governance are aware of any significant deficiencies noted.
5. Other Matters
The understanding may also include:
a. The overall audit strategy.
b. Arrangements involving the conduct of the engagement, such as timing, client
assistance, and the availability of documents.
(1) The names of specific client personnel to be contacted during the
engagement may be provided.
c. The involvement, if applicable of:
(1) Specialists.
(2) Internal auditors.
(3) A predecessor auditor.
d. Arrangements regarding fees and billing (e.g., method, amount, and frequency of
payment).
Auditing & Attestation 3 Becker CPA Review
A3-
8 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
e. Any limitation of or other arrangements regarding the liability of the auditor or the
client.
(1) For example, indemnification to the auditor for liability arising from knowing
misrepresentations to the auditor by management. (Regulators, including
the Securities and Exchange Commission, may restrict or prohibit such
liability limitation arrangements.)
f. Conditions under which access to the audit documentation may be granted to
others.
g. Additional services to be provided relating to regulatory requirements.
h. Arrangements regarding other services to be provided in connection with the
engagement, or particular audit procedures requested by the client.
C. DOCUMENTATION
The auditor should document the understanding with the client through a written
communication (e.g., a client engagement letter). The engagement letter should be accepted
(signed and dated) by the client.
V. PLANNING THE AUDIT
A. OBJECTIVE
The objective of the planning phase is the development of an overall strategy for the audit,
including its conduct, organization, and staffing. The nature, extent, and timing of planning
procedures will vary based on the size and complexity of the entity, and on the auditor's
experience with and understanding of the entity.
B. REQUIREMENTS
The auditor is required to:
1. Obtain an understanding of the entity and its environment, including its internal control,
sufficient to assess risk and design audit procedures.
a. The auditor must plan the audit to be responsive to the initial risk assessment,
but should also be prepared to make revisions to audit strategy based on the
results of audit procedures.
2. Obtain knowledge of the client's business and industry.
3. Use analytical procedures as a planning procedure.
4. Develop and document an audit plan (covered later).
5. Consider materiality and audit risk.
C. KNOWLEDGE OF THE CLIENT'S INDUSTRY
Obtaining knowledge about the client's industry helps to highlight practices unique to that
industry that may have an effect on the client's financial statements. The most common
sources of industry information are:
1. AICPA accounting and audit guides;
2. Trade publications and professional trade associations;
3. Government publications; and
4. AICPA Accounting Trends and Techniques (an annual survey of accounting practices).
P
LANNING
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-9
D. KNOWLEDGE OF THE CLIENT'S BUSINESS
The auditor should obtain knowledge relating to the client's business before commencing the
audit. Understanding the client's business provides information regarding events and
transactions that may affect the client's financial statements. The auditor may:
1. Tour Client Facilities
A tour of the client's facilities gives the auditor an excellent opportunity to meet the
client's personnel and observe the general operation of the company. A well-organized
tour can often save the auditor much time and effort during the course of the audit. As
a practical matter, this step is most important for new client relationships.
2. Review the Financial History of the Client
The auditor should review written documents relating to the current and past financial
history of the client. These may include:
a. Previous audit reports;
b. Annual and permanent audit files;
c. Prior year and interim financial statements;
d. Minutes of stockholders' and board of directors' meetings;
e. Communications with third parties;
f. SEC filings;
g. Dun and Bradstreet reports; and
h. Tax returns.
3. Obtain an Understanding of Client Accounting
The auditor should obtain an understanding of client accounting methodology because
it affects the design of internal control, which in turn impacts planned audit procedures.
Specifically, the auditor should obtain an understanding of:
a. Methods used to gather and process accounting information, including the extent
to which computer processing is used and the use of any outside service
organization. Such methods influence the client's design of internal control and
the auditor's consideration thereof. Review of the client's policies and
procedures manual often provides information about client accounting.
b. Events and transactions that may affect the financial statements or require
special audit consideration.
c. Other factors affecting audit risk, such as related party transactions.
d. Applicable accounting and auditing pronouncements.
4. Inquire of Client Personnel
The auditor should inquire about current business developments affecting the entity.
Auditing & Attestation 3 Becker CPA Review
A3-
10 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A
NALYTICAL
P
ROCEDURES
E. ANALYTICAL PROCEDURES
Analytical procedures are evaluations of financial information made by a study of plausible
relationships among both financial and nonfinancial data. At all stages of the audit, an
understanding of these relationships is essential.
1. Use of Analytical Procedures
Analytical procedures are used:
a. For planning the nature, extent, and timing of other auditing procedures
(mandatory);
b. As substantive tests to obtain audit evidence (optional);
c. As an overall review in the final review stage of the audit (mandatory).
2. Analytical Procedures Performed During Planning
The planning process
assist in planning the nature, extent, and timing of the auditing procedures that will be
used to gather audit evidence.
a. During planning, analytical procedures consist of a review of data aggregated at
a high level, such as comparing financial statements to budgeted or anticipated
results.
b. Generally, financial data is used, though relevant nonfinancial data (e.g., number
of employees, square footage of selling space, or volume of goods produced)
may also be considered.
must include application of analytical procedures, performed to
c. Purpose
The objective of analytical procedures used during planning is to:
(1) Enhance the auditor's understanding of the client's business and of
transactions and events that have occurred since the last audit date.
(2) Identify unusual transactions and events, and amounts, ratios, or trends
that might be significant to the financial statements and may represent
specific risks relevant to the audit.
Analytical procedures are discussed further in Auditing & Attestation 4.
