OVER AND UNDER AUDITING
2014
• Boston AGA Chapter
• January 23, 2014
• Art Hayes
• www.hayesways.com
• bubbabubba1111@gmail.com
1
2
Why would you change what
you are already doing?
• Doesn’t it seem that you are pretty
successful?
• Isn’t there risk in changing? Maybe it
won’t work out as well as what you are
doing now?
• And what if you are not so sure you are
doing the right thing—then won’t there be
even greater reluctance to try something
new and maybe screw up even more and
even be detected?
3
So, before we start we need to
see if we can answer two basic
questions
• 1. ________________________
• 2. ________________________
4
• A word about the perspective…
• The way we do our audits is inextricably
tied into questions of ethics.
• Re Ethics—can we just “hide” behind more
work we have to do?
• The ultimate test=how well did you utilize
your resources and how good was the
quality of the work product you gave to
your client.
5
The basics
• What do we have to do?
• How do we know what we have to do?
• What else is there that we do?
– The “extras”?
• is there any room for slack?
– Do we have any time for side trips?
– What is a side trip?
– Is it a part of the mission?
– Did we waste that time? Do it for nothing?
6
Our basic activities
• Risk assessment procedures (performed in
every engagement) include:
– Inquiries of management and others within the entity
– Analytical procedures
– Observation and inspection
7
• Top ten (or so?) over and under auditing
dilemmas
• And tools to address them
• Finding the right balance between drive by
audits and the never ending story
– Hint: this does not mean less work
8
The double edged sword
• Professional judgment
– Is it truly subjective?
• Is there an objective measure/test to what
we do?
– Peer review?
– Media?
– Snitches?
9
What is our real
mission/purpose/vision?
• To critique and report?
– Our independent role
• To improve their operations?
– To strive for the betterment of the overall
concerns of taxpayers?
• To improve their ability to safeguard their
assets and information?
10
• What is the greatest under-auditing trap?
• What is the greatest over-auditing trap?
• How do you determine the answers for
your entity?
11
12
• True or False
•
1. Relatively inexperienced auditors will more likely
than not result in under auditing, at least as regards detecting fraud.
•
2. Relatively seasoned auditors will more likely than
not result in over auditing, since they will tend to do the same work
they are accustomed to do, on automatic pilot.
•
3. A way to control under auditing is to utilize auditee
personnel to do some of the audit work.
•
4. Independence issues are irrelevant to the issue of
over and under auditing.
•
5. There are many factors in an audit engagement that
affect over and under auditing that are beyond the control of the
auditors
13
• TOP TEN OR SO DILEMMAS
–
–
–
–
–
–
–
–
–
–
Not enough staff.
Not enough time.
So much to look at.
So many standards.
The Easter egg hunt phenomenon.
We are not clairvoyant.
They could gang up on us.
They seem so nice.
The learning curve and predictability.
We don’t want to look stupid!!
14
TOP TEN OR SO POSSIBLE
SOLUTIONS
• 1. KNOW YOUR ENTITY. Take the time
to talk to people. Learn as much as you
can about the industry, the operations and
the challenges. The more you know, the
better you can design your steps, the more
guesswork you can avoid, and the better
you can aim your efforts at where the risks
are.
15
• 2. AUDIT TO RISK. After learning about
your entity, critically revisit your audit
program, particularly if you have a canned
audit program. We must concentrate our
limited hours in the areas of most
importance. And let the other areas go.....
16
• 3. For CAFRS, understand opinion
units. Use the right materiality levels for
the right funds. Use work from one
opinion whenever you can to support the
work of a government-wide opinion
unit. Don't duplicate effort just because
they are different opinion units.
17
• 4. Use CAATS when you can rather than
detailed testwork. For some types of
analysis, CAATS can be much more
effective than detailed testwork.
18
• 5. Don't shy away from using analytical
procedures as your sole support if there
are not significant risks and if there are
solid relationships in the analyticals and
the expectations can be explained and
relied on.
19
• 6. Don't allow scope creep. We deal with
legislative bodies and other oversight that
would like us to look at everything. We
have to be able to identify the additional
effort required for each additional request
and do our best to gently persuade the
interested parties that it will have to wait or
be part of a separate effort.
