ABC Retailers — Internal Controls

First Pages

lou6920x_fm_i-xxxiv.indd i 04/21/20 09:20 PM

Auditing & Assurance Services

First Pages

lou6920x_fm_i-xxxiv.indd ii 04/21/20 09:20 PM

First Pages

lou6920x_fm_i-xxxiv.indd iii 04/21/20 09:20 PM

Timothy J. Louwers, PhD, CPA, CISA, CFF Professor Emeritus James Madison University

Penelope L. Bagley, PhD, CPA Department Chair and Associate Professor of Accounting Appalachian State University

Allen D. Blay, PhD, CPA Denise Dickins Accounting Faculty Fellow and Associate Professor Florida State University

Jerry R. Strawser, PhD, CPA KPMG Chair of Accounting Texas A&M University

Jay C. Thibodeau, PhD, CPA Rae D. Anderson Professor of Accounting Bentley University

Auditing & Assurance Services

First Pages

lou6920x_fm_i-xxxiv.indd iv 04/21/20 09:20 PM

AUDITING & ASSURANCE SERVICES, EIGHTH EDITION

Published by McGraw-Hill Education, 2 Penn Plaza, New York, NY 10121. Copyright © 2021 by McGraw-Hill Education. All rights reserved. Printed in the United States of America. Previous editions © 2018, 2015, and 2013. No part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written consent of McGraw-Hill Education, including, but not limited to, in any network or other electronic storage or transmission, or broadcast for distance learning.

Some ancillaries, including electronic and print components, may not be available to customers outside the United States.

This book is printed on acid-free paper.

1 2 3 4 5 6 7 8 9 LWI 24 23 22 21 20

ISBN 978-1-260-36920-5 (bound edition) MHID 1-260-36920-X (bound edition) ISBN 978-1-260-70373-3 (loose-leaf edition) MHID 1-260-707373-8 (loose-leaf edition)

Portfolio Manager: Elizabeth Eisenhart Product Developers: Erin Quinones Marketing Manager: Katherine Wheeler Content Project Managers: Mary E. Powers (core), Angela Norris (assessment) Buyer: Laura Fuller Design: Matt Diamond Content Licensing Specialists: Abbey Jones Cover Image: © Oskari Porkka/Shutterstock Compositor: SPi Global

All credits appearing on page or at the end of the book are considered to be an extension of the copyright page.

Library of Congress Cataloging-in-Publication Data

Names: Louwers, Timothy J., author. | Blay, Allen D., 1970- author. | Thibodeau, Jay C., author. | Strawser, Jerry R., author. | Bagley, Penelope, author. Title: Auditing & assurance services / Timothy J. Louwers, James Madison University, Allen Blay, Florida State University, Jay Thibodeau, Bentley University, Jerry Strawser, Texas A&M University, Penelope Bagley, Appalachian State University. Other titles: Auditing and assurance services Description: Eighth edition. | New York, NY : McGraw-Hill Education, 2021. | First edition entered under title. Identifiers: LCCN 2020010135 (print) | LCCN 2020010136 (ebook) | ISBN 9781260369205 (bound edition) | ISBN 9781260703733 (loose-leaf edition) | ISBN 9781260703672 (ebook) Subjects: LCSH: Auditing. Classification: LCC HF5667 .A815 2021 (print) | LCC HF5667 (ebook) | DDC 657/.45—dc23 LC record available at https://lccn.loc.gov/2020010135 LC ebook record available at https://lccn.loc.gov/2020010136

The Internet addresses listed in the text were accurate at the time of publication. The inclusion of a website does not indicate an endorsement by the authors or McGraw-Hill Education, and McGraw-Hill Education does not guarantee the accuracy of the information presented at these sites.

mheducation.com/highered

First Pages

lou6920x_fm_i-xxxiv.indd v 04/21/20 09:20 PM

Some people come into our lives and quickly go. Some stay awhile and leave footprints on our hearts and we are never quite the same.

Anonymous

We dedicate this book to the following educators whose footprints we try to follow:

Professor Homer Bates (University of North Florida)

Professor Stanley Biggs (University of Connecticut)

Professor Lewis C. Buller (Indiana State University)

Professor Patrick Delaney (Northern Illinois University)

Professor William Hillison (Florida State University)

Professor John Ivancevich (University of Houston)

Professor Richard Kochanek (University of Connecticut)

Professor John L. “Jack” Kramer (University of Florida)

Professor Jack Robertson (University of Texas at Austin)

Professor Robert Strawser (Texas A&M University)

Professor Sally Webber (Northern Illinois University)

Professor “IBM Jim” Whitney (The Citadel)

First Pages

vi

lou6920x_fm_i-xxxiv.indd vi 04/21/20 09:20 PM

Meet the Authors Timothy J. Louwers is Professor Emeritus at James Madison University. Professor Louwers received his undergraduate and master’s degrees from The Citadel and his PhD from Florida State University. Prior to beginning his academic career, he worked in public accounting with KPMG, specializing in financial, governmental, and informa- tion systems auditing. He is a certified public accountant (South Carolina and Virginia) and a certified information systems auditor. He is also certified in financial forensics.

Professor Louwers’s research interests include auditors’ reporting decisions and ethi- cal issues in the accounting profession. He has authored or coauthored more than 60 publications on a wide range of accounting, auditing, and technology-related topics, including articles in the Journal of Accounting Research, Accounting Horizons, the Jour- nal of Business Ethics, Behavioral Research in Accounting, Decision Sciences, the Jour- nal of Forensic Accounting, Issues in Accounting Education, the Journal of Accountancy, the CPA Journal, and Today’s CPA. Some of his published work has been reprinted in Russian and Chinese. He is a respected lecturer on auditing and technology-related issues and has received teaching excellence awards from the University of Houston and Louisiana State University. He has appeared on both local and national television news broadcasts, including MSNBC and CNN news programs.

Allen D. Blay is an Associate Professor of Accounting and the Denise Dickins Accounting Faculty Fellow at Florida State University.

Professor Blay completed his PhD at the University of Florida in 2000. He teaches auditing at all levels and teaches a seminar in auditing research in the doctoral program. His research interests relate to auditor judgment and decision making. Professor Blay has authored or coauthored publications on a wide range of accounting and auditing topics in journals such as Contemporary Accounting Research, Auditing: A Journal of Practice and Theory, Organizational Behavior and Human Decision Processes, the Journal of Business Eth- ics, Behavioral Research in Accounting, Issues in Accounting Education, the International Journal of Auditing, and the Journal of Accounting, Auditing, and Finance. He is currently an editor for Issues in Accounting Education and serves on several editorial boards.

Professor Blay has been active in the American Accounting Association, co-chairing the 2020 Auditing Section Midyear Meeting and serving on the steering committee for the Intensive Data and Analytics Summer Workshop the past three years, as well as in many other roles over the years. He is also active in the American Institute of CPAs, serving in various volunteer roles relating to the Uniform CPA Exam. Prior to entering academics, Professor Blay worked in public accounting auditing financial institutions. He currently directs the accounting doctoral program at Florida State University.

Jerry R. Strawser is Executive Vice President and Chief Financial Officer at Texas A&M University and holds the KPMG Chair in Accounting.

Prior to his current appointment, Professor Strawser served as dean of Mays Business School at Texas A&M University, interim executive vice president and provost at Texas A&M University, interim dean of the C. T. Bauer College of Business at the University of Houston, and Arthur Andersen & Co. Alumni Professor of Accounting.

Professor Strawser has coauthored three textbooks and more than 60 journal articles. In addition to his academic experience, he had prior public accounting experience at two Big Four accounting firms. He has also developed and delivered numerous executive development programs to organizations such as AT&T, Centerpoint Energy, Continental

Courtesy of James Madison University

Courtesy of Kallen M. Lunt

Courtesy Jerry R. Strawser

First Pages

Meet the Authors vii

lou6920x_fm_i-xxxiv.indd vii 04/21/20 09:20 PM

Airlines, ConocoPhillips, Halliburton, KBR, KPMG, Minute Maid, PricewaterhouseC- oopers, McDermott International, Shell, Southwest Bank of Texas, and the Texas Society of Certified Public Accountants. Professor Strawser is a certified public accountant in the state of Texas and earned his BBA and PhD in Accounting from Texas A&M University.

Jay C. Thibodeau is the Rae D. Anderson Professor of Accounting and Director of PhD Programs at Bentley University.

Professor Thibodeau is a certified public accountant and a former auditor. He received his bachelor’s degree from the University of Connecticut in 1987 and his PhD from the University of Connecticut in 1996. He joined the faculty at Bentley in 1996 and has remained there ever since. Professor Thibodeau has conducted executive education pro- grams for numerous leading firms including Fidelity Investments, KPMG, Pricewater- houseCoopers, Stryker, and Blue Coat Technologies.

Professor Thibodeau’s scholarship focuses on audit judgment and decision making and audit education. He is a coauthor of two textbooks and has written more than 50 book chapters and articles for academics and practitioners in journals such as Auditing: A Journal of Practice & Theory, Journal of Information Systems, Accounting Horizons and Issues in Accounting Education.

Professor Thibodeau served as the president of the Auditing Section of the American Accounting Association for the 2014/2015 academic year. He has received national rec- ognition for his work six times: First, for his thesis, winning the 1996 Outstanding Doc- toral Dissertation Award presented by the ABO section of the AAA. Four other times, for curriculum innovation, winning the 2001 Joint AICPA/AAA Collaboration Award, the 2003 Innovation in Assurance Education Award, the 2016 Forensic Accounting Teaching Innovation Award, and the 2019 Innovation in Assurance Education Award. And finally, for outstanding service, receiving a Special Service Award from the Auditing Section for his work in helping to create the Center for Audit Quality’s Access to Auditors program.

Penelope L. Bagley is the Department Chairperson and Professor of Accounting at Appalachian State University.

Professor Bagley received her undergraduate and master’s degrees from North Caro- lina State University and her PhD at the University of Georgia. Prior to obtaining her PhD, Professor Bagley worked for a short time in the audit field. She is a certified public accountant in North Carolina. Professor Bagley teaches both undergraduate and grad- uate auditing courses. Professor Bagley has authored and co-authored publications on accounting and auditing topics in journals such as Auditing: A Journal of Practice & Theory, Accounting Horizons, and Behavioral Research in Accounting. She has also co- authored auditing cases, published in Issues in Accounting Education. Professor Bagley is active in the American Accounting Association and has served on various committees for the Auditing Section. In her spare time, Professor Bagley likes to spend time with her husband Matt and children, Garrett and Julianne. She is an avid runner, most recently qualifying and running the 2019 Boston Marathon.

Bentley University

Penelope L. Bagley

First Pages

viii

lou6920x_fm_i-xxxiv.indd viii 04/21/20 09:20 PM

As auditors, we are trained to investigate beyond appearances to determine the underly- ing facts—in other words, to look beneath the surface. From the Enron and WorldCom scandals of the early 2000s to the financial crisis of 2007–2008 to present-day issues and challenges related to significant estimation uncertainty, understanding the auditor’s responsibility related to fraud, maintaining a clear perspective, probing for details, and understanding the big picture are indispensable to effective auditing.

With the availability of greater levels of qualitative and quantitative information (“Big Data”), the need for technical skills and challenges facing today’s auditor is greater than ever. The Louwers, Bagley, Blay, Strawser, and Thibodeau team has dedi- cated years of experience in the auditing field to this new edition of Auditing & Assur- ance Services, supplying the necessary investigative tools for future auditors.

Cutting-Edge Coverage The eighth edition of Auditing & Assurance Services continues its tradition as the most up-to-date auditing text on the market. All chapters and modules have been revised to incorporate

∙ The latest professional standards, recodifications, and proposals from the Interna- tional Auditing and Assurance Standards Board, Auditing Standards Board, and Public Company Accounting Oversight Board.

∙ A list of the relevant professional standards that are covered in that chapter, including new AICPA reporting standards effective for 2020 fiscal years, as well as compre- hensive coverage of the new PCAOB standards on auditing estimates.

Data Analytics ∙ One trend has emerged as a potential sea change in the financial statement auditing

process: the data and analytics challenge.

We believe students should be prepared to make the best use possible of relevant data using state-of-the-art analytical tools. In fact, the terms big data and data and analytics are frequently being used to describe a growing movement among audit professionals. As the AICPA moves to add data and analytics onto the Uniform CPA Examination, our collective view is that students must be able to not only meet current requirements, but be ahead of the game.

To prepare students, the eighth edition of Auditing & Assurance Services has been revised deliberately to help students critically think about the use of increased data and analytical tools in the financial statement audit. In addition to changes within the main chapters of the book, we have added

∙ A new module specifically covering data and analytics in auditing, which follow- sthe AICPA Guide to Data Analytics.

∙ Author-Created Cases and Exercises (as part of Data Analytics Module) that cover the majority of uses of data analytics in the financial statement audit, along with extensive solutions to help instructors implement the materials in their classroom.

It is our belief that students should be trained in the process of data and analytics, and learn to think critically about situations they may face in an audit. We believe that the knowledge students attain should be software independent, particularly since software

Look Beneath the Surface . . .

First Pages

ix

lou6920x_fm_i-xxxiv.indd ix 04/21/20 09:20 PM

technology changes so rapidly. However, we also believe that it is important for stu- dents to become familiar with at least one specific data and analytic software tool, and recent AACSB standards echo this belief. Thus, an important goal of the eighth edition is to provide a clear and implementable method to fully integrate a leading data analysis tool, the IDEA Data Analysis software, into the auditing class. Many of our exercises, however, can be implemented using whatever technology an instructor chooses to use, like Excel.

We believe that IDEA provides an outstanding platform to illustrate the steps that auditors need to take related to data and data analysis while completing the financial statement audit. Leading auditing professionals have confirmed that using IDEA is an outstanding way for entry-level auditing professionals to begin the journey into the world of big data and data analytics. Simply stated, big data is manifested in the finan- cial statement auditing process through the use of tools like IDEA.

Overall, our revisions related to the big data challenge were designed to provide instructors a set of tools and mechanisms to bring data and analytics into the classroom in a meaningful way. Through the use of these tools, students can be sure they are pre- pared to enter practice with an appreciation for and knowledge of the increasing impor- tance of data and analytics in the auditing profession.

Perhaps most importantly, the eighth edition of Auditing & Assurance Services also continues to be the most up-to-date auditing text on the market. The book has fully inte- grated the new PCAOB and ASB reporting standards. In addition, we fully cover the PCAOB’s new standards on audits of estimates, including fair value estimates, and the use of specialists in an audit. In addition, all chapters and modules have been revised to incorporate the latest updates from the international standards of audit- ing (ISAs) and the Auditing Standards Board (ASB). With Auditing & Assurance Ser- vices, eighth edition, students are prepared to take on auditing’s latest challenges.

The Louwers author team uses a conversational, yet professional tone—hailed by reviewers as a key strength of the book.

Flexible Organization Auditing & Assurance Services teaches students auditing con- cepts by emphasizing real-life contexts when describing the auditing process. The authors use chapters and modules to

“The format allows you to integrate the modules into the chapter material in any way you would find useful.” —Frank J. Beil, University of Minnesota

Chapters Modules

The 12 chapters cover the auditing process extensively with a multitude of cases designed to give students a better understanding of how a best-practice concept developed from real-world situations.

Modules A–H provide instructors additional material that can be used throughout the course. Topics such as fraud, ethics, sampling, and technology are covered in the modules, which are designed to be taught whenever instruc- tors want to introduce the topic in their course.

First Pages

x

lou6920x_fm_i-xxxiv.indd x 04/21/20 09:20 PM

achieve this goal. Although the chapters follow a logical sequence that we recommend professors consider for their classes, the modules have been written to be used on a stand-alone basis. In essence, the modules have been deliberately prepared for entirely flexible implementation of these topics without excessive reliance on chapter sequenc- ing. We encourage you to integrate these modules into your syllabi in a manner that best suits your approach to the auditing course.

Engage Your Students with Real Examples An effective accounting textbook integrates real-world scenarios with theoretical discus- sion. Auditing & Assurance Services places the student in the role of a decision maker, by illustrating the application of auditing concepts using actual situations experienced by accounting firms and companies such as:

∙ Each chapter or module opens with a “real-world” example that draws upon concepts discussed within that chapter or module.

∙ A series of mini-cases available on the Instructor Resource Center have been devel- oped for use by instructors to further bring text material to life. These mini-cases fea- ture real situations experienced by companies, individuals, or accounting firms and are updated by the authors to include both timeless classics such as Arthur Andersen’s failure to detect fraud at Enron to more recent situations such as Lehman Brothers.

Fraud Awareness The fraud coverage in Auditing & Assurance Services is the most extensive available and is complemented by real-world examples chosen to engage students through the following tools:

Confirming Pages

117

lou6920x_ch04_117-171.indd 117 04/09/20 02:53 PM

LEARNING OBJECTIVES The professional standards emphasize the importance of an auditor’s identification and assessment of the risks of material misstatement that exist related to an audit client. Once each of the risks is identified and assessed, the auditor needs to plan an appropriate response. Given the importance of risk assessment,

it is not surprising that the professional standards state that the risk assessment process underlies the entire audit process. In Chapter 3, we covered the engagement planning process, beginning with pre- engagement activities, supervision, and materiality. In this chapter, we provide comprehensive coverage of an auditor’s risk assessment and its impact on the audit process.

Risk comes from not knowing what you’re doing.

Warren Buffett.

Profit is the result of risks wisely selected.

Frederick Barnard Hawley.

The Audit Risk Model and Inherent Risk Assessment

C H A P T E R 4

Professional Standards References

Topic AU-C/ISA Section AS Section

Consideration of Fraud in a Financial Statement Audit 240 2401

Consideration of Laws and Regulations 250 2405

Communications with Audit Committees 260 1301

Audit Planning 300 2101

Identifying and Assessing the Risks of Material Misstatement 315 2110

Materiality 320 2105

Auditors’ Responses to Risks of Material Misstatement 330 2301

Audit Evidence 500 1105

Substantive Analytical Procedures 520 2305

Related Parties 550 2410

∙ Auditing Insights integrated throughout the text. ∙ Apollo Shoes Case, the only stand-alone fraud audit

case on the market (available online). ∙ Mini-cases that may be assigned to supplement

text chapters and modules that expose students to landmark fraud cases at Bernie Madoff Investment Securities, Enron, HealthSouth,

Parmalat, PTL Club, and Satyam Computer Services. ∙ Specific discussion of management fraud (Chapter 4), employee fraud (Chapter 6),

and the Certified Fraud Examiner Exam (Module D).

First Pages

xi

lou6920x_fm_i-xxxiv.indd xi 04/21/20 09:20 PM

Create a State-of-the-Art Learning Environment: Instructor Resources The author team and McGraw-Hill are dedicated to providing instructors with the best teaching resources available. In addition to the solutions manual, test bank, PowerPoint Presentations, and the Apollo Shoe Case, the following resources are also available.

The Updated Auditor The author team scrutinizes leading business and academic publications for relevant issues and research that sheds light on auditing and the audit process. Recent findings from academic research and discussions from professional literature are drawn from the following publications:

∙ Accounting Horizons ∙ Accounting Today ∙ Auditing: A Journal of Practice & Theory ∙ Behavioral Research in Accounting ∙ Bloomberg Businessweek ∙ CFO.com ∙ CPA Journal ∙ Journal of Accountancy ∙ Journal of Accounting and Economics ∙ The Accounting Review ∙ The Wall Street Journal

These excerpts are highlighted throughout the text as Auditing Insights to allow for easy identification and review by instructors and students.

In addition to the use of Auditing Insights, on a monthly basis, the author team pro- vides an Updated Auditor briefing, which summarizes the content of relevant business and academic publications on a chapter-by-chapter basis, to allow students to apply cur- rent developments in the profession with material discussed in class. The Updated Audi- tor briefing is available in Connect. With the Updated Auditor, instructors will always be at the cutting edge of auditing practice!

IDEA Software and Workbook With the availability of unprecedented amounts of quantitative and qualitative infor- mation and tools available to access and process that information, it is imperative that students learn and utilize the latest technologies used by auditing professionals. As previously stated, McGraw-Hill Education has forged a partnership with Caseware Analytics for the use of the IDEA data analysis tool. Chapters 3 (audit planning), 4 (risk assessment), 5 (internal control), 7–9 (operating cycle chapters), both modules on sam- pling (Modules E and F), and the new data and analytics module (Module G) have been revised to reference the use of IDEA within the chapter or module.

First Pages

xii

lou6920x_fm_i-xxxiv.indd xii 04/21/20 09:20 PM

In addition, the eighth edition includes end-of-chapter exercises utilizing author- developed databases exclusively for use with Auditing & Assurance Services as well as supplemental materials available in Connect to complement the IDEA workbook and provide hands-on instructions on using the IDEA software. The authors also provide

∙ Implementation guidance to instructors. ∙ Robust video walk-throughs. ∙ Detailed solutions and explanations on this new content.

Overall, the author team has provided significant resources to prepare students for the auditing environment in 2020 and beyond.

Roger CPA Review McGraw-Hill has partnered with Roger CPA Review (Powered by UWorld), a global leader in CPA Exam preparation, to provide students a smooth transition from the accounting classroom to successful completion of the CPA Exam. While many aspiring accountants wait until they have completed their academic studies to begin preparing for the CPA Exam, research shows that those who become familiar with exam content earlier in the process have a stronger chance of successfully passing the CPA Exam. Accordingly, students using these McGraw-Hill materials will have access to Roger CPA Review multiple choice questions supported by explanations written by CPAs focused on exam preparation. McGraw-Hill and Roger CPA Review are dedicated to supporting all accounting students along their journey, ultimately helping them achieve career success in the accounting profession. For more information about the full Roger CPA Review program, exam requirements, and exam content, visit www.rogercpareview.com.

TestGen TestGen is a complete, state-of-the-art test generator and editing application software that allows instructors to quickly and easily select test items from McGraw Hill’s Test- Gen testbank content and to organize, edit and customize the questions and answers to rapidly generate paper tests. Questions can include stylized text, symbols, graphics, and equations that are inserted directly into questions using built-in mathematical templates. With both quick-and-simple test creation and flexible and robust editing tools, TestGen is a test generator system for today’s educators.

First Pages

xiii

lou6920x_fm_i-xxxiv.indd xiii 04/21/20 09:20 PM

Association to Advance Collegiate Schools of Business (AACSB) Statement McGraw-Hill Education is a proud corporate member of AACSB International. Under- standing the importance and value of AACSB accreditation, Auditing & Assurance Services, 8e, recognizes the curricula guidelines detailed in the AACSB standards for business accreditation by connecting selected questions in the text and test bank to the eight general knowledge and skill guidelines in the AACSB standards. The statements contained in Auditing & Assurance Services, 8e, are provided only as a guide for the users of this textbook. The AACSB leaves content coverage and assessment within the purview of individual schools, their mission, and their faculty. Although Audit- ing & Assurance Services, 8e, and the teaching package make no claim of any specific AACSB qualification or evaluation, we have within Auditing & Assurance Services, 8e, labeled selected questions in Connect according to the eight general knowledge and skills areas.

First Pages

xiv

lou6920x_fm_i-xxxiv.indd xiv 04/21/20 09:20 PM

New to the Eighth Edition of

In response to feedback and guidance from numerous auditing accounting faculty, the authors have made many important changes to the eighth edition of Audit- ing & Assurance Services, including the following:

∙ The eighth edition of Auditing & Assurance Ser- vices features Connect and SmartBook.

∙ A new Module G has been added to include full cov- erage of the uses of Data and Analytics in auditing, including extensive Data Analytics Exercises with author-created data.

∙ All chapters and modules have been revised to incorporate professional standards adopted through January 2020.

∙ New Update to Apollo Shoes, Inc. case with Data Analytics content. Apollo Shoes, Inc. is an audit case designed to introduce students to the entire audit process. Newly created auto-gradable ques- tions, instructor implementation guide, and videos can be found online in Connect.

∙ Auditing Insight boxes have been added and updated throughout the textbook to place issues

The following breakdown shows the revisions we made on a chapter-by-chapter basis:

CHAPTER 1: Auditing and Assurance Services ∙ Updated the section on the importance of reliable

information for users by incorporating a discus- sion about Theranos, the blood-testing startup company that was recently featured in an HBO movie. In many cases, the informational package provided to potential investors did not include an independent audit report. The example reinforces why it is so important for investors and creditors to review audited financial statements as they consider whether to invest or loan money to a company.

∙ Included a new Auditing Insight featuring the most recent audit quality report published by KPMG. Importantly, the report highlighted the firm’s invest- ment in the audit of the future and included a dis- cussion of cognitive technologies such as IBM’s Watson and the importance of harnessing the emerg- ing power of Big Data.

∙ Included a new Auditing Insight that describes the role of EY, a Big Four accounting firm, in the the annual Hall of Fame voting for baseball. That is, while the the Baseball Writers’ Association of America is responsible for the voting, EY is respon- sible for verifying that eligible voters are properly registered and have signed a code of conduct, and that the actual count of votes is correct!

CHAPTER 2: Professional Standards ∙ Added opening vignette describing the Deloitte Bra-

zil audits of Gol Intelligent Airlines and alteration of documentation in response to a PCAOB inspection.

∙ Added Auditing Insights related to the Carillion audit failure, the United Kingdom Competition and Markets Authority recommendations for auditor independence, and the KPMG controversy related to advance notification of audits selected for PCAOB inspection.

∙ Included a summary of recent academic research relating to the impact of PCAOB inspection results

discussed within the text into a real-world context. These boxes incorporate numerous examples from business and academic publications as well as actual company annual reports and audit reports.

∙ Examples using the Caseware IDEA software are included in Chapters 3, 4, 5, 7, 8, 9, Module F, and the new Module G focusing on Data and Analytics. In addition, end-of-chapter exercises using author-devel- oped databases exclusively for use with Auditing & Assurance Services as well as supplemental materials to complement the IDEA workbook are provided.

∙ Tables in the cycle chapters have been fully standard- ized to focus on the risk assessment process for each relevant assertion. The chapters provide a consistent focus on how auditors respond to assessed risk of material misstatement, through the incorporation of easy-to-read tables throughout Chapters 6 through 10 to highlight the key issues and risks faced by audi- tors in the examination of different accounts. These tables take the students through the risk assessment process for each cycle on a step-by-step basis to mir- ror the methodology used in current audit practice.

Highlights of Auditing & Assurance Services, 8e

Part I: The Contemporary Auditing Environment

First Pages

xv

lou6920x_fm_i-xxxiv.indd xv 04/21/20 09:20 PM

on auditor dismissal, auditor market share and fees, auditor opinions, audit quality, and audit effort in years following the inspection.

∙ Included 2019 auditors’ report for Microsoft, one of the first major companies to be subject to disclosure of critical audit matters in the auditors’ report.

∙ Summarized PCAOB inspections of 2014, 2015, and 2016 audits conducted by Big Four firms and expanded analysis to summarize the number of audits in which the client’s report on internal control was revised as a result of the inspection.

Auditing & Assurance Services

CHAPTER 3: Engagement Planning ∙ Updated planning discussion for changes related to

the updated PCAOB Auditing Standard 1210: Using the Work of an Auditor-Engaged Specialist, effective for FYE 12/15/2020 and amendments to Auditing Standard 1105: Audit Evidence and Audit Standard 1201: Supervision of the Audit Engagement.

∙ Integrated discussion of matters of planning related to the client’s computer environment and the use of CAATs (former LO 3-5) into the chapter and remainder of the text.

∙ Introduced a new vignette reflecting current audit environment and independence concerns.

∙ Rearranged and updated discussions on Staffing the Audit Engagement and Materiality for readability and flow.

∙ Updated and replaced Audit Insights and examples throughout the chapter to reflect more recent events.

CHAPTER 4: The Audit Risk Model and Inherent Risk Assessment ∙ Renamed the chapter to better reflect the chapter

content. ∙ Introduced a new vignette discussing recent PCAOB

inspection reports and their continued focus on issues related to audit risk assessment.

∙ Added a discussion in Inherent Risk Assessment to reflect the need for the auditor to also understand the client’s computerized processing when gaining an understanding of the client’s business and environment.

∙ Replaced and updated Audit Insights and examples throughout the chapter to reflect more recent events.

CHAPTER 5: Risk Assessment: Internal Control Evaluation ∙ Revised the introduction to include the recent “cease

and desist” orders issued by the SEC (January 2019) against four public companies: Lifeway Foods Inc., Digital Turbine Inc., CytoDyn Inc., and Grupo Simec

S.A.B de C.V. After providing each of these compa- nies with as many as 10 years to address their prob- lems, the SEC finally had enough and decided to take action. In taking this action, the SEC made clear that “disclosure of material weaknesses is not enough without meaningful remediation. We are commit- ted to holding corporations accountable for failing to timely remediate material weaknesses.” The introduc- tion allows for instructors to emphasize the impor- tance of the internal control audit in their classes

∙ Added an Auditing Insight that featured, Elon Musk, the billionaire co-founder of Tesla Inc., who was fined $20 million by the SEC for a seemingly harmless tweet that he made on August 7, 2018. The tweet indicated that he had secured financing to take the company pub- lic, causing an increase of over six percent in the com- pany’s stock price. The basis of the SEC’s complaint against Tesla related back to a lack of internal controls.

∙ Replaced the dated Krispy Kreme management report on Internal Control over Financial Reporting with excerpts from a Costco Wholesale Corporation management report on internal control over financial reporting, which identified a material weakness in its system of internal control. The material weakness related to information technology general controls which serves to reinforce the importance of informa- tion technology controls in today’s audit environ- ment. The report was issued on October 26, 2018.

CHAPTER 6: Employee Fraud and the Audit of Cash ∙ Updated the discussion on bank cash confirmations

to include a detailed description of the process and an example of electronic confirmation using Confir- mation (formerly Confirmation.com).

∙ Added multiple new and current Auditing Insights focusing on recent interesting frauds involving the misuse of cash within an organization, including an insightful and somewhat humorous story involving lunch ladies at a school cafeteria.

Part II: The Financial Statement Audit

First Pages

xvi

lou6920x_fm_i-xxxiv.indd xvi 04/21/20 09:20 PM

∙ Revised the end-of-chapter content to address elec- tronic bank confirmations.

CHAPTER 7: Revenue and Collection Cycle ∙ Included a new section with details surrounding

the audit of revenue recognized in accordance with ASC 606. The section discusses the five-step rev- enue recognition process and how auditors approach the issues involved.

∙ Included a new introduction to the chapter that discusses the recent Carillion fraud and the issues involved with estimation of revenue under longer- term revenue contracts.

∙ Added a comprehensive end-of-chapter exercise involving a substantive analytical procedure for auditing ticket revenue for a university. The exercise requires students to consider issues related to suf- ficiency of evidence and precision of data.

∙ Updated PCAOB inspection findings through the latest inspection reports.

∙ Included several new data and analytics exercises in the new Module G related to revenue recogni- tion, along with several existing author-created and IDEA workbook exercises, enabling instructors to have many options for integration of data analytics into their courses.

CHAPTER 8: Acquisition and Expenditure Cycle ∙ Substantially revised all tables in the chapter to be

identical in format for all cycle chapters (6-10). This enables instructors to present a common format that matches the current method of auditing, from iden- tification of significant accounts and relevant asser- tions to substantive procedures to audit residual risks.

∙ Added multiple new auditing insights covering cur- rent news related to auditing the expenditure cycle.

∙ The end of chapter materials contain a new CPA Exam-style simulation that requires students to link audit issues to assertions, control procedures, and substantive procedures to match the new increase emphasis of these areas on the CPA Exam.

CHAPTER 9: Production Cycle and the Audit of Inventory ∙ Revised the chapter to focus on the audit of the

inventory account, no longer primarily focusing on the production cycle. The chapter addresses risks of material misstatement in the inventory account for companies ranging from manufacturers to retailers such as Target.

∙ Substantially revised all tables in the chapter to be identical in format for all cycle chapters (6–10). This enables instructors to present a common format that matches the current method of auditing, from identification of significant accounts and relevant assertions to substantive procedures to audit residual risks.

∙ End-of-chapter materials include a new CPA Exam– style simulation involving issues in an inventory count. An additional new end-of-chapter exercise involves fraud detection in an audit of inventory.

∙ New data and analytic exercises included with Module G focus on issues related to audits of the inventory account. The chapter continues to include a focus on data and analytics that integrates several IDEA exercises, including author-created content and end-of-chapter materials.

∙ Updated PCAOB inspection findings to focus on current issues being addressed in inspection reports.

CHAPTER 10: Finance and Investment Cycle ∙ Significantly expanded the discussion of audit-

ing accounting estimates, including fair values, to address the newly revised PCAOB standards. In addition, added a much more detailed discus- sion of the general approach to auditing accounting estimates.

∙ Updated tables throughout the chapter to include examples involving auditing accounting estimates in investment accounts.

∙ Included in the introduction a new discussion of the very recent (August 2019) accusations of GE by Harry Markopolos. The introduction allows students to consider the difficult issues involved in auditing the finance and investment cycle and how the audi- tor may have approached these issues.

CHAPTER 11: Completing the Audit ∙ Updated discussion of Ability to Continue as a

Going Concern for updates to PCAOB Auditing Standard 2415 and AICPA AU-C 570, The Audi- tor’s Consideration of an Entity’s Ability to Con- tinue as a Going Concern.

∙ Updated introductory vignette to reflect current state of Valeant (now Bausch Health).

∙ Abbreviated Attorney Letter and Written Represen- tations sections to include most relevant material.

∙ Replaced and updated Audit Insights and examples throughout the chapter to reflect more recent events.

First Pages

xvii

lou6920x_fm_i-xxxiv.indd xvii 04/21/20 09:20 PM

MODULE A: Other Public Accounting Services ∙ Significantly streamlined and reorganized presen-

tation into four major sections addressing special issues in GAAS audits, other attestation engage- ments, accounting and review service engagements, and assurance engagements.

∙ Expanded coverage of audits of financial statements prepared using a special purpose framework and prospective financial information.

∙ Added Auditing Insights relating to the required scope of agreed–upon-procedures engagements required by the National Collegiate Athletics Asso- ciation, PCAOB sanctions relating to broker–dealer compliance, deficiencies from a PCAOB inspection report related to the use of service auditor’s reports, trends in corporate responsibility reporting, and BDO’s assurance on Amazon Trust Services’ Certi- fication Authority operations.

∙ Incorporated tables and other pedagogical summa- ries throughout module to provide overview of key differences in scope of engagements and accoun- tants’ reports across different types of engagements.

∙ Significantly expanded end-of-chapter materials, including a number of Connect-gradable assignments.

MODULE B: Professional Ethics ∙ Added an Auditing Insight to illustrate the General-

ization argument featuring the data breach at Equi- fax, the largest data breach in history. The breach resulted in the names, addresses, and social secu- rity numbers of over 147 million Americans being stolen. The data breach occurred in May 2017 but

wasn’t discovered by Equifax until July 29th, nearly two months later. It took the company another six weeks to notify the public that names and Social Security numbers of millions had been stolen. In the aftermath, the SEC brought charges against for- mer Equifax Chief Information Officer Jun Ying in March of 2018 for using his knowledge of the breach to sell shares of the company’s stock before the breach was made public.

∙ Added two new key terms, independence in fact and independence in appearance. Article IV of the AIC- PA’s Professional Code of Conduct requires that “a member in public practice should be independent in fact and appearance when providing auditing and other attestation services.” As a result, it was impor- tant to feature these concepts as key terms.

∙ Added an Auditing Insight that describes how Price- waterhouseCoopers (PwC) lost Alteryx as an audit client over independence concerns. Alteryx is a soft- ware company that was being used by PwC. As a result of their promotion of the software to their cli- ents, executives at Alteryx became concerned about the independence of their auditing firm. As such, they replaced PwC with Deloitte.

MODULE C: Legal Liability ∙ Added a new introductory vignette on litigation

involving PwC for its audits of Colonial Bank and resulting settlement with the FDIC.

∙ Updated the summary of major settlements involv- ing Big Four accounting firms to include more recent settlements.

Part III: Stand-Alone Modules

CHAPTER 12: Reports on Audited Financial Statements ∙ Revised chapter and end-of-chapter materials to incor-

porate the revised auditors’ report for non-issuers required by Statement on Auditing Standards No. 134.

∙ Added Auditing Insight relating to recent issues regarding the use of component auditors (U.K. affiliate firms’ involvement in the audits of Amazon, Black- Rock, and Citigroup; KPMG, Deloitte, and BDO’s use of Zimbabwe affiliate firms; and Deloitte’s use of mul- tiple component auditors in the audit of Monsanto).

∙ Added examples from auditors’ reports issued for Alphabet, Caesars Entertainment Corporation,

DowDupont, Fannie Mae, Freddie Mac, General Electric, General Motors, Kraft Heinz Company, Tesla Inc., and YUM! Brands.

∙ Added appendix related to auditors’ reports on financial statements and reports on internal con- trol over financial reporting for issuers, including information relating to the topics included as criti- cal audit matters in the early round of auditors’ reports.

∙ Provided supplemental auditors’ reports and end-of- chapter materials in Connect for instructors wishing more extensive coverage of auditors’ reporting for issuers and the PCAOB audit report.

First Pages

xviii

lou6920x_fm_i-xxxiv.indd xviii 04/21/20 09:20 PM

∙ Expanded the discussion of academic research examining auditor litigation to include recent stud- ies that investigated the factors affecting the litiga- tion risk faced by audit firms.

∙ Replaced and updated Audit Insights and examples throughout the module to reflect more recent events.

MODULE D: Internal Audits, Governmental Audits, and Fraud Examinations ∙ New introductory vignette highlighting 2018 Atlanta

cyber attack and the importance of the internal audit role and recommendations.

∙ Restructured learning objectives to include only three similar objectives focused on each of the three areas highlighted in the module, Internal Audits, Governmental Audits, and Fraud Examinations.

∙ Reorganized discussions of Internal Audits and Governmental Audits. Aligned the discussions to include similar topic headings including definition, types of services, standards, and reports.

∙ Consolidated review checkpoints to appear at the end of each of the three major sections; added three new review checkpoints for Internal Audits.

∙ Replaced and updated Audit Insights and examples throughout the module to reflect more recent events.

MODULES E and F: Sampling ∙ Focused sampling modules on applications of attri-

butes (Module E) and variables (Module F) sampling, while integrating CPA-exam specific concepts and terminology from the former overview module as appropriate.

∙ Reoriented Modules E and F to illustrate how results from an attributes sampling application influence the necessary level of detection risk and variables sampling application.

∙ Included vignette in Module E to illustrate how polls in the 2017 United Kingdom “snap” election, 2016 Brexit vote, and 2016 United States presidential election were subject to sampling risk and emphasize the importance of controlling sampling risk in the audit examination.

