Question 1

Which of the following conditions is necessary for a practitioner to accept an attest engagement to examine and report on a nonissuer's internal control over financial reporting?

Accepted Answer

Choice "B" is correct. In order for a practitioner to examine and report on management's assertion about the effectiveness of an entity's internal control, management must present its written assertion about the effectiveness of internal control. Choice "A" is incorrect. The examination may be made separately from or in conjunction with an audit, and there is no requirement that the practitioner rely on internal control. Choice "C" is incorrect. No requirement for previous engagement experience exists in order to report on a client's internal control. Choice "D" is incorrect. The practitioner's report is considered appropriate for general distribution.

Question 2

How do the scope, procedures, and purpose of an engagement to express a separate opinion on a nonissuer's internal control compare to those for obtaining an understanding of internal control and assessing control risk as part of an audit?

Accepted Answer

Choice "d" is correct. In an engagement to express a separate opinion on an entity's internal control, the scope is extensive, and the purpose is directed primarily toward the internal control report. In an audit, the scope is less extensive, and the purpose is to determine the nature, timing, and extent of auditing procedures. Similar procedures generally would be used in both types of engagements. Choices "a", "b", and "c" are incorrect, based on the above Explanation.

Question 3

Rachel, CPA, is conducting an audit of Eaton Enterprises, a nonissuer. Rachel has conducted her audit in accordance with generally accepted auditing standards, and she wishes to emphasize in her report that such standards do not require the same level of testing and reporting on internal control as is required for audits of issuers under the Sarbanes-Oxley Act. Which report modification would be most appropriate in this situation?

Accepted Answer

Choice "A" is correct. The auditor may expand the scope paragraph to state that internal control was considered as a basis for designing appropriate audit procedures, but not for the purpose of expressing an opinion on the effectiveness of internal control. This serves to emphasize that the extended level of testing and reporting on internal control required by the Sarbanes-Oxley Act did not apply in this case. Choice "B" is incorrect. The auditor should modify the scope paragraph, not add an additional explanatory paragraph. Choice "C" is incorrect. An "except for" qualified opinion would not be appropriate in this case. Choice "D" is incorrect. Although a report modification is not required, the question states that Rachel wishes to emphasize the scope of her work on internal control. In such situations, the scope paragraph should be modified.

Question 4

Which of the following best describes the responsibility of the auditor with respect to significant deficiencies and material weaknesses in an audit of an issuer?

Accepted Answer

Choice "B" is correct. In an audit of an issuer, the auditor is required to communicate both significant deficiencies and material weaknesses to management and the audit committee, but only material weaknesses result in an adverse opinion on the effectiveness of internal control. Choice "A" is incorrect. In an audit of an issuer, significant deficiencies (that do not rise to the level of being material weaknesses) do not result in an adverse opinion on the effectiveness of internal control. Choice "C" is incorrect. In an audit of an issuer, both significant deficiencies and material weaknesses must be communicated, in writing, to management and the audit committee. In addition, significant deficiencies (that do not rise to the level of being material weaknesses) do not result in an adverse opinion on the effectiveness of internal control. Choice "D" is incorrect. In an audit of an issuer, the auditor is required to communicate both significant deficiencies and material weaknesses to management and the audit committee.

Question 5

When management's assertion about the effectiveness of a nonissuer's internal control is presented in a representation letter that will not accompany the CPA's report:

Accepted Answer

Choice "B" is correct. When management's assertion does not accompany the CPA's report, the first paragraph of the report should contain a statement of management's assertion. Choice "A" is incorrect. There is no requirement to limit the use of the report, but the report must include a statement of management's assertion. Choice "C" is incorrect. The CPA may accept such an engagement but is required to include management's assertion in the report. Choice "D" is incorrect. Negative assurance is prohibited with respect to a report on the effectiveness of an entity's internal control.

Question 6

Management of Eva Industries, an issuer as defined under the Sarbanes-Oxley Act, believes it has eliminated a material weakness previously noted in its assessment of internal control, and has hired Henna and Company, CPAs, to attest to the improvements in internal control. Which of the following is true of this engagement?

Accepted Answer

Choice "C" is correct. Eva's management must provide a written report to accompany Henna and Company's report. Choices "A" and "D" are incorrect. An engagement to report on whether a previously reported internal control weakness continues to exist is a voluntary engagement, not required by professional standards. Choice "B" is incorrect. An engagement to report on whether a previously reported internal control weakness continues to exist is a voluntary engagement, not required by professional standards. In addition, as an issuer, Eva must have an audit in accordance with PCAOB standards.