20
• 7. When scope creep does occur, we must
remember to remove the procedures the next
year. Too often, we let something into the
audit program and we never get it out. By the
time someone wonders why a certain step
that doesn't support the opinion is in the audit
program, it has already been completed. Or
we look at the step and think it's a pretty
good step and a worthwhile procedure, but
forget that it is not necessary for the opinion.
21
• 8. Cut the extra compliance steps that
have no chance of being material
noncompliance. Too many rules are
tested that are good to know, but don't
support the opinion. If we find a few
payments that weren't made within the
prompt payment act parameters, will it
really affect our opinion or our report?
22
• 9. Limit your attributes to only the
substantive questions that support the
opinion and only the key internal controls
(if relying on internal control.) Don't make
a big laundry list to review for every single
transaction.
23
• 10. Be cautious with your
sampling. Reconcile, reconcile,
reconcile. People sometimes ask for
listings of the main types of receivables
and test away without considering what
percent of the total receivable total they
have. You could be missing a larger than
comfortable percent of the total.
24
• 11. Understanding the overall balance is
also important from the overauditing
standpoint.
• Always make sure you know how much
you need to be testing overall and
understand what population you are
talking about before you develop your
steps and sampling plan.
25
• 12.commemorate/communicate/coordinate
/consolidate
• From this day forward, keep track of over
and under-under auditing tendencies and
communicate this to staff
• Make it a part of audit huddles
• Develop a central data base
26
•
The top nine things that prevent auditors
from finding problems/fraud, per a staff
survey
– lack of time
– lack of documentation at the auditee
– not knowing what the real procedures are at the
agency
– lack of knowledge about such problems/fraud
– lack of knowledge and understanding of information
technology issues
– so many auditing procedures to do
– isolation of the auditors on site
– fear of crying wolf
– fear of making the auditee mad
27
Possible solutions to these
obstacles*.
• Look at the current “required” audit steps and determine if they
are really “required” and eliminate (or do every other year) if
possible.
• Having more auditors with medical expertise and mental health
training
• Rotate auditors as well ask keep some on the audit with
knowledge of ways to “beat the system”
• * from my staff survey
28
Things that assist me in finding
problems
• CAATS
• OK, I’ll admit it. I like to find the big issues (I
don’t find them very often, and they are not
necessarily fraud)—but I get a real charge out of
finding stuff! I think the thing I rely on most is a
skepticism where I pretty much assume that
anything unusual I see is a problem until I can
assure myself that it is not.
29
• True, this goes against the “American
Way,” in which we assume innocence until
we prove guilt. However, if it walks like a
duck, quacks like a duck, and swims like a
duck, I’m going to assume it’s a duck until
someone can be pretty convincing that its
not a duck!
30
• Conversations with staff around the office. I believe that
interdisciplinary thought groups would allow the
exchange of ideas, experiences, and problems and bring
to light potential issues. E-mail is a wonderful and
efficient tool for communicating knowledge, but it does
not replace conversation as a “trigger” for recollections
and experiences that may have fallen out of mind. There
have been several occasions in my life where a
comment or event did not seem significant at the time,
but later became a critical issue with the development of
more information
31
• Provide more training that directly relates to types of
problems/fraud we might encounter on an audit with
focus on the mechanics of schemes and how those
schemes can be detected
• When the existing audit programs are revamped for new
procedures under new standards, make sure that
managers and in-charges understand that more time
may be needed to complete the audit, and remind them
that we are here to perform quality audits, not to
establish bragging rights by trying to finish the audit in
less time than the previous auditors
32
• Emphasize to auditors that it’s OK to ask as many questions as
they want, and they should continue asking questions until
they are satisfied with and completely understand the answers;
the auditee’s attitude does not control the amount of questions
• Explain the roles of each section in our office and what each
section does, and emphasize that every section must be on the
lookout for problems/fraud when performing work; the auditors
in each section should be made aware of what to do if fraud is
found and should understand the process of handling a fraud
allegation and who performs the various tasks related to
handling the allegation; the auditors should also understand
that fraud investigations may require the assistance of auditors
from various areas of our office and are not just handled by
Investigations
33
• Emphasize that it’s better to make a big
deal of an issue that could indicate
fraud and find that it’s not fraud, rather
than pass over the issue and find out
later that fraud was occurring
34
• Asking questions about things that look odd
• Giving careful thought to answers that the
auditee gives me to make sure the answers
are plausible and make sense
• Asking for documentation whenever possible
to verify auditee statements
• Gaining an understanding of the procedures
that may apply to the area I’m looking at
(purchasing, contracts, etc) so that I can
determine if anything appears out of place
35
• Asking other auditors for their opinion on issues that
look strange (the other auditor might notice
something I overlooked or might be able to share
experience or expertise with the issue in question)
• If the auditee gives a statement that involves the
activities or participation of other individuals,
following up with those individuals to verify the
auditee’s statements (for example, if Bob says that
Fred told him about something, ask Fred if he really
did)
• Asking the auditee where his or her information
came from
36
• Encouragement from my superiors and co-workers
• Training classes
• Experience on the audit. The more years that I am
on a particular audit, the more likely I am to uncover
some irregularity
• Conscientious, talented auditors to work with me
• Guidance from managers
• Knowledgeable internal auditors at the auditee
•
37
Improving auditor skepticism through
cognitive dissonance theory
•
Is objectivity a myth?38
•
How much do we struggle to not have an open mind (by holding onto our
assumptions/biases/beliefs) when we profess to have an open mind?