∙ Included IDEA screen captures within modules to illustrate the identification and input of parameters as well as the evaluation of sample results.

∙ Expanded number of Connect-gradable assignments in end-of-chapter materials.

MODULE G: Data and Analytics in Auditing ∙ A new module addresses the key questions stu-

dents have about what Data and Analytics are in

an auditing context, and how audit procedures using these techniques should be conducted. The module follows the approach from the AICPA Guide to Data Analytics in Auditing.

∙ The module contains an extended discussion of infor- mation produced by the entity (IPE) and how the audi- tor should assess the completeness and accuracy of this information, as well as the precision of the infor- mation for the purposes of the auditing procedure.

∙ The end of chapter multiple choice, exercises and problems contain entirely author-created questions and examples, as well as significant assistance for instruc- tors for implementing the exercises in their classrooms.

∙ Exercises and problems are linked to learning objectives in other chapters in the book to enable instructors to appropriately integrate the important topic of data and analytics throughout the auditing curriculum.

MODULE H: Auditing and Information Technology ∙ Given that the use of information technology (IT)

is pervasive in the financial reporting process on largely all audit clients in today’s environment, audi- tors must gain an understanding of how IT is used in the internal control system. This is now explained in detail in Module H with a focus on three phases: (1) determining the scope of the IT testing plan by carefully identifying each of the IT dependencies; (2) understanding the IT controls and processes that need to be tested for each IT dependency; and (3) testing the IT controls.

∙ In today’s audit environment, to help facilitate the identification of IT dependencies, as key internal control activities are identified and understood by auditors, they are generally categorized as being: (1) purely manual control activities; (2) manual control activities that rely on a system generated report; or (3) entirely automated controls. Each of these cat- egories is now described in detail in Module H.

∙ We increased our coverage of a commonly used form of reperformance testing referred to as the test data approach. When using this approach, the audi- tor will create a set of data to simulate a series of transactions that contain known errors in order to test whether the client’s IT control activity is operat- ing effectively. In the revised module, we included a commonly used example known as the test of one where auditors test a three-way match control in either the revenue or the purchasing process.

FOR INSTRUCTORS

65% Less Time Grading

®

You’re in the driver’s seat. Want to build your own course? No problem. Prefer to use our turnkey, prebuilt course? Easy. Want to make changes throughout the semester? Sure. And you’ll save time with Connect’s auto-grading too.

Checkmark: Jobalou/Getty ImagesPadlock: Jobalou/Getty Images

Make it simple, make it affordable. Connect makes it easy with seamless integration using any of the major Learning Management Systems— Blackboard®, Canvas, and D2L, among others—to let you organize your course in one convenient location. Give your students access to digital materials at a discount with our inclusive access program. Ask your McGraw-Hill representative for more information.

Solutions for your challenges. A product isn’t a solution. Real solutions are affordable, reliable, and come with training and ongoing support when you need it and how you want it. Our Customer Experience Group can also help you troubleshoot tech problems— although Connect’s 99% uptime means you might not need to call them. See for yourself at status. mheducation.com

Laptop: McGraw-Hill; Woman/dog: George Doyle/Getty Images

They’ll thank you for it. Adaptive study resources like SmartBook® 2.0 help your students be better prepared in less time. You can transform your class time from dull definitions to dynamic debates. Find out more about the powerful personalized learning experience available in SmartBook 2.0 at www.mheducation.com/highered/ connect/smartbook

FOR STUDENTS

“I really liked this app—it made it easy to study when you don't have your text- book in front of you.”

- Jordan Cunningham, Eastern Washington University

Top: Jenner Images/Getty Images, Left: Hero Images/Getty Images, Right: Hero Images/Getty Images

Calendar: owattaphotos/Getty Images

Effective, efficient studying. Connect helps you be more productive with your study time and get better grades using tools like SmartBook 2.0, which highlights key concepts and creates a personalized study plan. Connect sets you up for success, so you walk into class with confidence and walk out with better grades.

No surprises. The Connect Calendar and Reports tools keep you on track with the work you need to get done and your assignment scores. Life gets busy; Connect tools help you keep learning through it all.

Study anytime, anywhere. Download the free ReadAnywhere app and access your online eBook or SmartBook 2.0 assignments when it’s convenient, even if you’re offline. And since the app automatically syncs with your eBook and SmartBook 2.0 assignments in Connect, all of your work is available every time you open it. Find out more at www.mheducation.com/readanywhere

Learning for everyone. McGraw-Hill works directly with Accessibility Services Departments and faculty to meet the learning needs of all students. Please contact your Accessibility Services office and ask them to email [email protected], or visit www.mheducation.com/about/accessibility for more information.

First Pages

xxii

lou6920x_fm_i-xxxiv.indd xxii 04/21/20 09:20 PM

Dawn P. Addington Central New Mexico Community College

Michael D. Akers Marquette University

Fatima Alali California State University–Fullerton

Sylvia Anderson University of Maryland University College

Jeffrey J. Archambault Marshall University

Jack Armitage University of Nebraska–Omaha

MaryAnne Atkinson Central Washington University

Dereck D. Barr The University of Mississippi

LuAnn Bean Florida Institute of Technology

Frank J. Beil University of Minnesota

Marie Blouin Penn State University–Harrisburg

David Blum Moraine Park Technical College

Russell F. Briner University of Texas at San Antonio

Alexander K. Buchholz Brooklyn College of the City University of New York

Suzanne M. Busch California State University–East Bay

Eric Carlsen Kean University

OUR SINCEREST THANKS . . . The American Institute of Certified Public Accountants (AICPA) has generously given permission for liberal quotations from official pronouncements and other AICPA publi- cations, all of which lend authoritative sources to the text. In addition, several publish- ing houses, professional associations, and accounting firms have granted permission to quote and extract from their copyrighted material. Their cooperation is much appreci- ated because a great amount of significant auditing thought exists in this wide variety of sources.

A special acknowledgment is due to the Association for Certified Fraud Examiners (ACFE). It has been a generous contributor to the fraud auditing material in this text. The authors also acknowledge the valuable inclusion of the educational version of IDEA software in the eighth edition, which significantly enhances the practical application of the book.

Also, the authors are particularly grateful to Ryan Dunn (Auburn University), Meghann Cefaratti (Northern Illinois University), Brad Roof (James Madison Univer- sity), and Yigal Rechtman (Pace University) for their many insightful comments over the past several years. The feedback they contributed while teaching from our text has contributed greatly to the clarity and accuracy of subsequent editions. A special thanks to Michael K. Shaub for his valuable critique of Chapter 5 and to Cristina Alberti for her input on Module H. In addition, thanks to Steven Dwyer, Suzanne McLaughlin, and Frank Wimer for the example developed to help explain the difference between general and application controls in Module H. Thanks to Helen Roybark for her help with the preparation of the instructor PowerPoint presentations and Joleen Kremin for her contri- bution to the Apollo Shoes, Inc. case.

We are sincerely grateful for the valuable input of all those who helped guide our developmental decisions for the past seven editions of Auditing & Assurance Services:

Acknowledgments

First Pages

Acknowledgements xxiii

lou6920x_fm_i-xxxiv.indd xxiii 04/21/20 09:20 PM

Meghann Cefaratti Northern Illinois University

John Critchett Madonna University

Karl Dahlberg Rutgers University

John E. Delaney Southwestern Texas University

Marcus Mason Doxey University of Kentucky

Raymond Elson Valdosta State University

Tom English Boise State University

Patricia Feller Nashville State Community College

Marilyn Fisher Corinthian Colleges

Diana R. Franz University of Toledo

John Gabelman Columbus State Community College

Clyde Galbraith West Chester University

Andy Garcia Bowling Green State University

David Gelb Seton Hall University

Earl Godfrey Gardner-Webb University

Judith G. Grant Northern Virginia Community College at Annandale

Emily Elaine Griffith The University of Georgia

Richard Hale Midway College

James Hansen University of Illinois at Chicago

Aretha Hill Florida A&M University

Steven C. Hunt Western Illinois University

Venkataraman Iyer The University of North Carolina at Greensboro

Keith Jones George Mason University

Bonita K. Peterson Kramer Montana State University–Bozeman

Joseph M. Larkin St. Joseph’s University

Rose Layton University of Southern California

Pamela Legner College of DuPage

Philip Levine Berkeley College

R. D. Licastro Penn State University–University Park

Maureen Mascha Marquette University

Dorothy McMullen Rider University

Heidi H. Meier Cleveland State University

Bharat Merchant Baruch College

Eddie Metrejean Georgia Southern University

Charles Miller California Polytech University

Perry Moore Lipscomb University

Fowler A. Murrell Lehman College

Ramesh Narasimhan Montclair State University

Vincent Owhoso Northern Kentucky University

Dwight M. Owsen Long Island University Brooklyn

Gary Peters University of Arkansas

Byron Pike Minnesota State University–Mankato

Marshall Pitman University of Texas–San Antonio

Sharon Polansky Texas A&M University–Corpus Christi

First Pages

xxiv Acknowledgements

lou6920x_fm_i-xxxiv.indd xxiv 04/21/20 09:20 PM

In addition, we would like to recognize our outstanding staff at McGraw-Hill: Manag- ing Director, Tim Vertovec; Brand Manager, Elizabeth Eisenhart; Marketing Manager, Kate Wheeler; Core Product Developer, Erin Quinones; Assessment Product Developer, Allie Kukla; Content Project Managers, Mary Powers and Angela Norris; Buyer, Laura Fuller; and Designer, Matt Diamond. For their encouragement, assistance, and guidance in the production of this book, we are grateful.

Kathy Pollock Indiana University–Purdue University Fort Wayne

Duane Ponko Indiana University of Pennsylvania

Dwayne Powell Arkansas State University

Abdul Qastin North Carolina A&T State

Linda Quick University of South Carolina

Hema Rao SUNY–Oswego

Jason T. Rasso University of South Florida

Yigal Rechtman Pace University

Tracy Reed Appalachian State University

Barbara Reider University of Montana

Raymond Reisig Pace University

John Rigsby Mississippi State University

Pamela Roush University of Central Florida

Maria Sanchez Rider University

Kristen Kelli Saunders University of South Carolina

Tammi Schaefer University of South Carolina

Bunney L. Schmidt Utah Valley State College

Timothy Andrew Seidel University of Arkansas

Carol Shaver Louisiana Tech University

Jaysinha Shinde Eastern Illinois University

Adrianne Slaymaker Metropolitan State University

Duane Smith Brescia University

Beverly Strachan Troy University at Montgomery

Iris Stuart California State University

Christine N. Todd Colorado State University–Pueblo

John Trussel Penn State University–Harrisburg

Jerry L. Turner University of Memphis

Frank Venezia State University at Albany

Barbara Vinciguerra Moravian College

Bobby Waldrup University of North Florida

Rick Warne University of Cincinnati

J. Donald Warren Jr. Rutgers University

Christian Wurst Temple University

Tu Xu Georgia State University

Xu Zhaohui University of Houston–Clear Lake

Lin Zheng Northeastern Illinois University

Douglas Ziegenfuss Old Dominion University

First Pages

Acknowledgements xxv

lou6920x_fm_i-xxxiv.indd xxv 04/21/20 09:20 PM

Few understand the enormous commitment of time and energy that it takes to put together a textbook. As authors, we are constantly scanning The Wall Street Journal and other news outlets for real-world examples to illustrate theoretical discussions, reread- ing and rewriting each other’s work to make sure that key concepts are understandable, and double-checking our solutions to end-of-chapter problems. Among the few who do understand the time and energy commitment are our family members (Barbara Louwers; Matt, Garrett, and Julianne Bagley; Kristin, Jackson, Elijah, Jonah, Ansley, and Laney Grace Blay; Susan and Meghan Strawser; and Ellen, Jenny, Eric, and Jessica Thibodeau) who uncomplainingly endured endless refrains of, “I just need a couple more minutes to finish this section.” Words cannot express our gratitude to each of them for their patience and unending support.

Tim Louwers

Pennie Bagley

Allen Blay

Jerry Strawser

Jay Thibodeau

First Pages

xxvi

lou6920x_fm_i-xxxiv.indd xxvi 04/21/20 09:20 PM

12. Reports on Audited Financial Statements 537

PART THREE Stand-Alone Modules

Please refer to pages xviii–xxiii for guidance on when to best integrate these modules.

A. Other Public Accounting Services 593 B. Professional Ethics 631 C. Legal Liability 679 D. Internal Audits, Governmental Audits, and

Fraud Examinations 721 E. Attributes Sampling 757 F. Variables Sampling 796 G. Data and Analytics in Auditing 845 H. Information Technology Auditing 881 INDEX 922

PART ONE The Contemporary Auditing Environment

1. Auditing and Assurance Services 1 2. Professional Standards 41

PART TWO The Financial Statement Audit

3. Engagement Planning and Audit Evidence 78

4. The Audit Risk Model and Inherent Risk Assessment 117

5. Risk Assessment: Internal Control Evaluation 172

6. Employee Fraud and the Audit of Cash 220 7. Revenue and Collection Cycle 269 8. Acquisition and Expenditure Cycle 328 9. The Production Cycle and Auditing

Inventory 389 10. Finance and Investment Cycle 443 11. Completing the Audit 499

Brief Contents

First Pages

xxvii

lou6920x_fm_i-xxxiv.indd xxvii 04/21/20 09:20 PM

Chapter 2 Professional Standards 41 Introduction 42 Generally Accepted Auditing Standards (GAAS) 44

Organization of GAAS 45 Fundamental Principle: Responsibilities 46

Competence and Capabilities 47 Independence and Due Care 47 Professional Skepticism and Professional

Judgment 49 Fundamental Principle: Performance 50

Reasonable Assurance 51 Planning and Supervision 51 Materiality 52 Risk Assessment 53 Audit Evidence 54

Fundamental Principle: Reporting  56 Evaluating the Quality of Public Accounting Firms’ Practices 59

System of Quality Control 59 PCAOB Inspection of Firms 61

Summary 63 Key Terms 64 Multiple-Choice Questions for Practice and Review 65 Exercises and Problems 69 Appendix 2A Referencing Professional Standards 76

PART TWO THE FINANCIAL STATEMENT AUDIT

Chapter 3 Engagement Planning and Audit Evidence Introduction 79 Pre-Engagement Activities 80

Client Acceptance or Continuance 80 Compliance with Independence and Ethical

Requirements 83 Engagement Letters 84

Audit Plan 85 Staffing the Audit Engagement 86 Time Budget 89

Materiality 91 Materiality Calculation 92

PART ONE THE CONTEMPORARY AUDITING ENVIRONMENT

Chapter 1 Auditing and Assurance Services User Demand for Reliable Information 2

Information Risk in a Big Data World 3 Auditing, Attestation, and Assurance Services 4

Definition of Financial Statement Auditing 5 Auditing in a Big Data Environment 6 Attestation Engagements 7 Assurance Services 8 Examples of Assurance Services 10

Management’s Financial Statement Assertions 11

Existence or Occurrence (Existence, Occurrence, Cutoff) 14

Completeness (Completeness, Cutoff) 14 Valuation and Allocation (Accuracy or

Valuation) 15 Rights and Obligations (Rights and

Obligations) 15 Presentation and Disclosure (Classification,

Understandability) 16 Importance of Assertions 16

Professional Skepticism 18 Public Accounting 21

Assurance Services 21 Tax Services 23 Advisory Services 23

Other Kinds of Engagements and Information Professionals 24

Internal Auditing 24 Governmental Auditing 25 Regulatory Auditors 26

Become a Professional and Get Certified! 26 Education 27 Examination 27 Experience 28 State Certificate and License 29 Skill Sets and Your Education 30

Summary 31 Key Terms 31 Multiple-Choice Questions for Practice and Review 32 Exercises and Problems 38

Contents

First Pages

xxviii Contents

lou6920x_fm_i-xxxiv.indd xxviii 04/21/20 09:20 PM

Audit Team Brainstorming Discussions 144 Inquiry of Audit Committee, Management, and Others

within the Company 144 Overall Assessment and Documentation of Inherent Risk Assessment 145

Document Risk Assessment 146 Fraud and Other Significant Risks 146 Communication of Fraud Risks 147

Auditors’ Responsibilities for Client Noncompliance with Laws and Regulations 148 Audit Strategy Memorandum 150 Summary 151 Key Terms 152 Multiple-Choice Questions for Practice and Review 153 Exercises and Problems 157 Appendix 4A Selected Financial Ratios 168 Appendix 4B Sample Audit Memorandum 169

Chapter 5 Risk Assessment: Internal Control Evaluation Introduction 173 Internal Control Defined 174 Management Versus Auditors’ Responsibility for Internal Control 175

Management’s Internal Control Responsibilities 175 Auditors’ Internal Control Responsibilities 176

Components of Internal Control 178 Control Environment 179 Risk Assessment 181 Control Activities 182 Information and Communication 187 Monitoring 189 Limitations of Internal Control 190

Internal Control Evaluation 191 Phase 1: Understand and Document the Client’s Internal

Control 191 Phase 2: Assess the Control Risk (Preliminary) 197 Phase 3: Identify Controls to Test and Perform Tests of

Controls 199 Responsibilities in the Audits of Issuers Required by PCAOB Auditing Standard No. 2201 204

Requirements 204 Internal Control Communications 207 Summary 209 Key Terms 209 Multiple-Choice Questions for Practice and Review 211 Exercises and Problems 214 Appendix 5A Audit Plan 219

Audit Procedures for Obtaining Audit Evidence 94 1. Inspection of Records and Documents 96 2. Inspection of Tangible Assets 99 3. Observation 99 4. Inquiry 99 5. Confirmation 100 6. Recalculation 101 7. Reperformance 101 8. Analytical Procedures 101

Audit Documentation 103 Permanent Files 103 Current Files 104 Audit Documentation Arrangement and Indexing 105

Summary 107 Key Terms 108 Multiple-Choice Questions for Practice and Review 109 Exercises and Problems 113

Chapter 4 The Audit Risk Model and Inherent Risk Assessment Introduction 118 Audit Risk 118

Audit Risk 118 Inherent Risk 119 Control Risk 120 Detection Risk 120 Audit Risk Model 120

Fraud Risk 124 Fraud 126 Types of Fraud 127

Inherent Risk Assessment—“What Could Go Wrong?” 130

Understanding the Client’s Business and Its Environment 132

Industry, Regulatory, and Other External Factors 132

The Nature of the Company 133 Related Parties 134 Client Computerized Processing 134 Selection and Application of Accounting Principles,

Including Related Disclosures 135 Company Objectives, Strategies, and Related Business

Risks 136 Company Performance Measures 136

Gathering Information and Preliminary Analytical Procedures 137

General Business Sources 137 Company Sources 138 Information from Client Acceptance or Continuance

Evaluation, Audit Planning, Past Audits, and Other Engagements 138

Preliminary Analytical Procedures 138

First Pages

Contents xxix

lou6920x_fm_i-xxxiv.indd xxix 04/21/20 09:20 PM

Internal Control Activities and Design Evaluation 281

Entity-Level Controls in the Revenue and Collections Cycle 281

Control Considerations at the Account and Assertion Level 282

Tests of Operating Effectiveness of Internal Control 284

Summary: Control Risk Assessment 287 Substantive Analytical Procedures and Tests of Details 288

Analytical Procedures 291 Confirmation of Accounts and Notes Receivable 291 Alternative Procedures 296 Additional Notes about Confirmations 297 Dual-Purpose Nature of Accounts Receivable

Confirmations 297 Review for Collectability  297 Cutoff and Sales Returns 298

Audit Risk Model Applied 300 Application in the Field 300 Audit Cases: Extended Audit Procedures 301 Summary 308 Key Terms 309 Multiple-Choice Questions for Practice and Review 309 Exercises and Problems 314 Appendix 7A Internal Control Questionnaires 324 Appendix 7B Audit Plan 326

Chapter 8 Acquisition and Expenditure Cycle Introduction 329 Acquisition and Expenditure Cycle: Typical Activities 330

Purchasing Goods and Services 330 Receiving the Goods or Services 333 Recording the Asset or Expense and Related

Liability 333 Significant Accounts and Relevant Assertions 333

Accounts Payable 334 Expenses 335

Risk of Material Misstatement 336 Internal Control Activities and Design Evaluation 338

Entity-Level Controls 338 Control Considerations 338 Custody 340 Periodic Reconciliation 340

Chapter 6 Employee Fraud and the Audit of Cash Introduction 221

Employee Fraud Overview 222 Employee Fraud Red Flags 223 Characteristics of Fraudsters 223

The Fraud Triangle 225 Incentive/Pressure 226 Opportunity 226 Attitude/Rationalization 227

Fraud Prevention 228 Managing People and Pressures in the Workplace 228 Internal Control Activities and Employee

Monitoring 229 Tone at the Top 231

The Audit of Cash 232 Management Reports and Data Files in an Audit of

Cash 233 Significant Accounts and Relevant Assertions 236 Risk of Material Misstatement 236 Evaluating the Design and Operating Effectiveness of

Internal Controls 237 Substantive Procedures 243

“Extended Procedures” to Detect Fraud 248 Summary 252 Key Terms 253 Multiple-Choice Questions for Practice and Review 254 Exercises and Problems 258 Appendix 6A Internal Control Questionnaires 266 Appendix 6B Audit Plans 268

Chapter 7 Revenue and Collection Cycle Introduction 270 Revenue and Collection Cycle: Typical Activities 271

Receiving and Processing Customer Orders, Including Credit Granting 272

Delivering Goods and Services to Customers 272 Billing Customers and Accounting for Accounts

Receivable 273 System Generated Reports and Data Files in the Revenue

and Collection Cycle 273 Significant Accounts and Relevant Assertions 276 Risk of Material Misstatement 277

Revenue Recognition 277 Collectability of Accounts Receivable 280 Customer Returns and Allowances 280

First Pages

xxx Contents

lou6920x_fm_i-xxxiv.indd xxx 04/21/20 09:20 PM

Financing the Entity through Debt and Stockholder Equity 447

Financial Planning 447 Raising Capital 447 Investing Transactions: Investments

and Intangibles 450 Significant Accounts and Relevant Assertions 452 Risk of Material Misstatement 453

Complex Transactions 454 Fair Market Value 455 Related-Party Transactions 455 Lease Accounting 456 Loan Covenants 456 Impairments 457 Presentation and Disclosure 457

Internal Control Activities and Design Evaluation 458

Control Considerations 460 Tests of Operating Effectiveness of Internal Control 460

Control over Accounting Estimates 463 Authorization 464 Record Keeping 464 Custody 465 Summary: Control Risk Assessment 465

Substantive Analytical Procedures and Tests of Details 466

Auditing Accounting Estimates, including Fair Value Measurements 472

Long-Term Liabilities and Related Accounts 475 Stockholders’ Equity: Substantive Procedures 476 Auditing Stock-Based Compensation Plans 477

Fraud Cases: Extended Audit Procedures 478 Summary 482 Key Terms 483 Multiple-Choice Questions for Practice and Review 484 Exercises and Problems 487 Appendix 10A Internal Control Questionnaires 495 Appendix 10B Substantive Audit Plans 496

Chapter 11 Completing the Audit Introduction 500 Audit Timeline 501 Procedures Performed During Fieldwork 503

Completing Substantive Procedures 503 Attorney Letters 504 Written Representations 507 Ability to Continue as a Going Concern 509 Adjusting Entries and Financial Statement

Disclosure 510

Testing of Operating Effectiveness of Internal Control 341

Tests of Controls 341 Substantive Analytical Procedures and Tests of Details 344

Open Purchase Orders 346 Audit Risk Model Applied 352 Fraud Cases: Extended Audit Procedures 354 Audit Issues in the Expense and Acquisition Cycle 357 Summary 358 Key Terms 358 Multiple-Choice Questions for Practice and Review 359 Exercises and Problems 362 Appendix 8A Internal Control Questionnaires 372 Appendix 8B Audit Plans 375 Appendix 8C The Payroll Cycle 377

Chapter 9 The Production Cycle and Auditing Inventory Keeping Count 390 Inventory Management: Typical Activities 391 Significant Accounts and Relevant Assertions 395 Risk of Material Misstatement 396 Internal Control Activities and Design Evaluation 399 Testing of Operating Effectiveness of Internal Control 403 Substantive Analytical Procedures and Tests of Details 408

Difficult Inventory Circumstances 415 Audit Risk Model Applied 420

Fraud Case: Extended Audit Procedures (AS 2301) 421 Summary 422 Key Terms 424 Multiple-Choice Questions for Practice and Review 425 Exercises and Problems 428 Appendix 9A Internal Control Questionnaires 439 Appendix 9B Audit Plans 441

Chapter 10 Finance and Investment Cycle Introduction 444 Finance and Investment Cycle: Typical Activities 446

First Pages

Contents xxxi

lou6920x_fm_i-xxxiv.indd xxxi 04/21/20 09:20 PM

PART THREE STAND-ALONE MODULES

MODULE A Other Public Accounting Services Introduction 594 Introduction to Attestation Engagements 595 Attestation Engagements: Special Audit Reporting Considerations 596

Special Purpose Frameworks 597 Specified Elements, Accounts, or Items 598 Compliance with Contractual Agreements or Regulatory

Requirements 599 Other Attestation Engagements 600

Applying Agreed-Upon Procedures 600 Prospective Financial Information 601 Compliance Attestation 604 Service Organizations 606 Other Attestation Engagements and Summary 608

Accounting and Review Services for Historical Financial Information 609

Review Engagements 609 Compilation Engagements 611 Preparation Engagements 612 Summary of Engagements on Historical Financial

Information 613 Assurance Services Engagements 614

Scope of Assurance Services 614 Trust Services 615 The Future of Assurance Services 617

Summary 617 Key Terms 618 Multiple-Choice Questions for Practice and Review 619 Exercises and Problems 623

MODULE B Professional Ethics Introduction 632 General Ethics 633 An Ethical Decision Process 634 Philosophical Principles in Ethics 635

The Imperative Principle 635 The Principle of Utilitarianism 637 The Generalization Argument 637 Virtue Ethics 637

Ethical Codes of Conduct 638 U.S. Securities and Exchange Commission

(SEC) 639 The Public Company Accounting Oversight Board

(PCAOB) 639 The International Federation of Accountants

(IFAC) 640

Audit Documentation Review 513 Subsequent Events and Subsequently Discovered Facts 514

Subsequent Events 515 Subsequently Discovered Facts 516

Responsibilities Following the Audit Report Release Date 518

Omitted Procedures 518 Communications with Individuals Charged with

Governance  518 Management Letter 520 Summary of Audit Communications 520

Summary 521 Key Terms 521 Multiple-Choice Questions for Practice and Review 522 Exercises, Problems, and Simulations 526

Chapter 12 Reports on Audited Financial Statements Introduction 538 Overview of Auditors’ Reports 539

The Standard Report for Non-Issuers 540 Types of Opinions 542

Conditions that Require Modifications to the Auditors’ Standard (Unmodified) Report 543

Departures from GAAP 543 Scope Limitations 546

Audits of Group Financial Statements 550 Auditors’ Reports Referencing Other Matters Encountered During the Audit 553

Consistency 553 “Going-Concern” Uncertainties 554 Other Information Included in Annual

Reports 555 Required Supplementary Information 556 Other Modifications 556 Summary: Emphasis-of-Matter and Other-Matter

Paragraphs 557 Other Reporting Topics 557

Comparative Financial Statements 558 Summary Financial Statements 560 Supplementary Information 561 Disclaimers of Opinion 561

Summary 562 Key Terms 564 Multiple-Choice Questions for Practice and Review 565 Exercises and Problems 568 Appendix 12A Auditors’ Reports for Issuers (Public Entities) 581

First Pages

xxxii Contents

lou6920x_fm_i-xxxiv.indd xxxii 04/21/20 09:20 PM

The Changing Landscape of Auditors’ Liability 698 Sarbanes–Oxley 699 Racketeer Influenced and Corrupt Organizations Act 700 Aiding and Abetting 700 Organization of Accounting Firms as Limited Liability

Partnerships 701 Proportionate Liability 701 Class-Action Suits 702 Auditors’ Liability Caps 703 Other Developments 703

Summary 704 Key Terms 705 Multiple-Choice Questions for Practice and Review 706 Exercises and Problems 711

MODULE D  Internal Audits, Governmental Audits, and Fraud Examinations 721 Introduction 722 Internal Audits, Governmental Audits, and Fraud Examinations 722 Internal Audits 723

Internal Auditing Defined 723 Types of Internal Audit Services 725 Internal Audit Standards 728 Internal Audit Reports 729

Governmental Audits 730 Governmental Auditing Defined 730 Types of Governmental Audits 731 GAO Government Auditing Standards 733 GAO Audit Reports 734 Single Audit Act of 1984 and Amendments of 1996 735

Fraud Examinations 737 The Art of Fraud Examinations 739 Fraud Examiner Responsibilities 741 Building a Fraud Case 742 Protecting the Evidence 742 Obtaining Litigation Support 742

Summary 743 Key Terms 744 Multiple-Choice Questions for Practice and Review 745 Exercises and Problems 748

MODULE E Attributes Sampling 757 Introduction 758 Planning (Steps 1-3) 759

Step 1: Determine the Objective of Sampling 759 Step 2: Define the Characteristic of Interest 759 Step 3: Define the Population 760

Performing (Steps 4-6) 761 Step 4: Determine the Sample Size 761

The Professional Ethics Executive Committee (PEEC) of the American Institute of CPAs (AICPA) 640

An Emphasis on Independence 642 American Institute of Certified Public Accountants 642 SEC and PCAOB Independence Rules 649 Other Effects of Sarbanes–Oxley on Auditor

Independence 652 Government Accountability Office (GAO) Independence

Requirements 652 AICPA Rules of Conduct: Integrity and Objectivity, Responsibilities to Clients, and Other Responsibilities 653

Integrity and Objectivity Rule 653 General Standards Rule 654 Compliance with Standards Rule 655 Accounting Principles Rule 655 Confidential Client Information Rule 656 Fees and Other Types of Remuneration 658 Acts Discreditable Rule 660 Advertising and Other Forms of Solicitation Rule 660 Form of Organization and Name Rule 661

Consequences of Violating the Code of Professional Conduct 662

Self-Regulatory Discipline 663 Public Regulation Discipline 664

Summary 665 Key Terms 666 Multiple-Choice Questions for Practice and Review 666 Exercises and Problems 671

MODULE C Legal Liability 679 The Legal Environment 681 Liability Under Common Law 683

Liability to Clients 683 Liability to Third Parties 684 Liability for Compilation and Review Services 688

Liability Under Statutory Law 689 The Securities Act of 1933 (Securities Act) 690

Section 11: Civil Liability 690 Auditors’ Defenses under the Securities Act 691 Section 13: Statute of Limitations 692 Section 17: Antifraud 692 Section 24: Criminal Liability 692

The Securities Exchange Act of 1934 (Securities Exchange Act) 693

Section 10 and Rule 10(b)-5: Antifraud 693 Section 18: Civil Liability 694 Auditors’ Defenses under the Securities Exchange Act 695 Section 32: Criminal Liability 695 Foreign Corrupt Practices Act (FCPA) 696

Summary of Auditors’ Liability to Clients and Third Parties 697

First Pages

Contents xxxiii

lou6920x_fm_i-xxxiv.indd xxxiii 04/21/20 09:20 PM

Risk Assessment Procedures 850 Tests of Controls 852 Substantive Analytical Procedures 853 Tests of Details 855

Conducting Audit Data Analytics 857 Plan the ADA 857 Access and Prepare the Data 858 Consider the Relevance and Reliability of the Data

Used 859 Perform the ADA 861 Evaluate the Results and Draw Conclusions 861

Documentation Requirements 862 Common Tools Used in ADA 863

Professional Skepticism in ADA 864 The Next Generation of Auditing 864

External Big Data 865 Artificial Intelligence 865 Distributed Ledger Technology 865

Summary 866 Key Terms 867 Multiple-Choice Questions for Practice and Review 868 Exercises and Problems 870

MODULE H Information Technology Auditing 881 Information Technology (IT) Systems 882 Reliance on IT Controls 884

Scoping the IT Audit Procedures 885 Types of IT Control Activities 886 General IT Controls 887 Automated Application Controls 893 Output Controls 896

Assessing Control Risk in an IT Environment 898 Testing Controls in an IT Environment 900 End-User Computing and Other Environments 903

End-User Computing Control Considerations 903 Service Organizations 905

Computer Abuse and Computer Fraud 906 Preventive, Detective, and Damage-Limiting

Controls 907 Computer Forensics 909

Summary 909 Key Terms 910 Multiple-Choice Questions for Practice and Review 911 Exercises and Problems 913

Index 922

Step 5: Select the Sample Items 767 Step 6: Measure the Sample Items 767

Evaluating Sample Results (Step 7) 768 Calculating the Upper Limit Rate of Deviation 768 Making the Evaluation Decision 770 Qualitative Evaluation of Deviations 771

Documenting 773 Other Attributes Sampling Methods 774 Summary 775 Key Terms 776 Multiple-Choice Questions for Practice and Review 777 Exercises and Problems 780 Appendix E.A AICPA Sample Size Tables 793 Appendix E.B AICPA Sample Evaluation Tables 795

MODULE F Variables Sampling 796 Introduction 797

Role of Variables Sampling in the Audit 797 Definition of Variables Sampling 797 Monetary Unit Sampling (MUS): Planning 798

Steps 1–3: Planning 799 MUS: Performing 800

Step 4: Determine the Sample Size 800 Step 5: Select the Sample Items 804 Step 6: Measure the Sample Items 805

MUS: Evaluating 806 Step 7: Evaluating Sample Results 806

Other Variables Sampling Approaches 811 Documentation in Variables Sampling 812

Summary 813 Key Terms 813 Multiple-Choice Questions for Practice and Review 815 Exercises and Problems 818 Appendix F.A AICPA MUS Tables 829 Appendix F.B Classical Variables Sampling 831 Appendix F.C Nonstatistical Sampling 842

MODULE G Data and Analytics in Auditing 845 Introduction 846 Audit of the Future 848

Data and Analytics 849 Common Uses of Audit Data Analytics 850

Auditing & Assurance Services

First Pages

1

lou6920x_ch01_001-040.indd 1 02/19/20 02:57 PM

LEARNING OBJECTIVES You are about to embark on a journey of understanding how auditors work to keep the capital markets safe and secure for the investing public. You should know that students demonstrate success in the auditing course quite differently from the way they do in other accounting courses. For example, when taking financial accounting, students typically demonstrate success by correctly identifying the proper journal entry for a given set of facts and circumstances. In auditing, success is typically demonstrated by completing multiple-choice, short- answer, and simulation-type questions based on the professional standards that regulate the auditing process. Overall, this book provides you with a comprehensive set of materials that will allow you

to master these professional auditing standards. Chapter 1 provides an introduction to the auditing and assurance profession.

Your objectives are to be able to

LO 1-1 Define information risk and explain how the financial statement auditing process helps to reduce this risk, thereby reducing the cost of capital for a company.

LO 1-2 Define and contrast financial statement auditing, attestation, and assurance services.

LO 1-3 Describe and define the assertions that management makes about the recognition, measurement, presentation, and disclosure of the financial statements and explain why auditors use them as the focal point of the audit.

Doty, James R. Keynote Address: The Reliability, Role and Relevance of the Audit: A Turning Point. New York: Public Company Accounting Oversight Board, 2011.

Our system of capital formation relies upon the confidence of millions of

savers to invest in companies. The auditor’s opinion is critical to that trust.

Auditing and Assurance Services

C H A P T E R 1

Professional Standards References

Topic AU-C/ISA Section

AS Section

Overall Objectives of the Independent Auditor  200 1001 1005 1010 1015

Consideration of Fraud in a Financial Statement Audit 240 2401

Audit Evidence 500 1105

Attestation Standards AT 101 AT 101

Compliance Auditing Considerations in Audits of Recipients of Governmental Financial Assistance 935 6110

First Pages

2 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 2 02/19/20 02:57 PM

USER DEMAND FOR RELIABLE INFORMATION When seeking capital to grow their business, management has an incentive to present their company’s financial statements and future prospects in a manner that will entice potential investors and creditors. As a result, it is essential that investors and creditors have assurance that they can rely on the information provided by management, which creates demand for the financial statement audit. If only investors in Theranos, a blood-testing startup company, had asked for an independent audit report. In March 2018, the Securi- ties and Exchange Commission (SEC) settled massive fraud charges against Theranos and their president, Sunny Balwani. The SEC’s complaint alleged that the materials provided to potential investors included a company overview, reports of clinical trials, and financial statement information and projections. However, the package did not include an indepen- dent audit report. Unfortunately the company, which was valued as high as $9 billion by investors back in 2009, barely had enough cash to pay the bills just five years later.1 This example helps to reinforce why it is so important for investors and creditors to review audited financial statements as they consider whether to invest or loan money to a com- pany. It also helps to explain why audit quality is so important to investors and creditors.

You may be asking, why is audit quality so important? Well, as we have just seen, both investors and creditors depend on reliable financial statement information to make their investment and lending decisions about a company. As a result, the confidence of investors and creditors is shaken each and every time that audit quality is compromised. To help ensure that audit quality is not compromised, the Sarbanes–Oxley Act of 2002 created the Public Company Accounting Oversight Board (PCAOB) to regulate the audit profession for public companies. In fact, the PCAOB is responsible for setting all audit standards to be followed on audits of public companies. In addition, the PCAOB is required to perform inspections of the audit work completed and the quality control pro- cesses employed by audit firms. As a direct result, accounting students should know that if they plan to work as financial statement auditors, they will be entering a world that is focused on audit quality. Consider the following Auditing Insight.

LO 1-1 Define information risk and explain how the financial statement auditing process helps to reduce this risk, thereby reducing the cost of capital for a company.

1https://www.marketwatch.com/story/the-investors-duped-by-the-theranos-fraud-never-asked-for-one-important- thing-2018-03-19

In January 2019, KPMG published its report on audit quality for 2018. In the report, the firm’s leaders affirmed their responsibility to the investing public for instilling confidence in the capital mar- kets. The key drivers of the firm’s audit quality efforts include a strong system of quality control, including the establishment of a firm culture with an unrelenting focus on delivering high quality audits. In addition, and perhaps most importantly, the report high- lighted the importance of developing its people and its investment

in the audit of the future. The report specifically discussed the firm’s investment in cognitive technologies such as IBM’s Wat- son and the importance of harnessing the emerging power of Big Data. The report is a clear indication to students that quality matters more than anything else in their future work as auditing professionals.

Source: https://home.kpmg/content/dam/kpmg/us/pdf/2019/01/progress- through-change-kpmg-2018-audit-quality-report.pdf?n=3.

