Deck 9: Assessing Control Risk and Designing Test of Controls

Question 1

Describe a five-step approach that is used for identifying significant or material internal control weaknesses.

Answer 1

1.Identify existing controls.Weaknesses are the absence of adequate controls,so the auditor must first know which controls exist.
2.Identify the absence of key controls.Internal control questionnaires,narratives,and flowcharts are useful to identify areas in which key controls are lacking and the likelihood of misstatements is increased.
3.Consider the possibility of compensating (or mitigating)controls.A compensating (or mitigating)control is a control elsewhere in the system that offsets a weakness.
4.Decide whether there is a significant deficiency or material weakness.The likelihood of misstatements and their materiality are used to evaluate if there are significant deficiencies or material weaknesses.
5.Determine potential material misstatements that could result.This step is intended to identify specific errors or fraud and other irregularities that are likely to result from the absence of controls.

Question 2

When a compensating control exists,a weakness in the system

A)is no longer a concern because the potential for misstatement has been sufficiently reduced.
B)is reduced but not removed;therefore,it is still of concern to the auditor.
C)could cause a material loss,so it must be tested using substantive procedures.
D)is magnified and must be removed from the sampling process and examined in its entirety.

Answer 2

A

Question 3

When the auditor attempts to determine the operation of the accounting system by tracing one or a few transactions through the accounting system,this is referred to as

A)tracing.
B)vouching.
C)tests of controls.
D)a walk-through.

Answer 3

D

Question 4

When planning the audit,the auditor's decision on the appropriate assessed level of control risk to use is

A)an economic issue,trading off the costs of testing controls against the cost of testing balances.
B)calculated by using the audit risk model.
C)calculated by using a standard formula.
D)determined by using actuarial tables.

Question 5

Control risk is a measure of the auditor's expectation that internal controls will

A)prevent material misstatements from occurring.
B)detect and correct material misstatements.
C)either prevent material misstatements or detect and correct them.
D)neither prevent material misstatements nor detect and correct them.

Question 6

Jenny is the information technology support manager at CMH.Jenny is considered to be a super-user at CMH since she can circumvent normal controls.In order to address the risk of super-users,management should

A)remove the super-user.
B)establish effective compensating controls.
C)update the background check on the super-user on a yearly basis.
D)ensure that the super-user is familiar with the code of conduct of the company.

Question 7

The internal control objective of accuracy is related to the financial statement assertion of

A)Valuation.
B)Completeness.
C)Presentation.
D)Occurrence.

Question 8

A procedure that would most likely be used by an auditor in performing tests of control procedures that involve segregation of functions and that leave no transaction trail is

A)inspection.
B)observation.
C)reperformance.
D)reconciliation.

Question 9

Identify the difference among control deficiency,significant deficiency,and material weakness.

Question 10

Narratives,flowcharts,and internal control questionnaires are three commonly used methods of

A)documenting the auditor's understanding of internal controls.
B)testing internal controls.
C)designing the audit manual and procedures.
D)documenting the auditor's understanding of the client's organizational structure.

Question 11

Control tests are required for

A)obtaining evidence about the operating effectiveness of company control procedures.
B)analytical review of financial statement balances.
C)accomplishing control over the validity of recorded transactions.
D)obtaining evidence about the financial statement assertions.

Question 12

Paul is in the process of performing procedures to obtain the necessary understanding of the client's internal controls.As part of this process,Paul received from the client completed narratives,flowcharts,and internal control questionnaires.Paul can use this information from the client

A)if the entity-level controls and tone at the top were found to be effective.
B)if there has not been any significant change in the internal controls since the prior year.
C)as long as any subsequent reliance on controls is adequately substantiated with testing.
D)since it was prepared by management,which is unbiased.