F. OVERALL AUDIT STRATEGY
1. General Strategy Considerations
The auditor should establish an overall strategy for the audit, considering factors such
as:
a. Characteristics of the engagement, including the basis of reporting, industryspecific
reporting requirements, and locations of the entity.
b. The reporting objectives, including the timing and nature of required
communications.
c. Preliminary evaluations of materiality, audit risk, and internal control, including
entity-specific or industry-related developments.
d. The involvement of other auditors, specialists, internal auditors, or service
organizations.
e. The effect of information technology.
f. Knowledge gained from prior experience with the entity.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-11
2. Resource Allocation
The auditor should allocate appropriate resources to the engagement. Allocation of
resources includes:
a. Determining the appropriate staffing for the engagement (i.e., number of staff
members to assign, skill levels required, etc.).
b. Scheduling audit work, team meetings, and reviews.
3. Small Entities
For a small entity, establishment of an audit strategy may be a simple, less formal
process, such as preparing a brief memorandum at the end of one audit and updating it
at the beginning of the next.
4. Communication with Those Charged with Governance
The auditor is required to communicate the planned scope and timing of the audit with
those charged with governance (covered further in Auditing & Attestation 5).
G. THE AUDIT PLAN
1. Components of an Audit Plan
The auditor must develop an audit plan in which specific audit procedures are
documented. The audit plan should include a description of the nature, extent, and
timing of:
a. Planned Risk Assessment Procedures
(1) Planned risk assessment procedures are used to assess the risk of
material misstatement.
(2) The results of risk assessment procedures will affect whether and to what
extent further audit procedures are necessary.
b. Planned Further Audit Procedures
(1) Further audit procedures are applied at the relevant assertion level for
each material account balance, transaction class, and disclosure item.
(2) The plan for further audit procedures may include tests of the operating
effectiveness of controls, and should also include the nature, extent, and
timing of planned substantive procedures.
c. Other Audit Procedures
Other audit procedures (for example, a letter to the client's attorney) may be
necessary to comply with GAAS.
PASS KEY
A written audit plan (i.e., documentation of specific audit procedures) is
required.
2. Relationship of Audit Strategy and Audit Plan
While creation of an audit plan typically follows development of the audit strategy, the
two activities are closely interrelated and may overlap to some extent.
3. Need for a Specialist
The auditor should consider the need for a specialist, either from within the audit firm or
from the outside. For example, an information technology (IT) specialist may be used
to understand or test IT when:
Auditing & Attestation 3 Becker CPA Review
A3-
12 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
a. There are complex or interrelated systems, new systems, or changes to existing
systems.
b. The entity makes extensive use of e-commerce or other emerging technologies.
c. Significant audit evidence is only available in electronic form.
4. Timing of Audit Procedures
a. Testing at an Interim Date
During planning, the auditor generally establishes the timing of the audit work,
which may include the gathering of audit evidence at interim dates. When audit
procedures are performed before year-end, the auditor must assess the
incremental risk involved and determine whether sufficient alternative procedures
exist to extend the interim conclusions to year-end (covered later).
b. Effect of Information Technology
The auditor should consider the methods used by the client to process
accounting information, and whether those methods affect the availability of data.
For example, when computer processing is used, documents may exist only
briefly because they are discarded once information is entered into the system.
In such situations, the auditor may need to schedule audit procedures to coincide
with the availability of information. The auditor should also consider performing
tests several times during the year.
VI. MISSTATEMENTS AND MATERIALITY
A. MISSTATEMENTS
1. Misstatements can result from errors, which are unintentional, or fraud, which is
intentional. Misstatements include:
a. Inaccuracies in the collection or processing of data.
b. Departures from generally accepted accounting principles.
c. Omissions.
d. Incorrect estimates or judgments.
e. Inappropriate selection or application of accounting policies.
2. The auditor should consider what level of misstatement would be material, either alone
or when aggregated with other misstatements.
3. Misstatements may be either known or likely.
a. Known Misstatements
Known misstatements are specific misstatements identified during the audit.
b. Likely Misstatements
Likely misstatements are misstatements that the auditor considers likely to exist,
either due to differences between auditor and management judgments regarding
estimates or based on extrapolation from audit evidence.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-13
4. Tolerable Misstatement
Tolerable misstatement (also called tolerable error) is the maximum error in a specific
population (for example, an account balance) that the auditor is willing to accept.
5. Communication to Management
All misstatements, other than those considered trivial, must be communicated to
management.
a. In this communication, the auditor should:
(1) Distinguish between known and likely misstatements.
(2) Request management to review the situation and make appropriate
corrections.
b. The auditor should reevaluate the amount of likely misstatement remaining, if
any, after management has made adjustments.
c. If management does not correct some or all of the known and likely
misstatements, the auditor should consider the implications on the auditor's
report.
B. MATERIALITY
Materiality is the amount of error or omission that would affect the judgment of a reasonable
person. The auditor's report (covered in Auditing & Attestation 1) gives
absolute, assurance that the client's financial statements as a whole are free from material
misstatement.
reasonable, not
1. Needs of Users
In determining materiality, the auditor considers the general needs of financial
statement users, rather than the needs of any specific user group. Users are assumed
to:
a. Have appropriate knowledge of business, the economy, and accounting.
b. Recognize that financial statements inherently include some level of uncertainty.
c. Understand how materiality affects both the preparation and audit of the financial
statements.
d. Have both a willingness and an ability to properly analyze the financial
statements, and to make appropriate decisions based on this analysis.
2. Preliminary Judgment about Materiality
During the planning stage, the auditor uses professional judgment to establish a
preliminary level of materiality.
a. Generally, the auditor uses financial statements (e.g., annualized interim financial
statements, prior period annual financial statements, budgets, forecasts, etc.), as
adjusted for relevant changes that have occurred, to set a preliminary measure of
materiality.
b. Tolerable error, as determined for specific account balances, transaction classes,
or disclosure items, is typically lower than overall financial statement materiality
limits.
c. Because the financial statements are interrelated, the auditor should use the
smallest level of misstatement that could be material to any one of the financial
statements.