Audit QualityAUDITING INSIGHT

LO 1-4 Define professional skepticism and explain its key characteristics.

LO 1-5 Describe the organization of public accounting firms and identify the various services that they offer.

LO 1-6 Describe the audits and auditors in governmental, internal, and operational auditing.

LO 1-7 List and explain the requirements for becoming a certified public accountant (CPA) and other certifications available to an accounting professional.

First Pages

Chapter 1 Auditing and Assurance Services 3

lou6920x_ch01_001-040.indd 3 02/19/20 02:57 PM

Before we think about audit quality any further, we must first explain the vital role that financial statement auditors play in supplying key decision makers with useful, under- standable, and timely information. When you have a better understanding of why audit- ing is so critical to help ensure the liquidity of the world’s capital markets, we will then explore in detail the process auditors take to help ensure that audit quality is achieved. Because many of you are likely planning to enter the public accounting profession and work as an auditor, we hope that you will work hard to acquire this knowledge so that you may do your part in playing a key role in maintaining the public’s confidence in both the auditing profession and the capital markets.

Information Risk in a Big Data World All businesses make a countless number of decisions each and every day. Decisions to purchase or sell goods or services, lend money, enter into employment agreements, or buy or sell investments depend in large part on the quality of useful information. These decisions affect business risk, which is the risk that an entity will fail to meet its objec- tives. For example, business risk includes the chance a company takes that customers will buy from competitors, that product lines will become obsolete, that taxes will increase, that government contracts will be lost, or that employees will go on strike. If the company fails to meet its objectives enough times, the company may ultimately fail. To minimize these risks and take advantage of other opportunities presented in today’s competitive business environment, decision makers such as chief executive officers (CEOs) demand timely, relevant, and reliable information. Similarly, investors and creditors demand high- quality information to make educated financial decisions. Information professionals such as accountants and auditors help satisfy this demand.

In recent years, as a result of ever-increasing computing power, the decision-making environment is rapidly being transformed into one that is characterized by the availability of significant amounts of data and information. Let’s face it, the amount of informa- tion that organizations are seeking to manage is larger than anyone could have possibly imagined just 10 years ago. You are entering a world where upper management teams are placing more emphasis than ever on how to make sense of this seemingly ever-increasing availability of data and information. To help you prepare for this “big data” challenge, we will be drawing upon this theme in multiple chapters throughout this book.

There are at least four environmental conditions in this big data world that increase user demand for relevant and reliable information:

1. Complexity. Events and transactions in today’s global business environment are numer- ous and often very complicated. You may have studied derivative securities and hedging activities in other accounting courses, but investors and other decision makers may not have your level of expertise when dealing with these complex transactions. Furthermore, these decision makers are not trained to collect, compile, and summarize the key operat- ing information themselves. They need the services provided by information profession- als to help make the information more understandable for their decision processes.

2. Remoteness. Decision makers are usually separated from current and potential business partners not only by a lack of expertise but also by distance and time. Investors may not be able to visit distant locations to check up on their investments. They need to employ full-time information professionals to do the work they cannot do for themselves.

3. Time sensitivity. Today’s economic environment requires businesses, investors, and other financial information users to make decisions more rapidly than ever before. The ability to promptly obtain high-quality information is essential to businesses that want to remain competitive in our global business environment.

4. Consequences. Decisions can involve a significant investment of resources. The con- sequences are so important that reliable information, obtained and verified by infor- mation professionals, is an absolute necessity. Enron’s aftermath provides a graphic example of how decisions affect individuals’ (as well as companies’) financial secu- rity and well-being. Enron’s stock dropped from $90 to $0.90 in little more than a year, leaving employees who had invested their life savings in the company virtually

First Pages

4 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 4 02/19/20 02:57 PM

penniless. To put this drop in perspective, an investor’s $5 million investment in Enron stock in 2000 (enough for an enjoyable retirement) was worth only $50,000 a year later.

A further complication in effective decision making is the presence of information risk. Information risk is the probability that the information circulated by a company will be false or misleading. Decision makers usually obtain their information from companies or organizations they want to conduct business with, provide loans to, or engage with in buy- ing or selling the company’s stock. Because the primary source of information is the target company itself, an incentive exists for that company’s management to make its business or service appear to be better than it actually is, to put its best foot forward. As a result, preparers and issuers of financial information (directors, managers, accountants, and other people employed in a business) might benefit by giving false, misleading, or overly opti- mistic information. This potential conflict of interest between information providers and users, along with financial statement frauds such as those of Enron and WorldCom, leads to a natural skepticism on the part of users. Thus, they depend on information profession- als to serve as independent and objective intermediaries who will lend credibility to the information. This lending of credibility to information is known as providing assurance. When the assurance is provided for specific assertions made by management, we refer to the assurance provided as attestation. When the assertions are embodied in a company’s financial statements, we refer to the attestation as auditing. More specifically, when their work is completed, the auditors supply an opinion as to whether the financial statements and related footnotes are presented fairly in all material respects. The actual compilation and creation of the financial statements is completed by the company’s accountants.

Bernard Madoff, a former chairman of the NASDAQ stock market and a respected Wall Street adviser and broker for 50 years, was arrested after his sons turned him in for running “a giant Ponzi scheme,” bilking investors out of billions of dollars. Many investors, including actors, investment bankers, politicians, and sports personalities, lost their life savings. Some who had already retired, now in their 70s and 80s, were forced to go back to work. Others lost their retirement homes. Charities and pensions that had invested heavily were wiped out.

Although some of the world’s most knowledgeable investors fell prey to the scam, numerous red flags were present for all who were wise enough to see them. First, Madoff’s fund returned 13–16 percent per year, every year, no matter how the markets performed. Second,

his stated strategy of buying stocks and related options to hedge downside risk could not have occurred because the number of options necessary for such a strategy did not exist. Third, although his firm claimed to manage billions of dollars, its auditing firm had only three employees, including a secretary and a 78-year-old accountant who lived in Florida.

Sources: “Fund Fraud Hits Big Names,” The Wall Street Journal, December 13, 2008, pp. A1, A7; “Fees, Even Returns and Auditor All Raised Flags,” The Wall Street Journal, December 13, 2008, p. A7; “Top Broker Accused of $50 Billion Fraud,” The Wall Street Journal, December 12, 2008, pp. A1, A14; “Probe Eyes Audit Files, Role of Aide to Madoff,” The Wall Street Journal, December 23, 2008, pp. A1, A14.

The Consequences of Fraudulent Financial Information

AUDITING INSIGHT

REVIEW CHECKPOINTS 1.1 What is a business risk? 1.2 What conditions increase the demand for reliable information? 1.3 What risk creates a demand for independent and objective outsiders to provide assurance to

decision makers?

AUDITING, ATTESTATION, AND ASSURANCE SERVICES Now that you understand why decision makers need independent information profession- als to provide assurance on key information, we further define auditing and expand the discussion of attestation and assurance services in this section, and explain their roles in today’s information economy.

LO 1-2 Define and contrast financial statement auditing, attestation, and assurance services.

First Pages

Chapter 1 Auditing and Assurance Services 5

lou6920x_ch01_001-040.indd 5 02/19/20 02:57 PM

Definition of Financial Statement Auditing The focus of this book is on the financial statement auditing process, by far and away the most common type of auditing and assurance service provided in today’s market. Many years ago, the American Accounting Association (AAA) Committee on Basic Auditing Concepts provided a very useful general definition of auditing as follows:

Auditing is a systematic process of objectively obtaining and evaluating evidence regard- ing assertions about economic actions and events to ascertain the degree of correspon- dence between the assertions and established criteria and communicating the results to interested users.2

A closer look at the definition reveals several ideas that are important to any type of auditing engagement. Auditing is a systematic process. It is a purposeful and logical pro- cess and is based on the discipline of a structured approach to reaching final decisions. It has a logical starting point, proceeds along established guidelines, and has a logical conclusion. It is not haphazard, unplanned, or unstructured.

The process involves obtaining and evaluating evidence. Evidence consists of all types of information that ultimately guide auditors’ decisions and relate to assertions made by management about economic actions and events. When beginning a financial statement audit engagement, an independent auditor is provided with financial statements and other disclosures by management. In doing so, management essentially makes assertions about the financial statement balances (that the inventory on the balance sheet really does exist, that revenue transactions recorded on the income statement really did occur, that the list of liabilities on the balance sheet is complete, etc.) as well as assertions that the financial statement disclosures are fairly presented.

2American Accounting Association Committee on Basic Auditing Concepts. A Statement of Basic Auditing Concepts. American Accounting Association, 1973.

Although most of the largest public accounting firms trace their roots to the turn of the 19th century, auditing in the United States has a rich history. When the Pilgrims had a financial dispute with the English investors who financed their trip, an “auditor” was sent to resolve the difference. George Washington sent his financial records to the Comptroller of the Treasury to be audited before he could be reimbursed for expenditures he made during the Revolutionary War. One of the first Congress’s actions in 1789 was to set up an auditor

to review and certify public accounts. Even the “modern” concept of an audit committee is not so modern; the bylaws of the Potomac Company, formed in 1784 to construct locks on the Potomac River to increase commerce, required that three shareholders annually examine the company’s records. Flesher, Dale L., Gary John Previts, and William D. Samson. Auditing in the United States: A Historical Perspective. Abacus 41, John Wiley & Sons. Inc., 2008, 21–39.

AUDITING INSIGHT

External auditors generally begin their work with a focus on these assertions (explicit representations) made by management about the financial statement amounts and infor- mation disclosed in footnotes, and then they set out to obtain and evaluate evidence to prove or disprove these assertions or representations. Other types of auditors, however, often are not provided with explicit representations. For example, an internal auditor may be assigned to evaluate the cost effectiveness of the company’s policy to lease, rather than to purchase, heavy equipment. A governmental auditor may be assigned to determine whether goals of providing equal educational opportunities to all have been achieved with federal grant funds. Oftentimes, the latter two types of auditors must develop the explicit performance criteria or benchmarks for themselves.

The purpose of obtaining and evaluating evidence is to ascertain the degree of cor- respondence between the assertions made by the information provider and the estab- lished criteria. Auditors will ultimately communicate their findings to interested users.

First Pages

6 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 6 02/19/20 02:57 PM

To communicate in an efficient and understandable manner, auditors and users must have a common basis for measuring and describing financial information. This basis is the established criteria essential for effective communication.

Established criteria may be found in a variety of sources. For independent auditors, the criterion is whatever the applicable financial reporting framework is, whether it is Gener- ally Accepted Accounting Principles (GAAP) in the United States or International Financial Reporting Standards (IFRS) in other jurisdictions. Internal Revenue Service (IRS) auditors rely heavily on criteria specified in the Internal Revenue Code. Governmental auditors may rely on criteria established in legislation or regulatory agency rules. Bank examiners and state insurance board auditors look to definitions, regulations, and rules of law. Internal and governmental auditors rely a great deal on financial and managerial models of efficiency and effectiveness. Of course, all auditors rely to some extent on the sometimes elusive criteria of general truth and fairness. Exhibit 1.1 depicts an overview of financial statement auditing.

The AAA definition already presented is broad and general enough to encompass external, internal, and governmental auditing. The more specific viewpoint of external auditors in public accounting practice is reflected in the following statement about the financial statement audit made by the American Institute of Certified Public Accountants (AICPA), the public accounting community’s professional association:

The purpose of an audit is to enhance the degree of confidence that intended users can place in the financial statements. This is achieved by the expression of an opinion by the auditor on whether the financial statements are prepared, in all material respects, in accor- dance with an applicable financial reporting framework. In the case of most general pur- pose frameworks, that opinion is on whether the financial statements are presented fairly, in all material respects, in accordance with the framework. An audit conducted in accordance with generally accepted auditing standards and relevant ethical requirements enables the auditor to form that opinion.* (AU-C 200.11)

Auditing in a Big Data Environment The auditing environment has been transformed into an environment that is characterized by the availability of significant amounts of data and cutting-edge analytical tools. As a direct result, entry-level professionals are being asked to join public accounting firms

EXHIBIT 1.1 Overview of Financial Statement Auditing

Other Communications

Independent Auditor

Objective third party

Obtains and evaluates evidence

Management assertions about economic actions and events

Ascertain degree of correspondence between financial statements and framework

Applicable financial reporting framework

Knowledge of client’s business, observation of physical assets, inquiry of managers, confirmations from third parties, inspection of documents

GAAP IFRS

Footnotes

Statement of Cash Flows

Income Statement

Balance Sheet

Audit Report

American Institute of Certified Public Accountants, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards, December 15, 2012, https://www.aicpa.org

First Pages

Chapter 1 Auditing and Assurance Services 7

lou6920x_ch01_001-040.indd 7 02/19/20 02:57 PM

having completed coursework related to the use of data and analytical tools. The accom- panying Auditing Insight provides some examples.

A report published by PwC, “Data Driven: What Students Need to Suc- ceed in a Rapidly Changing Business World,” clearly indicates that the skills needed by entry-level auditing professionals must include profi- ciency in data analytics and technology.

But, the need for a digital mindset is hardly limited to entry-level professionals, and in 2018, PwC introduced a first of its kind app to help facilitate what they are calling a “Digital Workforce Transform- ation.” The app is designed to assess an individual’s digital fluency. Once the assessment is complete, the app then helps to “curate” training based on the individual’s needs.

It is now obvious that the world has changed and as a result the set of skills acquired by students must also change to adapt to the new digital world. Most importantly, while PwC is just one firm, our conversations with professionals across firms of varying size are in agreement with the need for a digital mindset to effectively operate in an audit environment characterized by Big Data and advanced analyti- cal tools.

Sources: “Data Driven—What Students Need to Succeed in a Rapidly Chang- ing Business World,” PwC, February 2015; https://www.pwc.com/us/en/press- releases/2018/digital-workforce-transformation.html.

Is there Really an “APP” for that?AUDITING INSIGHT

Among the critical issues for students to consider is how to identify the right set of data to analyze given a set of facts and circumstances. And, of course, how to present that analyses of such data in the most compelling format while documenting the results of their work. In addition, while analytical tools can rely on data sources that are both internal and external to the client, our current understanding is that entry-level audit pro- fessionals in today’s environment need to first learn how to make the best use of internal data and information produced by the entity, including system generated reports used by the client to execute its internal control activities and produce its financial statements.

Throughout this book, we will be providing examples of how to make the best use of such internal client data, which includes an emphasis on always verifying the complete- ness and accuracy of the underlying data set being used. There is even an entire module (Module G) that is dedicated to the use of Big Data and advanced analytical tools in the financial statement audit.

Attestation Engagements Many people appreciate the value of auditors’ attestations on historical financial state- ments, and as a result, they have found other types of information to which certified public accountants (CPAs) can attest. The all-inclusive definition of an attestation engagement is

An engagement in which a practitioner is engaged to issue a report on subject matter, or an assertion about subject matter that is the responsibility of another party.* (AT 101.01)

By comparing the AAA’s earlier definition of auditing with the definition of attesta- tion, you can see that the auditing definition is a specific type of attestation engagement. According to the earlier definition, in an audit engagement, an auditor (more specific than a practitioner) issues a report on assertions (financial statements) that are the responsibil- ity of management. For example, as more and more companies and organizations seek to demonstrate their efforts related to corporate social responsibility, demand is growing for attestation services related to sustainability reporting. The following Auditing Insight indicates the significance of this emerging market for public accounting firms.

In today’s global business environment, activist shareholders are increasingly pressur- ing board of director members and upper management teams regarding issues of social responsibility, the environment, and other matters related to sustainability. As a direct result, more companies than ever are directly integrating their sustainability initiatives into their overall business strategy and then seeking to quantify their sustainability and

American Institute of Certified Public Accountants, Attest Engagements, June 1, 2001, https://www.aicpa.org

First Pages

8 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 8 02/19/20 02:57 PM

social responsibility efforts with measurable outputs. These measurements might help to quantify the company’s performance in areas such as the environment, labor, and human rights. For example, in the following Auditing Insight, students can see how BlackRock, Inc. on of the world’s largest asset managers, has recently toughened their standards related to climate change and environmental risk reporting for the corporations in their investment portfolio.

That is the clear message being sent by BlackRock, Inc. Indeed, the firm has made clear that it intends to take a much tougher stance against corporations that are unwilling to provide a “full accounting” of the envi- ronmental risks that they are facing in their business operations. In tak- ing these steps, BlackRock seeks to show the marketplace that they are doing what they can in relation to climate change. Of course, it is an open

question just how much influence BlackRock can have over companies, but their chief executive, Laurence Fink clearly believes that by doing so, he will position his firm to “win over younger investors and millennials whow want to invest money in line with personal values.”

Source: “BlackRock Tightens Standards for Firms On Climate Change.” Wall Street Journal, Wednesday January 15, 2020, Page B1.

Climate Change Does Matter!AUDITING INSIGHT

• Agreed-Upon Procedures Engagements (AT-C Section 215), such as verifying inventory quantities and locations.

• Prospective Financial Information (AT-C Section 305), such as analy- sis of prospective or hypothetical “what-if” financial statements for some time period in the future.

• Reporting on Pro Forma Financial Information (AT-C Section 310), such as retroactively analyzing the effect of a proposed or consum- mated transaction on the historical financial statements “as if” that transaction had already occurred.

• Compliance Attestation (AT-C Section 315), such as ascertaining a client’s compliance with debt covenants.

• Reporting on Controls at a Service Organization (AT-C Section 320), such as organizations that provide outsourced processes that are likely to be relevant to the user entities’ internal control over financial reporting.

• Examination of Management’s Discussion and Analysis (AT-C Sec- tion 395), prepared pursuant to the rules and regulations of the Secur- ities and Exchange Commission (SEC).

Examples of Attestation Engagements

On November 20, 2018, Tim Mohin, the CEO of the Global Reporting Ini- tiative (GRI) was invited to ring the closing bell at NASDAQ. Why does this matter? Well, since GRI is a nonprofit organization that was established to promote environmental sustainability to organizations throughout the world, NASDAQ’s invitation recognizes the growing importance of listed companies reporting on their environmental, social, and governance impacts. And of course, it helps to clearly demonstrate that sustainability

reporting is an emerging market for CPAs. In fact, KPMG LLP reported that as of the end of 2017, 93 percent of the 250 largest global compa- nies issue some type of corporate responsibility report.

Sources: https://www.globalreporting.org/information/news-and-press-center/ Pages/GRI-Rings-Bell-at-Nasdaq-November-2018.aspx; https://assets.kpmg/ content/dam/kpmg/xx/pdf/2017/10/kpmg-survey-of-corporate-responsibility- reporting-2017.pdf

Ringing The Bell At NASDAQAUDITING INSIGHT

Of course, whenever a management team makes an assertion about information, there is an opportunity to perform an attestation engagement. Importantly, although sustain- ability is a prominent example of an emerging attestation engagement completed by CPAs, other examples of attestation engagements completed by CPAs (discussed more in Module A) appear in the following box.

Assurance Services Although auditing refers specifically to expressing an opinion on financial statements and attestation refers more generally to expressing an opinion on any type of information or subject matter that is the responsibility of another party (such as sustainability measures),

First Pages

Chapter 1 Auditing and Assurance Services 9

lou6920x_ch01_001-040.indd 9 02/19/20 02:57 PM

assurance services include an even broader set of information, including nonfinancial information. The following Auditing Insight indicates how the quality of information can assist both buyers and sellers in today’s market.

Exhibit 1.2 shows two 1961 Topps Mickey Mantle baseball cards. The card on the right was offered on eBay with the seller’s representation that the card was in Near Mint/Mint condition. This representation is a standard description and is the equivalent of a grade 8 on a standard 10-point scale used in grading the quality of a trading card. The card was purchased on eBay for $205.50.

Within a week, a second 1961 Topps Mickey Mantle baseball card was sold on eBay. Again, this card was offered with the seller’s representation that the card was in Near Mint/Mint condition (card on the left). The only difference was that this card had been sent to Professional Sports Authenticator (PSA), a company that verifies the authenticity and quality of sports items. Note that PSA does not buy or sell sports merchandise; it acts only as an independent third party expressing a professional opinion regarding the merchandise in ques- tion. This card sold for $585.

The only difference between the two transactions was that the buyers of the card on the left had more information concerning the risk inherent in the transaction. Why was the first transaction riskier? What were the buyers’ concerns? Were the concerns only from inten- tional misstatements? How did the grading of the card by PSA reduce these concerns? What are the incentives for PSA to grade the card

accurately? How does the business of PSA relate to the profession of auditing?

AUDITING INSIGHT

EXHIBIT 1.2 Professional Sports Authenticator as Third-Party Assuror

Courtesy of Allen Blay

Although the primary focus of our earlier discussion of information risk was in the context of economic decisions, information risk is present whenever someone must make a decision without having complete knowledge. The AICPA expanded the profes- sion’s traditional focus on accounting information to include all types of information, both financial and nonfinancial. The expanded services are collectively referred to as assurance services, which the AICPA defines as independent professional services that improve the quality of information, or its context, for decision makers. The major ele- ments, and boundaries, of the definition are

∙ Independence. CPAs want to preserve their attestation and audit reputations and com- petitive advantages by preserving integrity and objectivity when performing assurance services.3

∙ Professional services. Virtually all work performed by CPAs (accounting, auditing, data management, taxation, management, marketing, finance) is defined as a profes- sional service as long as it involves some element of judgment based on education and experience.

∙ Improving the quality of information or its context. The emphasis is on infor- mation, CPAs’ traditional stock in trade. CPAs can enhance quality by assuring

3A survey commissioned by the AICPA found that CPAs are viewed more positively than any other business professional by both business decision makers and investors. Sixty-nine percent of investors and 74 percent of business decision makers feel that “CPAs have a unique perspective that is valuable when making business and financial decisions, even when those decisions are not directly related to accounting.” In terms of attributes ascribed to CPAs, they are most associated with integrity, competence, and objectivity (“Brand Research Shows CPAs Viewed Positively in Marketplace,” AICPA News Update, October 20, 2008).

First Pages

10 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 10 02/19/20 02:57 PM

users about the reliability and relevance of information, and these two features are closely related to the familiar credibility-lending products of attestation and auditing services. Context is relevance in a different light. For assurance services, improving the context of information refers not to the information itself but to how the information is used in a decision-making context. An example would be providing key information in a database that management could use to make impor- tant decisions.

∙ For decision makers. The decision makers are the consumers of assurance services, and they personify the consumer focus of different types of professional work. The decision makers are the beneficiaries of the assurance services. Depending upon the assignment, decision makers may be a very small, targeted group (e.g., managers of a database) or a large targeted group (e.g., potential investors interested in a mutual fund manager’s performance).

Examples of Assurance Services Although they are subsets of assurance services, attestation and auditing services are highly structured and intended to be useful for large groups of decision makers (e.g., investors, lenders). On the other hand, assurance services other than audit and attestation services tend to be more customized for use by smaller, targeted groups of decision mak- ers. For example, many companies and organizations have used public accounting firms to conduct a comprehensive assessment of risks the enterprise faces. This type of enter- prise risk assessment can then be used to show stakeholders that the management team understands and is properly managing risks the enterprise faces. We also present a few more examples of assurance services to illustrate the variety of services that fall under the assurance service umbrella. Some will look familiar and others may defy imagination. Be aware, however, that public accounting firms must pick and choose the services that they wish to provide to the market based on the expertise that resides within the firm. Nobody believes or maintains that all public accounting firms will want or be able to provide all types of assurance services.

∙ Cybersecurity risk assessment and assurance. ∙ XBRL (eXtensible Business Reporting Language) reporting. ∙ Information risk assessment and assurance. ∙ Regulatory compliance. ∙ Third-party reimbursement maximization. ∙ Customer satisfaction surveys. ∙ Evaluation of investment management policies. ∙ Fraud and illegal acts prevention and deterrence. ∙ Internal audit outsourcing.

Attestation and financial statement auditing services are special types of assurance services, but consulting services are not. In providing consulting services, CPAs use their professional skills and experiences to provide recommendations to a client for outcomes such as information system design and operation; in assurance services, the focus is entirely on the information that decision makers use. However, like consulting services, assurance services do have a “customer focus,” and CPAs develop assurance services that add value for customers (i.e., decision makers). Exhibit 1.3 depicts the relationships among assurance, attestation, and auditing services.

Although audits are specific types of assurance engagements and auditors can be described more generally as information assurors, hereafter we will use the term audi- tor instead of information assuror because of the specific responsibilities that auditors have under generally accepted accounting standards (GAAS) as well as under regulatory bodies such as the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB). However, many of the procedures that auditors

First Pages

Chapter 1 Auditing and Assurance Services 11

lou6920x_ch01_001-040.indd 11 02/19/20 02:57 PM

perform as part of an audit engagement are similar to those performed as part of other information assurance engagements. Throughout this book, we will point out these shared procedures when appropriate.

EXHIBIT 1.3 The Relationships among Audit, Attestation, and Assurance Engagements

Assurance Engagements

Attestation Engagements

Audit Engagements

Advances in information technology have allowed for more efficient reporting platforms that better meet the needs of decision makers. In that spirit, the AICPA is currently focused on a number of initiatives to help auditors meet the needs of their clients. Among the initiatives, the need to help companies with XBRL implementations for SEC reporting has taken center stage. XBRL (also referred to by the SEC as interac- tive data) is an information format designed specifically for business reporting. Through the “tagging” of specific data items (cash, inven- tory, sales transactions, etc.), XBRL facilitates the collection, summa- rization, and reporting of financial information in a medium that users

can easily transform for their own decision-making purposes. The SEC now requires all U.S. public companies and foreign private issuers listed with the SEC to use XBRL for SEC filings. Recently, the AICPA helped to launch the XBRL U.S. Center for Data Quality in an attempt to improve the utility of XBRL financial data filed with the SEC even more.

Sources: AICPA SOP 13-02, “Performing Agreed-Upon Procedures Engage- ments That Address the Completeness, Mapping Consistency, or Structure of XBRL-Formatted Information”; SEC 2009 Release No. 33-9002, “Interactive Data to Improve Financial Reporting”; “XBRL US Center for Data Quality.” All three are available through the AICPA’s website (www.aicpa.org).

XBRL ReportingAUDITING INSIGHT

REVIEW CHECKPOINTS 1.4 Define and explain auditing. What would you answer if asked by a communications major, “What do

auditors do?” 1.5 What is an attestation engagement? 1.6 What is an assurance service engagement? 1.7 In what ways are assurance services similar to attestation services (including audits of financial

statements)? 1.8 What are the four major elements of the broad definition of assurance services?

MANAGEMENT’S FINANCIAL STATEMENT ASSERTIONS From your earlier studies, you know that accounting is the process of recording, classify- ing, and summarizing a company’s transactions into financial statements that will create assets, liabilities, equities, revenues, expenses, and related disclosures. It is the means of satisfying users’ demands for financial information that arise from the forces of complex- ity, remoteness, time sensitivity, and consequences.

Auditing does not include the function of producing financial reports. The function of financial reporting is to provide statements of financial position (balance sheets), results of operations (income statements, statements of shareholders’ equity, and statements of

LO 1-3 Describe and define the assertions that management make about the recognition, measurement, presentation, and disclosure of the financial statements and explain why auditors use them as the focal point of the audit.

First Pages

12 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 12 02/19/20 02:57 PM

comprehensive income), changes in cash flows (statements of cash flows), and accom- panying disclosures to outside decision makers who do not have access to management’s internal sources of information. A company’s accountants, under the direction of its management team, perform this function. In fact, auditing standards emphasize that the financial statements are the responsibility of a company’s management. Thus, the finan- cial statements contain management’s assertions about the transactions and events that occurred during the period being audited (primarily the income statement, statement of shareholders’ equity, statement of comprehensive income, and statement of cash flows), assertions about the account balances at the end of the period (primarily the balance sheet), and assertions about the financial statement presentation and disclosure (primar- ily the footnote disclosures).

As the Auditing Insight about Sarbanes–Oxley makes clear, the upper management team at public companies must certify the correctness of the financial statements and the effectiveness of the internal control system for financial reporting. Given the current focus on internal controls, entry-level audit professionals are expected to understand the relationship between a company’s internal control activities and the relevant financial statement assertions about the financial statement account balances. We suggest that as a new auditing professional, a detailed understanding of this relationship will provide you with the opportunity to immediately contribute to the audit team. As a result, we are hopeful that this book can provide a foundation of knowledge to help simplify the rela- tionship, which is paramount in the post-Sarbanes–Oxley auditing environment.

Congress passed the Sarbanes–Oxley Act in 2002 in an attempt to address a number of weaknesses found in corporate financial reporting as a result of the frauds at companies such as WorldCom and Enron. Although the preparation of the financial statements has always been the responsibility of management, Sarbanes–Oxley has enhanced the disclosure provisions to create a heightened sense of accountability. One of its most important provisions (Section 302) states that key company officials must certify the financial statements. Certification means that the company’s chief execu- tive officer and chief financial officer must sign a statement indicating

1. They have read the financial statements. 2. They are not aware of any false or misleading statements (or any

key omitted disclosures).

3. They believe that the financial statements present an accurate pic- ture of the company’s financial condition.

Management must also make assertions regarding the effectiveness of the company’s internal controls over financial reporting. In addition, the auditors are required to issue an attestation report (Section 404) on the system of internal controls to provide assurance that the sys- tem of internal controls over financial reporting has been designed and is operating effectively.

Source: U.S. Congress, Sarbanes–Oxley Act of 2002, Pub. L. No. 107-204, 116 Stat. 745 (2002).

Sarbanes–Oxley and Management’s Responsibility for Financial Reporting

AUDITING INSIGHT

When planning the audit engagement, auditors use management’s assertions to assess external financial reporting risks by determining the different types of misstatements that could occur for each of the relevant management assertions identified and then develop auditing procedures that are appropriate in the circumstances. The auditing procedures are completed to provide the evidence necessary to persuade the auditor that there is no material misstatement related to each of the relevant assertions. Once the auditor is satis- fied that the evidence has supported each of the relevant assertions, the auditor issues a report to provide assurance to financial statement users that the financial statements are free of material misstatement in accordance with generally accepted accounting prin- ciples. As an auditor, you must keep in mind the importance of understanding manage- ment’s financial statement assertions and always remember that you are serving the entire public interest, including stakeholders such as bankers, investors, and employees when ultimately reporting that the financial statements are free of material misstatement.

First Pages

Chapter 1 Auditing and Assurance Services 13

lou6920x_ch01_001-040.indd 13 02/19/20 02:57 PM

When studying and learning about the assertions, a student of auditing must always remember that each assertion gives rise to a question that can be answered with audit evi- dence. In that spirit, Exhibit 1.4 provides a list of all of management’s financial statement assertions and some of the key questions that the audit team must address, with evidence, about each assertion. Note that column 1 in Exhibit 1.4 denotes the assertions currently identified by the PCAOB for public company audits.4 The PCAOB auditing standards do allow auditors to use different management assertions at their discretion, provided that the assertions cover the pertinent risks in each significant account. In that spirit, the

4The Public Company Accounting Oversight Board (PCAOB) is a nonprofit corporation established by Congress to oversee the audits of public companies. The PCAOB is discussed in more detail in Chapter 2.

EXHIBIT 1.4 Management Assertions

  ASB Assertions  

(1) (2) (3) (4) (5)

PCAOB Assertions

Assertions about Events and Transactions

Assertions about Account Balances

Assertions about Presentation and Footnote Disclosures Key Questions

Existence or occurrence Occurrence Existence Occurrence Do the assets listed really exist?

        Did the recorded sales transactions really occur?

Completeness Completeness Completeness Completeness Are the financial statements (including footnotes) complete?

        Were all transactions recorded?

  Cutoff     Are transactions included in the proper period?

Valuation or allocation Accuracy

Valuation and allocation Accuracy Are the accounts valued correctly?

      Valuation and allocation

Are expenses allocated to the period(s) that were benefited?

Rights and obligations  

Rights and obligations

Rights and obligations

Does the company really own the assets?

        Are all legal responsibilities to pay the liabilities identified?

Presentation and disclosure Classification   Classification

Were all transactions recorded in the correct accounts?

      Understandability Are the disclosures understandable to users?

Throughout this book, we will use Apollo Shoes, Inc. (the “Com- pany”) as a comprehensive case example to help illustrate impor- tant auditing concepts. The company is a distributor of athletic shoes. The Company’s products are shipped to large and small

retail outlets in a six-state area. The Company operates from a large office, which includes a warehouse in the Shoetown, Maine area. In this chapter, we will illustrate the financial statement assertions using Apollo Shoes.

The CompanyAPOLLO SHOES

First Pages

14 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 14 02/19/20 02:57 PM

Auditing Standards Board (ASB)5 provides an additional set of management assertions (columns 2, 3, and 4 in Exhibit 1.4). You will note that the ASB set of assertions, while in direct alignment with the PCAOB assertions, does provide greater detail and clarity for students of auditing to conceptualize. The key questions (column 5) indicate how each of these assertions must be thought about when evaluating specific aspects of management’s financial statements and disclosures. Each of the assertions is defined and described in detail in the following sections, organized along the lines of the PCAOB assertions iden- tified in column 1, with the aligned ASB assertion(s) following in parentheses.

Existence or Occurrence (Existence, Occurrence) The numbers listed on the financial statements have no meaning to financial statement users unless the numbers faithfully represent the actual transactions, assets, and liabilities of the company. Existence asserts that each of the balance sheet and income statement balances actually exist. Occurrence asserts that each of the income statement events and transactions actually did occur. As a general rule, the occurrence assertion relates to events, transactions, presentations, and footnote disclosures (as indicated in columns 2 and 4 of Exhibit 1.4), and the existence assertion relates to account balances (as indicated in column  3). Therefore, auditors must test whether the balance sheet amounts reported as assets, liabilities, and equities actually exist. To test the existence assertion, auditors typically verify cash with banks and count the physical inventory, verify accounts receivables and insurance policies with customers, and perform other procedures to obtain evidence whether management’s assertion is in fact supported. Similarly, management asserts that each of the revenue and expense transactions summarized on the income statement or disclosed in the financial statement footnotes really did occur during the period being audited. To test the occurrence assertion, auditors complete procedures to ensure that the reported sales transactions really did occur and were not created to fraudulently inflate the company’s profits.

5The ASB was established by the profession to issue auditing standards. Standards issued by the ASB apply to audits of private companies. The ASB is discussed in more detail in Chapter 2.

On Apollo Shoes, management would assert that their assets or liabilities all exist as of December 31st. For example, management asserts that its cash on the balance sheet really does exist. In addition,

management asserts that each revenue transaction on the income statement actually did occur.

Existence or OccurrenceAPOLLO SHOES

Completeness (Completeness, Cutoff) In the financial statements, management asserts that all transactions, events, assets, liabil- ities, and equities that should have been recorded have been recorded. In addition, man- agement asserts that all disclosures that should have been included in the footnotes have been presented. Thus, auditors’ specific objectives include obtaining evidence to deter- mine whether, for example, all inventory is included, all accounts payable are included, all notes payable are included, all expenses are recorded, and so forth. A verbal or written management representation saying that all transactions are included in the accounts is not considered a sufficient basis for deciding whether the completeness assertion is true. Auditors need to obtain persuasive evidence about completeness.

Cutoff is a more detailed expression of the completeness assertion. Cutoff refers to accounting for revenue, expense, and other transactions in the proper period (neither post- poning some recordings to the next period nor accelerating next-period transactions into the current-year accounts). Simple cutoff errors can occur when (1) a company records late December sales invoices for goods not actually shipped until early January; (2) a company records cash receipts through the end of the week (e.g., Friday, January 4) when the last batch of receipts for the year should have been processed on December 31; (3) a

First Pages

Chapter 1 Auditing and Assurance Services 15

lou6920x_ch01_001-040.indd 15 02/19/20 02:57 PM

company fails to record accruals for expenses incurred but not yet paid, thus understating both expenses and liabilities; (4) a company fails to record purchases of materials shipped free on board (FOB) shipping point but not yet received and, therefore, not included in the ending inventory, thus understating both inventory and accounts payable; and (5) a company fails to accrue unbilled revenue through the fiscal year-end for customers on a cycle billing system, thus understating both revenue and accounts receivable. In auditor’s jargon, the cutoff date generally refers to the client’s year-end balance sheet date.

On Apollo Shoes, management would assert that their assets or liabili- ties were complete as of December 31st. For example, management asserts that its accounts payable on the balance sheet includes all

amounts currently payable. In addition, management would assert that all expenses that should be included on the income statement actually were included.

CompletenessAPOLLO SHOES

On Apollo Shoes, management would assert that their assets or liabilities were valued in accordance with GAAP as of December 31st. For example, management asserts that its accounts receivable balance, net of the allowance for doubtful accounts, was stated at

the amount they actually expect to collect. In addition, management would assert that depreciation expense on the income statement reflects the appropriate allocation of fixed assets to the period of benefit under GAAP.

Valuation and AllocationAPOLLO SHOES

Valuation and Allocation (Accuracy or Valuation) In the financial statements, management asserts that the transactions and events have been recorded accurately and that the assets, liabilities, and equities listed on the balance sheet have been valued in accordance with GAAP (or IFRS). The audit objective related to valuation and allocation is to determine whether proper values have been assigned to assets, liabilities, and equities. Allocation refers to the appropriate percentage of an asset or liability balance being recorded on the income statement in accordance with GAAP (or IFRS). For example, has the proper depreciation expense been calculated for each fixed asset amount? Accuracy refers to the appropriate recording of the transactions involving these items. Auditors obtain evidence about specific valuations and mathematical accuracy by comparing vendors’ invoices to inventory prices, obtaining lower-of-cost-or-market data, evaluating collectability of receiv- ables, recalculating depreciation schedules, and so forth. Many valuation, accuracy, and allo- cation decisions amount to reaching conclusions about the proper application of GAAP (or IFRS). For example, due to the complexity in the accounting standards related to fair value (i.e., ASC Topic 820), there has been an increased focus on the valuation assertion.

Rights and Obligations (Rights and Obligations) In the financial statements, management asserts that they have ownership rights for all amounts reported as assets on the company’s balance sheet and that the amounts reported as liabilities represent the company’s own obligations. In simpler terms, the objective for an auditor is to obtain evidence that the assets are really owned and that the liabilities are really owed by the company being audited. You should be careful about ownership, however, because the assertion extends to include assets for which a company may not actually hold title. For example, an auditor will have a specific objective of obtaining evidence about the amounts capitalized for leased property. Likewise, owing includes accounting liabilities a company may not yet be legally obligated to pay. For example, specific objectives would include obtaining evidence about the estimated liability for product warranties. The auditor also has an obligation to ensure that the details of the company’s obligations are properly disclosed in the footnotes to the financial statements.