Question 7

Which of the following best describes the responsibility of the auditor to report significant deficiencies and material weaknesses in an attest engagement to examine the effectiveness of a nonissuer's internal control?

Accepted Answer

Choice "A" is correct. In an attest engagement to examine the effectiveness of an entity's internal control, the auditor must communicate both significant deficiencies and material weaknesses to management and those charged with governance. Choice "B" is incorrect. The auditor is required to communicate significant deficiencies. Choices "C" and "D" are incorrect. Both significant deficiencies and material weaknesses are required to be communicated to management and those charged with governance.

Question 8

An audit performed in accordance with OMB Circular A-133 will expand the auditor's responsibilities beyond generally accepted auditing standards. The auditor's expanded responsibilities include:

Accepted Answer

Choice "C" is correct. OMB Circular A-133 expands the auditor's responsibilities to include procedures designed to test and report on compliance matters having a direct and material effect on major federal award programs. Choice "A" is incorrect. OMB Circular A-133 expands procedures to major programs as defined by the Circular, not to all programs. Choice "B" is incorrect. OMB Circular A-133 audit objectives relate to management's assertions regarding compliance with laws, rules, and regulations, not to noncompliance issues identified by the Office of the Inspector General. Choice "D" is incorrect. OMB Circular A-133 relates to the financial and compliance audits of major federal financial assistance programs, not to the achievement of program objectives.

Question 9

Which of the following statements describes an auditor's obligation to identify deficiencies in the design or operation of internal control?

Accepted Answer

Choice "D" is correct. The auditor need not search for significant deficiencies in internal control, but should document and communicate any such deficiencies that are discovered. Choice "A" is incorrect. Tests of controls are designed and applied to evaluate the risk of financial statement misstatement, and to determine the nature, timing, and extent of substantive tests to be performed. They are not designed to discover significant deficiencies in internal control. Choice "B" is incorrect. Searching for significant deficiencies in internal control is not part of an audit, and it would be inappropriate for the auditor to state that no significant deficiencies in internal control were noted (even if management requested such a statement). Choice "C" is incorrect. Searching for significant deficiencies in internal control is not part of an audit even if the auditor expects that controls are operating effectively (i.e., expects to rely on controls).

Question 10

Which of the following best describes an auditor's responsibility with respect to communicating internal control deficiencies of issuers?

Accepted Answer

Choice "B" is correct. The auditor is required to communicate all deficiencies in internal control to management, and deficiencies that constitute a significant deficiency or a material weakness to management and the audit committee. Choice "A" is incorrect. There is no requirement that material weaknesses be communicated to the full board of directors. Choice "C" is incorrect. The auditor is required to communicate all deficiencies in internal control to management. Choice "D" is incorrect. The auditor is also required to communicate significant deficiencies to management and the audit committee.

Question 11

Which of the following best describes the responsibility of the auditor to report significant deficiencies and material weaknesses in an audit of a nonissuer?

Accepted Answer

Choice "A" is correct. In an audit of a nonissuer, the auditor is required to communicate both significant deficiencies and material weaknesses to management and those charged with governance. Choice "B" is incorrect. The auditor is required to communicate significant deficiencies. Choice "C" is incorrect. The auditor's report includes the definition of significant deficiencies and a list of such deficiencies noted, followed by the definition of material weaknesses and a list of such weaknesses noted. Choice "D" is incorrect. Both significant deficiencies and material weaknesses are required to be communicated to management and those charged with governance.

Question 12

When auditing an entity's financial statements in accordance with Government Auditing Standards (the Yellow Book), an auditor is required to report on:

Accepted Answer

Choice "B" is correct. When auditing an entity's financial statements in accordance with Government Auditing Standards, an auditor is required to report on the scope of the auditor's testing of compliance with laws and regulations, but not on recommendations for actions to improve operations. Choices "A", "C", and "D" are incorrect based on the above Explanation.

Question 13

For a nonissuer, a control deficiency would be considered a material weakness when the likelihood and magnitude of potential financial statement misstatements are:

Accepted Answer

Choice "A" is correct. A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the entity's financial statements will not be prevented or detected. Choices "B", "C", and "D" are incorrect, based on the above.