M
ATERIALITY
Auditing & Attestation 3 Becker CPA Review
A3-
14 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
d. This preliminary assessment of materiality ordinarily will be revised as the audit
progresses. The auditor should consider whether the audit plan needs to be
modified in response to any change in the assessment of materiality, and should
not assume that a misstatement is an isolated occurrence.
3. Evaluation of Audit Findings
a. The size of a misstatement is often evaluated in comparison to a relevant
financial base, such as net income, gross sales, gross margin, total assets, or
total liabilities.
b. The auditor must consider the effects, both individually and in the aggregate, of
uncorrected misstatements (both known and likely).
c. As the aggregate of known and likely misstatements approaches the materiality
level, the auditor should consider the risk that the addition of undetected
misstatements could cause materiality levels to be exceeded.
d. Prior period misstatements may affect the financial statements of the current
period.
e. Qualitative Considerations
Qualitative considerations sometimes may cause an otherwise immaterial
misstatement to be deemed material.
(1) The specific circumstances surrounding an entity may lead to situations in
which misstatements that do not exceed materiality limits are still likely to
influence the economic decisions of users.
(2) Misstatements are more likely to be considered material if they:
(a) Affect trends in profitability or mask a change in a trend, or change a
loss into income (or vice versa).
(b) Affect the entity's compliance with loan covenants, contracts, or
regulatory provisions.
(c) Increase management compensation, indicate a pattern of
management bias, or involve fraud or an illegal act.
(d) Affect significant financial statement elements, such as those
involving recurring earnings (as opposed to those involving
nonrecurring items).
(e) Can be objectively determined, as opposed to including an element
of subjectivity.
(3) Whether or not a misstatement is considered material is ultimately a matter
of professional judgment.
C. DOCUMENTATION REQUIREMENTS
The auditor should document the following items:
1. Planning levels of materiality and tolerable misstatement, the basis for those levels,
and any subsequent changes.
2. Known and likely misstatements that were corrected by management.
3. A summary of uncorrected misstatements (both known and likely), the auditor's
conclusion regarding whether such misstatements cause the financial statements to be
materially misstated, and the basis for this conclusion.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-15
a. Documentation of Uncorrected Misstatements
Documentation of uncorrected misstatements should include:
(1) Separate identification of known and likely misstatements.
(2) The aggregate effect on the financial statements.
(3) Relevant qualitative factors affecting materiality judgments.
VII. AUDIT RISK
A. WHAT IS AUDIT RISK?
Audit risk is the risk that the auditor may unknowingly fail to modify appropriately the opinion
on financial statements that are materially misstated.
1. Audit risk arises because the auditor obtains only reasonable (and not absolute)
assurance about whether the financial statements are free of material misstatement.
2. Audit risk should be reduced to a low level before an opinion on the financial
statements is expressed.
B. THE AUDIT RISK MODEL
1. Audit risk is comprised of the risk that the financial statements are materially misstated
(risk of material misstatement, or "RMM") and the risk that the auditor will not detect
such misstatements (detection risk, or "DR").
AR
Audit Risk
(should be low)
=
RMM
Risk of Material Misstatement
(assessed by auditor)
x
DR
Detection Risk
(controlled by auditor)
2. The components of audit risk may be assessed either quantitatively (e.g., as a
percentage), or non-quantitatively (e.g., high, medium, low, etc.).
3. Risk of Material Misstatement (RMM)
a. The auditor makes an assessment of the risk of material misstatement by
performing risk assessment procedures and, where appropriate, tests of controls
(covered later).
b. The risk of material misstatement can be subdivided into inherent risk ("IR") and
control risk ("CR").
c. Inherent Risk ("IR")
Inherent risk is the susceptibility of a relevant assertion to a material
misstatement, assuming there are no related controls.
(1) Assertions involving complex calculations, amounts derived from
estimates, and cash have relatively higher inherent risk than assertions
without those characteristics.
(2) Other factors specific to the entity and its environment may also tend to
increase inherent risk, such as technological developments that render a
product obsolete, a lack of working capital, or a decline in the overall
industry.
A
UDIT RISK
Auditing & Attestation 3 Becker CPA Review
A3-
16 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
d. Control Risk ("CR")
Control risk is the risk that a material misstatement that could occur in a relevant
assertion will not be prevented or detected on a timely basis by the entity's
internal control.
(1) Control risk is a function of the effectiveness of the design and operation of
internal control.
(2) Some amount of control risk will always exist due to inherent limitations of
any system of internal control (covered later).
e. Inherent risk and control risk exist independently of the audit, and the auditor
generally cannot change these risks.
PASS KEY
While the auditor cannot generally change the risk of material misstatement, the auditor can change his or her
this risk as the audit progresses. Many exam questions present a change in the auditor's assessed level of risk, and require
the candidate to determine the effect of this change.
assessment of
4. Detection Risk ("DR")
Detection risk is the risk that the auditor will not detect a misstatement that exists in a
relevant assertion.
a. Detection risk is a function of the effectiveness of audit procedures and of the
manner in which they are applied.
b. Some amount of detection risk will always exist because the auditor does not
examine 100 percent of an account balance or transaction class, and because
the auditor may make mistakes in applying audit procedures or in interpreting
results.
c. Detection risk can be subdivided into tests of details risk ("TD") and substantive
analytical procedures risk ("AP").
d. The auditor
can change detection risk (see below).