First Pages

16 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 16 02/19/20 02:57 PM

On Apollo Shoes, management would assert that they really do own and have the rights to the assets listed on the balance sheet, and that they really are obliged to pay the amount listed on the balance sheet

for liabilities as of December 31. For example, management asserts that it really owns its inventory of shoes. In addition, management asserts that it really does owe the amount listed for accrued expenses.

Rights and ObligationsAPOLLO SHOES

On Apollo Shoes, management would assert that they have com- pletely and accurately presented and disclosed all of their footnotes. For example, management asserts that its income tax footnote

disclosure is complete and accurately shows the breakdown of cur- rent and deferred income taxes.

Presentation and DisclosureAPOLLO SHOES

Presentation and Disclosure (Classification, Understandability) In the financial statements, management asserts that all transactions and events have been presented correctly in accordance with GAAP (or IFRS) and that all relevant information has been disclosed to financial statement users, usually in the footnotes to the financial statements. This assertion embodies several different components. First, disclosures must be relevant, reliable, and understandable or transparent to financial statement users. In addition, auditors will test to make sure that all have the proper disclosures made in accor- dance with GAAP (or IFRS). To complete this step, auditors will often use a disclosure checklist that highlights all the disclosures that should be made for a particular entity.

Second, transactions must be classified in the correct accounts (e.g., proper classifica- tion of transactions as assets or expenses). To test this assertion, auditors perform audit procedures such as analyzing repair and maintenance expenses to ensure that that they should in fact have been expensed rather than capitalized. Similarly, auditors will test from the opposite direction, examining additions to buildings and equipment to ensure that transactions that should have been expensed were not in fact capitalized in error (or fraud).

Third, to be useful to decision makers, information must be understandable. State- ment of Financial Accounting Concepts (SFAC) No. 2, “Qualitative Characteristics of Accounting Information,” defines understandability as “the quality of information that enables users to perceive its significance.” The responsibility levied on auditors is to make sure that the financial statements are “transparent.” In other words, investors should be able to understand how the company is doing by reading its financial statements and footnotes and should not have to rely on financial experts or lawyers to help them figure out what the fine print is saying. Another way to regard this assertion is to ask whether the disclosures have been written in plain English.

Importance of Assertions On each audit engagement, the auditor must identify each significant account or disclosure in the financial statements. An account or disclosure is significant if there is a reasonable possibility that the account or disclosure could contain a misstatement that is material. Once the significant accounts and disclosures have been identified, the auditor must then consider the relevance of each financial statement assertion, one at a time. An assertion is relevant, if there is a “reasonable possibility” that a material misstatement exists related to that assertion for the significant account being audited. As a result, the relevance of a par- ticular assertion is entirely dependent on the facts and circumstances on the audit engage- ment. For example, valuation may not be a relevant assertion for the cash account unless foreign currency translation is involved; however, the existence of cash is always relevant.

First Pages

Chapter 1 Auditing and Assurance Services 17

lou6920x_ch01_001-040.indd 17 02/19/20 02:57 PM

The financial statement assertions are important and at times can be difficult to comprehend. A student of auditing must remember that the key questions that must be answered about each assertion become the focal points for the audit procedures to be performed. In other words, audit procedures are the means to answer the key questions posed by management’s financial statement assertions. When evidence-gathering audit procedures are specified, you need to be able to relate the evidence produced by each procedure to one or more specific assertions. In essence, the secret to writing and review- ing a list of audit procedures is to ask, “Which assertion(s) does this procedure produce evidence about?” Then ask, “Does the list of procedures (the audit plan) cover all the assertions?” Exhibit 1.5 illustrates how the assertions relate to the financial statements.

Although standards-setting bodies such as the PCAOB and ASB try to neatly catego- rize transactions, balances, and disclosures according to the different assertions, the real

EXHIBIT 1.5 Management Assertions and Their Relationship to the Financial Statements

Existence—Does this cash really exist?

Rights and Obligations—Does the company really own this inventory?

Valuation or Allocation—Are these investments properly valued?

Completeness—Does the accounts payable and accrued expenses balance include all amounts owed?

Presentation and Disclosure—Are these disclosures understandable? Has everything been disclosed that should be?

Occurrence—Did these sales transactions really take place?

STATEMENT OF FINANCIAL CONDITION APOLLO SHOES INC. in thousands

As of December 31 2020 2019

Assets Cash $3,245 $3,509 Accounts Receivable (Net of Allowances of $1,263 and 210, 15,I48 2,738 respectively) (Note 3) Inventory (Note 4) 15,813 13,823 Prepaid Expenses 951 352 Current Assets $35,157 $20,422 Property, Plant, and Equipment (Note 5) 1,174 300 Less Accumulated Depreciation (164) (31) $1,010 $269 Investments (Note 6) 613 613 Other Assets 14 0 Total Assets $36,794 $21,304

Liabilities and Shareholders’ Equity Accounts Payable and Accrued Expenses $4,675 $3,556 Short-Term Liabilities (Note 7) 10,000 0 Current Liabilities $14,675 3,556 Long-Term Debt (Note 7) 0 0 Total Liabilities $14,675 3,556 Common Stock 8,105 8,105 Additional Paid-in Capital 7,743 7,743 Retained Earnings 6,271 1,900 Total Shareholders’ Equity $22,119 $17,748 Total Liabilities and Shareholders’ Equity $36,794 $21,304 The accompanying notes are an integral part of the consolidated financial statements.

NOTES TO CONSOLIDATED FINANCIAL STATEMENTS APOLLO SHOES, INC.

1. Summary of Significant Accounting Policies

Business activity The Company develops and markets technologically superior podiatric athletic products under various trademarks, including SIREN, SPOTLIGHT, and SPEAKERSHOE.

Marketable Securities Investments are valued using the market value method for investments of less than 20%, and by the equity method for investments greater than 20% but less than 50%.

Cash equivalents Cash equivalents are defined as highly liquid investments with original maturities of three months or less at date of purchase.

Inventory valuation Inventories are stated at the lower of First-in, First-out (FIFO) or market.

Property and equipment and depreciation Property and equipment are stated at cost. The Company uses the straight-line method of depreciation for all additions to property, plant, and equipment.

Intangibles Intangibles are amortized on the straight-line method over periods benefited.

Net Sales Sales for 2017 and 2016 are presented net of sales returns and allowances of $4.5 million, and $0.9 million, respectively, and net of warranty expenses of $ 1.1 million, and $0.9 million, respectively.

Income taxes Deferred income taxes are provided for the tax e�ects of timing di�erences in reporting the results of operations for financial statements and income tax purposes, and relate principally to valuation reserves for accounts receivable and inventory, accelerated depreciation and unearned compensation.

Net income per common share Net income per common share is computed based on the weighted average number of common and common equivalent shares outstanding for the period.

Reclassification Certain amounts have been reclassified to conform to the 2016 presentation.

2. Significant Customers

Approximately 15%, and 11% of sales are to one customer for years ended December 31, 2017 and 2016, respectively.

STATEMENTS OF INCOME APOLLO SHOES INC. in thousands (except per share data)

For year ended December 31, 2020 2019

Net Sales (Note 2) $240,575 $236,299 Cost of Sales $141,569 $120,880 Gross Profit $99,006 $115,419 Selling, General and Administrative Expenses $71,998 $61,949 Interest Expense (Note 7) $875 0 Other Expense (Income) ($204) ($1,210) Earnings from Continuing Operations Before Taxes $26,337 $54,680 Income Tax Expense (Note 10) $10,271 $21,634 Earnings from Continuing Operations $16,066 $33,046 Discontinued Operations, Net of tax benefit ($31,301) Extraordinary Item, Net of tax benefit (Note 11) ($11,695) Net Income $4,371 $1,745

Earnings Per Common Share From Continuing Operations $1.98 $4.08 Other ($1.44) ($3.86) Net Income $0.54 $0.22

Weighted shares of common stock outstanding 8,105 8,105

The accompanying notes are an integral part of the consolidated financial statements.

First Pages

18 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 18 02/19/20 02:57 PM

world is seldom as orderly. For example, although cutoff procedures provide evidence about completeness, they also provide evidence about valuation and existence. Prema- turely recording sales transactions inflates revenue and/or asset values because the trans- action did not occur by the income statement date. Similarly, if a cutoff test shows a delay in recording a liability, the liability is not only incomplete but undervalued as well. Thus, errors in financial statements may affect multiple management assertions.

REVIEW CHECKPOINTS  1.9 What is the difference between financial statement auditing and financial accounting? 1.10 List and briefly explain each of the Auditing Standards Board’s (ASB) management assertions. List

at least one key question that auditors must answer with evidence related to each management assertion.

1.11 Why is the ASB’s set of management assertions important to auditors? Do these assertions differ from those included in PCAOB standards? If so, how are they different?

When Lehman Brothers filed for bankruptcy in September 2008, it was reportedly the largest bankruptcy in U.S. history. How could such a large firm seem to collapse so suddenly? Some observers blamed the audi- tors. In fact, in a civil fraud lawsuit filed by the attorney general of New York back in 2010, auditors at Ernst & Young (EY) were identified, along with other investment bankers and senior Lehman executives, as hav- ing played a role in the bank’s demise. The lawsuit described a “cozy” relationship between Lehman and EY because “two of Lehman’s chief

financial officers were former EY employees” and “Ernst & Young charged Lehman $150 million in audit fees over a seven-year period of time.” EY settled the lawsuit in April 2015 for $10 million without the admission of any wrongdoing by its professionals. However, the lawsuit serves as a reminder for auditors to always exhibit professional skepticism.

Sources: “Ernst Accused of Lehman Whitewash,” The Wall Street Journal, December 22, 2010, p. C1; “Ernst & Young Reaches Settlement with N.Y. Attorney General,” The Wall Street Journal, April 16, 2015, p. C1.

Why Be Skeptical?AUDITING INSIGHT

PROFESSIONAL SKEPTICISM

“Doveryai, no Proveryai” (Trust, but Verify) Ronald Reagan, “Doveryai, no proveryai: Trust but verify.” November 28, 2017, https://www.c-span.org

LO 1-4 Define professional skepticism and explain its key characteristics.

Professional skepticism is defined in the professional auditing standards as having an atti- tude that “includes a questioning mind and a critical assessment of evidence.” Essentially, it is an auditor’s responsibility to not accept management assertions without corroboration. Stated differently, an auditor must ask management to “prove” each of the relevant asser- tions with documentary evidence. The occurrence of errors and fraud in financial reports highlights the following basic premise, which underlies the importance of professional skepticism: A potential conflict of interest always exists between the auditors and the man- agement of the company being audited. This potential conflict arises because management wants to present the company in the best possible light whereas auditors must ensure that the information about the company’s financial condition is “presented fairly.”

With full awareness of this potential conflict of interest, auditors must always remain professionally skeptical in their relationships with management, but not

First Pages

Chapter 1 Auditing and Assurance Services 19

lou6920x_ch01_001-040.indd 19 02/19/20 02:57 PM

adversarial or confrontational. Nevertheless, knowing that a potential conflict of inter- est always exists causes auditors to perform procedures to search for errors and frauds that could have a material effect on the financial statements. And, even though the vast majority of audits do not contain fraud, auditors have no choice but to exercise professional skepticism at all times and on all audits because of misdeeds perpetrated by just a few people in a few companies. The professional standards emphasize the importance of maintaining and then applying an attitude of professional skepticism throughout the entire audit process.

Auditing firms have long recognized the importance of exercising professional skepti- cism when making professional judgments. In fact, as illustrated in the following Audit- ing Insight, firms have increasingly stressed the importance of being skeptical when evaluating documentary evidence. You can definitely expect to encounter difficult eco- nomic transactions as an auditor. When auditors encounter a difficult transaction, they must take the time to fully understand the economic substance of that transaction and then critically evaluate, with skepticism, the evidence provided by the client to justify its accounting treatment. No shortcuts are allowed. Rather, auditors are required to be unbi- ased and objective when making their professional judgments.

Judgment and decision-making researchers in auditing have long known about common biases that can interfere with or obstruct aud- itors from making excellent professional judgments. One example is the anchoring bias, which recognizes the possibility that an aud- itor might “anchor” on a number provided by a client manager (e.g., an estimate for the allowance for doubtful accounts) and then have difficulty adjusting to the economically correct amount. In its mono- graph, entitled “Elevating Professional Judgment in Accounting and Auditing,” KPMG (2011) outlines a professional judgment framework designed to help auditors to mitigate professional judgment biases like the anchoring bias. In order to do so, auditors must first be aware

of the possibility that these biases might interfere with their profes- sional judgment. Beyond awareness, the monograph argues that auditors must follow a disciplined process that includes (1) clarifying the issues and objectives, (2) considering the possible alternatives, (3) gathering and evaluating the relevant evidence, (4) reaching an audit conclusion, and (5) carefully documenting their rationale for the professional judgment reached. And, perhaps most importantly, the monograph emphasizes the importance of an auditor exercising pro- fessional skepticism throughout the entire process.

Source: “Elevating Professional Judgment in Accounting and Auditing: The KPMG Professional Judgment Framework” (Montvale, NJ: KMPG, 2011).

Overcoming Judgment Biases: The Importance of Professional Judgment

AUDITING INSIGHT

Persuading a skeptical auditor is not impossible, just somewhat more difficult than persuading a normal person in an everyday context. Skepticism is a manifestation of objectivity, holding no special concern for preconceived conclusions on any side of an issue. In fact, the auditor should not care about the impact that an economic transaction has on the “bottom line” of a company, only that the accounting rules were followed and were properly applied and that the financial statements are appropriate for the user’s needs. Skepticism is not being cynical, hypercritical, or scornful. The properly skeptical auditor asks questions such as the following: (1) What do I need to know? (2) How well do I know it? (3) Does it make sense? and (4) What could go wrong?

Auditors understand that receiving explanations from an entity’s management is merely the first step in the professional judgment process, not the last. Auditors must listen to the explanation, and then always test it by examining sufficient competent audit evidence. The familiar phrase “healthy skepticism” should be viewed as a show-me attitude, not a predisposition to accepting unsubstantiated explanations. Auditors must gather the evi- dence needed, uncover all the implications from the evidence, and then arrive at the most appropriate and supportable conclusion. Time pressure to complete a financial statement audit engagement is no excuse for failing to exercise professional skepticism. Too many auditors have gotten themselves into trouble by accepting a manager’s glib explanation and stopping too early in an investigation without seeking corroborating evidence.

First Pages

20 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 20 02/19/20 02:57 PM

In its Staff Audit Practice Alert about professional skepticism, the PCAOB expressed serious concern about “whether auditors consistently and diligently apply professional skepticism.” The alert recognizes that there are a number of factors that could “impede” the application of professional skepticism but stresses the importance of taking what- ever actions are necessary to make sure that professional skepticism is applied in an appropriate manner throughout the audit process.

THE HURTT SKEPTICISM SCALE How skeptical are you? Answer the following 30 questions to find out. As a benchmark, business students typically fall between 90 to 150 points; auditors score much higher.

Professional SkepticismAUDITING INSIGHT

Questions Strongly Disagree        

Strongly Agree

 1. I often accept other people’s explanations without further thought. 1 2 3 4 5 6  2. I feel good about myself. 1 2 3 4 5 6  3. I wait to decide on issues until I can get more information. 1 2 3 4 5 6  4. The prospect of learning excites me. 1 2 3 4 5 6  5. I am interested in what causes people to behave the way that they do. 1 2 3 4 5 6  6. I am confident of my abilities. 1 2 3 4 5 6  7. I often reject statements unless I have proof that they are true. 1 2 3 4 5 6  8. Discovering new information is fun. 1 2 3 4 5 6  9. I take my time when making decisions. 1 2 3 4 5 6 10. I tend to immediately accept what other people tell me. 1 2 3 4 5 6 11. Other people’s behavior does not interest me. 1 2 3 4 5 6 12. I am self-assured. 1 2 3 4 5 6 13. My friends tell me that I usually question things that I see or hear. 1 2 3 4 5 6 14. I like to understand the reason for other people’s behavior. 1 2 3 4 5 6 15. I think that learning is exciting. 1 2 3 4 5 6 16. I usually accept things I see, read, or hear at face value. 1 2 3 4 5 6 17. I do not feel sure of myself. 1 2 3 4 5 6 18. I usually notice inconsistencies in explanations. 1 2 3 4 5 6 19. Most often I agree with what the others in my group think. 1 2 3 4 5 6 20. I dislike having to make decisions quickly. 1 2 3 4 5 6 21. I have confidence in myself. 1 2 3 4 5 6 22. I do not like to decide until I’ve looked at all of the readily available information. 1 2 3 4 5 6 23. I like searching for knowledge. 1 2 3 4 5 6 24. I frequently question things that I see or hear. 1 2 3 4 5 6 25. It is easy for other people to convince me. 1 2 3 4 5 6 26. I seldom consider why people behave in a certain way. 1 2 3 4 5 6 27. I like to ensure that I’ve considered most available information before making a decision. 1 2 3 4 5 6 28. I enjoy trying to determine if what I read or hear is true. 1 2 3 4 5 6 29. I relish learning. 1 2 3 4 5 6 30. The actions people take and the reasons for those actions are fascinating. 1 2 3 4 5 6

Sources: Kathy Hurtt, “Development of a Scale to Measure Professional Skepticism,” Auditing: A Journal of Practice & Theory 29, no. 1 (May 2010), pp. 149–171; Public Company Accounting Oversight Board, Staff Audit Practice Alert No. 10: Maintaining and Applying Professional Skepticism in Audits (Washington, DC: PCAOB, 2012).

Although the SEC places constraints on the common practice of auditors’ joining public clients that they have previously audited, close relationships often exist between former colleagues now employed by the client and members of the audit team. In these cases, the audit team must guard against being too trusting in accepting representations about the client’s financial statements. Of more concern is the fact that former colleagues have inside knowledge of the firm’s practices and procedures, knowing where the audit team will probably look (and where they might not look).

First Pages

Chapter 1 Auditing and Assurance Services 21

lou6920x_ch01_001-040.indd 21 02/19/20 02:57 PM

To summarize, due care requires an auditor to be professionally skeptical and question all material representations made by management (whether written or oral) during the professional judgment process. Although this attitude must be balanced by maintaining healthy client relationships, auditors should never assume management to be perfectly honest. The key lies in auditors’ skeptical attitude toward gathering and evaluating the evidence necessary to reach supportable conclusions.

EXHIBIT 1.6 Public Accounting Firm Organization

Chair and CEO

Local O�ces O�ce Managing

Partner

Assurance Services Consulting ServicesTax Services

Partner Partner

Manager

Senior (in-charge) accountants Sta� accountants (or associates)

Senior (in-charge) accountants Sta� accountants (or associates)

ManagerManager ManagerManager Manager

REVIEW CHECKPOINT 1.12 Why should auditors act as though there is always a potential conflict of interest between the

auditor and the management team of the organization being audited?

PUBLIC ACCOUNTING The practice of public accounting is conducted in thousands of practice units ranging in size from sole proprietorships (individuals who “hang out a shingle” in front of their homes) to the largest international firms with thousands of professionals. Furthermore, many public accounting firms no longer designate themselves as CPA firms. Many of them describe their businesses and their organizations as professional services firms or some variation on this term. Exhibit 1.6 shows an organization for a typical public accounting firm. However, some firms differ in their organization. For example, some have other departments such as small business advisory and forensic accounting. Other firms may be organized by industry (e.g., entertainment, oil and gas, health care, finan- cial institutions) to take advantage of firmwide expertise. And still some other firms have different names for their staff and management positions.

Assurance Services Generally speaking, assurance services involve lending credibility to information, whether that information is financial or nonfinancial. While financial statement auditing services remain the dominant service area, CPAs have also provided assurance to vote counts (Academy Awards), dollar amounts of prizes that sweepstakes have claimed to award, accuracy of advertisements, investment performance statistics, and characteristics claimed for computer software programs. Although assurance services (separate and dis- tinct from auditing) currently represent a fairly small part of a normal firm’s operating revenues, the AICPA continues to make an effort to market these additional services to the public and businesses.

LO 1-5 Describe the organization of public accounting firms and identify the various services that they offer.

First Pages

22 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 22 02/19/20 02:57 PM

At the present time, assurance services primarily include financial statement audit engagements and other nonaudit and attestation engagements. We discuss these services as key examples of assurance services that public accounting firms offer.

Financial Statement Auditing Services Most of the large, international accounting (Big Four) firms were founded around the turn of the 20th century (late 1800s/early 1900s) during the Industrial Revolution as European financiers sent representatives (individuals whom we now refer to as auditors) to check up on their investments (mostly railroads) in the United States. As such, the primary focus of many large international accounting firms’ practice has been traditional accounting and auditing services. Audits of traditional financial statements remain the most frequent type of assurance engagement that public companies (and most large and medium nonpublic companies) demand. Exhibit 1.7 shows the auditing (and other assur- ance services) revenues of the Big Four accounting firms based on their 2018 annual reports. This level of auditing activity usually drops as the size of the public accounting firm decreases. In other words, smaller firms usually provide more nonaudit and attesta- tion services for their clients.

Nonaudit and Attestation Engagements Basic accounting and review services are “nonaudit” services, performed frequently for medium and small businesses and not-for-profit organizations. Small public accounting firms perform a great deal of this type of nonaudit work. For example, CPAs can perform a compilation, which consists of preparing financial statements from a client’s books and records, without performing any evidence-gathering work. They can also perform a review, in which limited evidence-gathering work is performed but which is narrower in scope than an audit. Although these are the most common attestation engagements, CPAs

For baseball fans, the annual Hall of Fame vote has always been a source of fun and entertainment which is quite often accompanied by spirited conversation regarding the criteria that a player needs to meet to gain admittance into the Hall.

The Baseball Writers’ Association of America is responsible for the voting and only those writers that maintain 10 consecutive years fol- lowing a team are eligible to vote. But, do you know who verifies that

eligible voters are properly registered, have signed a code of conduct, and verifies the actual count of votes? You may have guessed it, one of the largest audit firm in the world, EY. So, although you might dis- agree with the final outcome from time to time, you can be assured that the appropriate process was followed and an accurate count was conducted each and every year!

Source: www.baseballhall.org

Baseball Hall of FameAUDITING INSIGHT

EXHIBIT 1.7 Revenues for the Big Four CPA Firms

  Deloitte EY KPMG PwC

Total revenues (in billions) $ 46.2 $ 36.4 $ 29.8 $ 42.5

Auditing and assurance services revenues $ 10.2 $ 12.6 $ 11.2 $ 17.4

(in billions and as a percent of revenue) 22% 35% 38% 41%

Tax revenues (in billions and as a percent of revenue) $ 8.3 $ 9.5 $ 6.6 $ 10.7

  18% 26% 22% 25%

Consulting services revenues $ 27.7 $ 14.3 $ 12.0 $ 14.4

(in billions and as a percent of revenue) 60% 39% 40% 34%

Sources:

First Pages

Chapter 1 Auditing and Assurance Services 23

lou6920x_ch01_001-040.indd 23 02/19/20 02:57 PM

also can attest to the accuracy of management’s discussion and analysis (MD&A) that accompanies the financial statements in an annual report, an entity’s internal controls, and hypothetical “what-if” projections relating to mergers or acquisitions.

Tax Services Local, state, national, and international tax laws are often called “accountant and attor- ney full-employment acts.” The laws are complex, and CPAs perform tax planning services and tax return preparation in the areas of income, gift, estate, property, and other taxation. A large proportion of the practice in small public accounting firms is tax related. Tax laws change frequently, and tax practitioners must spend considerable time in continuing education and self-study to keep current. Exhibit 1.7 shows the tax revenues of the Big Four accounting firms based on their 2018 annual reports. Smaller public accounting firms tend to conduct more tax consulting engagements and fewer audit engagements.

The role of tax consulting in a professional services firm has at times faced scrutiny. The Statements on Responsibilities in Tax Practice specifically state that “A CPA has both the right and responsibility to be an advocate for the client” in arguing tax positions with the IRS [TX 112.04]. Can the CPA be an advocate for the client with respect to tax matters and maintain objectivity with regard to other audit matters? Recent guidance from the Public Company Accounting Oversight Board (PCAOB) prohibits an account- ing firm from providing auditing services to a public company if the accounting firm provides tax consulting on aggressive interpretations of tax laws or “listed” transactions (those included on the U.S. Treasury Department’s list of questionable tax strategies), if contingent fees (i.e., fees depending on a certain outcome) are involved, or if the public accounting firm provides tax services for key company executives. In all three cases, the PCAOB argues that auditor independence would be impaired. Providing normal cor- porate tax return preparation and advice is permissible as long as the audit committee discusses with the accounting firm the implications of the tax consulting fees on auditor independence and preapproves the relationship in writing. As a result, this remains a common service area for firms to provide to their audit clients, but the firm must always maintain its independence and objectivity.

Advisory Services Prior to the turn of this century (the 1990s), the largest public accounting firms handled a great deal of advisory services for their auditing clients. In fact, advisory services pro- vided a great new revenue opportunity for firms and the potential for even more business appeared at times to be unlimited. Public accounting firms tried to become “one-stop shopping centers” for clients’ auditing, taxation, and business advice needs.

The Securities and Exchange Commission (SEC), the governmental agency charged with investor protection, expressed reservations as to whether the performance of non- audit services (such as advisory) impaired a public accounting firm’s ability to conduct an independent audit. The SEC’s concern was that the large amount of revenues gener- ated from advisory services might sway the auditor’s opinion on the company’s financial statements. The public accounting firms, on the other hand, argued that the provision of advisory services allowed them a closer look at the client’s operations, providing a syner- gistic, positive effect on the audit.

In response to the spate of corporate frauds, Congress resolved this difference of opinion, in part, by passing the Sarbanes–Oxley Act of 2002 (hereafter referred to as Sarbanes–Oxley), a broad accounting and corporate governance reform measure. Sarbanes–Oxley prohibits public accounting firms from providing any of the follow- ing services to a public audit client: (1) bookkeeping and related services; (2) design or implementation of financial information systems; (3) appraisal or valuation services; (4) actuarial services; (5) internal audit outsourcing; (6) management or human resources services; (7) investment or broker/dealer services; and (8) legal and expert services

First Pages

24 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 24 02/19/20 02:57 PM

(unrelated to the audit). As already stated, public accounting firms may provide general corporate tax return preparation and advice and other nonprohibited services to public audit clients if the company’s audit committee has approved them in advance.

To briefly summarize these restrictions, Sarbanes–Oxley prohibits public accounting firms from performing any consulting or advisory services in which the auditors may find themselves making managerial decisions or that would result in the firm auditing its own work (e.g., completing a financial information system implementation for its audit client). As a result of Sarbanes–Oxley, most of the large firms now provide consulting only for companies that they do not audit. However, the Big Four firms have still been able to dramatically increase the size of their advisory services in recent years. As shown in Exhibit 1.7, firm advisory revenues ranged between 28 and 58 percent of the Big Four firms’ total revenues in 2018. Of course, public accounting firms are not required to fol- low Sarbanes–Oxley guidelines for their non-SEC clients, and in those situations, firms can provide an array of consulting and advisory services provided they maintain their independence and objectivity when completing the financial statement audit.

REVIEW CHECKPOINTS 1.13 What are some examples of assurance services performed on nonfinancial information? 1.14 What are some of the major areas of public accounting services?

OTHER KINDS OF ENGAGEMENTS AND INFORMATION PROFESSIONALS

The AAA and the AICPA definitions of auditing clearly apply to the independent finan- cial statement auditors who work in public accounting firms. The word audit, however, is also used in other contexts to describe broader types of work. The variety of engagements performed by different kinds of information assurors causes some problems with termi- nology. In this textbook, independent auditor, external auditor, and CPA will refer to people doing financial statement audit work with public accounting firms. In the internal and governmental contexts discussed here, auditors are identified as operational audi- tors, internal auditors, and governmental auditors. Although all of these professionals are information assurors (and many are certified public accountants), the term CPA in this book will refer to financial statement auditors engaged in public practice.

Internal Auditing The Board of Directors of the Institute of Internal Auditors (IIA) defines internal auditing and states its objective as follows:

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.6

Internal auditors are employed by organizations such as banks, hospitals, city govern- ments, and industrial companies or work for CPA firms that provide internal auditing services. Internal auditors often perform operational audits. Operational auditing refers to the study of business operations for the purpose of making recommendations about the efficient and effective use of resources, effective achievement of business objectives, and

LO 1-6 Describe the audits and auditors in governmental, internal, and operational auditing.

6The Institute of Internal Auditors. Definition of Internal Audit. Accessed May 17, 2019. https://na.theiia.org

First Pages

Chapter 1 Auditing and Assurance Services 25

lou6920x_ch01_001-040.indd 25 02/19/20 02:57 PM

compliance with company policies. The goal of operational auditing is to help managers discharge their management responsibilities and improve profitability.

Internal auditors also perform audits of financial reports for internal use or limited external distribution (e.g., reports to regulatory agencies) much like external auditors audit financial statements distributed to outside users. Thus, some internal auditing work is sim- ilar to the auditing described elsewhere in this textbook. In addition, the services provided by internal auditors include (1) reviews of internal control systems to ensure compliance with company policies, plans, and procedures; (2) compliance with laws and regulations; (3) appraisals of the economy and efficiency of operations; and (4) reviews of effectiveness in achieving program results in comparison to established objectives and goals.

It should be noted that the AICPA defines operational auditing performed by inde- pendent CPA firms as a distinct type of management consulting service whose goal is to help a client improve the use of its capabilities and resources to achieve its objectives. So, internal auditors consider operational auditing integral to internal auditing and external auditors define it as a type of assurance service offered by public accounting firms. In fact, providing these types of internal auditing services continues to be a growing busi- ness for many large CPA firms. However, both the SEC and the PCAOB prohibit CPA firms from providing these services to their own public audit clients.

Governmental Auditing The U.S. Government Accountability Office (GAO) is an accounting, auditing, and investigating agency of the U.S. Congress, headed by the U.S. Comptroller General. In one sense, GAO auditors are the highest level of internal auditors for the federal govern- ment. Many states have audit agencies similar to the GAO. These agencies answer to state legislatures and perform the same types of work described in this section for GAO audi- tors. In another sense, GAO and similar state agencies are really external auditors with respect to government agencies they audit because they are organizationally independent.

Many government agencies have their own internal auditors and inspectors general. Well-managed local governments also have internal audit departments. For example, most federal agencies (Department of Defense, Department of Human Resources, Department of the Interior), state agencies (education, welfare, controller), and local governments (cities, counties, tax districts) have internal audit staffs. Governmental and internal audi- tors have much in common.

The GAO shares with internal auditors the same elements of expanded-scope ser- vices. The GAO, however, emphasizes the accountability of public officials for the effi- cient, economical, and effective use of public funds and other resources. The generally accepted government auditing standards (GAGAS) define and describe three broad types of audits that may be performed. They are financial audits, attestation engagements, and performance audits.

Financial-related audits include determining whether financial information is pre- sented in accordance with the established and applicable financial reporting framework. There are many types of attestation engagements, including whether the governmental entity’s internal control system is suitably designed and implemented to achieve the applicable control objectives.

Attestation engagements would also include a compliance audit function applied with respect to applicable laws and regulations. All government organizations, programs, activ- ities, and functions are created by law, and most are surrounded by regulations that govern the things they can and cannot do. For example, a program established to provide school meals to low-income students must comply with regulations about the eligibility of recipi- ents. A compliance audit of such a program involves a study of schools’ policies, proce- dures, and actual performance in determining eligibility and handing out meal tickets.

Performance audits refer to a wide range of governmental audits that include (1) econ- omy and efficiency audits and (2) program audits. Governments are concerned about accountability for the appropriate use of taxpayers’ resources; performance audits are a means of seeking to improve accountability for the efficient and economical use of

First Pages

26 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 26 02/19/20 02:57 PM

resources and the achievement of program goals. In addition, the program audit helps determine whether the financial resources being spent are truly helping the government achieve its stated objectives for a particular program. Performance audits, like internal auditors’ operational audits, involve studies of the management of government organiza- tions, programs, activities, and functions.

• Improper Payments: Selected Agencies Need Improvements in Their Assessments to Better Determine and Document Risk Susceptibility (GAO-19-714, January 10, 2019).

• Information Technology: IRS Needs to Take Additional Actions to Address Significant Risks to Tax Processing (GAO-18-298, June 28, 2018).

• Civil Penalties: Certain Federal Agencies Need to Improve Efforts to Comply with Inflation Adjustment Requirements (GAO-17-634, August 31, 2017).

• Management Report: Improvements Needed in Controls over the Pro- cesses Used to Prepare the U.S. Consolidated Financial Statements (GAO-17-524, July 12, 2017).

• Maritime Administration: Proceeds from the Sale of Obsolete Vessels Were Accounted for, Allocated, and Disbursed Consistent with Applic- able Law (GAO-17-280, February 23, 2017).

GAO Engagement Examples

Regulatory Auditors For the sake of clarity, other kinds of auditors deserve separate mention. The U.S. Inter- nal Revenue Service employs auditors. They take the “economic assertions” of taxable income made by taxpayers on tax returns and determine their correspondence with the standards found in the Internal Revenue Code. They also audit for fraud and tax evasion. Their reports can either clear a taxpayer’s return or claim that additional taxes are due.

State and federal bank examiners audit banks, savings and loan associations, and other financial institutions for evidence of solvency and compliance with banking and other related laws and regulations. As a result of the financial crisis of 2008/2009 and the resulting Dodd-Frank Act of 2010, these examiners have been in the news frequently as they work to help ensure the safety and security of the U.S. banking system.

REVIEW CHECKPOINTS 1.15 What is operational auditing? How does the AICPA view operational auditing? 1.16 What are the three broad types of governmental audits described by the GAGAS issued by the

GAO? 1.17 Define what is meant by compliance auditing. 1.18 Name some other types of auditors in addition to external, internal, and governmental auditors.

BECOME A PROFESSIONAL AND GET CERTIFIED! If you plan to begin your career in accounting (which we hope you do since you are reading this book!), you are on your way to being known as an accounting professional. Congratulations! Being part of a profession implies a higher level of societal responsi- bility. In order to meet this responsibility, it is absolutely essential that you acquire the knowledge required to do your job; and certification indicates that you have acquired that knowledge. In that spirit, being certified as a CPA is generally regarded as the high- est mark of distinction and is required to practice as a financial statement auditor in the United States. In Australia, Canada, and the United Kingdom, the chartered accountant

LO 1-7 List and explain the requirements for becoming a certified public accountant (CPA) and other certifications available to an accounting professional.

First Pages

Chapter 1 Auditing and Assurance Services 27

lou6920x_ch01_001-040.indd 27 02/19/20 02:57 PM

(CA) designation is required to practice as a financial statement auditor. For an informa- tion technology (IT) audit professional, a certified information systems auditor (CISA) is the key mark of distinction. In fact, depending on your area of professional service within public accounting, a certified fraud examiner (CFE), certified forensic accoun- tant (CFA), certified information systems security professional (CISSP), or even a cer- tified internal auditor (CIA), certification may be just as important. Outside of public accounting, certification as a certified management accountant (CMA) or as a certified information technology professional (CITP) may be the most appropriate. Regardless of your career choice, a certification adds credibility that will assist you throughout your entire career.

Education While education requirements vary across the different certifying organizations, we focus on the CPA certification in this book because of its importance to financial statement auditors. For the CPA, the specific education requirements vary by state for both having permission to take the CPA examination and for receiving a CPA certificate. As a result, students must visit the website of their own state’s board of accountancy and search for the exact regulations that apply in their home state. As we approach 2020, most states are requiring you to take 150 semester hours of college education before you receive a CPA certificate, but many states now allow you to take the CPA examination after only 120 semester hours of college education. Still other certifications (such as the CIA) allow you to take the exam before you have graduated.

In addition to entry-level education requirements, all certifying organizations have reg- ulations about continuing professional education (CPE). Indeed, once certified, account- ing professionals obtain CPE hours in a variety of ways: continuing education courses, in-house training, and even college courses. These types of courses range in length from one hour to two weeks, depending on the subject. Many CPE providers offer courses online. If in-house training is not an option, many CPAs obtain their CPE by taking part in training sessions offered by their home state’s professional accounting organization or other industry conferences.

Examination When working as a financial statement auditor, CPAs have a critically important role in protecting the public interest when they attest to the reliability of a company’s financial statements. As a result, the profession needs to make sure that only qualified individuals can become certified and then licensed as CPAs. To do so, the AICPA creates and then administers the Uniform CPA Examination. When creating the exam, the AICPA works hard to ensure that the knowledge and skills covered on the exam are aligned with those that are needed to protect the public interest in current practice. In fact, back in 2017, the AICPA conducted a thorough practice analysis to “ensure that the exam measures the right knowledge and skills to protect the public interest and meet the needs of the boards of accountancy as they license CPAs.”7 The practice analysis revealed that due primarily to the outsourcing of routine tasks and significant advances in information technology, the job of a newly licensed CPA has changed and the AICPA decided to make substantial changes to the CPA exam as of April 1, 2017. The new CPA exam is now described.

The CPA exam now has an increased emphasis on higher-order skills like problem solving, critical thinking, and analytical ability. The exam still covers Auditing and Attestation (AUD), Financial Accounting and Reporting (FAR), Regulation (REG), and Business Environment and Concepts (BEC). However, the exam is now 16 hours, instead of 14, and the emphasis has shifted toward the completion of more task-based

7Tysiac, Ken. 2016. What Will Be Tested on the Next CPA Exam. Journal of Accountancy, Association of International Certified Professional Accountants.

First Pages

28 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 28 02/19/20 02:57 PM

simulations, which allows higher-order skills to be more accurately tested and measured. In the required AUD section, candidates will have four hours to complete 72 multiple- choice questions and eight to nine task-based simulations. The exam score is equally weighted between the multiple-choice questions and task-based simulations. To help can- didates prepare for the exam, the AICPA has published detailed blueprints for each of the four sections. Each blueprint is designed to provide clarity about the knowledge content, skills, and types of tasks that might be tested for each exam. The summary blueprint for the AUD section is provided in the accompanying table (with rough approximations of weights given to each content area and skill allocation*):

Association of International Certified Professional Accountants, “Uniform CPA Examination® Auditing and Attestation (AUD).” May 31, 2018, https://www.aicpa.org/

Content Area Allocation Weight

Ethics, Professional Responsibilities, and General Principles 15–25% Assessing Risk and Developing a Planned Response 20–30% Performing Further Procedures and Obtaining Evidence 30–40% Forming Conclusions and Reporting 15–25%

Skill Allocation Weight

Evaluation 5–15% Analysis 15–25% Application 30–40% Remembering and Understanding 30–40%

Source: http://www.aicpa.org/BECOMEACPA/CPAEXAM/NEXTEXAM/Pages/next-cpa-exam.aspx. Summary blueprints for REG, FAR, and BEC can also be found at this site.