Question 13

After considering a client's internal controls,an auditor has concluded that the internal controls are well designed and are functioning as intended.Under these circumstances,the auditor would most likely

A)perform tests of controls to the extent outlined in the audit program.
B)determine the control procedures that should prevent or detect errors and irregularities.
C)use a combined audit approach that includes tests of controls and substantive tests.
D)determine whether transactions are recorded to permit preparation of financial statements in accordance with generally accepted accounting principles.

Question 14

List and explain the methods of documenting the auditor's understanding of internal controls.

Question 15

Each key control that the auditor intends to rely on must be supported by sufficient

A)tests of details of balances.
B)tests of controls.
C)analytical review procedures.
D)reperformance procedures.

Question 16

The procedures to test effectiveness of control policies and procedures in support of a reduced assessed control risk are called

A)tests of details of balances.
B)tests of controls.
C)analytical procedures.
D)a walk-through.

Question 17

Greenvale Construction Limited was started by four brothers who lived in the Toronto area.Over time,the brothers moved to different parts of the country.They decided it was a good idea to keep the company and organize their work as separate divisions under the same company.There are now three divisions,one for each of the brothers who are actively involved in construction.The fourth brother,Ted,is responsible for accounting and record keeping.Ted went back to school and completed an accounting designation,and now has three employees in the accounting area.
Each of the brothers has moved on to specialize in a different kind of construction work.In Toronto,it is mainly new home construction.In Edmonton,the work is primarily renovations of large homes and small commercial enterprises.In Halifax,the work is mid-sized to large commercial projects.All of the brothers prefer to subcontract their work rather than hiring full time construction employees,although some of the subcontract relationships have lasted over fifteen years now.
Required:
Explain what you would do to document your understanding of internal control for Greenvale.Identify potential risk areas where you would need to focus additional attention.

Question 18

You have just finished documenting your understanding of cycle controls at an audit engagement.
Required:A)Explain how you will identify the controls that will be tested.B)What process will you follow for weakness in internal controls?

Question 19

Ideally,tests of controls should be applied to controls

A)at the balance sheet date.
B)at each quarterly interim period.
C)for the entire period under audit.
D)at the beginning of the fiscal period.

Question 20

Once an understanding of internal controls is obtained that is sufficient for audit planning,then the auditor must first assess

A)whether a lower level of control risk could be supported.
B)whether the financial statements are auditable.
C)the level of control risk supported by the understanding obtained.
D)the level of control risk to use.

Question 21

What are the two types of reports service auditors issue?

Question 22

On the basis of audit evidence gathered and evaluated,an auditor decides to increase the assessed level of control risk from that originally planned.To achieve an overall audit risk level that is substantially the same as the planned audit risk level,the auditor would

A)decrease substantive testing.
B)decrease detection testing.
C)increase inherent risk.
D)increase materiality.

Question 23

The existence of advanced automated systems affects the audit process.Which of the following characteristics is an indicator of the presence of an advanced automated information system?

A)use of data communications (such as the Internet)to transfer transaction data
B)use of packaged software to process sales both locally and across Canada
C)use of customer relationship management systems to manage sales information
D)numerically-controlled equipment used in the manufacturing process

Question 24

The auditor may identify some risks that cannot be effectively tested by substantive tests alone,for example,when there are paperless transactions (perhaps using EDI - electronic data interchange).To address these risks,the auditor is required to

A)assess the design effectiveness of relevant controls and test them.
B)obtain an understanding of the controls and test them if reliance is intended.
C)obtain an understanding of the controls and assess their design effectiveness.
D)test the controls that address the paperless aspects of the transactions.

Question 25

A)The first step in the auditor's study and evaluation of internal control is to obtain an understanding of internal control for audit planning purposes.List the remaining steps.B)Which two assessments must be made prior to testing controls? C)Describe five common procedures an auditor can use to obtain an understanding of internal control design.

Question 26

When services are outsourced to a third party service provider that significantly impact financial reporting,what should the auditor do to gain evidence over the operating effectiveness of the internal controls at the third party?