5. Effect on the Audit
The auditor's overall judgment about the level of risk in an engagement will affect the
staffing, level of supervision, and scope of the audit. While auditors use professional
judgment to assess each aspect of audit risk, they can change only the level of
detection risk. The auditor uses his or her assessment of the risk of material
misstatement as a basis for determining an appropriate level of detection risk.
a. Inverse Relationship of RMM to DR
When the auditor determines that the risk of material misstatement is high,
detection risk should be set at a low level. Conversely, when the risk of material
misstatement is low, the auditor can justify a higher detection risk.
b. The Auditor Can Change Detection Risk
The auditor can change the level of detection risk by varying the nature, extent,
and timing of audit procedures. For example, as the acceptable level of
detection risk decreases, the assurance provided from substantive procedures
should increase. The auditor may:
(1) Change the nature of substantive tests from a less effective to a more
effective procedure (e.g., direct test toward independent parties outside the
entity rather than toward parties or documentation inside the entity).
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-17
(2) Change the extent of substantive tests (e.g., use a larger sample size).
(3) Change the timing of substantive tests (e.g., perform substantive tests at
year-end rather than at interim).
Alternatively, if the acceptable level of detection risk increases, the assurance
that must be obtained from substantive tests decreases, allowing for somewhat
less persuasive evidence to be used, for a reduced extent of testing, or for more
testing to be performed at interim.
c. Substantive Procedures Required
Note that even when the assessed risk of material misstatement is low,
substantive procedures will always be necessary for all relevant assertions
related to material transaction classes, account balances, and disclosures.
PASS KEY
Many exam questions deal with the relationship between the risk of material misstatement (RMM) and detection risk, or
between RMM and substantive testing. While there is an inverse relationship between RMM and detection risk, there is a
direct relationship between RMM and the assurance required from substantive procedures. In other words, greater risk
requires more persuasive evidence, a larger sample size, and/or a shift from interim to year-end testing.
VIII. AUDIT RISK AND MATERIALITY: CONSIDERATION DURING AN AUDIT
A. OVERALL CONSIDERATIONS
1. Audit risk and materiality should be considered together in designing the nature, extent,
and timing of audit procedures, and in evaluating the results of those procedures.
2. Considerations of audit risk and materiality are affected by the size and complexity of
the entity, as well as the auditor's experience with and knowledge of the entity, its
environment, and its internal control.
3. Audit risk and materiality must be considered at both the financial statement level and
the account balance, individual transaction class, or disclosure item level.
B. CONSIDERATIONS AT THE FINANCIAL STATEMENT LEVEL
At the financial statement level, the auditor should consider risks that have a pervasive effect
on the financial statements, potentially affecting many relevant assertions. Audit risk at the
financial statement level often relates to the entity's control environment.
1. Purpose
Considerations of audit risk and materiality at the financial statement level are used to:
a. Design risk assessment procedures.
b. Identify and assess risk.
c. Design further audit procedures.
d. Evaluate the financial statements taken as a whole.
2. Auditor's Response
In responding to audit risk at the financial statement level, the auditor should consider:
a. The competency of personnel assigned to the engagement.
b. The potential need for a specialist.
c. The appropriate level of supervision of assistants.
Auditing & Attestation 3 Becker CPA Review
A3-
18 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
C. CONSIDERATIONS AT THE ACCOUNT BALANCE, TRANSACTION CLASS, OR
DISCLOSURE ITEM LEVEL
1. Purpose
Considerations of audit risk and materiality at the account balance, individual
transaction class, or disclosure item level are used to determine the nature, extent, and
timing of audit procedures to be applied to specific account balances, transaction
classes, or disclosure items. The audit risk model may be useful in this regard.
2. Inverse Relationship Between Audit Risk and Materiality
There is an inverse relationship between audit risk and materiality. The risk of a very
large misstatement may be low, whereas the risk of a small misstatement may be high.
Also, the more material a misstatement is, the less likely it is that the auditor will miss it.
As materiality decreases, audit risk increases.
IX. DEVELOPING THE AUDIT PLAN
A. AUDIT PROCEDURES
Audit procedures are performed to obtain evidence on which to base the audit opinion. Audit
procedures may be categorized as:
1. Risk Assessment Procedures
Risk assessment procedures are used to obtain an understanding of the entity and its
environment, including its internal control, in order to assess the risk of material
misstatement.
a. Risk assessment procedures alone do not provide audit evidence sufficient to
support an audit opinion.
2. Tests of Controls
Tests of controls are used to evaluate the operating effectiveness of internal control in
preventing or detecting material misstatements.
a. Test of controls are necessary when:
(1) The auditor's risk assessment is based to some extent on the operating
effectiveness of internal control.
(2) Substantive procedures alone are deemed to be insufficient (covered
later).
3. Substantive Procedures
Substantive procedures are used to detect material misstatements. They include tests
of details (as applied to transaction classes, account balances, and disclosures) and
substantive analytical procedures.
a. Substantive procedures are performed in response to the planned level of
detection risk, which in turn may be based (to some extent) on the results of tests
of controls.
b. Since risk assessment is judgmental, and since there are inherent limitations of
internal control, substantive procedures will always be necessary for all relevant
assertions related to each material transaction class, account balance, and
disclosure item.
Note that specific audit procedures will be covered in a later class.
A
UDIT PLAN
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-19
B. FINANCIAL STATEMENT ASSERTIONS
1. What are Financial Statements?
Financial statements are not statements of facts. They are claims and assertions,
made implicitly or explicitly by management, about the recognition, measurement,
presentation, and disclosure of information in the financial statements.
2. Categories of Assertions
Assertions used by the auditor fall into three categories:
a. Transactions and Events
(1)
recorded have been recorded.