Generally speaking, each section of the new CPA exam consists of multiple-choice question and task-based simulations (except for BEC, which also includes graded writ- ten communication). The task-based simulations are short case studies in which you will be asked to apply your auditing and accounting knowledge. A simulation may involve identifying a potential problem, electronically researching the topic using a database of authoritative standards, and reporting your findings. Each section’s exam blueprint is designed specifically for candidates to help prepare for the exam. Throughout this book, you will have many opportunities to acquire the knowledge necessary to pass the AUD section of the exam.

General information about the CPA exam can be obtained from a special site set up by the AICPA (available at www.aicpa.org). Because qualifications for taking the CPA examination vary from state to state, you will need to contact your state board of accoun- tancy for an application or more information. You can find your state board of accccof Accountancy (NASBA) website (www.nasba.org). Exhibit 1.8 lists the requirements for the most commonly recognized professional certifications.

Experience Although not required to sit for a professional exam, experience is required to become certified. Most states and territories require a person who has attained the education level and passed the CPA examination to have a period of experience working under a practic- ing CPA before awarding a CPA certificate. Experience requirements vary across states, but most jurisdictions require one to two years of experience. A few states require that the experience be obtained in a public accounting firm, but most of them accept experience in other organizations (GAO, internal audit, management accounting, Internal Revenue Service, and the like) as long as the applicant performs work requiring accounting judg- ment and is supervised by a competent accountant, preferably a CPA. Other certifying organizations also have experience requirements.

First Pages

Chapter 1 Auditing and Assurance Services 29

lou6920x_ch01_001-040.indd 29 02/19/20 02:57 PM

EXHIBIT 1.8 Certification Requirements

  Certified Public Accountant (CPA)

Certified Information Systems Auditor (CISA)

Certified Internal Auditor (CIA)

Certified Fraud Examiner (CFE)

Certified Management Accountant (CMA)

Education Level Varies by state; Generally 150 hours. However, Check with your state board of accountancy

No specific degree requirement

Bachelor’s degree or its educational equivalent

Bachelor’s degree or its educational equivalent

Bachelor’s degree, or pass the CPA, CFA, CIA or CFE examination

Experience Varies by state; Generally 1-2 years working under a CPA. Check with your state board of accountancy

5 years of professional information system (IS) auditing, control, or security work experience for certification

Generally 2 years of internal auditing experience or its equivalent for certification. May be less with a Master’s degree

2 years of professional experience for certification

2 continuous years of professional experience in management accounting and/ or financial management

Exam Coverage 1. Auditing and attestation (AUD)

2. Financial accounting and reporting (FAR)

3. Regulation (REG) 4. Business

environment and concepts (BEC)

1. The process of auditing information systems

2. Governance and management of IT

3. Information systems acquisition, development, and implementation

4. Information systems operations, maintenance, and service management

5. Protection of information assets

1. Essentials of Internal Auditing

2. Practice of Internal Auditing

3. Business Knowledge of Internal Auditing

1. Fraud prevention and deterrence

2. Financial transactions and fraud schemes

3. Investigation 4. Law

1. Financial reporting, planning, performance, and control

2. Financial decision making

Test Length 4 parts, 16 hours 1 part, 4 hours (150 mc questions)

3 parts, 6.5 hours (325 mc questions)

4 parts (2 hours each part - 100 questions each); 8 total hours

2 parts (100 mc questions and two 30-minute essays, each) 8 hours

Passing Score 75% 450 (on an 800-point scale)

600 (on a 750-point scale)

75% 360 per part (on a 500-point scale)

Test Dates On demand in 1st two months of each calendar quarter

Two testing windows: Feb.-May & Oct.-Jan.

On demand Self-administered On demand during the months of Jan, Feb, May, Jun, Sep, and Oct

Administering Body American Institute of Certified Public Accountants

Information Systems Audit and Control Association

Institute of Internal Auditors

Association of Certified Fraud Examiners

Institute of Management Accountants

Website www.aicpa.org www.isaca.org www.theiia.org www.acfe.com www.imanet.org

State Certificate and License The AICPA does not issue CPA certificates or licenses to practice. Rather, all states and territories have state accountancy laws and state licensing boards to administer them. After satisfying state requirements for education and experience, successful candidates receive their CPA certificate from their state board of accountancy. At the same time, new CPAs must pay a fee to obtain a state license to practice or work for a CPA firm that

First Pages

30 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 30 02/19/20 02:57 PM

is licensed to practice in their state. Thereafter, state boards of accountancy regulate the behavior of CPAs under their jurisdiction (enforcing state codes of ethics) and supervise the continuing education requirements.

After becoming a CPA licensed in one state, a person can obtain a CPA certificate and license in another state by filing the proper application with the second state board of accountancy, meeting that state’s requirements, and obtaining another CPA certificate. Many CPAs hold certificates and licenses in several states. From a global perspective, individuals must be licensed in each country. Similar to CPAs in the United States, char- tered accountants (CAs) practice in Australia, Canada, Great Britain, and India.

Efforts are currently under way through the AICPA and the National Association of State Boards of Accountancy (NASBA) to streamline the licensing process so that CPAs can practice across state lines without having to have 50 different licenses. Under the concept of substantial equivalency, as long as the licensing (home) state requires (1) 150 hours of education, (2) successful completion of the CPA exam, and (3) one year of experience, a CPA can practice (either in person or electronically) in another substantial equivalency state

without having to obtain a license in that state. The super majority of states and the District of Columbia have enacted provisions to allow CPAs licensed in other states to practice without notification (but agreeing to be under the state’s automatic jurisdiction). This uniform mobility arrangement is temporary though, because a CPA who relo- cates to another state must ultimately seek licensing in that state.

Source: AICPA State Regulation and Legislation Team at www.aicpa.org.

Auditors Make a Run for the BorderAUDITING INSIGHT

Skill Sets and Your Education The requirements to become certified are rather strenuous, but they may not be enough! Let us take you on a brief tour of the core competencies listed by the AICPA, the Asso- ciation of Certified Fraud Examiners (ACFE), the Institute of Internal Auditors (IIA), the Institute of Management Accountants (IMA), the Information Systems Audit and Control Association (ISACA), and other guidance-providing groups: mathematics, international culture, psychology, economics, statistics, political science, inductive and deductive rea- soning, ethics, group dynamic processes, finance, capital markets, managing change, his- tory of accounting, regulation, information systems, taxation, and (oh, yes) accounting and auditing. Add administrative capability, analytical skills, business knowledge, communica- tion skills (writing and speaking), efficiency, intellectual capability, marketing and selling, model building, people development, capacity for putting client needs first, and more.

We hope you are suitably impressed by this recitation of virtually all of the world’s knowledge. You will be very old when you accomplish a fraction of the skill development and education suggested. Now the good news: (1) not everyone needs to be completely knowledgeable in all of these areas upon graduation from college, (2) learning and skill development evolve over a lifetime, and (3) no one expects you to know everything on the job. In fact, we have observed that audit teams composed of members specializing in some areas with other members specializing in other areas seem to work best in practice. We do, however, stress the need to continue your education even after you leave school. Learning should be a lifelong pursuit, not something that ends when you receive your diploma.

REVIEW CHECKPOINTS 1.19 Why is continuing education required to maintain certification? 1.20 Why do you think experience is required to become certified? 1.21 What are some of the functions of a state board of public accountancy? 1.22 What are some of the limitations to practicing public accounting across state and national boundaries?

First Pages

Chapter 1 Auditing and Assurance Services 31

lou6920x_ch01_001-040.indd 31 02/19/20 02:57 PM

Decision makers need more than just information; they need reliable and credible infor- mation that they can rely upon. Internet buyers rely on website information when pur- chasing online. Financial analysts and investors use financial reports to help make stock investment decisions. Suppliers and creditors use financial reports to decide whether to grant credit and bank loans. Labor organizations use financial reports to help determine a company’s ability to pay wages. Government agencies and Congress use financial infor- mation in preparing analyses of the economy and in making laws concerning taxes, sub- sidies, and the like. These various users rely on independent information assurors such as CPAs to reduce information risk. Auditors (and other information assurance providers) assume the role of certifying (or attesting to) published financial information, thereby offering users the valuable service of providing assurance that information risk is low.

This chapter began by defining information risk and explained how auditing and assur- ance services play a role in minimizing this risk. The financial statements were explained in terms of the primary assertions that management makes in them, and these assertions were identified as the focal points of the auditors’ evidence-gathering work. Auditing is practiced in numerous forms by various practice units, including public accounting firms, the Internal Revenue Service, the U.S. Government Accountability Office, internal audit departments in companies, and several other types of regulatory auditors. Fraud examiners, many of whom are internal auditors and inspectors, have also found a niche in auditing-related activities.

The public accounting profession recognizes that, in today’s information economy, information risk exists in areas outside of financial transactions. Assurance services is a broad category of information-enhancement services that build on CPAs’ auditing, attes- tation, accounting, and consulting skills to create products useful to a wide range of deci- sion makers (customers). While reliable information helps make capital markets efficient and helps people know the consequences of a wide variety of economic decisions, CPAs practicing the assurance function are not the only information professionals at work in the economy. Bank examiners, IRS auditors, state regulatory agency auditors (e.g., auditors in a state’s insurance department), internal auditors employed by a company, and federal government agency auditors all practice information assurance in one form or another.

Most financial statement auditors aspire to become certified public accountants, which involves successfully completing a rigorous examination, obtaining practical experience, and maintaining competence through continuing professional education. Auditors also obtain credentials as certified internal auditors, certified management accountants, certi- fied information systems auditors, and certified fraud examiners. Each of these fields has large professional organizations that govern the professional standards and quality of practice of its members.

Summary

assurance: The lending of credibility to information, 4 assurance services: The independent professional functions that improve the quality of information, or its context, for decision makers, 9 attestation: An accounting service resulting in a report on subject matter or an assertion about subject matter that is the responsibility of another party, 4 attestation engagement: An engagement in which a practitioner is engaged to issue a report on subject matter, or an assertion about subject matter that is the responsibility of another party, 7 auditing: The systematic process of objectively obtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence between the assertions and established criteria and communicating the results to interested users, 4 business risk: Those factors, events, and conditions that could prevent the organization from achieving its business objectives, 3 completeness: Management assertion that all of the transactions, events, assets, liabilities, equity interests, and other disclosures that should have been recorded in the financial statements have been recorded, 13

Key Terms

First Pages

32 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 32 02/19/20 02:57 PM

cutoff: Management assertion that refers to accounting for revenue, expense, and other transactions in the proper period. The cutoff date generally refers to the audit client’s year-end balance sheet date, 14 existence: Management assertion that all assets, liabilities, and equity interests do actually exist, 13 financial reporting: Process of providing statements of financial position (balance sheets), results of operations (income statements, statements of shareholders’ equity, and statements of comprehensive income), changes in cash flows (statements of cash flows), and accompanying disclosure to outside decision makers who do not have access to management’s internal sources of information; a company’s accountants, under the direction of its management, perform this function, 11 information risk: The probability that the information circulated by an entity will be false or misleading, 4 internal auditing: An examination service provided to a company to assist the company to meet its corporate goals and objectives by evaluating and recommending risk management, control, and governance processes, 24 occurrence: Management assertion that all of the transactions and events that have been recorded are valid, pertain to the entity, and have actually taken place, 13 operational auditing: An examination designed to evaluate the processes and procedures of an organization or an area within an organization to ensure the process or area is operating efficiently and effectively, 24 presentation and disclosure: Management assertion that all transactions and events have been presented correctly and that all relevant information has been disclosed to financial statement users, usually in the footnotes to the financial statements, 13 professional skepticism: A state of mind that is characterized by appropriate questioning and a critical assessment of audit evidence, 18 relevant assertion: A management assertion is relevant if there is a reasonable possibility that a material misstatement exists related to that assertion for the significant account or footnote disclosure being audited, 16 rights and obligations: The entity is entitled to all rights of the assets, the liabilities are the legal responsibility of the entity, and all of the disclosed events and transactions pertain to the entity, 13 significant accounts: A financial statement account or footnote disclosure is considered significant if there is a chance that the account or footnote disclosure could contain a material misstatement. As a result, an auditor will have to conduct some procedures on each significant account or disclosure, 16 system generated reports: Any report that is generated by the audit client’s information system that is used to execute its internal control procedures or produce its financial statements. It is important to test that each system generated report is complete and accurate if it is being used for either of these purposes, 7 substantial equivalency: The process through which CPAs licensed in one state can practice in another state, 30 valuation or allocation: Management assertion that all assets, liabilities, and equity interests of the entity have been valued in accordance with the relevant financial reporting standards (e.g., GAAP) and are listed in the financial statements at the proper amount, and any resulting valuation adjustments have been appropriately recorded in the financial statements, 13

1.23 Which of the following would be considered an assurance engagement? a. Giving an opinion on a prize promoter’s claims about the amount of sweepstakes prizes

awarded in the past. b. Giving an opinion on the conformity of the financial statements of a university with gen-

erally accepted accounting principles. c. Giving an opinion on the fair presentation of a newspaper’s circulation data. d. Giving assurance about the average drive length achieved by golfers with a client’s golf balls. e. All of the above.

LO 1-2

All applicable questions are available with Connect.

Multiple-Choice Questions for Practice and Review

First Pages

Chapter 1 Auditing and Assurance Services 33

lou6920x_ch01_001-040.indd 33 02/19/20 02:57 PM

1.24 It is always a good idea for auditors to begin an audit with the professional skepticism char- acterized by the assumption that a. A potential conflict of interest always exists between the auditor and the management of

the enterprise under audit. b. In audits of financial statements, the auditor acts exclusively in the capacity of an auditor. c. The professional status of the independent auditor imposes commensurate professional

obligations. d. Financial statements and financial data are verifiable.

1.25 In an attestation engagement, a CPA practitioner is engaged to a. Compile a company’s financial forecast based on management’s assumptions without

expressing any form of assurance. b. Prepare a written report containing a conclusion about the reliability of a management

assertion. c. Prepare a tax return using information the CPA has not audited or reviewed. d. Give expert testimony in court on particular facts in a corporate income tax controversy.

1.26 A determination of cost savings obtained by outsourcing cafeteria services is most likely to be an objective of a. Environmental auditing. b. Financial auditing. c. Compliance auditing. d. Operational auditing.

1.27 The primary difference between operational auditing and financial auditing is that in opera- tional auditing a. The operational auditor is not concerned with whether the audited activity is generating

information in compliance with financial accounting standards. b. The operational auditor is seeking to help management use resources in the most effec-

tive manner possible. c. The operational auditor starts with the financial statements of an activity being audited

and works backward to the basic processes involved in producing them. d. The operational auditor can use analytical skills and tools that are not necessary in finan-

cial auditing.

1.28 According to the AICPA, the purpose of an audit of financial statements is to a. Enhance the degree of confidence that intended users can place in the financial

statements. b. Express an opinion on the fairness with which they present financial position, results of

operations, and cash flows in conformity with accounting standards promulgated by the Financial Accounting Standards Board.

c. Express an opinion on the fairness with which they present financial position, results of operations, and cash flows in conformity with accounting standards promulgated by the U.S. Securities and Exchange Commission.

d. Obtain systematic and objective evidence about financial assertions and report the results to interested users.

1.29 Bankers who are processing loan applications from companies seeking large loans will probably ask for financial statements audited by an independent CPA because a. Financial statements are too complex for the bankers to analyze themselves. b. They are too far away from company headquarters to perform accounting and auditing

themselves. c. The consequences of making a bad loan are very undesirable. d. They generally see a potential conflict of interest between company managers who want

to get loans and the bank’s needs for reliable financial statements.

LO 1-4

LO 1-2

LO 1-6

LO 1-6

LO 1-2

LO 1-1

First Pages

34 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 34 02/19/20 02:57 PM

1.30 The Sarbanes–Oxley Act of 2002 prohibits public accounting firms from providing which of the following services to an audit client? a. Bookkeeping services. b. Internal auditing services. c. Valuation services. d. All of the above.

1.31 Independent auditors of financial statements perform audits that reduce a. Business risks faced by investors. b. Information risk faced by investors. c. Complexity of financial statements. d. Timeliness of financial statements.

1.32 The primary objective of compliance auditing is to a. Give an opinion on financial statements. b. Develop a basis for a report on internal control. c. Perform a study of effective and efficient use of resources. d. Determine whether client personnel are following laws, rules, regulations, and policies.

1.33 What requirements are usually necessary to become licensed as a certified public accountant? a. Successful completion of the Uniform CPA Examination. b. Experience in the accounting field. c. Education. d. All of the above.

1.34 The organization primarily responsible for ensuring that public officials are using public funds efficiently, economically, and effectively is the a. Governmental Internal Audit Agency (GIAA). b. Central Internal Auditors (CIA). c. Securities and Exchange Commission (SEC). d. Government Accountability Office (GAO).

1.35 Performance audits usually include [two answers] a. Financial audits. b. Economy and efficiency audits. c. Compliance audits. d. Program audits.

1.36 The objective in an auditor’s review of credit ratings of a client’s customers is to obtain evi- dence related to management’s assertion about a. Completeness. b. Existence. c. Valuation and allocation. d. Rights and obligations. e. Occurrence.

1.37 Jones, CPA, is planning the audit of Rhonda’s Company. Rhonda verbally asserts to Jones that all expenses for the year have been recorded in the accounts. Rhonda’s representation in this regard a. Is sufficient evidence for Jones to conclude that the completeness assertion is supported

for expenses. b. Can enable Jones to minimize the work on the gathering of evidence to support Rhonda’s

completeness assertion. c. Should be disregarded because it is not in writing. d. Is not considered a sufficient basis for Jones to conclude that all expenses have been

recorded.

LO 1-5

LO 1-1

LO 1-6

LO 1-7

LO 1-6

LO 1-6

LO 1-3

LO 1-4

First Pages

Chapter 1 Auditing and Assurance Services 35

lou6920x_ch01_001-040.indd 35 02/19/20 02:57 PM

1.38 The risk to investors that a company’s financial statements may be materially misleading is called a. Client acceptance risk. b. Information risk. c. Moral hazard. d. Business risk.

1.39 When auditing merchandise inventory at year-end, the auditor performs audit procedures to ensure that all goods purchased before year-end are received before the physical inventory count. This audit procedure provides assurance about which management assertion? a. Cutoff. b. Existence. c. Valuation and allocation. d. Rights and obligations. e. Occurrence.

1.40 When auditing merchandise inventory at year-end, the auditor performs audit procedures to obtain evidence that no goods held on consignment are included in the client’s ending inven- tory balance. This audit procedure provides assurance about which management assertion? a. Completeness. b. Existence. c. Valuation and allocation. d. Rights and obligations. e. Occurrence.

1.41 When an auditor reviews additions to the equipment (fixed asset) account to make sure that fixed assets are not overstated, she wants to obtain evidence as to management’s assertion regarding a. Completeness. b. Existence. c. Valuation and allocation. d. Rights and obligations. e. Occurrence.

1.42 The Sarbanes–Oxley Act of 2002 generally prohibits public accounting firms from a. Acting in a managerial decision-making role for an audit client. b. Auditing the firm’s own work on an audit client. c. Providing tax consulting to an audit client without audit committee approval. d. All of the above.

1.43 Substantial equivalency refers to a. An auditor’s tendency not to believe management’s assertions without sufficient

corroboration. b. Providing consulting work for another firm’s audit client in exchange for the other firm’s

providing consulting services to one of your clients. c. The waiving of certification exam parts for an individual holding an equivalent certifica-

tion from another professional organization. d. Permitting a CPA to practice in another state without having to obtain a license in that

state.

1.44 Which of the following best describes the relationship between auditing and attestation engagements? a. Auditing is a subset of attestation engagements that focuses on the certification of finan-

cial statements. b. Attestation is a subset of auditing that provides lower assurance than that provided by an

audit engagement.

LO 1-1

LO 1-3

LO 1-3

LO 1-3

LO 1-5

LO 1-7

LO 1-2

First Pages

36 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 36 02/19/20 02:57 PM

c. Auditing is a subset of attestation engagements that focuses on providing clients with advice and decision support.

d. Attestation is a subset of auditing that improves the quality of information or its context for decision makers.

1.45 During an audit of a company’s cash balance on a company with operations in only one country, the auditor is most concerned with which management assertion? a. Existence. b. Rights and obligations. c. Valuation or allocation. d. Occurrence.

1.46 When auditing an investment in a publicly-traded company, an auditor most likely would seek to conduct which audit procedure to help satisfy the valuation assertion? a. Inspect the stock certificates evidencing the investment. b. Examine the audited financial statements of the investee company. c. Review the broker’s advice or canceled check for the investment’s acquisition. d. Obtain market quotations from The Wall Street Journal or another independent source.

1.47 Cutoff tests designed to detect valid sales that occurred before the end of the year but have been recorded in the subsequent year would provide assurance about management’s asser- tion of a. Presentation and disclosure. b. Completeness. c. Rights and obligations. d. Existence.

1.48 Which of the following audit procedures probably would provide the most reliable evidence related to the entity’s assertion of rights and obligations for the inventory account? a. Trace test counts noted during physical count to the summarization of quantities. b. Inspect agreements for evidence of inventory held on consignment. c. Select the last few shipping advices used before the physical count and determine whether

the shipments were recorded as sales. d. Inspect the open purchase order file for significant commitments to consider for

disclosure.

1.49 In auditing the accrued liabilities account on the balance sheet, an auditor’s procedures most likely would focus primarily on management’s assertion of a. Existence or occurrence. b. Completeness. c. Presentation and disclosure. d. Valuation or allocation.

1.50 Which of the following best describes the focus of the following engagements?

LO 1-3

LO 1-3

LO 1-3

LO 1-3

LO 1-3

LO 1-2

Auditing Engagement Attestation Engagement

Assurance Engagement

Consulting Services Engagement

a. Any information Financial statements Advice and decision support

Financial information

b. Financial information Advice and decision support

Financial statements Any information

c. Advice and decision support

Any information Financial information Financial statements

d. Financial statements Financial information Any information Advice and decision support

First Pages

Chapter 1 Auditing and Assurance Services 37

lou6920x_ch01_001-040.indd 37 02/19/20 02:57 PM

1.51 Which of the following is a reason to obtain professional certification? a. Certification provides credibility that an individual is technically competent. b. Certification often is a necessary condition for advancement and promotion within a pro-

fessional services firm. c. Obtaining certification is often monetarily rewarded by an individual’s employer. d. All of the above.

1.52 During an audit of an entity’s stockholders’ equity accounts, the auditor determines whether there are restrictions on retained earnings resulting from loans, agreements, or state law. This audit procedure most likely is intended to verify management’s assertion of a. Existence or occurrence. b. Completeness. c. Valuation or allocation. d. Presentation and disclosure.

1.53 When auditing the accounts receivable account on the balance sheet, an auditor’s procedures most likely would focus primarily on management’s assertion of a. Existence. b. Completeness. c. Presentation and disclosure. d. Rights and obligations.

1.54 An auditor selected items for test counts from the client’s warehouse during the physical inventory observation. The auditor then traced these test counts into the detailed inventory listing that agreed to the financial statements. This procedure most likely provided evidence concerning management’s assertion of a. Rights and obligations. b. Completeness. c. Existence. d. Valuation.

1.55 An auditor’s purpose in auditing the information contained in the pension footnote most likely is to obtain evidence concerning management’s assertion about a. Rights and obligations. b. Existence. c. Presentation and disclosure. d. Valuation.

1.56 Which of the following would best be described as an attest engagement? a. An engagement to implement an ERP system. b. An engagement to develop a more efficient payroll process. c. An engagement to assess the effectiveness of an internal control system. d. An engagement to assist the client in an IRS audit.

1.57 An auditor seeks to test the accuracy of the amount recorded as revenue on a contract with a customer under ASC 606. Which PCAOB assertion is most likely being tested? a. Rights and Obligations. b. Valuation and Allocation c. Presentation and Disclosure. d. Completeness.

1.58 In testing the goodwill at an audit client in the retail industry, an auditor may seek to deter- mine whether the account balance had been impaired. Such impairment procedures would be designed to test which financial statement assertion? a. Existence. b. Completeness. c. Presentation and Disclosure. d. Valuation.

LO 1-7

LO 1-3

LO 1-3

LO 1-3

LO 1-3

LO 1-5

LO 1-3

First Pages

38 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 38 02/19/20 02:57 PM

1.59 In testing inventory at an audit client in the retail industry, you note that some of the inven- tory is contracted to be held on consignment. As a result, which financial statement assertion is now relevant? a. Rights and obligations. b. Completeness. c. Existence or occurrence. d. Valuation or allocation.

1.60 Audit, Attestation, and Assurance Services. Following is a list of various professional ser- vices. Identify each by its apparent characteristics as audit engagement, attestation engage- ment, or assurance engagement. Because audits are a subset of attestation engagements, which are a subset of assurance engagements, choose the most specific description. In other words, if you believe the engagement is an audit engagement, select only audit engagement rather than checking all three. Similarly, the choice of assurance engagement for an audit, while technically correct, would not be the best choice.

LO 1-2

Select Exercises and Problems are available with Connect.

Exercises and Problems

  Audit Engagement Attestation Engagement Assurance Engagement

Real estate demand studies      

Ballot for awards show      

Utility rates applications      

Newspaper circulation audits      

Third-party reimbursement maximization      

Annual financial report to stockholders      

Rental property operation review      

Examinations of financial forecasts and projections      

Customer satisfaction surveys      

Compliance with contractual requirements      

Benchmarking/best practices      

Evaluation of investment management policies      

Information systems security reviews      

Productivity statistics      

Internal audit strategic review      

Financial statements submitted to a bank loan officer      

1.61 Controller as Auditor. The chairman of the board of Hughes Corporation proposed that the board hire as controller a CPA who had been the manager of the team that conducted Hughes Corporation’s audit engagement. The chairman thought that hiring this person would make the annual audit unnecessary and would consequently result in saving the professional fee paid to the auditors. The chairman proposed to give this new controller a full staff to conduct such investigations of accounting and operating data as necessary. Evaluate this proposal.

1.62 Management Assertions. Complete the following chart indicating the corresponding Audit- ing Standards Board assertions and whether the assertion relates to transactions, balances, or disclosures.

LO 1-4

LO 1-3

First Pages

Chapter 1 Auditing and Assurance Services 39

lou6920x_ch01_001-040.indd 39 02/19/20 02:57 PM

1.63 Management Assertions. Your audit manager has asked you to explain the PCAOB asser- tions by using an account on the balance sheet at your audit client. For the accounts receiv- able account, please define each of the PCAOB assertions, using the accounts receivable account as a way to illustrate each assertion. You are encouraged to reference Exhibit 1.5 to help you answer this question.

1.64 Operational Auditing. Bigdeal Corporation manufactures paper and paper products and is trying to decide whether to purchase Smalltek Company. Smalltek has developed a process for manufacturing boxes that can replace containers that use fluorocarbons for expelling a liquid product. The price may be as high as $45 million. Bigdeal prefers to buy Smalltek and integrate its products while leaving the Smalltek management in charge of day-to-day operations. A major consideration is the efficiency and effectiveness of Smalltek’s opera- tions. Bigdeal wants to obtain a report on the operational efficiency and effectiveness of the Smalltek sales, production, and research and development departments.

Required: Who can Bigdeal engage to produce the report resulting from this operational audit? Several possibilities exist. Are there any particular advantages or disadvantages in choosing from among them?

1.65 Auditor as Guarantor. Your neighbor, Loot Starkin, invited you to lunch yesterday. Sure enough, it was no “free lunch” because Loot wanted to discuss the annual report of Dodge Corporation. He owns Dodge stock and just received the annual report. Loot says, “Our auditors prepared the audited financial statements and gave an unqualified opinion, so my investment must be safe.”

Required: What misconceptions does Loot Starkin seem to have about the auditor’s role with respect to Dodge Corporation?

1.66 Identification of Audits and Auditors. Audits may be characterized as (a) financial state- ment audits, (b) compliance audits, (c) economy and efficiency audits, and (d) program results audits. The work can be done by independent (external) auditors, internal auditors, or governmental auditors (including IRS auditors and federal bank examiners). Following is a list of the purposes or products of various audit engagements:

LO 1-3

LO 1-5, 1-6

LO 1-1, 1-2

LO 1-6

PCAOB Assertion Corresponding ASB Assertion Nature of Assertion

Existence or Occurrence    

Rights and Obligations    

Completeness    

Valuation and Allocation    

Presentation and Disclosure    

First Pages

40 Part One The Contemporary Auditing Environment

lou6920x_ch01_001-040.indd 40 02/19/20 02:57 PM

Required: For each of the engagements listed, indicate (1) the type of audit (financial statement, com- pliance, economy and efficiency, or program results) and (2) the type of auditors you would expect to be involved.

1.67 Financial Assertions and Audit Objectives. You are engaged to examine the financial state- ments of Spillane Company for the year ended December 31. Assume that on November 1, Spillane borrowed $500,000 from Second National Bank to finance plant expansion. The long-term note agreement provided for the annual payment of principal and interest over five years. The existing plant was pledged as security for the loan. Due to the unexpected difficulties in acquiring the building site, the plant expansion did not begin on time. To use the borrowed funds, management decided to invest in stocks and bonds and on November 16, invested the $500,000 in publicly traded securities.

Required: Identify the relevant financial statement assertions for the publicly traded securities account (an asset) based on the PCAOB’s five management assertions about the financial statements.

1.68 Internet Exercise: Professional Certification. Each state has unique rules for certifica- tion concerning education, work experience, and residency. Visit the website for your state board of accountancy and download a list of the requirements for becoming a CPA in your state. Although not all of the state boards of accountancy have websites, you can find those of most states by accessing the National Association of State Boards of Accountancy at its website (www.nasba.org).

1.69 Internet Exercise: Professional Certification. Visit the website of the Institute of Inter- nal Auditors (www.theiia.org), the Institute of Management Accountants (www.imanet.org), the Association of Certified Fraud Examiners (www.acfe.com), or the Information Systems Audit and Control Association (www.isaca.org). Review the information regarding the cer- tifications available. Does the organization explain the benefits of having its certification? What topics are covered on the certification exam? What are the minimum requirements to take the exam? What additional experience is required to receive the certification?

LO 1-3

LO 1-7

LO 1-7

  Type of Audit

Type of Auditor

 1. Analyze proprietary schools’ spending to train students for low-demand occupations.    

 2. Determine whether an advertising agency’s financial statements are fairly presented in conformity with GAAP.    

 3. Study the effectiveness of the Department of Defense’s expendable launch vehicle program.    

 4. Compare costs of municipal garbage pickup services to comparable services subcontracted to a private business.    

 5. Investigate financing terms of tax shelter partnerships.    

 6. Study a private aircraft manufacturer’s test pilot performance in reporting on the results of test flights.    

 7. Conduct periodic examinations by the U.S. Comptroller of Currency of a national bank for solvency.    

 8. Evaluate the promptness of materials inspection in a manufacturer’s receiving department.    

 9. Report on the need for the states to consider reporting requirements for chemical use data.    

10. Render a public report on the assumptions and compilation of a revenue forecast by a sports stadium/racetrack complex.

Apollo Shoes Audit Planning Part One You are a recently promoted senior (in charge) auditor for Anderson, Olds, and Water- shed and have been assigned to the engagement team of a new client, Apollo Shoes Inc. As part of the planning process, you need to familiarize yourself with Apollo Shoes. To do so, you will want to review the prior year 10-K, Board of Directors meeting minutes, and CEO letter to the shareholders. Detailed instructions can be found in Connect.

First Pages

41

lou6920x_ch02_041-077.indd 41 02/18/20 04:42 PM

LEARNING OBJECTIVES Chapter 2 discusses the standards that govern the conduct of audit examinations (generally accepted auditing standards) and how these standards offer the explicit guidance that must be followed during audits. In addition, Chapter 2 identifies important policies and procedures implemented by auditing firms (through a system of quality control) to ensure that the firms’ audits comply with appropriate professional standards and can withstand scrutiny

by regulatory bodies. Finally, the chapter discusses external monitoring efforts that evaluate the quality of audit firms’ work.

Your objectives are to be able to

LO 2-1 Understand the development and source of generally accepted auditing standards.

LO 2-2 Describe the fundamental principle of responsibilities and how this principle relates to the characteristics and qualifications of auditors.

Bernard Madoff, money manager, approximately one year prior to being arrested for embezzling $50 billion from investors in a Ponzi scheme

In today’s regulatory environment, it’s virtually impossible to

violate rules.

Professional Standards

C H A P T E R 2

Professional Standards References

Topic AU-C/ISA Section

AS Section

Overall Objectives of the Independent Auditor 200 1001 1005  1010 1015

Quality Control for an Audit Engagement 220 1220

Audit Planning 300 2101

Supervision of the Audit Engagement 300 1201

Identifying and Assessing the Risks of Material Misstatement 315 2110

Materiality 320 2105

Audit Evidence 500 1105

Reporting on Financial Statements 700 3101

Modifications to Reports on Financial Statements 705 3105

Quality Control QC 10 1110, QC 20

First Pages

42 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 42 02/18/20 04:42 PM

INTRODUCTION The introductory quote from Bernie Madoff suggests that a strong regulatory environ- ment results in compliance with established rules (despite the fact that Madoff himself did not do so!). Who sets the rules and standards for audits? Until 2002, the accounting profession was self-regulated; that is, the standards governing audits were established by members of the profession themselves through the American Institute of Certified Public Accountants (AICPA). Although critics indicated that self-regulation was akin to having university students establish the systems used to determine their grades, this practice con- tinued for more than 60 years and, although some concerns were raised during this time, remained largely unchanged.

Motivated to a great extent by the audit failures related to Enron and WorldCom, Con- gress passed the Sarbanes–Oxley Act of 2002 (Sarbanes–Oxley). Among other reforms, this act created the Public Company Accounting Oversight Board (PCAOB) to provide external and independent oversight over the audits of public entities, or issuers. (An issuer is an entity that offers registered securities, such as stocks and bonds, for sale to the general public.) Among other matters, the PCAOB is responsible for registering public account- ing firms, establishing and enforcing standards for audit engagements, and inspecting the quality of audits conducted by registered public accounting firms.

The PCAOB’s inspection process and public reporting of results have received a great deal of media attention. As one of the “Big Four” accounting firms along with EY, KPMG, and PwC, Deloitte is a premier provider of accounting and auditing ser- vices. With worldwide revenues of more than $43 billion in 2018 and more than 286,200 employees operating in more than 150 countries, Deloitte’s professionals provide ser- vices to leading organizations throughout the world.1 Clearly, it is important for firms such as Deloitte to implement policies, procedures, and standards to ensure the quality of their work to their clients as well as others who rely on their work in making economic decisions.

Since 2009, an international affiliate of Deloitte (Deloitte Touche Tohmatsu Auditores Independentes, also known as Deloitte Brazil) served as the auditor of Gol Intelligent Airlines (a low-cost Brazilian airline).2 In its 2010 audit of Gol’s financial statements, Deloitte Brazil was found to have violated generally accepted auditing standards with respect to obtaining evidence regarding Gol’s maintenance deposit assets and revenues; in addition, Deloitte Brazil failed to address several issues that suggested Gol’s internal control over financial reporting was not operating effectively. As a result, Deloitte Brazil issued false and misleading opinions on Gol’s financial statements and internal control over financial reporting.

In 2012, the PCAOB selected the 2010 Gol audit for review as part of its inspec- tion process. In anticipation of the possibility of receiving a negative inspection report, Deloitte Brazil altered the documentation related to the Gol audit and provided other

1Data are drawn from Deloitte’s 2018 Global Impact Report. 2Much of the factual information in this vignette is drawn from PCAOB Release No. 105-2016-031, In the Matter of Deloitte Touche Tohmatsu Auditores Independentes, December 5, 2016 and the PCAOB enforcement actions related to individual Deloitte personnel.

LO 2-3 Describe the fundamental principle of performance and identify the major activities performed in an audit.

LO 2-4 Understand the fundamental principle of reporting and identify the basic contents of the auditors’ report.

LO 2-5 Understand the role of a system of quality control and monitoring efforts in enabling public accounting firms to meet appropriate levels of professional quality.

First Pages

Chapter 2 Professional Standards 43

lou6920x_ch02_041-077.indd 43 02/18/20 04:42 PM

misleading documents and information to the PCAOB inspectors. The following record- ing maintained by one of Deloitte Brazil’s auditors illustrates the nature of these efforts:

Person 1: Any evidence that you have of this, remove it from your machine. Keep it in a – if you have that, keep it somewhere else, but not in your machine, not in the office. Okay?

Person 2: No. Okay. Person 1: Okay? Another thing, considering that he [the partner in charge of the Gol

audit] will take the responsibility for all this, everything you told me, every- thing we discussed, never happened.

Person 2: Okay. Person 1: Never! Whatever happens – I, if somebody says, “No, [other staff at

Deloitte Brazil] said to you-”, I will say “No, there must be a mistake!” I will never admit it was said.

So what was the outcome? Deloitte Brazil settled, with the following sanctions:

∙ Censure ∙ Civil monetary penalty of $8 million (to date, the largest ever levied by the PCAOB;

the second largest was a $2 million penalty assessed to EY in 2012) ∙ Prohibitions from accepting new audit engagements ∙ Required reviews of all work on existing audit clients by Deloitte Global member or

affiliate firms. ∙ Appointment of an independent monitor to review and assess Deloitte Brazil’s quality

control system and evaluate implementation of other sanctions.

In addition to these firmwide sanctions, 12 individuals affiliated with Deloitte Brazil were censured and sanctioned through monetary penalties, disbarment from affiliating with PCAOB-registered accounting firms (for periods ranging from one year to perma- nent), suspensions, or other restrictions on audit-related responsibilities. Then-PCAOB Director of Enforcement Claudius Modesti commented that Deloitte’s actions were “the most serious misconduct we’ve discovered.”3

The preceding vignette illustrates the powerful role of the PCAOB and its significant impact on regulation in the accounting profession. The following summarizes PCAOB enforcement activity for the three-year period 2016–2018.4

3“Bother in Brazil,”The Economist, December 10, 2016, pp. 63-64. 4Disciplinary orders drawn from PCAOB website (https://pcaobus.org/enforcement/Pages/default.aspx).

Settled Actions Adjudicated Actions

Number of cases 128 7 Disbarment of CPA/revocation of firm registration 84 7 Suspension of CPA/suspension of firm registration 13 0 Withdrawal of firm registration from PCAOB 8 0 Cases involving Big Four firms 18 1 # / total monetary penalties  83 / $15.4 million 7 / $842,500 Range of monetary penalties $1,000–$8 million $2,500–$150,000

This vignette illustrates the public scrutiny placed on policies and procedures imple- mented by firms to conduct quality audits. Although situations like these, as well as the Madoff fraud referenced in the opening quote to this chapter, are exceptions rather than the rule, accounting firms clearly are being held to a higher standard for the quality of their work, and failures are receiving intense attention in the media. The development of professional auditing standards, actions taken by audit firms to ensure that their audits comply with these standards, and monitoring efforts by external bodies (such as the PCAOB) to evaluate the quality of audit firms’ work are the focal points of this chapter.