•
As professionals, we are expected to employ critical thinking in analyzing
information/evidence
•
This includes weighing conflicting information from various sources
•
But are we to be totally objective?
•
The scientific method is designed to prove that a hypothesis is true??
•
What is the main role of attorneys?
38
•
Two main perspectives:
•
What we tell ourselves to justify what we do..staying off the slippery slopes
•
Our possible predispositions to whether we think a person or an
organization is trustworthy
– And how those notions may affect our evaluation of what they say or do
•
What others tell us to justify what they have done or not done
– And whether we buy off on it
•
If this sounds familiar, it is what we tell friends/family when they have been
hurt
– It wasn’t your fault/they were jerks/you are better off without him/her/that job
• And the basis of cognitive reframing therapy
39
• What are the two primary types of
mistakes we can make in evaluating
information?
– False positives
– False negatives
– Which is worse?
40
Purpose of this session
• To assist you in recognizing the traps we
all can fall into when we are evaluating
information and evidence
41
• When our brains are made up, it is very
hard to change them
• Cognitive dissonance—a state of tension
created whenever a person holds two
cognitions (ideas, attitudes, beliefs,
opinions) which are psychologically
inconsistent. Leon Festinger
• Smoking is not a good thing, it can kill me;
I smoke two packs a day
42
• It produces mental discomfort
– From minor pangs to deep anguish
• We don’t rest easy until we find a way to
reduce it
• Quit smoking
• Convince yourself smoking isn’t so bad
– Or it is worth the risk because it helps me relax, or
prevents me from gaining weight (another health risk)
43
Three primary applications to
auditing and accountability
• Auditors and the need to remain objective in
skeptically analyzing audit evidence
• Management and those charged with
governance who need to remain objective and
vigilant to indicators of possible fraud, waste or
abuse through designing, establishing and
monitoring effective internal controls
• All of us as human beings who can trip down
that ol’ slippery slope
44
Auditor responsibilities per SAS 99
• Paragraph 14: when responses to
inquiries of management, those charged
with governance, or others are
inconsistent or otherwise unsatisfactory
(for example, vague or implausible), the
auditor should further investigate the
inconsistencies or unsatisfactory
responses.
45
• Paragraph 14: maintain the proper
questioning mind throughout the audit
• Paragraph 15: the questioning mind
should include setting aside any prior
belief that management is honest and has
integrity and consider the risk of
management override of controls
46
• Paragraph 15:
• Consider known external and internal
factors that might: 1.create
incentives/pressures to commit fraud, 2.
provide opportunities for fraud to be
perpetrated and 3. indicate a culture or
environment that enables rationalization
for committing fraud
47
• Paragraph 16: professional skepticism
should lead auditors to continually be alert
for information or other conditions that
could indicate that MMDF may have
occurred
48
• Paragraph 16: professional skepticism
should lead auditors to thoroughly probe
the issues, require additional evidence as
necessary, consult with other team
members and, if appropriate, experts in
the firm, rather than rationalize or
dismiss the information or other
conditions indicating that a MMDF may
have occurred.