(2) (
the correct (proper) accounting period.
(3)
events have been recorded appropriately.
(4)
accounts.
(5)
occurred and pertain to entity.
Completeness. All transactions and events that should have beenProper Period) Cutoff. Transactions and events have been recorded inAccuracy. Amounts and other data relating to recorded transactions andClassification. Transactions and events have been recorded in the properOccurrence. Transactions and events that have been recorded have
b. Account Balances
(1)
been recorded have been recorded.
(2)
included in the financial statements at appropriate amounts, and any
resulting valuation or allocation adjustments are appropriately recorded.
(3)
and liabilities are the obligations of the entity.
(4)
Completeness. All assets, liabilities, and equity interests that should haveAllocation and Valuation. Assets, liabilities, and equity interests areRights and Obligations. The entity holds or controls the rights to assets,Existence. Assets, liabilities, and equity interests exist.
c. Presentation and Disclosure
(1)
financial statements have been included.
(2)
presented and described and disclosures are clearly expressed.
(3)
transactions have occurred and pertain to the entity.
(4)
fairly and at appropriate amounts.
Completeness. All disclosures that should have been included in theUnderstandability and Classification. Financial information is appropriatelyRights and Obligations, and Occurrence. Disclosed events andValuation and Accuracy. Financial and other information are disclosed
PASS KEY
The following mnemonic may be used to aid in your memorization of the financial statement assertions:
CPA CO CARE CURV
("A
CPA CO CARE about CURVed assertions.")
F
INANCIAL
S
TATEMENT
A
SSERTIONS
Auditing & Attestation 3 Becker CPA Review
A3-
20 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
3. Relevant Assertions
Relevant assertions are assertions that have a meaningful bearing on whether an
account is fairly stated. For example, valuation is typically not relevant to the cash
account.
a. In determining whether an assertion is relevant to a particular account, the
auditor should consider the nature of the assertion, the volume of activity related
to the assertion, and the nature and complexity of the systems used to process
information supporting the assertion.
C. USE OF ASSERTIONS
1. An auditor uses relevant assertions to form a basis for assessing risk, and for the
design and performance of further audit procedures. The auditor should identify
potential misstatements that may occur, and then design audit procedures to address
those risks.
2. The following table provides some examples of the use of relevant assertions in
developing audit procedures for inventory.
Relevant Assertion Potential Misstatement Audit Procedure
Inventories included in the
balance sheet physically
exist (existence assertion).
The inventory balance
includes amounts that
don't physically exist (i.e.,
inventory is overstated).
Physically examine
inventory items.
Inventory quantities
include all inventory on
hand (completeness
assertion).
Inventory items on hand
are excluded from the
inventory balance (i.e.,
inventory is understated).
Observe physical
inventory counts.
Inventory quantities
include all inventory stored
at outside locations
(completeness assertion).
Inventory items stored at
outside locations are
excluded from the
inventory balance (i.e.,
inventory is understated).
Obtain confirmation of
inventories held at outside
locations.
3. Note that:
a. There may be more than one relevant assertion related to the same overall
category (e.g., completeness).
b. A given audit procedure may provide evidence supporting more than one
assertion. For example, when an auditor obtains confirmation of inventories held
at outside locations, evidence is obtained not just about completeness, but also
about the existence of inventory.
c. More than one procedure may be required to fully support an assertion. For
example, in order to be reasonably certain that inventory quantities include all
inventory on hand at year-end, the auditor should also inspect receiving
transactions near year-end for recording in the proper period.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-21
S
UPERVISION
A
UDIT
P
LAN
D. DRAFTING THE AUDIT PLAN
After sufficient planning information has been gathered, an audit plan should be
drafted. A written audit plan is
audit procedures that the auditor believes are necessary to accomplish the objectives of the
audit. It serves as the work plan for the supervising auditor and assistants working on the
engagement. Thus, the audit plan should set out procedures in reasonable detail, specifying
the nature, extent, and timing of the work to be performed, and including a reference to the
assertion under consideration (this reference may be implied as to the objective). For
example,
"Perform a specified procedure (e.g., count/vouch/trace/compare/
calculate/confirm/examine)… –
required for every audit. The audit plan is a listing ofnature
...on [a specified number of records from a specified population] –
extent
...as of [some interim date or year-end, either for the entire period
or from the date of interim fieldwork]." –
timing
As the audit progresses, the initial audit plan may need to be modified in response to
changing conditions or the results of other procedures. Modifications are often made after
assessing the risk of material misstatement, or based on the results of audit procedures. The
audit plan should be designed so that the audit evidence gathered will support the auditor's
conclusions.
X. SUPERVISION OF ASSISTANTS
GAAS requires proper supervision of assistants during the course of the audit to ensure that the
work they perform is adequate to accomplish the objectives of the examination and is consistent
with conclusions presented in the report. Guidance should be provided to assistants regarding both
technical and personnel aspects of the audit.
A. PROPER SUPERVISION
When assistants are used, proper supervision includes:
1. Directing the efforts of assistants;
2. Communicating with the audit team regarding the susceptibility of the financial
statements to material misstatement due to error or fraud;
3. Informing assistants of their responsibilities, the objectives of the procedures they are
to perform, and any matters that may affect their performance of those procedures;
4. Staying informed (e.g., by directing staff to report back) regarding significant
accounting and auditing issues, new developments, and difficulties encountered in
performing the audit;
5. Reviewing the work performed by assistants to determine whether it was adequately
performed and documented, whether the objectives of the audit were accomplished,
and whether the work is performed is consistent with the conclusions to be presented
in the auditor's report; and
6. Dealing with differences of opinion among members of the audit team.
Auditing & Attestation 3 Becker CPA Review
A3-
22 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
I
NTERNAL
A
UDITORS
B. EXTENT OF SUPERVISION
The extent of the supervision depends upon:
1. The complexity of the subject matter; and
2. The qualifications of the assistants.
C. DISAGREEMENTS WITH ASSISTANTS
A disagreement among members of the audit team regarding certain accounting and auditing
issues may exist at the end of the audit. If the differences still exist after consulting with the
auditor who has final responsibility for the audit (generally a partner), dissenting staff
members should be allowed to disassociate themselves from the resolution by documenting
their disagreement. In this event, the basis for the final resolution should also be
documented.