First Pages

44 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 44 02/18/20 04:42 PM

GENERALLY ACCEPTED AUDITING STANDARDS (GAAS) At least two historical milestones had a significant impact on the development of audit- ing standards. In 1938, a scandal of epic proportions broke at McKesson & Robbins, a large pharmaceutical company. Price Waterhouse & Co. (now PwC), the company’s auditor for more than 10 years, failed to discover that the company had inflated inven- tory and receivables through the falsification of supporting documents (including one phony shipment from the United States to Australia by truck!). Auditors merely accepted management’s assertions about inventory and receivables balances without verifying their existence. The accounting profession reacted quite strongly to the scandal by task- ing the AICPA to develop standards that served as the basis for audits of both issuers and non-issuers (nonpublic entities). From 1939 through 2002, the AICPA’s Auditing Standards Board issued Statements on Auditing Procedures (1939–1972) and State- ments on Auditing Standards (SASs) (1972–present) to provide guidance for the conduct of audits.5

A second defining moment in the development of auditing standards was the mas- sive frauds at Enron and WorldCom (and the inability of those entities’ auditors to identify the frauds). In response to these failures, Sarbanes–Oxley (which was passed by a vote of 99-0 in the U.S. Senate!) created the PCAOB and delegated the respon- sibility for developing standards for the audits of issuers to this body. The PCAOB issues Auditing Standards, which are subject to the formal approval of the Securities and Exchange Commission (SEC). The authorization for developing standards for the audits of non-issuers continues to remain with the Auditing Standards Board of the AICPA.

Until 2016, PCAOB standards consisted of a combination of Auditing Standards issued by the PCAOB and standards issued by the AICPA that had not been superseded by the PCAOB (referred to as Interim Auditing Standards). Effective December 31, 2016, the PCAOB has reorganized and combined these standards into a single body of pronouncements. Appendix 2A illustrates how auditors utilize the PCAOB and ASB standards in providing appropriate professional guidance.

The relevant pronouncements of the AICPA and PCAOB are collectively referred to as generally accepted auditing standards (GAAS).6 GAAS are auditing standards that identify necessary qualifications and characteristics of auditors and guide the conduct of the audit examination. The purpose of GAAS is to meet the objectives of an audit examination, which are (AU-C 200.12):

∙ To obtain reasonable assurance about whether the financial statements as a whole are free of material misstatement, whether due to fraud or error.

∙ To issue a report on the financial statements.

Generally, auditors who do not follow the guidance provided in GAAS are presumed to have performed deficient audits. The auditing standards also includes interpretive pub- lications (which includes Interpretations, exhibits, AICPA Audit and Accounting Guides, and AICPA Auditing Statements of Position). Although officially considered less authori- tative and less binding than the guidance in the SASs and Auditing Standards, auditors still must justify any departures from these publications, which provide guidance on the application of GAAS in specific circumstances, including engagements for entities in certain industries. The relationship among these various pronouncements is summarized in the following graphic.

LO 2-1 Understand the development and source of generally accepted auditing standards.

5Statements on Auditing Standards (SAS) are authoritative AICPA pronouncements on auditing theory and practice. Statements on Auditing Procedure (SAP) Nos. 1–54 were codified into SAS 1 in 1972. 6The auditing standards for public entities are sometimes referred to as PCAOB Standards to distinguish them from the standards for nonpublic entities.

First Pages

Chapter 2 Professional Standards 45

lou6920x_ch02_041-077.indd 45 02/18/20 04:42 PM

Auditing standards are quite different from audit procedures. Audit procedures are the particular and specialized actions that auditors take to obtain evidence in a specific audit engagement. Auditing standards, on the other hand, are quality guides to the audit that apply to all audits. For example, auditing standards indicate that auditors must determine that recorded accounts receivable are based on actual sales to customers. An audit proce- dure used to satisfy that standard is to confirm accounts receivable with the company’s customers. This difference is the reason auditors’ reports refer to an audit “conducted in accordance with standards of the Public Company Accounting Oversight Board” [emphasis added] rather than in accordance with audit procedures.

In addition to the standards for U.S. issuers and non-issuers, it is important to note that separate auditing standards have been developed for governmental and foreign entities. A summary of the body charged with establishing standards as well as the standards themselves for various types of audits follows.

Collectively Referred to as GAAS

Guide general conduct of audit engagements

Provide requirements supporting fundamental principles

Provide guidance on the application of GAAS

Fundamental Principles

PCAOB Auditing Standards and ASB Statements on Auditing Standards

Interpretive Publications

  Issuers Non-issuers Governmental Entities Foreign Entities

Rule-making body Public Company Accounting Oversight Board (PCAOB)

AICPA Auditing Standards Board (ASB)

U.S. Government Accountability Office (GAO)

International Auditing and Assurance Standards Board (IAASB)

Standards Auditing Standards (ASs)

Statements on Auditing Standards (SASs)

Government Auditing Standards (The Yellow Book)

International Standards on Auditing (ISAs)

Website www.pcaobus.org www.aicpa.org www.gao.gov www.ifac.org

If an accounting firm audits issuers and non-issuers throughout the world, that firm may be subject to multiple (sometimes conflicting) standards issued by the ASB, PCAOB, and IAASB, among others. For this reason, auditors and regulators have a great interest in convergence—that is, making the standards coordinated, if not uniform, throughout the world. The ISAs are a first step in the development of one consistent set of guidelines that auditors worldwide can follow. Although the focus in this text will be on audits of U.S. issuers and non-issuers (and therefore pronouncements of the PCAOB and ASB), it is important that students be aware that additional standards exist related to the audits of governmental and foreign entities.

Organization of GAAS The body of GAAS is based on three fundamental principles identified by the ASB that underlie all audits. These fundamental principles relate to (1) responsibilities of the audit team, (2) performance of the audit, and (3) reporting the results of the engagement. They

First Pages

46 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 46 02/18/20 04:42 PM

are established to meet the objectives of an audit and are supported by objectives and requirements of specific SASs. While these principles have been issued by the ASB and are not formally applicable to the audits of issuers, they are consistent with and reflect the requirements of GAAS for audits of issuers.

Recall from Chapter 1 the definition of auditing as

REVIEW CHECKPOINTS 2.1 Define generally accepted auditing standards (GAAS). What is the purpose of GAAS? 2.2 Who is responsible for developing standards for the audits of issuers? Who is responsible for devel-

oping standards for the audits of non-issuers? 2.3 Identify the role of the following bodies in the auditing standards-setting process: (1) the AICPA; (2)

the PCAOB; (3) the SEC. 2.4 Identify the three fundamental principles underlying GAAS.

Auditors are responsible for:

• Having appropriate competence and capabilities to perform the audit.

• Complying with relevant ethical requirements. • Maintaining professional skepticism and exercising professional

judgment throughout the planning and performance of the audit.

Closer examination of the fundamental principles reveals that they closely parallel that definition. For example, the responsibilities principle defines objectivity and identifies the important role that objectivity plays in the audit. The performance principle requires, among other things, auditors to plan the work (i.e., conduct the audit using a “systematic process”) and to “obtain and evaluate evidence” through assessing the risk of material misstatement and gathering sufficient appropriate evidence. Finally, the reporting principle provides guidance for “communicating the results” of the audit about whether the financial statements are pre- pared using “established criteria” (an applicable financial reporting framework, or GAAP).

. . . a systematic process of objectively obtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence between the assertions and established criteria and communicating the results to interested users.

FUNDAMENTAL PRINCIPLE: RESPONSIBILITIES The fundamental principle of responsibilities relates to the personal integrity and profes- sional qualifications of auditors. This principle addresses the following responsibilities of auditors:

LO 2-2 Describe the fundamental principle of responsibilities and how this principle relates to the characteristics and qualifications of auditors.

First Pages

Chapter 2 Professional Standards 47

lou6920x_ch02_041-077.indd 47 02/18/20 04:42 PM

As shown in the following figure, most of the issues related to responsibilities are addressed before a firm accepts a prospective client. However, professional skepticism and professional judgment must be considered and exercised by the auditor throughout the entire engagement.

Competence and capabilities

Relevant ethical requirements (independence)

Professional skepticism and professional judgment Relevant ethical requirements (due care)

STAGES OF AN AUDIT

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Audit Evidence Reporting

Competence and Capabilities Competence and capabilities begin with education in accounting because auditors hold themselves out as experts in accounting standards, financial reporting, and auditing. In addition to university-level education prior to beginning their careers, auditors are required to participate in continuing professional education throughout their careers to ensure that their knowledge keeps pace with changes in the accounting and auditing pro- fession. In fact, one of the important requirements for maintaining a CPA license is suf- ficient continuing professional education.

Education is only one element of competence and capabilities. Another important dimension is experience, which is gained with hands-on practice and on-the-job train- ing. An important component of this experience is the ability to develop and apply professional judgment in real-world audit situations. These situations include various judgments related to gathering evidence as to the fairness of an entity’s financial state- ments and evaluating whether that evidence indicates that the financial statements are prepared according to generally accepted accounting principles. (Professional judg- ment is also an important component of the performance principle, which will be dis- cussed later.)

Independence and Due Care The responsibilities principle requires auditors to comply with appropriate ethical requirements; two important requirements relate to independence and due care. Audi- tors must maintain independence in mental attitude; that is, auditors are expected to be unbiased and impartial with respect to the financial statements and other informa- tion they audit. This “state of mind” is often referred to as the auditor possessing inde- pendence in fact. This independence allows auditors to form an opinion on the entity’s financial statements without being affected by influences that might compromise that opinion.

It is not only important for auditors to be unbiased; they must also appear to be unbi- ased. Independence in appearance relates to others’ (particularly financial statement users’)

First Pages

48 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 48 02/18/20 04:42 PM

perceptions of auditors’ independence. For example, imagine that the son or daughter of your professor was enrolled in your class. While your professor may truly be unbiased and evaluate the child fairly, it is unlikely that you and your classmates would believe your professor to be independent.

Although independence is a complex concept and many different threats to indepen- dence exist, two general types of relationships that are believed to jeopardize (or compro- mise) independence are

1. Financial relationships, such as owning shares of stock in a client or having a loan outstanding to or from a client.

2. Managerial relationships, such as the ability to act in a decision-making capacity on behalf of a client or to provide advice on systems or information that will subsequently be audited. (For example, some questions were raised when the lead audit partner of PwC on the Mattel audit recommended candidates for senior-level finance positions within Mattel).7

Clearly, the relationships just listed would impair perceptions of auditors’ indepen- dence, but other considerations are necessary. For example, although it seems safe to conclude that an audit team member’s spouse should be restricted from the preceding types of relationships for a client for which the team member is providing services, could that spouse have these types of relationships with respect to a client served by a distant office of the team member’s firm? Could the audit team member’s third cousin have such relationships?

It is difficult to think of a matter more fundamental to the value of an audit than independence. Without independence, third-party users are not able to rely on the auditor’s work and opinion on the entity’s financial statements. The preceding discus- sion identifies some of the major factors affecting independence, but the possible rela- tionships involving auditors, entities, and their personnel are endless; the complexities of these relationships have resulted in a number of interpretations and ethics rulings regarding auditor independence. Many individuals fundamentally question whether auditors can be independent given the fee arrangement they have with their clients. (Imagine the situation if you directly paid your professor instead of the university for your tuition!) In addition, the often long-standing relationships between auditors and their clients have resulted in some attempts to require periodic rotation of audit firms to lessen the impact of financial relationships between these two parties and enhance independence.

Issues related to auditor independence may provide some significant challenges in practice. For example, an investigation in 2000 of independence violations at PwC revealed that “.  .  . approximately 86.5 percent of PwC partners and 10.5 percent of all other PwC professionals had independence violations.”8 The Auditing Insight “Carillion and Independence” summarizes a case that raised concerns about auditor independence.

This section introduces the concept of auditor independence and provides a limited overview of issues that impact auditor independence. A detailed discussion of AICPA and SEC rules related to independence (and various interpretations of those rules) is provided in Module B.

A second ethical requirement identified by the responsibilities principle is that of due care. Due care reflects a level of performance that would be exercised by reasonable auditors in similar circumstances. This standard is often referred to as that of a prudent auditor; auditors are expected to possess the skills and knowledge of others in their pro- fession but are not expected to be infallible. This aspect relates to the competence and

7“Mattel’s Finance Chief to Leave,” The Wall Street Journal, October 30, 2019, p. B5. 8“Independent Consultant Finds Widespread Independence Violations at PricewaterhouseCoopers,” SEC Press Release 2000–4, January 6, 2000.

First Pages

Chapter 2 Professional Standards 49

lou6920x_ch02_041-077.indd 49 02/18/20 04:42 PM

capabilities of the auditor to perform the engagement and issue appropriate reports. One specific element of due care noted by the standards is the need for auditors to plan and perform the audit with an appropriate level of professional skepticism as discussed in the following section.

Professional Skepticism and Professional Judgment Professional skepticism and professional judgment are necessary responsibilities of audi- tors throughout the entire audit process. Professional skepticism (which was introduced in Chapter 1) is a state of mind that is characterized by appropriate questioning and a critical assessment of audit evidence. When exhibiting professional skepticism, auditors do not assume that management is dishonest, nor do they assume that management is unques- tionably honest. Rather, auditors evaluate and consider

∙ Contradictory audit evidence obtained through different procedures. ∙ The reliability of documentary evidence. ∙ The reliability of information obtained from management and those charged with gov-

ernance of the entity (e.g., the audit committee).

Although the preceding discussion suggests that professional skepticism is a relatively straightforward concept, situations occur during the audit that could impede auditors’ abil- ity to apply appropriate levels of professional skepticism. A PCAOB Staff Practice Alert9 identified the following conditions that present challenges for auditors maintaining appro- priate levels of professional skepticism; these conditions may result in auditors failing to appropriately question, assess, and evaluate evidence, and, ultimately, reach the correct conclusion during their engagement:

∙ Financial incentives and pressures (such as building or maintaining a long-term audit engagement, facing pressures to keep audit fees low, achieving high levels of client satisfaction, and providing other fee-related services to clients).

∙ Time pressures (such as completing the audit and report prior to deadlines and sched- uling and workload demands on partners and other audit team members).

∙ Personal relationships developed with clients that provide auditors with an inappropri- ate level of trust or confidence in management.

Professional judgment is the application of relevant training, knowledge, and experience in making informed decisions about appropriate courses of action during the audit engagement.

9Staff Audit Practice Alert No. 10, “Maintaining and Applying Professional Skepticism in Audits,” PCAOB, December 4, 2012.

Issues related to the importance of independence have been raised following the collapse of Carillion, the second largest United Kingdom (U.K). construction company with over 43,000 worldwide employees. Two U.K. House of Commons committees noted that “. . . conflicts of interest at every turn” resulted in KPMG’s failure to challenge ques- tionable accounting practices at Carillion.

The U.K.’s Competition and Markets Authority (CMA) has rec- ommended that the Big Four split their auditing and nonauditing functions into separate operating entities (currently, nonauditing services account for over 75 percent of total firm revenues and unlike U.S. firms, U.K. firms can provide significant levels of

consulting services to audit clients). In addition, the CMA recom- mends that the audit of larger companies be conducted by two firms (one of which is a non-Big Four firm), in an effort to spur competition. In response to these recommendations, two Big Four firms (PwC and KPMG) have announced restructuring of their audit practices.

Sources: “Big Four Auditors Face New U.K. Calls to Break Part,” The Wall Street Journal Online, May 16, 2018; “U.K. Toughens Auditor Rules,” The Wall Street Journal, December 19, 2018, p. B11; “KPMG to Restructure Audit Business in U.K.,” CFO.com, May 17, 2019; “PwC Revamps Audit Business in Britain,” The Wall Street Journal, June 6, 2019, p. B10.

Carillion and IndependenceAUDITING INSIGHT

First Pages

50 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 50 02/18/20 04:42 PM

These judgments relate to the evidence obtained during the audit and the conclusions reached based on this evidence. Auditors are required to demonstrate this characteristic throughout the entire audit process as they do professional skepticism. Professional judgment is required as auditors gather evidence, evaluate evidence, and draw conclusions based on evidence. Professional judgment is particularly important in evaluating the reasonableness of various management estimates required in preparing the entity’s financial statements.

In addition to demonstrating appropriate levels of professional judgment, auditors are required to carefully document their professional judgment in such a manner that experi- enced auditors with no previous relationship with the audit can understand the judgments made in reaching conclusions on significant issues.

A preliminary investigation of the actions of David Friehling (the indi- vidual responsible for the audits of Bernard L. Madoff Investment Securities LLC) illustrated the following potential violations of ele- ments of the responsibilities principle:

• Friehling did not verify the existence of assets or securities trades made by Madoff’s company, suggesting a lack of professional skepticism and a lack of due care.

• Friehling was the sole auditor at Friehling and Horowitz, raising the question as to whether a “one-man” firm has the capability to effectively audit a company as large as Madoff’s.

• Friehling and his family had investment accounts at Madoff’s com- pany worth more than $14 million, a conflict of interest that raises questions about his independence.

Source: “Accountant Arrested for Sham Audits,” The Wall Street Journal, March 19, 2009, p. C1.

Madoff and the Responsibilities PrincipleAUDITING INSIGHT

REVIEW CHECKPOINTS 2.5 Distinguish between independence in fact and independence in appearance. Can auditors be inde-

pendent in fact yet not be perceived to be independent in appearance? 2.6 What is due care? To what standards are auditors held with respect to due care? 2.7 Define professional skepticism and professional judgment. During what stages of the audit are

auditors required to demonstrate these characteristics?

FUNDAMENTAL PRINCIPLE: PERFORMANCE The fundamental principle of performance sets forth general quality criteria for con- ducting an audit. As noted in the preceding section, in addition to the elements of this principle, the performance of the audit is influenced by the need for auditors to exercise professional skepticism and professional judgment throughout the audit process. The performance principle states that

LO 2-3 Describe the fundamental principle of performance and identify the major activities performed in an audit.

To express an opinion, the auditor obtains reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error. To obtain reasonable assurance, which is a high but not absolute level of assurance, the auditor:

• Plans the work and properly supervises any assistants.

First Pages

Chapter 2 Professional Standards 51

lou6920x_ch02_041-077.indd 51 02/18/20 04:42 PM

As the preceding reflects, the performance principle contains five elements: (1) rea- sonable assurance, (2) planning and supervision, (3) materiality, (4) risk assessment, and (5) audit evidence. These are discussed in the remainder of this section.

Reasonable Assurance The concept of reasonable assurance recognizes that a GAAS audit may not detect all material misstatements and auditors are not “insurers” or “guarantors” regarding the fair- ness of the entity’s financial statements. However, auditors should provide a high level of assurance (or confidence) regarding their work. Auditors provide reasonable assurance through considering various risks relating to the likelihood of material misstatement in the financial statements and performing audit procedures to limit the overall risk to an acceptably low level. This is done through the risk assessment process, an additional ele- ment of the performance principle.

Planning and Supervision After obtaining or retaining the engagement, the next major stage of the audit is planning, as in the following figure. The professional standards contain several considerations for planning and supervising an audit. They are concerned with (1) preparing an audit plan and supervising the audit work, (2) obtaining knowledge of the client’s business, and (3) dealing with differences of opinion among the accounting firm’s own personnel.

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Audit Evidence Reporting

STAGES OF AN AUDIT

• Determines and applies appropriate materiality level or levels throughout the audit.

• Identifies and assesses risks of material misstatement, whether due to fraud or error, based on an understanding of the entity and its environment, including the entity’s internal control.

• Obtains sufficient appropriate audit evidence about whether material misstatements exist, through designing and imple- menting appropriate responses to the assessed risks.

GAAS require the preparation of a written audit plan. An audit plan is a list of the audit procedures that auditors need to perform to gather sufficient appropriate evidence on which to base their opinion on the financial statements. The procedures in an audit plan should be stated in enough detail to instruct the assistants about the work to be done. (You will see detailed audit plans later in this textbook.)

Auditors are also required to obtain an understanding of the client’s business and indus- try. This knowledge helps auditors identify areas for special attention (the accounts or classes of transactions where frauds or errors might exist), evaluate the reasonableness of accounting estimates made by management, evaluate management’s responses to inqui- ries, and make judgments about the appropriateness of management’s choices among

First Pages

52 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 52 02/18/20 04:42 PM

accounting principles. Auditors gain this understanding of a business through discussions with management and other client personnel; through experience with other entities in the same industry; and by reviewing AICPA accounting and audit guides, industry publi- cations, other entities’ financial statements, business periodicals, and textbooks.

Just as having advance notice of assignments and examinations makes it easier for you (as a student) to perform better on those assignments, timing is important for audit planning. To have time to plan an audit, auditors should be engaged before the client’s fiscal year-end. The more advance notice auditors have, the better they are able to pro- vide enough time for planning. The audit team may be able to perform part of the audit at an interim date—a date some weeks or months before year-end—and thereby make the rest of the audit work more efficient. For example, in examining property, plant, and equipment, auditors may evaluate activity in the account balance up to some date during the year (say, September 30) prior to year-end (December 31) and then evaluate activ- ity occurring between that date and December 31 following year-end (the roll-forward period), as shown in the following graphic. Essentially, at December 31, auditors have evaluated the account balance through the interim date (in this case, September 30) and will evaluate the remainder of the activity following year-end. Doing so permits audit work to be “shifted” from after year-end to prior to year-end and allows the audit to be completed on a more timely basis.

December 31January 1

Evaluate activity from January 1 through September 30

Evaluate activity from November 10 through December 31

Normal year-end workPlanning and interim work

Engagement planning is discussed in greater detail in Chapter 3. In addition, planning activities related to the audit of various accounts and cycles are discussed in Chapters 6, 7, 8, 9, and 10.

In its Form 12b-25 filing with the SEC, U.S. Premium Beef LLC dis- closed that it dismissed KPMG as its auditor and engaged PwC on February 28, 2012. Because of the late appointment of PwC and its inability to plan and perform the audit on a timely basis (U.S. Premium

Beef had a December 31 year-end), the company was unable to meet the deadline for filing its financial statements with the SEC. Sources: U.S. Premium Beef LLC Form 12b-25 (dated March 29, 2012); U.S. Premium Beef LLC Form 8-K (dated February 28, 2012).

Too LateAUDITING INSIGHT

Materiality The concept of materiality recognizes that auditors should focus on matters that are impor- tant to financial statement users. One common way of viewing materiality is the dollar amount that would influence the lending or investing decisions of financial statement users. Auditors and users do not expect account balances to be accurate to the penny; after all, many entities round their financial statements to the thousands, or even millions, of dollars! For example, Apple reported net income of $59.5 billion in 2018; clearly, a mis- statement of $1 million (less than 0.2 percent of net income) would not likely affect users’ decisions, but a misstatement of $10 billion (16.8 percent of net income) probably would. Materiality is recognized as part of the objective of an audit, which is “to obtain reason- able assurance about whether the financial statements as a whole are free of material misstatement” [emphasis added] (AU-C 200.12). Materiality is commonly established

First Pages

Chapter 2 Professional Standards 53

lou6920x_ch02_041-077.indd 53 02/18/20 04:42 PM

based on percentages of key financial statement subtotals, such as net income, sales or revenues, and total assets.

The audit team considers materiality in planning the audit, performing the audit, and evaluating the effect of misstatements on the entity’s financial statements. Auditors are responsible only for providing reasonable assurance that misstatements material to the entity’s financial statements are identified. Stated another way, auditors are not respon- sible for detecting misstatements that are not material to the financial statements.

Although the concept of materiality appears to be relatively straightforward, imple- mentation of materiality during the audit requires high levels of professional judgment. For example, suppose a small dollar misstatement (in absolute terms) resulted in an entity meeting its earnings expectations or resulted in an entity reporting higher earnings than in the previous year. Certainly, these impacts would likely influence investment decisions, even if the dollar amount is relatively small. Circumstances such as these are referred to as qualitative materiality factors and should also be considered by auditors. The role of materiality in the planning stages of the audit is discussed in more detail in Chapter 3.

Risk Assessment An important part of the performance principle is for auditors to identify important con- cerns (or risks) they face in the audit. This process is referred to as risk assessment:

The risk assessment process requires an understanding of the client, its operating envi- ronment, and its industry. This includes internal controls operating within the client’s accounting information systems that ultimately produce the client’s financial statements. Internal control may be defined as the policies and procedures implemented by an entity to prevent or detect material accounting frauds or errors and provide for their correction on a timely basis. Satisfactory internal control reduces the probability of frauds or errors in the accounts. This understanding provides the foundation for the work auditors do in assessing the risk of material misstatement, a combination of inherent risk (the probability that a material misstatement, either an error or fraud, will occur) and control risk (the probability that a material misstatement, either an error or fraud, will not be prevented or detected on a timely basis by the entity’s internal controls). One way to think of the risk of material misstatement is the likelihood that an error or fraud will exist in the financial statements prior to considering the auditors’ work.

The primary purpose of assessing the risk of material misstatement is to help auditors determine the nature, timing, and extent of further audit procedures necessary for gather- ing evidence about the fairness of the entity’s financial statements. The process of risk assessment presumes two necessary relationships:

1. Effective internal control reduces the control risk, and auditors thus have a reasonable basis for reducing the necessary effectiveness of further audit procedures.

2. Ineffective internal control increases control risk, and auditors must increase the nec- essary effectiveness of further audit procedures.

Because these audit procedures are used to obtain evidence with respect to the fairness of the account balance (i.e., to “substantiate” the account balance), they are referred to

STAGES OF AN AUDIT

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Audit Evidence Reporting

First Pages

54 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 54 02/18/20 04:42 PM

as substantive procedures. The auditors’ substantive procedures are reflected in the deter- mination of detection risk, which is discussed in the next section. A depiction of this relationship follows:

E�ective Internal Control Allows auditors to evaluate less evidence and/or use less e�ective substantive procedures

Ine�ective Internal Control Requires auditors to evaluate more evidence and/or use more e�ective substantive procedures

Lower Level of Control Risk

Higher Level of Control Risk

STAGES OF AN AUDIT

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Audit Evidence Reporting

The importance of internal control in the audit examination is evidenced by an increase in auditors’ responsibility for internal control in the audit of issuers that auditors evalu- ate (through testing the operating effectiveness of specific controls) and report on the effectiveness of an issuer’s internal control over financial reporting. This is one example of auditors’ responsibility in the audit of an issuer exceeding that for the audit of a non- issuer. Internal control is discussed in more detail in Chapter 5; in addition, important elements of internal control related to the audit of various accounts and cycles are dis- cussed in Chapters 6, 7, 8, 9, and 10.

REVIEW CHECKPOINTS  2.8 Define reasonable assurance. How does the audit team provide reasonable assurance in the

engagement?  2.9 What is an audit plan? During which stage of the audit is an audit plan prepared? 2.10 What is an interim date? How do audit procedures conducted prior to an interim date impact the

audit examination? 2.11 What is materiality? During what stages of the audit do auditors consider materiality? 2.12 For what reasons do auditors obtain an understanding of a client’s internal control? 2.13 What is the basic relationship between the effectiveness of the client’s internal control and the

necessary effectiveness of substantive procedures?

Audit Evidence The final element of the performance principle requires that the audit team collects and evaluates sufficient appropriate evidence to provide a reasonable basis for their opinion.

First Pages

Chapter 2 Professional Standards 55

lou6920x_ch02_041-077.indd 55 02/18/20 04:42 PM

Evidence is the information that auditors use in arriving at the conclusions on which to base the audit opinion and includes the underlying accounting data and all available corroborating information. Examples of evidence include minutes of meetings, confirma- tions with independent third parties, invoices, analyst reports, and all other information that permits auditors to reach valid, logical conclusions. As noted, the methods auditors use to gather and evaluate this evidence are referred to as substantive procedures, which are performed following the auditors’ risk assessment process.

The performance principle requires auditors to gather “sufficient appropriate” evi- dence. To be considered appropriate, evidence must be trustworthy (reliable) and must provide the audit team with information of interest (relevant). Professional standards note the following with respect to the reliability of evidence:

∙ Evidence created by sources external to the entity is more reliable than that created by the entity. From most to least reliable, sources of evidence are auditors (direct personal knowledge), parties external to the entity (external evidence), and parties internal to the entity (internal evidence).

∙ Evidence created by sources outside the entity is more reliable when received directly from the external source (direct external evidence) than when received from sources internal to the entity (external-internal evidence).

∙ Evidence obtained from entities with more effective internal controls is more reliable than that obtained from entities with less effective internal controls.

∙ Evidence obtained from original source documents is more reliable than that obtained from photocopies, facsimiles, or electronic documents.

Relevance refers to the nature of information provided by the audit evidence; for example, when auditors confirm accounts receivable with customers, this audit procedure provides evidence that the account is legitimate (i.e., the sale actually took place) but does not provide evidence that the account will ultimately be collectible. The nature of information provided by evidence is operationalized through the management assertions identified and discussed in Chapter 1.

Appropriateness relates to evidence quality, and sufficiency relates to evidence quan- tity. For large entities, auditors do not audit all of the transactions and components but examine a sample of these items in drawing their conclusions. Sufficiency relates to the number of transactions or components evaluated.

The sufficiency and appropriateness of evidence are reflected in the necessary level of detection risk. Detection risk represents the risk that the audit team’s substantive pro- cedures will fail to detect a material misstatement. As auditors require a higher quality of evidence (lower detection risk), they must gather more relevant and reliable evidence (appropriateness) and evaluate more transactions or components (sufficiency). Evidence- gathering procedures are discussed in more detail in Chapter 3. In addition, specific approaches to gathering evidence in the examination of various accounts and cycles are discussed in Chapters 6, 7, 8, 9, and 10.

“The level of fraud and financial deception that took place at Health- South is a blatant violation of investor trust, and Ernst & Young is as outraged as the investing public.” In a public statement, the account- ing firm asserted that HealthSouth, one of its largest clients, tried to deceive the firm’s audit team by creating false documents to support fraudulent journal entries. To support the firm’s claim, the statement

cited a court hearing in which a former HealthSouth employee tes- tified that “he knew of at least three occasions where company executives prepared false documents specifically to conceal fraud from Ernst.” Source: WeilStaff, Jonathan. 2003. Did HealthSouth Auditor Ernst Miss Key Clues to Fraud Risks? The Wall Street Journal.

Whom Can You Trust?AUDITING INSIGHT

First Pages

56 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 56 02/18/20 04:42 PM

Exhibit 2.1 summarizes the key characteristics of evidence just discussed. Note that both the sufficiency and the appropriateness of audit evidence affect detection risk. Also note that the appropriateness is affected by both the relevance of the evidence and its reliability.

EXHIBIT 2.1 Key Characteristics of Audit Evidence

Su�ciency (quantity of evidence)

Detection Risk

Appropriateness (quality of evidence)

Relevance (What does evidence tell

the auditor?)

Reliability (Can the auditor trust the

evidence?)

REVIEW CHECKPOINTS 2.14 Define audit evidence. 2.15 Define external, external-internal, and internal documentary evidence. 2.16 Distinguish between relevance and reliability as these concepts relate to audit evidence. How are

relevance and reliability associated with the appropriateness of audit evidence? 2.17 How does the source of evidence affect its reliability? 2.18 How are the sufficiency and appropriateness of evidence related to detection risk?

FUNDAMENTAL PRINCIPLE: REPORTING  The ultimate objective of the audit—the report on the audit—is guided by the fundamen- tal principle of reporting, which states

LO 2-4 Understand the fundamental principle of reporting and identify the basic contents of the auditors’ report.

Based on evaluation of the evidence obtained, the auditor expresses in the form of a written report, an opinion in accordance with the auditor’s findings, or states that an opinion cannot be expressed. The opinion states whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.

As the following graphic shows, reporting is the final stage of an audit and occurs following the gathering of audit evidence.

STAGES OF AN AUDIT

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Audit Evidence Reporting

First Pages

Chapter 2 Professional Standards 57

lou6920x_ch02_041-077.indd 57 02/18/20 04:42 PM

Report of Independent Registered Public Accounting Firm

The Board of Directors and Shareholders of Microsoft Corporation

Opinion on the Financial Statements

We have audited the accompanying consolidated balance sheets of Microsoft Corporation and subsidiaries (the “Company”) as of June 30, 2019 and 2018, the related consolidated statements of income, comprehensive income, stockholders’ equity, and cash flows, for each of the three years in the period ended June 30, 2019, and the related notes (collectively referred to as the “financial statements”). In our opinion, the financial statements present fairly, in all material respects, the financial position of the Company as of June 30, 2019 and 2018, and the results of its operations and its cash flows for each of the three years in the period ended June 30, 2019, in conformity with accounting principles generally accepted in the United States of America.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (“PCAOB”), the Company’s internal control over financial reporting as of June 30, 2019, based on criteria established in Internal Control — Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission and our report dated August 1, 2019, expressed an unqualified opinion on the Company’s internal control over financial reporting.

Basis for Opinion

These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on the Company’s financial statements based on our audits. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audits included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audits provide a reasonable basis for our opinion.

Critical Audit Matters

The critical audit matters communicated below are matters arising from the current-period audit of the financial statements that were communicated or required to be communicated to the Company’s Audit Committee and that: (1) relate to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of critical audit matters does not alter in any way our opinion on the financial statements, taken as a whole, and we are not, by communicating the critical audit matters below, providing separate opinions on the critical audit matters or on the accounts or disclosures to which they relate.

[Auditors’ report provided description and method of addressing Critical Audit Matters related to Revenue Recognition and Uncertain Tax Positions Related to Transfer Pricing Issues]

DELOITTE & TOUCHE LLP Seattle, Washington

August 1, 2019 We have served as the Company’s auditor since 1983

United States Securities and Exchange Commission. “McDonald’s Corporation 2018 Annual Report.” Accessed February 22, 2019. https://www.sec.gov

EXHIBIT 2.2 Example Auditors’ Report for Issuer (Microsoft Corporation)

An example of an auditors’ report is shown in Exhibit 2.2, and you should review it in relation to the following discussion.

The report in Exhibit 2.2 is the report form used for issuers; differences in wording exist, but the report for non-issuers conveys essentially the same information. You should understand the term financial statements to include not only the traditional financial statements, but also all footnote disclosures and additional information (e.g., earnings per share calculations) that are integral elements of the basic financial presentation required by GAAP.

First Pages

58 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 58 02/18/20 04:42 PM

The reporting principle requires the auditor to express an opinion on the entity’s financial statements (or indicate that an opinion cannot be expressed). With respect to this requirement, the last sentence in the first paragraph of Deloitte & Touche’s report begins with the phrase “In our opinion,” which represents the expression of an opinion.

In expressing this opinion, the auditor is required to assess the financial statements against an applicable financial reporting framework. A financial reporting framework is a set of criteria used to determine the measurement, recognition, presentation, and disclo- sure of material items in the financial statements; three examples of financial reporting frameworks are GAAP, International Financial Reporting Standards (IFRS), or a special purpose framework (such as cash or tax bases). Again, referring to Deloitte & Touche’s report in Exhibit 2.2, the first paragraph concludes that Microsoft’s financial statements present its financial condition, results of operations, and cash flows “. . . in conformity with U.S. generally accepted accounting principles” (GAAP). In this case, GAAP are the applicable financial accounting framework.

The report in Exhibit 2.2 is an example of an unmodified (or unqualified) opinion, which concludes that the entity’s (in this case, Microsoft’s) financial statements present its financial condition, results of operations, and cash flows in conformity with GAAP. Other types of opinions that can be expressed include the following:

∙ An adverse opinion concludes that the entity’s financial statements are not presented in conformity with GAAP (or other financial reporting framework such as IFRS).

∙ A qualified opinion concludes that except for a relatively isolated (usually limited) departure, the entity’s financial statements are presented in conformity with GAAP (or other financial reporting framework, such as IFRS).

∙ In some cases (e.g., if the auditors lack independence), auditors may choose not to express an opinion on the entity’s financial statements. This type of report is referred to as a disclaimer of opinion. (A disclaimer of opinion is an indication that an opinion cannot be expressed.)

When these situations are encountered, auditors add an explanatory paragraph to their report and would then modify some of the paragraphs of the report shown in Exhibit 2.2. These and other report modifications are discussed further in Chapter 12.

One important phrase in the first paragraph is “in all material respects. . . .” The con- cept of materiality has been discussed previously as part of the performance principle; used in a reporting context, it communicates that the audit team is unaware of any mate- rial misstatements in the financial statements. The choice of report (unqualified, quali- fied, or adverse) depends on the nature and materiality (significance) of the effect of the GAAP departure.

The report shown in Exhibit 2.2 expresses the auditors’ conclusion on the fairness of Microsoft’s financial statements. The second paragraph of this report references a report on Microsoft’s internal control over financial reporting. This report is also pre- sented along with Microsoft’s financial statements and expresses the auditors’ conclusion regarding the effectiveness of Microsoft’s internal control over financial reporting. Audit reporting is discussed in greater detail in Chapter 12.

REVIEW CHECKPOINTS 2.19 What is a financial reporting framework? How is it related to the auditors’ reporting

responsibilities? 2.20 What are the four types of audit opinions? What is the conclusion of each one?

First Pages

Chapter 2 Professional Standards 59

lou6920x_ch02_041-077.indd 59 02/18/20 04:42 PM

EVALUATING THE QUALITY OF PUBLIC ACCOUNTING FIRMS’ PRACTICES

To this point in the chapter, we have discussed the professional standards related to audit engagements. Many organizations are interested in ensuring that public accounting firms meet these engagement standards and maintain high levels of quality in their practices. For example, the SEC provides general oversight of the accounting and auditing pro- fessions, investigates audit failures (situations in which auditors fail to detect material financial statement misstatements), and levies fines against firms that have been found negligent in conducting audits. In addition, the PCAOB inspects the work of audit firms to ensure that their audits comply with professional standards.10

However, one important issue that has not been addressed is the nature of actions that firms themselves routinely take to ensure that their work is of high quality and meets the professional standards discussed in this chapter. For example, how do firms ensure that the personnel assigned to engagements are independent with respect to the client and have the appropriate level of competence to handle the assignment? What process do firms use when deciding either to accept or continue an audit engagement? The answers to these and other questions are reflected in policies and procedures that firms implement as part of a system of quality control, which is the focus of this section.