49
Requirements of SAS 109
• Paragraph 19: the auditor should plan and
perform the audit with an attitude of
professional skepticism, which should be
exercised throughout the audit
engagement
– Auditors should be rigorous in following up
on indications of MMDF or error
– Auditors should be alert for information or
other conditions indicating a MMDF/E may
have occurred.
50
MORE TOOLS FOR CONTROLLING OVER- AND
UNDER-AUDITING (or contributing to them?)
–
–
–
–
–
–
–
–
–
–
–
SAS 102, when must means must, or the real bottom lines
SAS 103, documentation and the no singing rule/lockdowns
SAS 104-111, The Risk Assessment Suite
SAS 99, fraud audits
SAS 112, more significant deficiencies/material weaknesses??
What did we know and what did we do with it?
What should we have known and what should we have done?
What did we not do?
What did we document?
Did we act like an auditor or a consultant?
Did we feel independent?
51
• HOW WE USE THOSE TOOLS
– Make everyone accountable
– Give everyone authority
– Question everything
– Be courageous
– Accept that there will be some boo boos
– Develop processes for sharing successes and
failures among teams
52
• BEING YOUR OWN CONSULTANT:
– A task force?
• All volunteer
– But don’t neglect to add as necessary
• Cross section
• Top official part and parcel of it
• Over-arching considerations
– Basic philosophy
– processes
• Everything is on the table
• Keep minutes
• Distribute beyond the task force
– And ask for comments
53
• Processes, continued
– Deadlines-the ultimate deadline
• And mini-deadlines
– Assignments
– Paragraph by paragraph
54
• OUTPUT:
– Internal control questionnaires
– Audit programs
– Technical tools
– New devices
• Mini rep letters
• Tougher findings and recommendations
– CAATALOGS
55
• OUTCOMES:
– You show me yours, I’ll show you my risk
assessment
– Symmetry of motion
– Confluence of intent and purpose
– Increased communication and understanding
– Better division of labor
56
• Some of the major risks to consider (just
possibilities, each entity has to consider their
particular situation):
– Over ride
•
•
•
•
Not just by management, but especially by management
Special handled approvals
High level approval of routine transactions
A sob story
– Lack of segregation of duties
• Functional as well as organizational
57
• The possibility of greed entering the
picture (Ooops, even in the public sector)
– Conflicts of interest
– Bribes
– Abuse of authority and position/property
– Bonus rounds
– Slush funds
• The fallacy of “compensating controls”
– They are really going to do something
indirectly that they can’t do directly?
58
• Good sources of information
– The appendices to SAS 109
• A-Understanding the Entity and its Environment
• B-Internal Control Components
• C-Conditions and Events That may Indicate Risks
of Material Misstatement
59
• Monitoring activities:
– Should be on a regular basis
– Totally dependent on the adequacy of the
original source documentation
– Should be performed by someone
independent of the transactions
– They should understand why they are doing
this, its importance and what they should do if
they detect a problem
60
• They should ask about any “exceptions” to
the rules
– Unexpected problems
– New ideas about ways to improve the system
that haven’t yet been documented
– How are any exceptions documented?
• There should be an environment that is open to
changes and the need to do things differently
– Just make sure it is communicated upward and the rules
are adequately amended
61
• Any problems of any kind should be
documented and communicated to a
higher level
– The higher level needs to really look at the
exceptions and do something about them
– All of this should be documented
– When the “problems” suggest fraud, waste or
abuse, they should receive special attention
• Setting the tone
• There are consequences
62
• SOME BEHAVIORS AND THOUGHTS
THAT LEAD TO OVER AND UNDER
AUDITING
– Failure to read the standards
– Failure to read the standards
– Failure to read the standards
– Failure to try to understand the standards
– Failure to try to apply the standards to your
audit engagements
63
• BAD BEHAVIORS AND THOUGHTS
continued:
– Non-critically relying too much on instructors
at conferences
– Rationalizing away problems/failing to
exercise professional skepticism
– Asking questions without analyzing the
answers and non-answers
– Failing to follow up on issues
• Failing to recognize issues in the first place
64
• BAD BEHAVIORS AND THOUGHTS
continued:
– Spending too much time spinning our wheels
in deciding whether we have a problem or not
– Asking questions we don’t understand
– Not applying what we learn in one situation to
other situations (reinventing that ol’ wheel)
65
• A COUPLE OF AREAS OF GREAT
OPPORTUNITY:
– IT processes
– Waste and abuse section
– Better findings
– huddles
66
• HUDDLE CONSIDERATIONS:
– THREE STRATA TO CONTINUE:
• Over-all philosophy of the audit organization
• The scope of individual audits
• The actions of individual auditors
• “Inside the audit huddle with Art”
• Association of government accountants’ journal of
government financial management, summer and
fall 2007
• www.agacgfm.org
67
• Risk assessment procedures (performed in
every engagement) include:
– Inquiries of management and others within the entity
– Analytical procedures
– Observation and inspection
• There are inherent limitations in internal control,
including:
– Risk of management over ride
– Possibility of human error, and
– The effects of system changes
68
68
• Therefore, regardless of the assessed risk
of MM, the auditor should design and
perform substantive procedures for all
relevant assertions related to each
material class of T/A’s, account balance,
and disclosure
– To obtain sufficient appropriate audit evidence
69
69
• Inquiry consists of seeking information of
knowledgeable persons, both financial and
non-financial, inside or outside the entity.