XI. THE ROLE OF THE CLIENT'S INTERNAL AUDITORS
When planning the audit, the auditor should consider the extent of involvement of the client's
internal auditors in the performance of the audit. While internal auditors must maintain
objectivity and integrity, they are not independent of the client, their employer. Thus, the
independent external auditor cannot share with the internal auditor any of the responsibility for audit
decisions, judgments, or assessments made as part of the audit (such as those concerning
materiality or accounting estimates), or any of the responsibility for issuing the report. The
procedures performed by the internal auditor can, however, provide information useful to the
auditor in obtaining an understanding of the internal control system, assessing risk, and performing
substantive tests. Additionally, the internal auditor may provide direct assistance to the CPA with
respect to obtaining an understanding of the entity and its environment, including its internal
control, performing tests of controls, and/or performing substantive tests.
A. EXTERNAL AUDITOR RESPONSIBILITIES
1. Obtain an Understanding of the Internal Audit Function
Since internal auditors often review and assess an entity's controls, the internal audit
function is considered to be part of the monitoring component of internal control
(covered later). The external auditor should therefore obtain an understanding of the
internal audit function (scope of activities, procedures used, access to records) and
determine whether any internal audit activities are relevant to the audit.
2. Assess Competence and Objectivity
If the auditor decides to make use of the internal auditor's work, competence and
objectivity must be assessed. Competence is reflected by education, professional
certification, experience, performance evaluations, the audit plan, audit procedures,
and the quality of audit documentation. Objectivity is reflected by the organizational
level to which the internal auditor reports, as well as by policies prohibiting audits of
areas where the internal auditor lacks independence.
3. Supervise and Review
The external auditor should supervise and review all work performed on the audit.
Evaluating the work of the internal auditor should include testing some of the internal
auditor's work, either by reperforming some of their tests or by examining similar items.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-23
4. Bear Responsibility
The external auditor remains solely responsible for the report on the financial
statements. While the internal auditor may assist with regard to routine ministerial
tasks, he or she may not be utilized to make judgment calls, which remain the
responsibility of the independent auditor. For example, the internal auditor could check
the mathematics of an accounts receivable schedule, but could not determine the
adequacy of the allowance for doubtful accounts.
B. EFFECT OF THE INTERNAL AUDITOR'S WORK
The work of an internal auditor may aid the external auditor in obtaining an understanding of
internal control, assessing risk, and performing substantive procedures. In judging the extent
of the effect of the internal auditor's work, the CPA should consider the materiality of financial
statement amounts, the risk of material misstatement, and the degree of subjectivity involved
in evaluating evidence.
1. For assertions related to material financial statement amounts with a high risk of
material misstatement or a high degree of subjectivity, the internal auditor's work alone
cannot eliminate direct testing by the CPA (e.g., assertions about the valuation of
assets/liabilities involving significant accounting estimates, or assertions about the
existence/disclosure of related-party transactions, contingencies, uncertainties, and
subsequent events).
2. For assertions related to less material financial statement amounts with a low risk of
material misstatement or a low degree of subjectivity, direct testing by the CPA may not
be necessary (e.g., assertions about the existence of cash, prepaid assets, or fixed
asset additions).
C. DIRECT ASSISTANCE PROVIDED BY THE INTERNAL AUDITOR
An external auditor may request that the internal auditor perform a specific task to aid in the
conduct of the audit. The external auditor should supervise, review, evaluate, and test the
work performed, and there should be communication between the auditors regarding
responsibilities, objectives, and accounting/auditing issues.
Auditing & Attestation 3 Becker CPA Review
A3-
24 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
S
PECIALIST
XII. USING THE WORK OF A SPECIALIST
An independent auditor may use the work of a specialist as an audit procedure to obtain
competent audit evidence in those circumstances that are material to the fair presentation of
financial statements.
A. WHO IS A SPECIALIST?
A specialist is a person or firm with special skills in a field other than accounting or auditing
(e.g., actuaries, appraisers, attorneys, engineers, etc.).
B. USE OF A SPECIALIST
A specialist may be engaged whenever the auditor believes it is desirable or necessary. For
example:
1. Valuation of restricted securities and works of art.
2. Determination of physical characteristics (e.g., related to mineral reserves or large
quantities of fungible goods).
3. Determination of specialized estimates, such as actuarial calculations used to
determine employee benefit obligations.
4. Interpretation of technical standards or legal documents.
The specialist should have an understanding of the auditor's use of the specialist's findings.
The specialist does not have to use the same methods as the client in calculating amounts.
The auditor must understand the nature of the specialist's work and be able to evaluate the
findings for their suitability in corroborating financial statement amounts.
C. COMPETENCE AND OBJECTIVITY
The auditor must be satisfied as to the professional competence and reputation of the
specialist. Generally, a specialist who is unrelated to the client will provide the auditor with
greater assurance of reliability. A specialist who is related to the client may be acceptable in
some circumstances, but the auditor may choose to perform additional procedures in those
cases to verify objectivity.