System of Quality Control Statement on Quality Control Standards No. 8 (SQCS 8), “A Firm’s System of Quality Control,” notes that the purpose of a system of quality control is to provide the firm reason- able assurance that the firm and its personnel

∙ Comply with professional standards and applicable regulatory and legal requirements. ∙ Issue reports that are appropriate in the circumstances.

Simply stated, a system of quality control is implemented by firms to ensure that their work is of high quality and meets the expectations of professional standards. Section 103 of Sarbanes–Oxley established broad areas of quality control standards that were required of registered public accounting firms. These areas serve as the basis for the following six elements of a system of quality control identified by SQCS 8:

1. Leadership responsibilities for quality within the firm (“tone at the top”). Undoubtedly, you have heard the phrase “leadership by example.” In order for qual- ity control standards to be effective, it is important that the firm’s management take a lead role in clearly and consistently demonstrating its own commitment to quality control and high-quality work. Doing so will make it clear to all personnel that high- quality work is valued and will be rewarded. Some examples of how this can be done include

∙ Assigning management responsibilities in such a manner that financial consider- ations do not override the quality of work performed.

∙ Basing performance evaluation, compensation, and promotion opportunities for personnel on the quality of work performed.

∙ Devoting sufficient resources for developing, communicating, and supporting the firm’s quality control policies and procedures.

LO 2-5 Understand the role of a system of quality control and monitoring efforts in enabling public accounting firms to meet appropriate levels of professional quality.

10Firms auditing only nonpublic entities undergo a peer review process conducted by the AlCPA’s National Peer Review Committee.

First Pages

60 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 60 02/18/20 04:42 PM

It may seem unusual to specify that personnel decisions should be based on the qual- ity of work performed. After all, what other basis should be used? Both the Enron and WorldCom cases provided anecdotal evidence that suggested the fear of losing a key client (and the impact of that loss on individual auditors’ performance evalu- ations and opportunities within the firm) contributed to the audit failures in those cases.

2. Relevant ethical requirements. Earlier in this chapter, we discussed indepen- dence and the importance of independence to the auditing profession. Firms should take various actions to ensure that personnel assigned to engagements are both independent in fact and independent in appearance with respect to the firm’s clients, such as

∙ Communicating independence requirements to personnel. ∙ Identifying circumstances and relationships that create threats to independence and

taking appropriate action to eliminate those threats or reduce them to an acceptable level.

∙ Obtaining written confirmation from all firm personnel with respect to their com- pliance with appropriate independence requirements.

3. Acceptance and continuance of client relationships and specific engagements. As discussed in Chapter 3, one of the most important decisions facing an audit firm is that of accepting an engagement (for a new client) or continuing to perform an engagement (for an existing client). When making this decision, firms should focus on three impor- tant issues:

1. The integrity and business reputation of the client. 2. The firm’s ability to adequately perform the engagement with an appropriate level

of professional competence. 3. The firm’s ability to comply with legal and ethical requirements related to the

engagement.

The purpose of this process is to avoid association with a client whose manage- ment lacks integrity and to ensure that the firm can perform the engagement at an appropriate level.

If firms decide to withdraw from an engagement after considering the preced- ing matters, SQCS 8 notes that the firm should document significant issues, con- sultations, conclusions, and the basis for any conclusions related to its decision to withdraw.

4. Human resources. The quality of any professional services organization (such as an audit firm) is based on the quality of its people. Effective quality control policies and procedures should be implemented to ensure that firms hire quality personnel, assign these personnel to engagements for which they have the appropriate capabilities, provide professional development opportunities to those individuals, and effectively evaluate, compensate, and promote them. These practices will increase the likeli- hood that a high-quality audit is conducted by ensuring that the firm has high-quality personnel and that these individuals have the ability to assume the responsibilities assigned to them.

5. Engagement performance. The performance principle (discussed earlier in this chap- ter) addressed a number of significant issues related to the conduct of an audit engage- ment. Firms frequently use manuals and other standardized forms of documentation to meet the preceding objectives.

An important element of quality control is the practice of conducting engagement quality control reviews for engagements meeting specified criteria identified by the firm (for example, engagements in a highly volatile industry or engagements that

First Pages

Chapter 2 Professional Standards 61

lou6920x_ch02_041-077.indd 61 02/18/20 04:42 PM

meet certain risk criteria). An engagement quality control review includes an internal evaluation of the significant judgments made by the audit team and the conclusions reached in formulating its report.

6. Monitoring. The purpose of monitoring is to provide the firm with reasonable assur- ance that policies and procedures composing the system of quality control are operat- ing effectively and complied with in practice. Examples of procedures used to monitor quality control include

∙ Reviews of selected administrative and personnel records. ∙ Reviews of engagement documentation, reports, and the client’s financial

statements. ∙ Discussions with firm personnel. ∙ Assessments of the (1) appropriateness of the firm’s guidance materials and

professional aids, (2) compliance with policies and procedures on indepen- dence, (3) effectiveness of continuing professional education, and (4) decisions regarding the acceptance and continuance of client relationships and specific engagements.

Firms may accomplish these monitoring activities through either an ongoing post- issuance review of engagement documentation or targeted inspection procedures for a sample of engagements conducted by the firm.

PCAOB Inspection of Firms Earlier in this chapter, we addressed the role of the PCAOB in establishing auditing stan- dards. In addition to this role, the PCAOB is charged with monitoring the quality of work performed by firms auditing issuers and bringing appropriate action against those firms if substandard work is identified. This monitoring is referred to as an inspection11 and is conducted as follows:

∙ For firms performing audits of more than 100 issuers, inspections are conducted on an annual basis.

∙ For firms performing audits of 100 or fewer issuers, inspections are conducted at least every three years.

Based on information from the PCAOB’s website, more than 1,800 accounting firms are registered with the PCAOB. As of January 1, 2019, 506 of these firms issue audit reports but only 11 were required to have annual inspections because they conducted audits for more than 100 companies.

Inspections are conducted by full-time employees of the PCAOB. These inspections consist of a review of a sample of audit engagements conducted by the firm as well as an overall evaluation of the firm’s system of quality control (policies related to audit performance, training, compliance with independence requirements, and client manage- ment). Copies of the PCAOB’s inspection reports can be found (on a firm-by-firm basis) on the PCAOB’s website. These reports detail the deficiencies identified by the PCAOB on the sample of audit engagements (the name of the client is not identified); information regarding deficiencies in the firm’s quality control are not publicly disclosed and will be disclosed only if the firm fails to address those deficiencies within a year following the inspection.

The importance of these inspections are evidenced by a recent scandal involving KPMG noted in the Auditing Insight “Stealing the Exam”.

11The AICPA has a similar type of process (referred to as peer review) for firms auditing non-issuers.

First Pages

62 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 62 02/18/20 04:42 PM

The Auditing Insight “Grading the Firms” provides a summary of reported deficien- cies for audits conducted by Big Four firms. Although that information summarizes audits conducted by large accounting firms, evidence suggests that a significant number of deficiencies has also been observed in audits conducted by smaller firms.12

12“Smaller Auditors Get So-So Grades,” The Wall Street Journal, February 26, 2013, p. C2.

AUDITING INSIGHT

A PCAOB employee (who was hoping to join KPMG) leaked confiden- tial information related to planned PCAOB inspections to executives at KPMG, which would allow the firm to prepare for the inspections and receive more favorable reports. In the two years preceding the leak, KPMG had the highest percentage of inspected audits found to be deficient, (38% and 54% in 2016 and 2015, respectively). In April 2017, KPMG terminated five executives (including the national man- agement partner for audit quality and professional practice, national partner in charge for inspections, and co-leader of the Banking and Capital Markets Group) for their roles in this scandal.

On June 18, 2019, KPMG agreed to a $50 million settlement with the SEC related to this matter. Six individuals (the five KPMG execu- tives and the PCAOB employee) have been charged with conspiracy and wire fraud for their roles in this scheme. As of October 2019, four

of the individuals have pleaded guilty and two were convicted on con- spiracy and wire fraud charges. While the maximum penalties range from 65 to 85 years in prison, one individual received a prison sen- tence of eight months and the other a sentence of 366 days.

Ironically, PCAOB inspections following of KPMG audits following the revelation of this scheme found deficiencies in nearly 50% of the audits inspected.

Sources: “KPMG Fires Partners Over Leak,” The Wall Street Journal, April 12, 2017, p. B1; “KPMG Ex-Partner Convicted in Scheme to Steal Information,” The Wall Street Journal, March 12, 2019, p. B3; “KPMG to Pay Penalty Over Cheat- ing Scandal,” The Wall Street Journal, June 18, 2019, p. B1-B2; “Auditor Sen- tenced in KPMG Case,” The Wall Street Journal, September 12, 2019, p. B10; “Another Former KPMG Executive Pleads Guilty in ‘Steal the Exam’ Scheme,” Wall Street Journal Online, October 4, 2019.

Stealing the Exam

Overall, these results indicate the following:

• 29% of all inspected audits had deficiencies • For audits having deficiencies, the average number of deficiencies

per audit was 2.1

• 0.6% and 2.3% of all inspected audits failed to identify a departure from GAAP and modified the opinion on internal control over finan- cial reporting, respectively.

Public Company Accounting Oversight Board. “PCAOB Firm Inspection Reports.” https://pcaobus.org/

Grading the FirmsAUDITING INSIGHT

Year

Number of Audits Inspected

Audits in Which Deficiencies Were Identified

Number of Deficiencies Identified

Audits in Which Departure from GAAP Not Identified by Firms

Audits in Which Report on Internal Control Was Revised

2018 reports (2017 audits) 217 67 138 0 2

2017 reports (2016 audits) 217 61 129 1 6

2016 reports (2015 audits) 217 61 127 3 7

The very public nature of the PCAOB inspection process and controversies surround- ing that process raise the question as to whether inspection reports measure audit quality and are useful to various parties in their decision processes. The following Auditing Insight summarizes academic research that examined how the inspection process and results influence the behavior of both audit firms and their clients. The PCAOB recently indicated that it is considering shifting the focus of its investigations from evaluating audit deficiencies to assessing the firms’ systems of quality control.13

13“Auditing the Auditors: U.S. Rethinks Approach,” The Wall Street Journal Online, May 6, 2016.

First Pages

Chapter 2 Professional Standards 63

lou6920x_ch02_041-077.indd 63 02/18/20 04:42 PM

• Abbott et al. concluded that clients were more likely to dismiss smaller (triennially inspected) audit firms when those firms received PCAOB inspection reports indicating that they failed to detect a departure from GAAP.

• Gramling et al. found that audit firms receiving a PCAOB inspection report that identified deficiencies were more likely to issue more severe audit opinions for clients experiencing financial difficulties following the inspection report compared to prior to the inspection report.

• Nagy concluded that audit firms receiving public disclosure of quality control criticisms suffered a significant loss in market share, consistent with perceptions that these reports are credible signals of audit quality.

• Lamoreaux found that audit firms subject to PCAOB inspections in a nonmandatory inspection regime conducted higher qual- ity audits (as measured by a greater incidence of issuing going- concern opinions and reporting material weaknesses in internal control and lower client earnings management activities).

• Boone et al. found that the PCAOB’s censure of Deloitte resulted in market share loss and reduced levels of audit fee growth, suggest- ing that the censure had a significant reputational effect on Deloitte.

• Aobdia found that audits identified with PCAOB report deficien- cies had a 9 percent increase in total audit hours in the year fol- lowing the reported deficiency. In addition, companies audited by firms with PCAOB report deficiencies were 18 percent more likely to switch auditors, while those without deficiencies were 17  percent less likely to switch auditors compared to non- inspected audits.

Sources: L. J. Abbott, K. A. Gunny, and T. C. Zhang, “When the PCAOB Talks, Who Listens? Evidence from Stakeholder Reaction to GAAP-Deficient PCAOB Inspection Reports of Small Auditors,” Auditing: A Journal of Practice & Theory, May 2013, pp. 1–31; A. A. Gramling, J. Krishnan, and Y. Zhang, “Are PCAOB- Identified Audit Deficiencies Associated with a Change in Reporting Decisions of Triennially Inspected Audit Firms?” Auditing: A Journal of Practice & Theory, August 2011, pp. 59–79; A. L. Nagy, “PCAOB Quality Control Inspection Reports and Auditor Reputation,” Auditing: A Journal of Practice & Theory, August 2014, pp. 87–104; P. T. Lamoreaux, “Does PCAOB Inspection Access Improve Audit Quality? An Examination of Foreign Firms Listed in the United States,” Journal of Accounting and Economics, April–May 2016, pp. 313–337; J.P. Boone, I.K. Khurana, and K.K. Raman, “Did the 2007 PCAOB Disciplinary Order Against Deloitte Impose Actual Costs on the Firm or Improve Its Quailty,” The Accounting Review, March 2015, pp. 405-441; D. Aobdia, “The Impact of the PCAOB Individual Engagement Inspection Process – Preliminary Evidence,” The Accounting Review, July 2018, pp. 53-80.

Academic Research on PCAOB InspectionsAUDITING INSIGHT

REVIEW CHECKPOINTS 2.21 What is a system of quality control? Identify the six elements of a system of quality control. 2.22 What factors should auditors consider in deciding whether to accept or continue the engagement

with a particular client? What should firms do if they decide to withdraw from an engagement? 2.23 Provide examples of procedures that firms have used to monitor their quality control policies and

procedures. 2.24 What role does the PCAOB play in connection with monitoring and regulating public accounting

firms? 2.25 How frequently are firms required to have PCAOB inspections?

This chapter discussed the professional standards that apply to audit engagements and identified important mechanisms that enable public accounting firms to provide profes- sional services to meet those standards. From an auditing standpoint, generally accepted auditing standards form the basis for professional engagements and the necessary quali- fications and characteristics of auditors. These standards are based on three basic prin- ciples, which reflect the overall conduct of the audit examination:

1. Responsibilities, which require auditors to possess competence and capabilities, com- ply with relevant ethical requirements, maintain professional skepticism, and exercise professional judgment.

2. Performance, which involves planning the work and supervising assistants, determin- ing and applying appropriate materiality levels, identifying and assessing the risk of material misstatement, and obtaining sufficient appropriate audit evidence.

Summary

First Pages

64 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 64 02/18/20 04:42 PM

3. Reporting, which requires that auditors express an opinion about the fairness of the entity’s financial statements.

To provide reasonable assurance of compliance with these standards, firms develop sys- tems of quality control that prescribe policies and procedures related to (1) the responsibili- ties of firm leadership for quality, (2) ethical requirements, (3) acceptance and continuance of client relationships and specific engagements, (4) human resources, (5) engagement performance, and (6) monitoring of the effectiveness of the system of quality control. Under Sarbanes–Oxley, firms conducting audits of issuers are required to have inspections of selected engagements and their systems of quality control by the PCAOB. The purpose of these inspections is to identify deficiencies in engagements conducted by the firms and provide suggestions for improvements in their systems of quality control.

Following is a summary of the professional standards and monitoring activities for audits of issuers and non-issuers.

  Professional Standards Monitoring Requirements

Issuer Auditing Standards issued by the PCAOB Annual or triennial inspections conducted by the PCAOB (frequency depends upon number of audits performed by the firm)

Non-issuer Statements on Auditing Standards issued by the ASB of the AICPA

Triennial peer reviews conducted through the AICPA National Peer Review Committee

American Institute of Certified Public Accountants (AICPA): As related to professional auditing standards, the body charged with establishing auditing standards for the audits of nonpublic entities through Statements on Auditing Standards (SASs) issued by the Auditing Standards Board, 42 appropriate (audit evidence): Characteristics related to the quality (relevance and reliability) of audit evidence, 55 audit plan: A comprehensive list of the specific audit procedures that the audit team needs to perform to gather sufficient appropriate evidence on which to base their opinion on the financial statements, 51 audit procedures: The specialized actions auditors take to obtain evidence in an engagement, 45 auditing standards: The audit quality guides that apply to all audits, 45 control risk: The likelihood that the client’s internal control policies and procedures fail to prevent or detect a material misstatement, 53 detection risk: The likelihood that the auditors’ substantive procedures will fail to detect a material misstatement that exists within an account balance or class of transactions, 55 due care: A level of performance that would be exercised by reasonable auditors in similar circumstances; auditors are expected to possess the skills and knowledge of others in their profession and are not expected to be infallible, 48 engagement quality control review: An internal evaluation of the significant judgments made by the audit team and the conclusions reached in formulating its report on an engagement conducted by that firm, 60 evidence: The information used by auditors in arriving at the conclusion on which the audit opinion is based, which includes the underlying accounting data and all available corroborating information, 55 financial reporting framework: The financial reporting standards (i.e., GAAP, IFRS, etc.) adopted by management and, when appropriate, those charged with governance (audit committee or board of directors) in the preparation of the financial statements, 58 generally accepted auditing standards (GAAS): Standards that identify necessary qualifications and characteristics of auditors and guide the conduct of the audit examination, 44

Key Terms

First Pages

Chapter 2 Professional Standards 65

lou6920x_ch02_041-077.indd 65 02/18/20 04:42 PM

independence in appearance: The extent to which others (particularly financial statement users) perceive auditors to be independent, 47 independence in fact: Auditors’ mental attitude and impartiality with respect to the client, 47 inherent risk: The probability that in the absence of internal controls, material errors or frauds could enter the accounting system used to develop financial statements, 53 inspection: An evaluation of an accounting firm’s audit engagements and system of quality control conducted by the PCAOB and required for any firms providing auditing services to public entities, 61 internal control: A process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the reliability of financial reporting, the effectiveness and efficiency of operations, and compliance with applicable laws and regulations, 53 issuer: An entity that offers registered securities, such as stocks and bonds, for sale to the general public (also known as a public entity). Issuers are subject to mandatory audit requirements, 42 materiality: An amount or event that has a substantial likelihood to influence financial statement users’ decisions. Thus, material information is a synonym for important information. The emphasis is on the financial statement users’ point of view, not on the auditors’ or managers’ points of view, 52 professional judgment: The application of relevant training, knowledge, and experience in making informed decisions about appropriate courses of action during the audit engagement, 49 professional skepticism: A state of mind that is characterized by appropriate questioning and a critical assessment of audit evidence, 49 Public Company Accounting Oversight Board (PCAOB): As related to professional auditing standards, the body charged with establishing auditing standards for the audits of public entities through the issuance of Auditing Standards. The PCAOB is also responsible for inspecting firms that perform audits of public entities, 42 reasonable assurance: The concept that recognizes that the costs of control activities should not exceed the benefits that are expected from the control activities, 51 risk of material misstatement: The combined probability that a material misstatement (error or fraud) will occur and not be prevented or detected on a timely basis by the entity’s internal controls. The risk of material misstatement is a combination of inherent and control risk, 53 substantive procedures: The detailed audit and analytical procedures designed to detect material misstatements in account balances and footnote disclosures, 54 sufficiency (audit evidence): The measure of the quantity of audit evidence (the number of transactions or components evaluated), 55 system of quality control: The policies and procedures implemented by a firm to provide with reasonable assurance that the firm and its personnel (1) comply with professional standards and applicable regulatory and legal requirements and (2) issue reports that are appropriate in the circumstances, 59

All applicable questions are available with Connect.

Multiple-Choice Questions for Practice and Review

2.26 Which of the following categories of principles is most closely related to gathering audit evidence? a. Performance b. Reasonable assurance c. Reporting d. Responsibilities

2.27 Which of the following is not related to ethical requirements of auditors? a. Due care b. Independence in appearance c. Independence in fact d. Professional judgment

LO 2-3

LO 2-2

First Pages

66 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 66 02/18/20 04:42 PM

2.28 One of an accounting firm’s basic objectives is to provide professional services that conform to professional standards. Reasonable assurance of achieving this objective can be obtained by following a. Generally accepted auditing standards. b. Standards within a system of quality control. c. Generally accepted accounting principles. d. International auditing standards.

2.29 Which of the following best demonstrates the concept of professional skepticism? a. Relying more extensively on external evidence rather than internal evidence. b. Focusing on items that have a more significant quantitative effect on the entity’s financial

statements. c. Critically assessing verbal evidence received from the entity’s management. d. Evaluating potential financial interests held by auditors in the client.

2.30 The primary purpose for obtaining an understanding of the entity’s environment (including its internal control) in a financial statement audit is a. To determine the nature, timing, and extent of substantive procedures to be performed. b. To make consulting suggestions to the entity’s management. c. To obtain direct sufficient appropriate audit evidence to afford a reasonable basis for an

opinion on the financial statements. d. To determine whether the entity has changed any accounting principles.

2.31 Ordinarily, what source of evidence should least affect audit conclusions? a. External documentary evidence. b. Inquiry of management. c. Documentation prepared by the audit team. d. Inquiry of entity legal counsel.

2.32 The most reliable evidence regarding the existence of newly acquired computer equipment is a. Inquiry of management. b. Documentation prepared externally. c. Evaluation of the client’s procedures. d. Physical observation.

2.33 Which of the following procedures would provide the most reliable audit evidence? a. Inquiries of the client’s internal audit staff. b. Inspection of prenumbered client purchase orders filed in the vouchers payable department. c. Inspection of vendor sales invoices received from client personnel. d. Inspection of bank statements obtained directly from the client’s financial institution.

2.34 Breaux & Co. CPAs require that all audit documentation indicates the identity of the pre- parer and the reviewer. This procedure provides evidence relating to which of the following? a. Independence. b. Adequate competence and capabilities. c. Adequate planning and supervision. d. Sufficient appropriate evidence gathered.

2.35 Which of the following concepts is least related to the standard of due care? a. Independence in fact b. Professional skepticism c. Prudent auditor d. Reasonable assurance

2.36 The evidence considered most appropriate by auditors is best described as a. Internal documents such as sales invoice copies produced under conditions of strong

internal control. b. Written representations made by the president of the entity.

LO 2-5

LO 2-2

LO 2-3

LO 2-3

LO 2-3

LO 2-3

LO 2-3

LO 2-2

LO 2-3

First Pages

Chapter 2 Professional Standards 67

lou6920x_ch02_041-077.indd 67 02/18/20 04:42 PM

c. Documentary evidence obtained directly from independent external sources. d. Direct personal knowledge obtained through physical observation and mathematical

recalculation.

2.37 Auditors’ understanding of the internal control in an entity provides information for a. Determining whether members of the audit team have the required competence and capa-

bilities to perform the audit. b. Ascertaining the independence in mental attitude of members of the audit team. c. Planning the professional development courses the audit staff needs to keep up to date

with new auditing standards. d. Planning the nature, timing, and extent of substantive procedures on an audit.

2.38 Which of the following elements of a system of quality control is related to firms receiving independence confirmations from its professionals with respect to clients? a. Acceptance and continuance of client relationships and specific engagements. b. Engagement performance. c. Monitoring. d. Relevant ethical requirements.

2.39 Which of the following is most closely related to the responsibilities principle? a. The auditors’ responsibility to issue a report as a result of their examination. b. The requirement that auditors gather sufficient, appropriate evidence upon which to base

an opinion on the financial statements. c. The auditors’ compliance with relevant ethical requirements of independence and due care. d. The auditors’ responsibility to plan the audit and properly supervise assistants.

2.40 Kramer, CPA, consulted an independent appraiser regarding the valuation of fine art for a not-for-profit museum. Consultation with the appraiser in this case would a. Be considered as exercising proper due care. b. Be considered a failure to follow generally accepted auditing standards because Kramer

should have known how to value fine art before accepting the engagement. c. Not be considered a violation of generally accepted auditing standards because generally

accepted auditing standards does not apply to not-for-profit entities. d. None of the above.

2.41 Which of the following topics is not addressed in the auditors’ report for an issuer? a. Responsibilities of the auditor and management in the financial reporting process. b. Absolute assurance regarding the fairness of the entity’s financial statements in accor-

dance with GAAP. c. A description of an audit engagement. d. A summary of the auditors’ opinion on the effectiveness of the entity’s internal control

over financial reporting.

2.42 Which of the following recognizes that an audit conducted under generally accepted audit- ing standards may not detect all material misstatements? a. Absolute assurance b. Professional judgment c. Reliability of audit evidence d. Reasonable assurance

2.43 Which of the following combinations would provide the auditor the most reliable evidence?

LO 2-3

LO 2-5

LO 2-2

LO 2-2

LO 2-4

LO 2-3

Source of Evidence Effectiveness of Internal Control

a. Internal More effective

b. Internal Less effective

c. External More effective

d. External Less effective

LO 2-3

First Pages

68 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 68 02/18/20 04:42 PM

2.44 Which of the following is most closely related to the relevance of audit evidence? a. Auditors decide to physically inspect investment securities held by a custodian instead of

obtaining confirmations from the custodian. b. In addition to confirmations of accounts receivable, auditors perform an analysis of the

aging of accounts receivable to evaluate the collectability of accounts receivable. c. In response to less effective internal control, auditors increase the number of customer

accounts receivable confirmations mailed compared to that in the prior year. d. Because of a large number of transactions occurring near year-end, auditors decide to

confirm a larger number of receivables following year-end instead of during the interim period.

2.45 Which of the following statements is not true with respect to the performance principle? a. Auditors are required to prepare a written audit plan during the planning stages of initial

audits but are not required to do so in continuing audits. b. Audit teams consider materiality in planning the audit, performing the audit, and evaluat-

ing the effect of misstatements on the entity’s financial statements. c. In assessing the risk of material misstatements, the audit team considers the effectiveness

of the entity’s internal controls in preventing and detecting misstatements. d. Auditors are required to consider both the relevance and the reliability of evidence in

evaluating whether the evidence they have gathered is appropriate.

2.46 Which of the following is true with respect to PCAOB inspections of accounting firms? a. All firms performing audits of issuers are required to have annual inspections conducted

by the PCAOB. b. PCAOB inspections review a sample of audits conducted by firms as well as the firm’s

systems of quality control. c. All results of PCAOB inspections are made available to the public following the inspection. d. Firms performing audits of 100 or fewer issuers may elect to have a peer review con-

ducted through the AICPA in lieu of a PCAOB inspection.

2.47 The particular and specialized actions that auditors take to obtain evidence during a specific engagement are known as a. Audit procedures. b. Audit standards. c. Interpretive publications. d. Statements on Auditing Standards.

2.48 Which of the following combinations of standards and types of audits are most closely related to the activities of the Public Company Accounting Oversight Board? a. Develop Auditing Standards for the audits of non-issuers. b. Develop Auditing Standards for the audits of issuers. c. Develop Statements on Auditing Standards for the audits of non-issuers. d. Develop Statements on Auditing Standards for the audits of issuers.

2.49 Which of the following best describes the general contents of the first paragraph of the “Basis for Opinion” section of the auditors’ report? a. A description of an audit examination, including the fact that the audit was conducted

under standards established by the PCAOB. b. The auditors’ conclusion with respect to the fairness of the entity’s financial statements. c. Statements identifying the responsibility of auditors and management in the financial

reporting process. d. The auditors’ conclusion with respect to the effectiveness of the entity’s internal control

over financial reporting.

2.50 Which of the following opinions would be issued if auditors believed that the entity’s finan- cial statements were not presented in conformity with GAAP? a. Adverse opinion b. Disclaimer of opinion

LO 2-3

LO 2-3

LO 2-5

LO 2-1

LO 2-1

LO 2-4

LO 2-4

First Pages

Chapter 2 Professional Standards 69

lou6920x_ch02_041-077.indd 69 02/18/20 04:42 PM

c. Qualified opinion d. Unmodified opinion

2.51 Which of the following principles is most closely associated with the auditors’ conclusion as to the fair presentation of the entity’s financial statements? a. Communication principle b. Performance principle c. Reporting principle d. Responsibilities principle

LO 2-4

2.52 AICPA and PCAOB Responsibilities. The creation of the PCAOB by the Sarbanes–Oxley Act has affected both the standards-setting process and the periodic review of the quality of an audit firm’s work.

Required: a. Identify the responsibilities of the AICPA, PCAOB, and SEC in the auditing standards-

setting process. b. Which standard(s) provide guidance for the audits of issuers? Which standard(s) provide

guidance for the audits of non-issuers? c. What role do the AICPA and PCAOB play in the periodic review of the quality of audit

firms’ work?

2.53 Professional Guidance. A challenge facing auditors is the wide array of professional guid- ance available to them in the audits of different types of entities.

Required: For each of the following, identify whether it is most appropriately associated with State- ments on Auditing Standards (SAS), Auditing Standards (AS), both (B), or neither (N). a. Issued by the American Institute of Certified Public Accountants. b. Issued by the Public Company Accounting Oversight Board. c. Provide guidance for services lesser in scope than an audit engagement. d. Apply to the audit of non-issuers. e. Require auditors to gather sufficient, appropriate evidence to support their opinion. f. Apply to the audit of issuers. g. Address quality control standards developed within the accounting firm. h. Become effective upon approval by the Securities and Exchange Commission.

2.54 Independence. You are meeting with executives of Cooper Cosmetics Corporation to arrange your firm’s engagement to audit the corporation’s financial statements for the year ending December 31. One executive suggests the audit work be divided among three staff members. One person would examine asset accounts, a second would examine liability accounts, and the third would examine income and expense accounts to minimize audit time, avoid duplication of staff effort, and curtail interference with entity operations. Advertising is the corporation’s largest expense, and the advertising manager suggests that a staff member of your firm whose uncle owns the advertising agency that handles the corporation’s advertising be assigned to examine the Advertising Expense account because the staff member has a thorough knowledge of the complex contact between Cooper Cos- metics and the advertising agency.

Required: a. To what extent should auditors follow the client’s suggestions for the conduct of an audit?

Discuss. b. List and discuss the reasons that audit work should not be assigned solely according to

asset, liability, and income and expense categories.

LO 2-1, 2-5

LO 2-1

LO 2-2

All applicable questions are available with Connect.

Exercises and Problems

First Pages

70 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 70 02/18/20 04:42 PM

c. Should the staff member of your accounting firm whose uncle owns the advertising agency be assigned to examine advertising costs? Discuss.

2.55 Independence. Generally accepted auditing standards require auditors to be independent. Included within this standard are the concepts of independence in fact and independence in appearance.

Required: a. Define independence in fact and independence in appearance. b. What two general types of relationships would normally compromise auditors’

independence? c. For each of the following separate situations, discuss whether you believe the auditors’

independence has been compromised. 1. The auditors’ firm provides extensive consulting services to the client; these services

provide revenues to the firm that exceed revenues received from the audit engagement. 2. The spouse of the partner in charge of the audit engagement occupies an executive-

level position within the client. 3. A distant relative of a partner within the firm occupies an entry-level position within

a client of the firm. (The audit is conducted by another office of the firm with which the partner has infrequent contact.)

4. A staff member within the firm owns shares of stock of one of that firm’s clients. (She is not a member of the engagement team serving that client.)

2.56 Professional Skepticism. An important principle for auditors is the need to maintain an appropriate level of professional skepticism.

Required: a. Define professional skepticism. b. During which stages of the audit are auditors required to exhibit professional skepticism? c. How does each of the following independent issues potentially relate to the principle of

professional skepticism? 1. The auditor’s firm has served the client for a long period of time, and strong friend-

ships have developed between the firm personnel and client’s officers. 2. Auditors are anxious to complete the audit shortly because of other workload demands

and deadlines related to other engagements. 3. The client has mentioned on a number of occasions its desire to reduce (or limit) the

audit fee.

2.57 Responsibilities Principle. Martin is considering submitting a proposal to conduct the audit examination of Phillip Inc., a manufacturer and distributor of automotive parts to large auto- mobile manufacturers. The following are some notes related to Martin’s initial consideration of this potential engagement. a. Martin learned of this client opportunity through one of its staff accountants, who is a

cousin of Phillip’s chief financial officer. b. Phillip is a particularly attractive engagement for Martin because it would allow the firm

to enter into the manufacturing market (most of Martin’s clients are in the services indus- try and are much smaller than Phillip).

c. Martin inquired with Phillip as to the reason for a change in auditors and was assured that the former auditors decided not to continue auditing Phillip Inc. because they no longer possessed the necessary expertise to audit clients in the automotive parts industry (this explanation was confirmed by the former auditors).

d. Martin is concerned about the numerous locations of Phillip’s warehouses and the ability to conduct an appropriate observation of Phillip’s year-end inventory balances.

e. When asked about inventory observation, Phillip indicated that its previous auditors observed physical inventory at different warehouses on different days and obtained a written statement from Phillip that transfers between locations did not occur.

f. If Martin obtains the engagement, it will take appropriate actions to ensure that firm per- sonnel are independent in fact and in appearance with respect to Phillip.

LO 2-2

LO 2-2

LO 2-2

First Pages

Chapter 2 Professional Standards 71

lou6920x_ch02_041-077.indd 71 02/18/20 04:42 PM

Required: For each of the above, identify the component of the responsibilities principle (competence and capabilities, ethical requirements, or professional skepticism and professional judgment) most closely related to that factor.

2.58 Performance Principle: Planning. Your public accounting practice is located in a city of 15,000 people. The majority of your work, conducted by you and two assistants, consists of compiling clients’ monthly statements and preparing income tax returns for individuals from cash data and partnership returns from books and records. You have a small number of audit clients; given the current size of your practice, you generally consider it a challenge to accept new audit clients. One of your corporate clients is a retail hardware store. Your work for this client has been limited to preparing the corporate income tax return from a trial balance submitted by the bookkeeper. On December 26, you receive from the president of the corporation a letter containing the following request:

We have made arrangements with First National Bank to borrow $500,000 to finance the purchase of a complete line of appliances. The bank has asked us to furnish our auditors’ certi- fied statement as of December 31, which is the closing date of our accounting year. The trial balance of the general ledger should be ready by January 10, which should allow ample time to prepare your report for submission to the bank by January 20. In view of the importance of this certified report to our financing program, we trust you will arrange to comply with the preced- ing schedule.

Required: From a theoretical viewpoint, discuss the difficulties that are caused by such a short notice audit request.

(AICPA adapted)

2.59 Performance Principle: Evidence. Generally accepted auditing standards (the perfor- mance principle) require auditors to gather sufficient appropriate evidence on which to base an opinion.

Required: a. Briefly define the characteristics “sufficient” and “appropriate” as they relate to audit

evidence. b. What are relevance and reliability (as they relate to audit evidence)? How do these con-

cepts relate to the auditors’ requirement to gather sufficient appropriate evidence? c. How does the source of evidence affect its reliability? d. How does the effectiveness of the entity’s internal control affect the sufficiency and

appropriateness of evidence gathered by auditors?

2.60 Performance Principle. You have accepted the engagement of auditing the financial state- ments of the C. Reis Company, a small manufacturing firm that has been your client for several years. Because you were busy writing the report for another engagement, you sent a staff accountant to begin the audit with the suggestion that she start with accounts receiv- able. Using the prior year’s audit documentation as a guide, she prepared a trial balance of the accounts, aged them, prepared and mailed positive confirmation requests, examined underlying support for charges and credits, and performed other work she considered neces- sary to obtain evidence about the validity and collectability of the receivables. At the con- clusion of her work, you reviewed the audit documentation she prepared and found she had carefully followed the prior year’s audit documentation.

Required: The opinion rendered by auditors states that the audit was made in accordance with gen- erally accepted auditing standards. Identify the important components of the performance principle and relate them to the audit of C. Reis Company by indicating how they were ful- filled or, if appropriate, how they were not fulfilled.

(AICPA adapted)

LO 2-3

LO 2-3

LO 2-3

First Pages

72 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 72 02/18/20 04:42 PM

2.61 Performance Principle. Identify how each of the following statements relates to the perfor- mance principle by considering which element(s) of the principle are related to that state- ment. (A statement may be related to more than one element.) Use the following elements in providing your response: ∙ Reasonable assurance ∙ Planning and supervision ∙ Materiality ∙ Risk assessment ∙ Audit evidence a. Evaluating the effectiveness of the client’s internal control in preventing or detecting

misstatements. b. Obtaining an understanding of the client’s business and industry. c. Acknowledging that the risk of failing to detect a material misstatement cannot be

reduced to zero. d. Obtaining confirmations from the client’s customers as to the ending balances in

accounts receivable. e. Preparing a written audit plan. f. Designing audit procedures to identify misstatements that would have a significant

effect on financial statement users’ decisions. g. Considering the likelihood that the account balance contains a material misstatement. h. Failing to detect material misstatements because of audit team mistakes and misinter-

pretations in evaluating evidence.

2.62 Responsibilities and Performance Principles. Respond to each of the following comments that you heard related to the audit of Swan Company, an issuer. a. “We don’t need to consider the risk of material misstatement in our work because we

really can’t do anything to reduce that risk.” b. “Because the client has not implemented effective internal controls, we need to gather

more reliable evidence. This means we need to test a greater number of transactions and obtain more reliable forms of evidence.”

c. “We will really need to spend a lot of time and effort on this audit. Because this client has just filed for a bond offering, we can’t allow for any misstatements in the financial state- ments. We need to guarantee the accuracy of the client’s financial statements.”

d. “Because this company has $140 million in revenues, we really shouldn’t be concerned about smaller accounts because they are not likely to have a major impact on the financial statements.”

e. “I know it will be more time consuming and expensive, but we are required to physi- cally inspect the stock certificates held by the client rather than obtain confirmation from the custodian. After all, our own direct observation is more reliable than receiving a confirmation.”

2.63 Reporting Principle. The reporting principle requires auditors to express their opinion through the issuance of a written report.

Required: a. What is the purpose of the auditors’ opinion and report? b. What are the major sections in the auditors’ report on the examination of an issuer? What

are the major contents of each of these sections? c. What are the four types of opinions that auditors can issue? d. How does the concept of materiality influence the auditors’ report?

2.64 Fundamental Principles. For each of the following related to audit engagements, identify whether the action is most closely related to the responsibilities, performance, or reporting principle. a. Evaluating the audit firm personnel’s independence with respect to a prospective client. b. Gathering sufficient, appropriate evidence. c. Exercising an appropriate level of professional skepticism.

LO 2-3

LO 2-2, 2-3

LO 2-4

LO 2-2, 2-3, 2-4

First Pages

Chapter 2 Professional Standards 73

lou6920x_ch02_041-077.indd 73 02/18/20 04:42 PM

d. Issuing a qualified opinion on the financial statements because of a material, yet not per- vasive, departure from GAAP.

e. Establishing materiality levels for use in determining the amount of evidence to be gathered.

f. Considering the susceptibility of the account balance to misstatement to assess the risk of material misstatement.

g. Possessing the appropriate competence and capabilities to perform the audit. h. Considering whether a scope limitation precludes sufficient evidence to allow an opinion

to be expressed on the entity’s financial statements. i. Planning the audit to provide reasonable assurance that the financial statements are free

of material misstatement. j. Evaluating the potential relationships between the auditor and family who are employed

by the entity.