– It is an audit procedure that is used
extensively throughout the audit and
• Often is complementary to performing other audit
procedures
– SAS 106, P. 31
70
• The auditor should perform audit
procedures in addition to the use of inquiry
to obtain sufficient appropriate audit
evidence (SAAE).
– Inquiry alone ordinarily does not provide
SAAE to detect a MM at the relevant assertion
level
– Moreover, inquiry alone is not sufficient to test
the operating effectiveness of controls
71
• Nor is inquiry alone sufficient to evaluate
the design of a control relevant to the audit
and to determine whether it has been
implemented.
72
72
• Responses to inquiries may provide the auditor
with information not previously possessed, or
– With corroborative audit evidence
• Alternatively, responses might provide
information that differs significantly from other
information the auditor has obtained, for
example
– Regarding the possibility of management over ride
• The auditor should resolve any significant
inconsistencies in the information obtained.
73
• effectively eliminates the auditor’s ability to assess
control risk at the maximum without having a basis
for that assessment, i.e., to “default” to maximum
control risk, with no adverse consequences for the
auditor or the auditor’s client:
– The auditor should assess the risk of MM as a basis
for further audit procedures; although that risk
assessment is a judgment rather than a precise
measurement, the auditor should have an appropriate
basis for that assessment
74
74
– This basis may be obtained through the risk
assessment procedures performed to obtain an
understanding of the entity and its environment,
including its internal control, and
– Through the performance of suitable tests of controls
to obtain audit evidence about their operating
effectiveness.
– SAS 107, P. 23
– Assessed risks and the basis for those assessments
should be documented SAS 109, P. 122. c
75
• Although the auditor has no responsibility to plan
and perform the audit to detect immaterial MS’s
– There is a distinction in the auditor’s response to
detected MS’s depending on whether those MS’s are
caused by error or fraud.
• When the auditor encounters evidence of
potential fraud, regardless of materiality, the
auditor should consider the implications for the
integrity of management or employees
– And the possible effect on other aspects of the audit
76
Provides that the auditor “must” consider
audit risks and materiality for the F/S’s
taken as a whole for certain specified
purposes
77
77
Those purposes are:
– determining the extent and nature of risk
assessment procedures
– Identifying and assessing the R/MM
– Determining the nature, timing and extent of
further audit procedures, and
– Evaluating whether the FS’s taken as a whole
are presented fairly, in conformity with GAAP
78
78
• The auditor must accumulate all known and likely MS’s
identified during the audit
– Other than those the auditor believes are trivial
• And communicate them to the appropriate level of
management
• On a timely basis
• Trivial-amount set so that any such MS’s, either individually or
when aggregated, would not be material to the FS’s, after the
possibility of other undetected MS’s is considered.
• The auditor should request management to respond
appropriately when MS’s are identified during the audit
79
79
• Because generally IT processing is
inherently consistent, performing audit
procedures to determine whether an
automated control has been implemented
may serve as a test of that control’s
operating effectiveness
– Depending on the auditor’s assessment and
testing of IT general controls,
• Including computer security and program change
control.
80
80
• As noted at page 256 of the audit guide:
– SAS 105 emphasizes the link between
understanding the entity, assessing risks, and
the design of further audit procedures.