A)Review the Type 2 Service Auditor's report (Report on the suitability of the design and operating effectiveness of controls of a service organization).
B)Review the Type 1 Service Auditor's report (Report on the suitability of the design of controls of a service organization).
C)Obtain a comfort letter from the third party on their internal controls.
D)Review the independent auditor's report for the third party.

Question 27

If an external auditor's client has used a service organization during the year for some of its payroll processing and accounting,which of the following steps should the external auditor take if he or she decides to use the service organization auditor's report as audit evidence that the entity's controls are operating effectively for certain assertions?

A)Consider the sufficiency and appropriateness of the evidence provided by the service organization's auditor's report about the effectiveness of controls intended to prevent or detect material misstatements in the particular assertions.
B)Double-date the audit report to show the date of the service organization's audit and the date of the client's audit.
C)The auditor should make reference to the report of the service auditor as a basis,in part,for his or her own opinion on the entity's financial statements.
D)Re-perform each of the audit tests used by the service organization auditor.

Question 28

The existence of advanced automated systems affects the audit process.Which of the following characteristics is an indicator of the presence of an advanced automated information system?

A)custom-designed operational or strategic information systems
B)use of packaged software to process sales both locally and across Canada
C)use of customer relationship management systems to manage sales information
D)numerically controlled equipment used in the manufacturing process

Question 29

Which of the following statements is true relating to internal control testing?

A)testing of controls is the most cost-efficient way of designing each audit
B)there is a point where further testing of controls becomes more expensive than performing substantive tests
C)substantive testing is the most cost-efficient way of designing each audit
D)as the work of testing of controls increases,the cost of substantive work increases

Question 30

The Sarbanes Oxley Act has had consequences for many areas of corporate activities,including the following impact on the work of the auditor:

A)The auditor is now required to report all fraudulent activities he/she uncovers directly to the Securities and Exchange Commission.
B)The auditor must prepare a report verifying the information in the financial statements.
C)The auditor must monitor how well management is carrying out its financial reporting responsibilities.
D)The auditor is specifically required to evaluate the internal controls used by management to prepare financial information.

Question 31

A secondary objective of the auditor's study and evaluation of internal control is that the study and evaluation provide

A)a basis for constructive suggestions concerning improvements in internal control.
B)a basis for reliance on the accounting system.
C)an assurance that the records and documents have been maintained in accordance with existing company policies and procedures.
D)an indication that management and employees are trustworthy.

Question 32

When the auditor identifies opportunities for the client to make operational improvements in the internal control system,it will be communicated to the client's audit committee in the

A)management letter.
B)reportable conditions letter.
C)engagement letter.
D)audit report.

Question 33

One approach to audit through the computer to test controls is to

A)reprocess live data with generalized audit software.
B)trace outputs to source documents to ensure documents have been processed correctly.
C)use simulated data in an audit program to determine if similar controls are being used.
D)reprocess live data and have the auditor compare the output with the previous output.

Question 34

Use of electronic funds transfers (such as electronic data interchange and online banking)has which of the following effects on the audit risk model?

A)decreases control risks associated with cash
B)increases control risks associated with cash
C)decreases test of control associated with computer programs
D)increases test of control associated with computer programs

Question 35

Describe the three types of tests that need to be performed by the auditor when auditing a client's data conversion process.

Question 36

The existence of advanced automated systems affects the audit process.Which of the following characteristics is an indicator of the presence of an advanced automated information system?

A)electronic data interchange systems for purchase orders,sales invoices,and payments
B)use of packaged software to process sales both locally and across Canada
C)use of customer relationship management systems to manage sales information
D)numerically controlled equipment used in the manufacturing process

Question 37

The Sarbanes-Oxley Act requires management to certify that it has informed the auditor and audit committee of any

A)related party transactions.
B)significant deficiencies in business practices.
C)significant deficiencies in internal controls.
D)specific business or industry risk.