Question 14

Snow, CPA, was engaged by Master Co., a nonissuer, to examine and report on management's written assertion about the effectiveness of Master's internal control over financial reporting. Snow's report should state that:

Accepted Answer

Choice "A" is correct. The practitioner's report should include a paragraph stating that because of the inherent limitations of any internal control, errors and fraud may occur and not be detected. Choice "B" is incorrect. The examination is performed in accordance with standards established by the AICPA, but management's assertion may be based on criteria established by some other recognized body. Choice "C" is incorrect. An examination (an attestation engagement) of management's assertion on the effectiveness of an entity's internal control over financial reporting does not provide a sufficient basis for an opinion on the fairness of the financial statements. Choice "D" is incorrect. An examination of management's assertion on the effectiveness of an entity's internal control over financial reporting is performed solely to report on that assertion, and not to plan an audit.

Question 15

When communicating internal control related matters noted in an audit of a nonissuer, an auditor's report issued on significant deficiencies should indicate that:

Accepted Answer

Choice "D" is correct. Any report issued on significant deficiencies should indicate that the purpose of the audit was to report on the financial statements and not to provide assurance on internal control. Choice "A" is incorrect. A statement that errors or irregularities may occur and not be detected due to inherent limitations in internal control is included in the report when an auditor is engaged to express an opinion on internal control, not when the auditor is reporting as part of an audit. Choice "B" is incorrect. The issuance of an unqualified opinion on the financial statements is never dependent on corrective follow-up action. Choice "C" is incorrect. A control deficiency (and not necessarily a material weakness) exists when deficiencies are not detected within a timely period by employees in the normal course of performing their assigned functions.

Question 16

For a nonissuer, a control deficiency would be considered a significant deficiency when the likelihood and magnitude of potential financial statement misstatements are:

Accepted Answer

Choice "C" is correct. A significant deficiency is a control deficiency, or combination of control deficiencies, that adversely affects the entity's ability to initiate, authorize, record, process, or report financial data reliably in accordance with GAAP such that there is more than a remote likelihood that a misstatement of the entity's financial statements that is more than inconsequential will not be prevented or detected. Choices "A", "B", and "D" are incorrect, based on the above.

Question 17

Which of the following best describes a CPA's engagement to report on a nonissuer's internal control over financial reporting?

Accepted Answer

Choice "A" is correct. An engagement to report on an entity's internal control is best described as an attestation engagement to examine and report on management's written assertions about the effectiveness of its internal control. Choice "B" is incorrect. An audit involves expressing (or disclaiming) an opinion on historical financial statements. An engagement to report on internal control is an attestation engagement and not an audit. Thus, the engagement is covered under the attestation standards rather than GAAS. Choice "C" is incorrect. A prospective engagement is not appropriate for a report on internal control. In fact, the CPA's report includes an "inherent limitations" paragraph stating that projections of the internal control evaluation to the future are risky, since conditions or the degree of compliance may change. Choice "D" is incorrect. In a consulting engagement, the practitioner develops findings, conclusions, and recommendations, but does not report on an assertion that is the responsibility of another party. When a CPA reports on an entity's internal control, he or she is in effect reporting on management's assertion.

Question 18

In which case might an auditor of an issuer render a qualified opinion on internal control?

Accepted Answer

Choice "D" is correct. A scope limitation requires the auditor to disclaim an opinion or withdraw from the engagement, and a material weakness in internal control requires the auditor to issue an adverse opinion. Neither situation would result in a qualified opinion. Choice "A" is incorrect. A scope limitation requires the auditor to disclaim an opinion or withdraw from the engagement. Choice "B" is incorrect. A material weakness in internal control requires the auditor to issue an adverse opinion. Choice "C" is incorrect. A scope limitation requires the auditor to disclaim an opinion or withdraw from the engagement, and a material weakness in internal control requires the auditor to issue an adverse opinion. Neither situation would result in a qualified opinion.

Question 19

When companies use information technology (IT) extensively, evidence may be available only in electronic form. What is an auditor's best course of action in such situations?

Accepted Answer

Choice "C" is correct. When companies use information technology (IT) extensively and evidence is available only in electronic form, generalized audit software packages generate the programs necessary to interrogate the files and extract and analyze the data. Choice "A" is incorrect. The use of information technology does not automatically imply that control risk is high. The auditor would need to evaluate the client's controls to make this determination. Choice "B" is incorrect. Although audit software might be used to perform analytical procedures, the data would first need to be extracted from the client's system. A generalized audit software package is the best way to do this. Choice "D" is incorrect. If information technology is used extensively, the auditor would likely perform more than limited tests of controls over electronic data.

Question 20