– It is anticipated that “generic” audit programs
will not be an appropriate response for all
engagements because risks vary between
entities.
81
• MORE WORK PROBABLY:
– SAS 109 introduces the concepts of
“Significant Risks” and other “Risks for Which
Substantive Procedures Alone do not Provide
Sufficient Appropriate Audit Evidence
82
• Whether the risk is a risk of fraud.
• Whether the risk is related to recent significant
economic, accounting, or other developments and,
therefore, requires specific attention.
• The complexity of transactions.
• Whether the risk involves significant transactions with
related parties.
• The degree of subjectivity in the measurement of
financial information related to the risks, especially
those involving a wide range of measurement
uncertainty.
• Whether the risk involves significant nonroutine
transactions which are outside the normal course of
business for the entity, or otherwise appear to be
unusual.
83
83
• if the auditor intends to rely on the controls
that mitigate a SR, the auditor should rely
on tests of those controls performed in the
current audit
– The greater the R/MM, the more audit
evidence the auditor should obtain
– The auditor should consider information
obtained in prior audits in designing the tests,
but not rely on that prior evidence re reliability
of the controls
• Per the reference to SAS 110, PP. 45-53 re SR’s: P. 45:
84
84
• The more sufficient the evidence from
testing the controls, the less substantive
testing the auditor can perform
85
85
• The more the auditor relies on the
operating effectiveness of the control in
assessing risk, the more the auditor
should increase the extent of the testing of
the control
• As the rate of expected deviation from a
control increases, the auditor should
increase the extent of the testing of the
control
– SAS 110, P. 48
86
86
• Generally IT processing is inherently
consistent
– Hence the auditor may be able to limit the
testing to one or a few instances of the control
operation.
• An automated control should function
consistently unless the program is
changed.
87
87
• Once the auditor determines that an
automated control is functioning as
intended
– The auditor should perform tests to determine
that the control continues to function
effectively
• Such tests might include:
– Determining that changes to the control were
not made without being subject to the
appropriate program change controls
– That the authorized version of the program is
being used, and
88
88
– That other relevant general controls are
effective.
– That changes to the programs have not been
made
• As may be the case when the entity uses
packaged software applications without modifying
or maintaining them
– The auditor may test the administration of IT security to
obtain audit evidence that unauthorized access has not
occurred during the period
89
89
• The characteristics of routine, day to day
business T/A’s often permit highly
automated processing with little or no
manual intervention.
• It may not be possible to perform only
substantive procedures re the risk.
90
90
• Audit procedures the auditor may assign
to a professional possessing IT skills
include
– Inquiring of an entity’s IT personnel how data
and T/A’s are initiated, authorized, recorded,
processed and reported, and
• How IT controls are designed
– Inspecting systems documentation;
– Observing the operation of IT controls; and
• Planning and performing tests of IT
controls
91
91
• The guidance provided by SAS 109
relating to documentation is significantly
greater than that provided by previous
standards (P. 122)
92
• SAS 110 expressly requires you to
document your linkage between assessed
risks and further audit procedures, with
regard to both:
– An overall assessment at the FS level and
– Further audit procedures responsive to the
assessed risk of MM at the relevant assertion
level
– Express linkage was not a requirement under
previous standards
93
93
• SAS 110 refers back to SAS 109, P. 102
for these requirements re the overall
assessment:
• The auditor should:
– Identify risks throughout the process of
obtaining an understanding and considering
the classes of T/A’s, account balances and
disclosures
– Relate the identified risks to “what can go
wrong” at the relevant assertion level
94
94
• SAS 110 points out that the nature of
further audit procedures is more important
than the timing or extent of them (P. 7)
– Increasing the extent of your audit procedures
will not compensate for procedures that do
not address the specifically identified risks of
MS
95
95
• SAS 110 provides that you should perform
certain substantive procedures on all
engagements. Those procedures include:
– Performing substantive tests for all relevant
assertions related to each material class of T/A’s,
account balance, and disclosure
• Regardless of the assessment of risk of MM (P. 51)
– Agreeing the FS’s, including their accompanying
notes, to the underlying accounting records
– Examining material journal entries and other
adjustments made during the course of preparing
the FS’s (P. 52)
96
96
• Re timing of the tests:
• Using audit evidence about the operating
effectiveness of controls obtained in prior
audits:
– The auditor should obtain evidence about
whether changes have occurred to those
specific controls subsequent to the prior audit
• Through a combination of observation, inquiry and
inspection
– To confirm the understanding of those specific97
97
controls. (P. 40)
• Eg. In a prior audit the auditor may have
determined that an automated control was
functioning as intended.