D. EFFECT ON THE AUDITOR'S REPORT
If the specialist's findings indicate that the financial statements are not in conformity with
GAAP, a qualified or adverse opinion would be issued. An unresolved difference between
the specialist's findings and the financial statements, or an unresolved disagreement between
the auditor and the specialist, would lead to a qualified opinion or disclaimer of opinion due to
a scope limitation.
If, as a result of the work performed by the specialist, the auditor decides to add explanatory
language or depart from an unqualified opinion, the auditor may refer to the specialist in the
report. However, if the auditor is expressing a standard unqualified opinion, no reference
should be made to the work of the specialist.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-25
FRAUD AND ILLEGAL ACTS
I. CONSIDERATION OF FRAUD DURING AN AUDIT
A. WHAT IS FRAUD?
1. Fraud vs. Error
Errors are unintentional misstatements or omissions of amounts or disclosures in the
financial statements. They include mistakes in gathering or processing accounting
data, inaccurate accounting estimates, and misunderstanding or accidental
misapplication of accounting principles.
Fraud is distinguished from error by intent of the parties involved: fraud is an intentional
action that results in misstatement of the financial statements, whereas error is an
unintentional action.
2. Types of Fraud
Misstatements may arise from either fraudulent financial reporting or misappropriation
of assets.
a. Fraudulent Financial Reporting
Fraudulent financial reporting involves intentional misstatements or omissions of
amounts or disclosures in the financial statements, designed to deceive financial
statement users. These are usually acts of management and may involve:
(1) Manipulation, falsification, or alteration of accounting records or supporting
documents from which financial statements are prepared;
(2) Misrepresentation in, or intentional omission from, the financial statements
of events, transactions, or other significant information; or
(3) Intentional misapplication of accounting principles relating to amounts,
classification, manner of presentation, or disclosures.
b. Misappropriation of Assets
Misappropriation of assets, or defalcation, involves theft of an entity's assets
when the effect of the theft causes the financial statements not to be presented
in conformity with GAAP. These acts usually involve one or more individuals
among management, employees, or third parties, and may involve stealing
assets or causing an entity to pay for something that has not been received.
3. Characteristics of Fraud
a. Fraud Risk Factors
Three conditions generally are present when fraud occurs. These conditions are
referred to as "fraud risk factors," and the auditor considers such factors in
identifying risks.
(1) Incentives/Pressures: a reason to commit fraud
(2) Opportunity: a lack of effective controls
(3) Rationalization/Attitude: an attempt to justify fraudulent behavior
The
Appendix includes detailed examples of the fraud risk factors.
F
RAUD
F
RAUD RISK
F
ACTORS
Auditing & Attestation 3 Becker CPA Review
A3-
26 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
b. Management Involvement in Fraud
Fraud often involves management since management is in a position to directly
or indirectly manipulate accounting records. Management can also override
established controls.
4. Reasonable Assurance
Due to the concealment aspects of fraud and the need to apply judgment in evaluating
fraud risk, even a properly planned and executed audit may fail to detect fraud. In
expressing an audit opinion, the auditor provides only reasonable (not absolute)
assurance that the financial statements are free of material misstatements resulting
from errors or fraud.
a. Fraud is often difficult to detect because those engaged in fraud will generally try
to conceal it. Collusion among various parties can also make it difficult to detect
fraud.
b. The concept of reasonable assurance recognizes the existence of audit risk but
implies that, based on a properly planned and executed audit, sufficient
appropriate audit evidence has been obtained to limit audit risk to a low level.
c. When an error or fraud has a direct effect on the financial statements, the auditor
stands a better chance of detecting it. The more indirect the effect of the error or
fraud is on the financial statements, the less chance the auditor has of detecting
it.
B. RESPONSIBILITY
1. Management's Responsibility
It is management's responsibility to design and implement programs and controls to
prevent, deter, and detect fraud.
2. Auditor's Responsibility
The auditor has a responsibility to plan and perform the audit to obtain reasonable
assurance about whether the financial statements are free of material misstatement,
whether caused by error or fraud. As part of audit planning, the auditor must
specifically assess the risk of material misstatement of the financial statements due to
fraud, and should consider this assessment in designing the audit procedures to be
performed. This risk assessment is an ongoing process, and should be considered in
every phase of the audit.
C. AUDIT REQUIREMENTS
1. Professional Skepticism
The auditor should maintain an attitude of professional skepticism, which includes a
questioning mind and a critical assessment of audit evidence.
a. The auditor should consider that fraud can occur regardless of any past
experience with the entity or any belief about management's honesty and
integrity.
b. The auditor should not rationalize or dismiss information that may be
indicative of fraud.
2. Audit Procedures
The auditor should perform the following procedures, which will also be covered in
greater detail below.
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-27
a. Discuss fraud risk with engagement personnel.
b. Obtain information to identify specific fraud risks.
c. Assess fraud risk and develop an appropriate response.
d. Evaluate audit evidence regarding fraud.
e. Make appropriate communications about fraud.
f. Document the auditor's consideration of fraud.
D. DISCUSSION AMONG ENGAGEMENT PERSONNEL
A discussion of the potential for material misstatement due to fraud is required as part of
planning.
1. Discussion Topics
The discussion should include:
a. "Brainstorming" (an exchange of ideas).
b. An emphasis on the importance of professional skepticism.
c. Consideration of factors that create incentives or pressures to commit fraud, that
provide an opportunity for fraud to be perpetrated, or that indicate a culture or
environment that enables management to rationalize committing fraud.
d. Consideration of the risk of management override of controls.
e. How the auditor might respond to identified fraud risks.
2. Other Requirements
The discussions should involve all key members of the audit team, may include
specialists, and may occur in multiple locations. Communication should continue
throughout the audit.