• In order to determine whether changes
have occurred to that control have been
made that affect its continued effective
functioning, the auditor may:
– Inquire of management and
• Inspect logs to determine if changes have been
made to it (P. 40)
98
98
• If the controls have changed since the
prior audit
– Have the changes affected continued audit
reliance on the controls
• i.e., changes that cause data to be accumulated or
calculated differently
– Vs. changes that do not affect reliability:
• Changes that enable an entity to receive a new
report from the system
• (P. 41)
99
99
• If, based on the understanding of the entity
and its environment, the auditor plans to
rely on controls that have not changed
since they were last tested,
– The auditor should test the operating
effectiveness of such controls at least once in
every third year in an annual audit (P. 42)
100
100
• BUT, the auditor may not rely on audit
evidence about the operating
effectiveness of controls obtained in prior
years for
– Controls that have changed since last
audited, or
– For controls that mitigate a Significant Risk
• (P. 42 and reference to PP. 40 & 45)
101
101
• The auditor should perform the following
risk assessment procedures to obtain an
understanding of the entity and its
environment, including its internal control:
• a. Inquiries of management and others
within the entity
• b. Analytical procedures
• c. Observation and inspection
•
•
AU Section 314
Understanding the Entity and Its Environment and Assessing the
Risks of Material Misstatement
•
Source: SAS No. 109.
106
.21
• The auditor is not required to perform all
the risk assessment procedures described
above for each aspect of the
understanding described in paragraph 21
• However, all the risk assessment procedures
should be performed by the auditor in the course
of obtaining the required understanding.
107
• In addition, the auditor might perform other
procedures where the information
obtained may be helpful in identifying risks
of material misstatement.
• For example, in cooperation with the
entity, the auditor may consider making
inquiries of others outside the entity such
as
108
• the entity’s external legal counsel or
valuation experts that the entity has used
• and
• Reviewing information obtained from
external sources such as reports by
analysts, banks, or rating agencies; trade
and economic journals; or regulatory or
financial publications
109
• Although much of the information the
auditor obtains by inquiries can be
obtained from management and those
responsible for financial reporting
• inquiries of others within the entity, such
as production and internal audit personnel,
and other employees with different levels
of authority, may be useful
110
• inquiries of others within the entity, such
as production and internal audit personnel,
and other employees with different levels
of authority, may be useful
• in providing the auditor with a different
perspective in identifying risks of material
misstatement
111
• In determining others within the entity to
whom inquiries may be directed, or the
extent of those inquiries
• the auditor should consider what
information may be obtained that might
help the auditor in identifying risks of
material misstatement.
112
• For example:
• Inquiries directed toward those charged
with governance
– may help the auditor understand the
environment in which the financial statements
are prepared.
113
• Inquiries directed toward internal audit
personnel
– may relate to their activities concerning the
design and effectiveness of the entity’s
internal control
• And
– whether management has satisfactorily
responded to any findings from these
activities.
114
• Inquiries of employees involved in
initiating, authorizing, processing, or
recording complex or unusual transactions
– may help the auditor in evaluating the
appropriateness of the selection and
application of certain accounting policies.
115
• Inquiries directed toward in-house legal
counsel
– may relate to such matters as litigation,
compliance with laws and regulations
– knowledge of fraud or suspected fraud
affecting the entity,
– warranties, post-sales obligations,
arrangements (such as joint ventures) with
business partners
– and the meaning of contract terms.
116
4U
1.
This is the single most important idea I got from this session.
_____________________________________________________
2.
This is why it is important (This what I will gain from its
use):________________________________________________
3.
This how I will use it: (What to do) (How to do it) (When to do it) (With
whom) _____________________________________________________
4.
This is share these ideas with _____________________________ not
later than ________________ because ___________________________
117
GOOD LUCK
I HOPE I HAVE HELPED!
REMEMBER—
IT IS NEVER TOO LATE
TO HAVE A HAPPY CHILDHOOD
118