E. OBTAINING INFORMATION
The auditor should perform the following procedures to obtain information useful in identifying
potential fraud risks.
1. Inquire of Entity Personnel Regarding Their Views of Fraud Risk
a. The auditor should direct inquiries to management, employees involved in
financial reporting, operating personnel, internal auditors, in-house legal counsel,
those charged with governance, etc.
b. Inquiries should be made regarding:
(1) The overall risk of fraud.
(2) Identified or suspected instances of fraud.
(3) Relevant programs and controls.
(4) The extent of oversight of distant locations.
(5) Communication of management's code of ethics.
(6) Whether management has reported to those charged with governance
regarding internal control and how it functions to prevent, deter, or detect
material misstatement due to fraud.
(7) What type of oversight the audit committee provides.
c. Inconsistent responses indicate a need for additional evidence.
Auditing & Attestation 3 Becker CPA Review
A3-
28 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
2. Consider the Results of Analytical Procedures
The auditor is required to perform analytical procedures in planning the audit, and
should consider the implications of any unusual or unexpected relationships identified.
a. During planning, the auditor is specifically required to perform analytical
procedures relating to revenue, in order to identify unusual relationships that
might be indicative of fraud.
b. Analytical procedures performed during planning often use data aggregated at a
high level, and therefore such procedures may provide only a broad indication
regarding fraud risk.
3. Evaluate Fraud Risk Factors
As discussed previously, three conditions (incentives/pressures, opportunity, and
rationalization/attitude) generally are present when fraud occurs. The auditor should
use professional judgment to determine whether and to what extent such conditions
are present.
a. Existence of Risk Factors
While the risk of material misstatement due to fraud is greatest when all three
risk factors are present, the existence of all three fraud risk factors is not an
absolute indication that fraud has occurred.
b. Absence of Risk Factors
Lack of observation of any or all of the three fraud risk factors does not imply that
there is no fraud risk. One condition may be significant enough on its own to
cause a risk of material misstatement due to fraud.
4. Consider Other Relevant Information
The auditor should consider other information that might be helpful in identifying fraud
risk. Such additional information might be identified during:
a. Discussions among engagement personnel.
b. Performance of procedures relating to the acceptance/continuance of clients and
engagements.
c. Reviews of interim financial statements.
d. The evaluation of inherent risk.
F. IDENTIFYING RISKS
The auditor should use the information gathered to identify risks that may result in a material
misstatement (at either the financial statement or relevant assertion level) due to fraud.
1. Attributes of Risk
In analyzing risk, the following four attributes should be considered.
a. Type of risk: Does it involve fraudulent financial reporting or misappropriation of
assets?
b. Significance of the risk: Can it lead to a
c. Likelihood of the risk: How likely is this to happen?
d. Pervasiveness of the risk: Does it affect the financial statements as a whole or
only specific accounts, transactions, or assertions?
material misstatement?
Becker CPA Review Auditing & Attestation 3
© 2009 DeVry/Becker Educational Development Corp. All rights reserved.
A3-29
2. Presumption of Risk
There is a presumption in every audit that the following two risks exist:
a. Improper revenue recognition
b. Management override of controls
These risks should be addressed by the auditor in evaluating the overall fraud risk.
3. Additional Considerations
The auditor should also consider the following factors.
a. Whether and to what extent the three fraud risk factors are present.
b. The size, complexity, and ownership characteristics of the entity.
(1) Large entities may have an audit committee, an internal audit function, or a
formal code of conduct, all of which may serve to deter fraud.
(2) A smaller entity may lack such features; however, it may exhibit a strong
corporate culture that discourages fraud.
c. The susceptibility of items to manipulation. Items are more susceptible to
manipulation when they involve:
(1) A high degree of management judgment and subjectivity, or
(2) Highly complex accounting principles.
G. ASSESSING RISKS
The auditor evaluates the identified risks after considering the effect of the entity's programs
and controls.
1. The auditor is required to obtain an understanding of the entity and its environment,
including its internal control, as part of planning the audit.
2. Specific controls may mitigate specific risks; broader controls (such as those promoting
a culture of honesty) may mitigate overall risk.
3. An identified control deficiency may exacerbate the risks.
H. RESPONDING TO ASSESSED RISK
1. Required Response
The auditor is required to respond to the results of the risk assessment on three levels.
a. Overall, General Response
The auditor should consider the overall fraud risk when:
(1) Assigning personnel to the engagement.
(2) Determining the appropriate level of supervision of engagement personnel.
(3) Evaluating management's selection and application of accounting
principles.
(4) Incorporating an appropriate level of unpredictability in the selection of
auditing procedures from one year to the next.
(a) The auditor should incorporate an element of unpredictability into
every audit.
Auditing & Attestation 3 Becker CPA Review
A3-
30 © 2009 DeVry/Becker Educational Development Corp. All rights reserved.
b. Response Encompassing Specific Audit Procedures
The auditor should respond to specifically identified risks by altering the nature,
extent, or timing of audit procedures. While the auditor's response may include
both substantive tests and tests of controls, tests of controls alone generally are
insufficient due to the risk of management override.
(1) Nature
The auditor may change the nature of specific procedures by seeking
evidence that is more reliable, or by obtaining additional corroborative
evidence.
(2) Extent
The auditor may vary the extent of testing by increasing sample size,
performing testing at a more detailed level, or performing more extensive
tests.
(3) Timing
The auditor uses judgment to determine the appropriate timing for audit
procedures. While performing substantive testing at or near the end of the
reporting period generally reduces risk, at times it makes sense to apply
such procedures to transactions occurring earlier in the period.
| | | | |