2.65 Comprehensive Principles Case Study. Ray, the owner of a small entity, asked Holmes, CPA, to conduct an audit of the entity’s records. Ray told Holmes that the audit was to be completed in time to submit audited financial statements to a bank as part of a loan appli- cation. Holmes immediately accepted the engagement and agreed to provide an auditors’ report within three weeks. Ray agreed to pay Holmes a fixed fee plus a bonus if the loan was granted. Holmes hired two accounting students to conduct the audit and spent several hours telling them exactly what to do. Holmes told the students not to spend time reviewing the controls but instead to concentrate on proving the mathematical accuracy of the ledger accounts and on summarizing the data in the accounting records that support Ray’s financial statements. The students followed Holmes’ instructions and, after two weeks, gave Holmes the financial statements, which did not include footnotes. Holmes studied the statements and prepared an unmodified auditors’ report. The report, however, did not refer to generally accepted accounting principles or to the fact that Ray had changed to the accounting standard for capitalizing interest.

Required: Briefly describe each of the principles and indicate how the action(s) of Holmes resulted in a failure to comply with these principles.

(AICPA adapted)

2.66 Fundamental Principles (Comprehensive). In each of the following, identify which of the elements of the fundamental principles (responsibilities, performance, or reporting) is most applicable. In addition, discuss what action(s) (if any) you believe auditors should take with respect to these issues. a. An entity has contacted you about performing its audit engagement. You have not previ-

ously served a client in the entity’s industry, which has many industry-specific account- ing issues that are both technical and complex.

b. An entity has entered into a number of lease agreements. Based on the requirements of GAAP, you believe that these obligations meet the criteria for being classified as capital leases; however, the entity has elected to treat these leases as operating leases, providing full and complete disclosure of this treatment in the footnotes to the financial statements.

c. Because of a disagreement with its current auditors, an entity has contacted you about conducting its current-year audit. However, because the previous auditors have just recently resigned from the engagement, you have some questions as to whether an audit can be completed in time to meet the entity’s deadlines for providing audited financial statements to a lender.

d. Based on the effectiveness of the entity’s internal control, you have assessed control risk at low levels and decided that a smaller number of customer accounts need to be confirmed.

e. An entity has contacted you about performing its audit engagement. This entity became aware of your firm because the husband of one of your partners is currently serving as the entity’s chief financial officer.

f. One of your clients is currently a potential defendant in several cases because of the dam- age caused by one of its products. Because this entity does not believe that it is likely to

LO 2-2, 2-3, 2-4

LO 2-2, 2-3, 2-4

First Pages

74 Part One The Contemporary Auditing Environment

lou6920x_ch02_041-077.indd 74 02/18/20 04:42 PM

receive an unfavorable outcome from this litigation, it did not disclose the potential litiga- tion in the footnotes accompanying their financial statements.

g. You are performing tests of the client’s controls over the processing of revenue transac- tions to determine whether these controls are operating effectively and can be relied upon to prevent or detect misstatements.

h. One of your supervisors has requested a number of clarifications based on her review of your work on an audit engagement. A subsequent meeting with her has resolved these clarifications, and you both have concluded that your work supports the opinion on the client’s financial statements.

2.67 Fundamental Principles (Comprehensive). Identify which of the major fundamental prin- ciples (responsibilities, performance, or reporting) is most closely related to each of the following: a. The need for auditors to consider their financial relationships with prospective clients. b. An auditor has raised some questions with respect to management’s response to various

inquiries concerning pending litigation facing the client. c. The auditors’ consideration of the effectiveness of the entity’s internal control on the

nature, timing, and extent of substantive procedures. d. The auditors’ evaluation of the magnitude of a misstatement that would impact percep-

tions of the entity’s profitability. e. The auditors’ issuance of a disclaimer of opinion because of a significant scope limitation. f. Relevant education and experience requirements for CPA licensure. g. The inability of an audit examination to provide absolute assurance with respect to

detecting all material misstatements. h. The requirement that auditors possess the skills and knowledge of others in their

profession. i. The preparation of a written audit plan that guides the conduct of the audit engagement. j. The auditors’ issuance of a qualified opinion because of a departure from GAAP.

2.68 Fundamental Principles (Comprehensive). Comment upon each of the following state- ments you heard in a conversation between two newly hired staff auditors. a. “Of course, I’m qualified to be assigned to this engagement. I have an accounting degree

from a top university and was an honors graduate. I know some of the accounting rules have changed since I graduated, but I’ll be able to figure that out as we go through the audit.”

b. “It doesn’t really matter what others think.  .  .  . I’m completely independent of Acme Industries and should be a member of the audit team. While I own some stock, it’s a small amount and I’m holding it for the long term, anyway.”

c. “You really have to question everything the client tells you. That’s what professional skepticism is all about. It’s a shame you can’t believe a word they say.”

d. “The evidence is lower in quality, but we typically use internal evidence when we audit property, plant, and equipment. It just takes too much time and costs too much to get more reliable evidence.”

e. “On that last job, we really planned the audit well. We were able to finish everything by November 1 and didn’t need to do any work after year-end.”

f. “We’re not too worried about internal control. We always do the same substantive proce- dures anyway, so why take the time to look at the client’s controls?”

g. “Because the client isn’t accounting for its leases properly, we need to issue either a qualified opinion or a disclaimer of opinion. Just how large a dollar impact does this have on the financial statements?”

h. “When we evaluate items for materiality, the only thing we need to worry about is the absolute dollar amount. There really isn’t anything else we need to consider.”

2.69 System of Quality Control. Each of the following quality control policies and procedures is typical of ones that can be found in public accounting firms’ systems of quality control. Identify each of them with one of the six elements of quality control identified by SQCS 8. a. Assign management responsibilities in such a manner that commercial considerations do

not override the quality of work performed.

LO 2-2, 2-3, 2-4

LO 2-2, 2-3, 2-4

LO 2-5

First Pages

Chapter 2 Professional Standards 75

lou6920x_ch02_041-077.indd 75 02/18/20 04:42 PM

b. Establish policies and procedures for resolving differences of opinion among firm per- sonnel that arise during professional engagements.

c. Develop policies and procedures to ensure that professionals are provided appropriate professional development opportunities.

d. Review engagement documentation, reports, and the client’s financial statements. e. Develop effective performance evaluation, compensation, and advancement procedures. f. Identify circumstances and relationships that create threats to independence and take

appropriate action to eliminate those threats or reduce them to an acceptable level. g. Identify whether the firm possesses the competency, capability, and resources to appro-

priately serve a specific client. h. Devote sufficient resources to develop, communicate, and support the firm’s quality con-

trol procedures. i. Retain engagement documentation for a sufficient period of time to satisfy the needs of

the firm, professional standards, laws, and regulations.

2.70 Evaluating Quality Control. Firms auditing issuers are required to have periodic inspec- tions conducted by the PCAOB.

Required: a. What are the major characteristics of PCAOB inspections? b. What types of firms typically have PCAOB inspections? How frequently are these evalu-

ations conducted?

2.71 Internet Exercise: Public Company Accounting Oversight Board Inspection Reports. Refer to the website of the Public Company Accounting Oversight Board (PCAOB) (www. pcaobus.org), review the information under “Inspections,” and select the most current inspection report for one of the Big Four firms (Deloitte, EY, KPMG, and PwC).

Required: a. What information is contained in the “public” version of the PCAOB’s inspection

reports? Is there any additional information that you would like to see? b. What categories of practices, policies, and procedures are evaluated in the PCAOB’s

inspection of the firm’s quality control system? c. For the firm you selected, how many practice offices had audits inspected by the PCAOB? d. For the firm you selected, for how many audits (issuers) did the PCAOB find deficiencies? e. Identify five deficiencies that were cited in the PCAOB’s inspection report. For each

deficiency, to which of the elements of the principles does it most closely relate? (If the firm had fewer than five deficiencies, evaluate all of the deficiencies identified in the report.)

f. Briefly summarize the firm’s response (if any) to the PCAOB’s inspection report.

LO 2-5

LO 2-5

First Pages

lou6920x_ch02_041-077.indd 76 02/18/20 04:42 PM

Referencing Professional Standards Shown here is a comparison of the categories of standards issued by the PCAOB and Auditing Standards Board (ASB). (Section numbers are shown in parentheses for each category.) These general categories parallel the majors stages of an audit engagement and serve as an appropriate starting point when researching the professional auditing literature with respect to an issue that may be encountered during the audit examination.

ASB PCAOB

General Principles and Responsibilities (200–299) General Auditing Standards (1000–1300)

Risk Assessment and Response to Assessed Risks (300–499)

Audit Procedures (2100–2900)

Audit Evidence (500–599) Audit Procedures (2100–2900)

Using the Work of Others (600–699) Incorporated in General Auditing Standards and Audit Procedures

Audit Conclusions and Reporting (700–799) Auditor Reporting (3100–3300)

Special Considerations (800–899) Other Matters Associated with Audits (6101–6115)

Special Considerations in the United States (900–999) Other Matters Associated with Audits (6101–6115) Matters Related to Filings Under Federal Securities Laws (4101–4105)

EXAMPLE: AUDITING REPORTING Assume that you were seeking guidance on the contents of the portion of the auditors’ report related to the opinion on the financial statements. For issuers, “Auditor Reporting” is covered under AS sections 3100–3300. Reviewing AS 3101 (“The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion”), paragraph 8 provides a detailed summary of the contents of the section of the report related to the financial statement opinion (the actual wording of this section is shown in Appendix B of AS 3101). In documenting your reference to the professional standards, you would cite AS 3101.08 or AS 3101 (Appendix B) as the appropriate source of profes- sional guidance.

For non-issuers, “Audit Conclusions and Reporting” are covered under AU-C sections 700–799. AU-C section 700 (“Forming an Opinion and Reporting on Financial State- ments”) specifically relates to the content of auditors’ reports. When you access AU-C section 700, you will see the source identified as SAS No. 134. If future pronouncements issued by the ASB affect audit reporting, AU-C section 700 will be updated to include those pronouncements. In this way, auditors can find all of the appropriate professional guidance for an area under one AU-C section rather than needing to reference several individual pronouncements.

Each AU-C section includes a number of paragraphs that address various matters related to that topic. AU-C section 700 has 61 paragraphs outlining the professional guidance for reporting and 81 other paragraphs (referred to as Application and Other Explanatory Material) to provide more specific guidance for applications of the standard. Paragraphs 21 through 37 provides the content related to the opinion on the financial statements; paragraph A81 (the “A” refers to application material) provides the actual wording of the report. In documenting your reference to the professional standards, you could refer to either SAS No. 134, AU-C 700.21-700.37, or AU-C 700.A81.

Appendix 2A

First Pages

Chapter 2 Professional Standards 77

lou6920x_ch02_041-077.indd 77 02/18/20 04:42 PM

EXAMPLE: AUDIT CONFIRMATIONS You are seeking guidance for the use of confirmations in the audit of an issuer; spe- cifically, you want to know what alternative procedures should be performed for non- responses to confirmations. Reviewing the categories of standards, “Audit Procedures” (AS sections 2100–2900) appears to be most applicable; a review of standards within this category allows you to identify AS 2310, “The Confirmation Process.” Reviewing this standard, paragraphs 31 and 32 describe the auditors’ responsibility for performing alternative procedures if replies to confirmations are not received. In documenting your reference to the professional standards, you would cite AS 2310.31-32.

For the audits of non-issuers, audit evidence is covered under AU-C sections 500–599. AU-C section 505 (“External Confirmations”) specifically relates to the use of external confirmations. When you access section 505, you will see the source identified as SAS No. 122. Paragraphs A24–A26 provide guidance for auditors’ responsibility for nonresponses to confirmations. In documenting your response, you could cite either SAS No. 122 or AU-C 505.A24–A26.

First Pages

78

lou6920x_ch03_078-116.indd 78 02/19/20 03:14 PM

LEARNING OBJECTIVES During the planning phase of an engagement, the professional standards emphasize that risk assessment underlies the entire audit process. Motivated by the importance of risk assessment, standards setters at both the PCAOB and ASB have each adopted a suite of standards related to the auditor’s assessment of, and response to, risk in a financial statement audit. Collectively, the standards also include guidance pertaining to audit planning, supervision, materiality, and other

related topics. In this chapter, we cover engagement planning, beginning with pre-engagement activities, supervision, and materiality. Next, we cover the types of audit procedures that can be completed and audit documentation. In Chapter 4, we provide a comprehensive explanation of an auditor’s assessment of risk.

Your objectives are to be able to:

LO 3-1 List and describe the required pre- engagement activities that auditors under- take before beginning an audit engagement.

Engagement Planning and Audit Evidence

Vision without action is a daydream;

action without vision is a nightmare. Japanese proverb

Professional Standards References

Topic AU-C/ISA Section AS Section

Overall Objectives of the Independent Auditor 200 1001, 1005, 1010, 1015

Terms of Engagement 210 1301

Communication between Predecessor and Successor Auditors 510 2610

Supervision of the Audit Engagement 220, 300 1201

Audit Documentation 230 1215

Audit Planning 300 2101

Materiality 320 2105

Audit Evidence 500 1105

Substantive Analytical Procedures 520 2305

Consideration of the Internal Audit Function in a Financial Statement Audit

610 2605

Using the Work of an Auditor-Engaged Specialist 620 1210

C H A P T E R 3

First Pages

Chapter 3 Engagement Planning and Audit Evidence 79

lou6920x_ch03_078-116.indd 79 02/19/20 03:14 PM

INTRODUCTION Since its existence, the PCAOB has been concerned about auditor compliance with inde- pendence requirements. The concern lies mostly with lengthy auditor client relationships, in particular that auditors may become too familiar with the client and ignore manage- ment issues or even allow for more “creative” accounting practices. The Sarbanes-Oxley act partially addressed this by requiring a mandatory rotation of the lead engagement part- ner every 5 years. Despite this, the independence concern remains. In 2011, the PCAOB issued a concept release statement that alluded to the possibility of audit firm rotation to help mitigate the issue. The concept statement was met with such staunch resistance from firms and issuers (i.e., public companies) that it has not (yet) come to fruition.1

In June of 2017, the PCAOB finalized their audit reporting standard and in doing so made some headway in the auditor independence arena. The new standard, which was effective beginning year-end December 15, 2017, requires auditors to include on the report the year the firm began to serve consecutively as the auditor. Supporters of the standard believe this could be an important point of consideration for investors. The 2018 annual filings revealed some long-standing auditor-client relationships among the Big 4 firms, including the following:

∙ KPMG had been auditing General Electric Company (GE) since 19092

∙ EY had been Coca Cola’s auditor since 1921 ∙ PwC had been Kellogg’s auditor since at least 1937 (PwC indicated in the audit report

that they could not determine the specific year the audit began) ∙ Deloitte served as General Motor’s auditor for 100 years, from 1918 – 2018, EY took

over in 2019.

This chapter is devoted to the audit planning process, beginning with the pre- engagement activities of client acceptance and continuance procedures, including determining compliance with independence requirements. The above described recent initiatives of the PCAOB underscore the importance, and difficulty, of determining com- pliance with independence in particular.

Once a client acceptance or a continuance decision is made, the auditor must develop a detailed audit plan documenting the audit testing procedures to be performed. The testing procedures, outlined later in this chapter, are designed in response to the risk of material misstatement for each of the relevant financial statement assertions in signifi- cant accounts. In this chapter we discuss how materiality is calculated, further discus- sion of the risk of material misstatement is included in Chapter 4. The audit plan and any work done related to the plan must be documented, as further discussed at the end of the chapter.

1Nicole H. Strydom, “Recent developments in Auditor Tenure and Independence,” Governance and Compliance Insider, May 8, 2018, https://governancecomplianceinsider.com/recent-developments-in-auditor-tenure-and-independence/ 2As of March 2019, the SEC was investigating accounting improprieties at GE. GE was undergoing scrutiny for the longstanding relationship with KPMG and therefore announced a plan to solicit bids for a new auditor for 2019 year-end. (Sources: Tammy Whitehouse, “SEC expands probe at GE after $22B impairment,” Compliance Week, October 31 2018,https://www .complianceweek.com/blogs/accounting-auditing-update/sec-expands-probe-at-ge-after-22b-impairment-charge; Aisha Al- Muslim, “GE to explore replacing KPMG as auditor,” The Wall Street Journal, December 14, 2018,https://www.wsj.com/articles/ ge-to-solicit-bids-for-independent-auditor-11544798014)

LO 3-2 Understand the importance of planning the audit engagement so that it is conducted in accordance with professional standards.

LO 3-3 Define materiality and explain its importance in the audit planning process.

LO 3-4 List and describe the eight general types of audit procedures for gathering evidence.

LO 3-5 Define what is meant by the proper form and content of audit documentation.

First Pages

80 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 80 02/19/20 03:14 PM

PRE-ENGAGEMENT ACTIVITIES Public accounting firms try to reduce their own business risks by carefully managing their audit engagements. To do so, public accounting firms undertake several activities before beginning any audit engagement. In general, these activities can be called risk management activities. Risk in an audit engagement generally refers to the probability that the firm could issue a clean, unmodified audit opinion when in fact a material mis- statement does exist in the financial statements and the opinion should have been modi- fied. Because of the importance of these activities, professional standards state that the auditor should perform the following activities: (1) perform procedures regarding the acceptance or continuance of the audit client relationship, (2) determine compliance with independence and ethics requirements, and (3) reach a contractual understanding with the client for the terms and conditions of the audit engagement. Each of these areas is now discussed.

Client Acceptance or Continuance An important element of a public accounting firm’s quality control policies and proce- dures is a system for deciding whether to accept a new client and, on a continuing basis, whether to continue providing services to existing clients. Public accounting firms are not obligated to accept undesirable clients, nor are they obligated to continue to serve clients when relationships deteriorate or when the management comes under a cloud of suspicion. The process activities are clearly focused on understanding and managing risk to the audit firm. In fact, to mitigate their business risk, public accounting firms devote substantial time to make sure that the audit clients that they serve do not become the focus of the next big accounting scandal.

LO 3-1 List and describe the required pre-engagement activities that auditors undertake before beginning an audit engagement.

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Substantive Procedures Reporting

STAGES OF AN AUDIT

Auditing a client that has integrity generally results in a problem-free engagement. Conversely, despite conducting an audit in accordance with generally accepted audit- ing standards, it is difficult for a public accounting firm to avoid appearing “guilty by

After Sarbanes–Oxley was passed in 2002, the most prestigious public accounting firms became far more vigilant about walking away from clients that they believed posed a high risk to the firm. When deciding whether to accept a new engagement or continue with an existing client, firms undertake a process to carefully inves- tigate the management team’s reputation and integrity. Audit firms typically perform criminal background checks on the important members of the management team and the audit committee. This process is completed to reduce the possible risk of working with a

client that would be willing to engage in illegal or unethical financial reporting practices.

Performing audits of public companies involves significant reputa- tion and litigation risks to public accounting firms because they are lending their credibility to the client’s financial statements filed with the SEC. As a result, each of the large firms takes dramatic steps to protect its reputation and avoid working with risky clients.

Source: “In-Depth Guide to Public Company Auditing: The Financial Statement Audit,” Center for Audit Quality, May, 2011 (available at www.thecaq.org).

Accounting Firms Will Walk Away from Risky Client

AUDITING INSIGHT

First Pages

Chapter 3 Engagement Planning and Audit Evidence 81

lou6920x_ch03_078-116.indd 81 02/19/20 03:14 PM

association” with a client that lacks integrity. The public accounting firm that has been terminated or has voluntarily withdrawn from the engagement (whether the audit has been completed or not) is known as the predecessor auditor. To reduce the risk of accept- ing a problem client, auditing standards require a prospective auditor to initiate contact with and attempt to obtain basic information directly from the predecessor regarding issues that reflect directly on the integrity of management. The audit client must grant its approval before the communication can occur between the prospective auditor and the predecessor auditor. Once approval is obtained, the prospective auditor should ask the predecessor auditor for information on management’s integrity; on disagreements with management about accounting principles, audit procedures, or similar matters; and the reasons for a change of auditors. Companies are free to, and often do, change audi- tors periodically, sometimes as a result of corporate policy to rotate auditors, sometimes because of fee considerations, and sometimes because of arguments about the scope of the audit or the acceptability of accounting principles. It is possible that a change in auditors occurred for the purpose of procuring new auditors who will agree with manage- ment’s treatment of questionable accounting practices. Not surprisingly, these types of disagreements between auditors and management would be of interest to investors and future auditors.

As a result, when a public company changes auditors, the company must file a Form 8-K report with the SEC and disclose that the board of directors approved the change. Form 8-K, the “special events report,” is required whenever certain significant events such as changes in control and legal proceedings occur. Public companies also must report any disagree- ments with the former auditors concerning matters of accounting principles, financial statement disclosures, or auditing procedures. At the same time, the former auditor must submit a letter stating whether the auditors agree with the explanation and, if not, provide particulars. These documents are available to the public through the SEC’s Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system, available on the SEC’s web- site (www.sec.gov). The purpose of these public disclosures is to make information avail- able about client–auditor conflicts that have occurred.

Not as often as you would think. Form 8-K filings show that large companies rarely switch auditors. From the beginning of 2016 to October of 2017, only seven S&P 500 index companies switched auditors. The seven companies and audit firms impacted are listed below:

• American Electric Power changed auditors from Deloitte to PwC, after a 106-year relationship!

• After 100 years, General Motors (GM) switched auditors from Deloitte to EY.

• Leucadia National Corp ended an 81-year audit relationship with PwC, switching to Deloitte.

• Marten Marietta switched from EY to PwC after 23 years. • Hershey switched from KPMG to EY after a 15-year relationship.

• Newell Brands switched auditors from EY to PwC after 14 years. • Johnson Controls International changed auditors from Deloitte to

PwC after 12 years.

This may seem like an unusually small number, however, switching auditors, especially for a large company, is no easy task. Consider, for example, that GM paid Deloitte $26 million in audit fees and an addi- tional $6 million in audit-related fees for the 2017 audit. The amount of resources (time, personnel, etc.) a firm would need available to take on a client of this size would be substantial, to say the least. This says nothing of the time and resources needed by GM to facilitate an auditor switch. Source: John Pakaluk, “After 100 Years, General Motors Switches Auditors,” Audit Analytics, https://www.auditanalytics.com/blog/after-100-years-general- motors-switches-auditor/; General Motors 2018 Proxy Statement, https://media. gm.com/static/proxy-statement/HTML1/general_motors-proxy2018_0077.htm

How Often Do Companies Switch Auditors?AUDITING INSIGHT

If you read closely, professional standards require only that the auditors attempt to communicate with the predecessor auditors. The AICPA Code of Professional Conduct does not permit the predecessor to provide information obtained during any audit engage- ments without the explicit consent of the client. Confidentiality remains even when the auditor–client relationship ends. Therefore, auditing standards require the prospective

First Pages

82 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 82 02/19/20 03:14 PM

public accounting firm to ask that the consent be given to permit the predecessor auditor to speak. If this consent is refused, the refusal should be regarded as a red flag, and the prospective auditor should be cautious about accepting the engagement.

In addition to communication with the predecessor auditor, client acceptance and con- tinuance policies and procedures generally include

∙ Obtaining and reviewing financial information about the prospective client: annual reports, interim statements, registration statements, Form 10-Ks, and reports to regu- latory agencies.

∙ Acquiring detailed criminal background checks of all senior managers. ∙ Requesting the prospective client’s bankers, legal counsel, underwriters, analysts, or

other persons who do business with the entity to provide information about it and its management.

∙ Considering whether the engagement would require special attention or involve unusual risks to the public accounting firm.

∙ Evaluating the public accounting firm’s independence with regard to the prospective client. ∙ Considering the need for individuals possessing special skills or knowledge to com-

plete the audit (e.g., IT auditor, valuation specialist, industry specialist).

The firms also search for news articles, lawsuits, and bankruptcy court outcomes nam- ing the entity, the chairman of the board, the CEO, the CFO, and other high-ranking offi- cers. In fact, the firms often engage private investigators to conduct additional searches for information when the prospective clients are financial institutions, companies accused of fraud, companies under SEC or other regulatory investigation, companies that have changed auditors frequently, and companies showing recent losses. These characteristics are red flags of potential problems, and public accounting firms want to know as much as they can about the companies and their officers before entering into a relationship with them. Without a doubt, management integrity (or lack thereof) is the primary reason for accepting (or not accepting) an audit engagement.

Client continuance decisions are similar to acceptance decisions except that the firm will have more firsthand experience with the entity. These types of client retention reviews are typically done annually and also with the occurrence of major events such as changes in management, directors, ownership, legal counsel, financial condition, litiga- tion status, nature of the client’s business, or scope of the audit engagement. In general, conditions that would have caused a public accounting firm to reject a prospective client can develop and lead to a decision to discontinue the engagement. For example, a cli- ent company could expand and diversify on an international scale so that a small public accounting firm might not have the resources to continue the audit. In addition, it would not be unusual to see newspaper stories about public accounting firms dropping clients after directors or officers admit to falsification of financial statements, theft and misuse of corporate assets, or other improprieties.

In December of 2017, KPMG announced their decision to resign as Liberty Tax’s auditor, three months after the firing of CEO John Hewitt. Hewitt was fired for having romantic relationships with female employ- ees and giving them preferential treatment, yet remained the chairman of the board due to his status as controlling shareholder of the com- pany. When announcing the decision, KPMG cited concerns around internal controls over financial reporting, more specifically related to

management integrity and the tone at the top. Ultimately Hewitt did agree to resign as chairman of the board and sell his ownership shares of the company in July 2018, following delayed earnings reports and violation warnings of listing requirements from the NASDAQ exchange.

Sources: “KPMG Resigns from Auditing Liberty Tax,” Accounting Today, December 11, 2017, M. Cohn; “Liberty Tax Soars After Founder Involved in Sex Scandal Agrees to Leave Firm,” Accounting Today, July 24, 2018, A. Melin.

KPMG Severs Relationship with Liberty TaxAUDITING INSIGHT

First Pages

Chapter 3 Engagement Planning and Audit Evidence 83

lou6920x_ch03_078-116.indd 83 02/19/20 03:14 PM

Compliance with Independence and Ethical Requirements If you recall from Chapter 2, the responsibilities principle requires auditors to comply with appropriate ethical requirements for each audit engagement; two important require- ments relate to independence and due care. Auditors must maintain independence in mental attitude; that is, auditors are expected to be unbiased and impartial with respect to the financial statements and other information they audit. This “state of mind” is often referred to as the auditor possessing independence in fact. This independence allows auditors to form an opinion on the entity’s financial statements without being affected by influences that might compromise that opinion. Not only is it important for auditors to be unbiased, but they must also appear to be unbiased. Independence in appearance relates to others’ (particularly financial statement users’) perceptions of auditors’ independence.

In fact, if the auditor is not independent, the financial statements are considered unaudited for all practical purposes. A lack of independence can result in disciplin- ary action by regulators and/or professional organizations and litigation by those who relied on the financial statements (e.g., clients and investors). The profession as a whole depends on the value of independence in that the auditor’s opinion on the financial statements loses its value if the auditor is not considered to be independent from the management of the firm. As a result of the importance placed on independence, public accounting firms must have a process in place to ensure that they are independent of the company being audited.

Because public accounting firms are subject to strict independence rules, they actively monitor the key relationships and the investment portfolios of their individual partners. These processes are in place to help ensure that the firm is independent of any relationship that might impact the firm’s professionals from maintaining objec- tivity when making professional judgments on each audit. In fact, even after an audit client has passed the client acceptance process, independence rules must continue to be rigorously maintained. The importance of this process is exemplified by the way that KPMG handled a recent situation involving a rogue partner, described in the fol- lowing Auditing Insight.

KPMG LLP was forced to resign from two large audit clients, Herbalife Ltd. and Skechers USA Inc., because Scott London, the partner assigned to each client, admitted to providing stock tips about the two audit clients to a friend in exchange for cash and gifts. The friend is believed to have made more than $1 million from trading on the insider information. By providing confidential insider information, Lon- don directly violated the AICPA Code of Professional Conduct regard- ing confidential client information. As a result, the firm immediately fired him and resigned as the external auditor for the two clients. The resignation was necessary because London “violated the firm’s rig- orous policies and protections, betrayed the trust of clients as well as colleagues, and acted with deliberate disregard for KPMG’s long- standing culture of professionalism and integrity.”* There was a fear that the firm’s independence and objectivity toward the clients would potentially be compromised as a result of this partner’s actions. In addition to resigning from the two audits, KPMG decided to withdraw its audit report on the financial statements of Herbalife for the three

previous years and for Skechers for the previous two years. In doing so, KPMG stated that it did not believe there were any errors in the financial statements. However, because of London’s actions, the firm believed doing so was appropriate. London pleaded guilty to a federal insider-trading charge on July 1, 2013, publicly admitting that he did reveal confidential information about his clients to a friend. The friend used the information to make over $1 million. London was sentenced to serve 14 months in a federal prison in April 2014.

Sources: J. Eaglesham, J. Chung, and H. Karp, “Trading Case Embroils KPMG,” The Wall Street Journal, April 10, 2013, p. A1; M. Geller and E. Flitter, “FBI Probes Trading as KPMG Quits Herbalife, Skechers Audits.” Reuters.com, April 9, 2013, available at www.reuters.com/article/2013/04/09/us-herbalife- auditor-idUSBRE9380N920130409; S. Pfeifer, “Former KPMG Partner Scott London Pleads Guilty to Insider Trading.” Los Angeles Times, July 1, 2013, available at http://articles.latimes.com/2013/jul/01/business/la-fi-mo-kpmg- scott-london-insider-trading-20130627; S. Pfeifer, “Former KPMG Partner Sentenced for Insider.” Los Angeles Times, April 24, 2014, available at http://www.latimes.com/business/la-fi-kpmg-london-20140425-story.html.

Compromised Independence?AUDITING INSIGHT

Geller, Martinne, and Emily Flitter. “FBI probes trading as KPMG quits Herbalife, Skechers audits.” Reuters, April 9, 2013. https://www.reuters.com/article/ us-herbalife-auditor/fbi-probes-trading-as-kpmg-quits-herbalife-skechers-audits-idUSBRE9380N920130409.

First Pages

84 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 84 02/19/20 03:14 PM

Engagement Letters Professional standards require auditors to reach a mutual understanding with clients concern- ing engagement requirements and expectations and to document this understanding, usually in the form of a written letter. When a new client is accepted or when an audit engagement continues from year to year, an engagement letter should be prepared. This letter sets forth the understanding with the client, including in particular (1) the objectives of the engagement, (2) management’s responsibilities, (3) the auditors’ responsibilities, and (4) any limitations of the engagement. Other matters of understanding, such as the ones shown in Exhibit 3.1, also may be included in the letter. For example, the additional internal control considerations required by the Public Company Accounting Oversight Board are specifically mentioned in the example engagement letter. In fact, a close review of this exhibit reveals the importance of an auditor being quite detailed when completing the engagement letter.

EXHIBIT 3.1 Engagement Letter

September 15, 2020

Mr. Matt Lancaster Chair, Audit Committee Dunder-Mifflin Inc. P.O. Box 349 Scranton, Pennsylvania 18503

Dear Mr. Lancaster:

This letter will confirm our understanding of the arrangement for our audit of the financial statements of Dunder-Mifflin Inc. for the year ending December 31, 2020.

We will audit the Company’s balance sheet at December 31, 2020, and the related statements of income, comprehensive income, stockholders’ equity, and cash flows for the year then ended, for the purpose of expressing an opinion on them. We will also audit whether Dunder-Mifflin Inc. maintained effective internal control over financial reporting as of December 31, 2020, based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO criteria). Dunder-Mifflin Inc.’s management is responsible for these financial statements and for maintaining effective internal control over financial reporting. Management is also responsible for making financial records and related information available for audit and for identifying and ensuring that the company complies with the laws and regulations that apply to its activities. Our responsibility is to express an opinion on these financial statements and an opinion on the effectiveness of the company’s internal control over financial reporting based on our audits. If, for any reason, we are unable to complete the audit or are unable to form or have not formed an opinion, we may decline to express an opinion or decline to issue a report as a result of the engagement.

We will conduct our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement and whether effective internal control over financial reporting was maintained in all material respects. Our audit of the financial statements includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, and evaluating the overall financial statement presentation. Our audit of internal control over financial reporting includes obtaining an understanding of internal control over financial reporting, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

Our fee for these services will be at our regular hourly rates, plus travel and other out-of-pocket costs. Invoices will be rendered on a monthly basis and are payable on presentation. If this letter correctly expresses your understanding, please sign the enclosed copy where indicated and return it to us.

Very truly yours,

Michael Scarn, LLP

DUNDER-MIFFLIN Inc.

By

Date

First Pages

Chapter 3 Engagement Planning and Audit Evidence 85

lou6920x_ch03_078-116.indd 85 02/19/20 03:14 PM

AUDIT PLAN An audit plan is a comprehensive list of the specific audit procedures that the audit team needs to perform to gather sufficient appropriate evidence on which to base their opin- ion on the financial statements. The professional standards require that the auditor plan each audit engagement, including the establishment of an overall strategy for each audit engagement. Specifically, when planning the engagement, the auditor needs to develop and document a plan that describes the nature, timing, and extent of further audit pro- cedures to be performed to assess the risk of material misstatement at the financial statement and the assertion level. Next, the auditor must carefully plan the nature, tim- ing, and extent of control tests and substantive tests that are designed to mitigate these risks to an acceptable level. This planning process is required to be led by the assigned engagement partner.

LO 3-2 Understand the importance of planning the audit engagement so that it is conducted in accordance with professional standards.

In effect, the engagement letter acts as a contract. Thus, it serves as a means for reduc- ing the risk of misunderstandings with the client and as a means of avoiding legal liability for claims that the auditors did not perform the work promised.

Many public accounting firms also have policies about sending a termination letter to former clients. Such a letter is a good idea because it provides an opportunity to deal with the subject of future services, in particular, (1) access to audit documentation by successor auditors, (2) reissuance of the auditors’ report when required for SEC report- ing or comparative financial reporting, and (3) fee arrangements for such future services. The termination letter also may include a report of the auditors’ understanding of the circumstances of termination (e.g., disagreements about accounting principles and audit procedures, fees, or other conflicts). These matters can be of great interest to prospective auditors who should always remember to ask for a copy of the termination letter.

REVIEW CHECKPOINTS 3.1 What sources of information can auditors use in connection with deciding whether to accept a new

client? 3.2 Why do predecessor auditors need to obtain the client’s consent to give information to prospective

auditors? What information should prospective auditors try to obtain from predecessor auditors? 3.3 What benefits are obtained by having an engagement letter? What is a termination letter?

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Substantive Procedures Reporting

STAGES OF AN AUDIT

The professional standards are absolutely clear that the nature and extent of work completed during engagement planning will depend on the company’s size, complexity, and industry. In addition, the auditor’s prior experience with the company, including any major changes from prior years, will have an impact on the nature and extent of plan- ning activity. Furthermore, the client’s information technology system used to process accounting transactions will also have an impact on planning activities. As a result, audit

First Pages

86 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 86 02/19/20 03:14 PM

firms spend a considerable amount of time on risk assessment at both the financial state- ment level and the management assertion level for the client being audited.

Importantly, this process begins with a detailed understanding of the client’s business, industry, and strategy to achieve a competitive advantage in its marketplace. During this process, the auditor should obtain an understanding of important events that have affected the client, its operations, and its accounting information system. When understanding the accounting information system, the auditor should pay particular attention to:

∙ The complexity of the computer operations used by the entity (e.g., batch processing, online processing, outside service centers).

∙ The organizational structure of the computerized processing activities. ∙ The availability of data for the auditor. ∙ The need for specialized skills.

Relatedly, the auditor should obtain an overall understanding of the financial state- ments, and ultimately the management assertions. This understanding provides the base of knowledge necessary to assess audit risk, providing the underlying basis to construct the audit plan.

For example, the evaluation of the risk of material misstatement is likely to vary for different financial statement accounts and may even vary for different classes of signifi- cant transactions related to the same financial statement account. Ultimately, the audit plan will need to identify each of the relevant financial statement assertions (i.e., exis- tence, occurrence, completeness, cutoff, rights and obligations, valuation and allocation, accuracy, classification, and understandability) for each of the significant financial state- ment accounts and disclosures identified at an audit client.

The risk assessment process provides the basis to determine the nature, timing, and extent of internal control tests and substantive tests of account balances and disclosures at an audit client. That is, for each relevant assertion, the auditor must determine the combi- nation of control and substantive tests that will be necessary to gather enough evidence to persuade the auditor that no material misstatement exists for the relevant assertion being audited. When the tests have been completed, audit team members will often indicate the date that the procedure was performed and where the evidence is documented in the audit plan. Thus, audit plans are used not only for quality control and supervision but also as documentation to show that the audit engagement was planned and supervised in accor- dance with professional standards.

Risk assessment is absolutely critical in the audit planning process. Remember that the professional standards require that when planning, the auditor should establish the overall audit strategy for the company being audited, which includes the risk assessment proce- dures that will be performed and ultimately the auditor’s plan to respond to each of the assessed risks of material misstatement with specific auditing procedures. Because of the importance of risk assessment to the financial statement audit process, we devote exclu- sive attention to this subject in Chapter 4.The remainder of this chapter will focus on all other aspects of engagement planning. Essentially, there are three goals of audit planning:

∙ To make sure that the firm has the requisite staff to conduct the audit in accordance with professional standards in a timely and profitable manner;

∙ To determine materiality; and ∙ To outline the specific audit procedures, including tests of control and substantive

tests that need to be executed properly in order to mitigate assessed risks of material misstatement and be in compliance with professional standards.

Staffing the Audit Engagement When a new client is obtained, most public accounting firms assign a full-service team to the engagement. For a typical audit engagement, this team usually consists of the audit engagement partner (the person with final responsibility for the audit, usually an industry specialist), an audit manager, an information technology (IT) auditor, a tax specialist, a

First Pages

Chapter 3 Engagement Planning and Audit Evidence 87

lou6920x_ch03_078-116.indd 87 02/19/20 03:14 PM

quality assurance partner (the second audit partner who reviews the audit team’s work in critical audit areas), and audit staff. The assignment of staff depends on the riskiness of the engagement. For new clients, companies with complex significant transactions and public companies, more experienced staff members are typically assigned. No matter the type of engagement, planning meetings should include all team members and focus on the financial statement accounts that represent the highest risk of material misstatement.

The Center for Audit Quality (CAQ) is a nonprofit organization that is dedicated to promoting “high quality performance by public company auditors,” which helps to ensure the highest level of “investor confi- dence” in the capital markets. In providing the financial support for the CAQ, the public company auditing firms recognize the importance of working together to achieve audit quality.

The importance of planning was recently elevated by the CAQ when it released its own set of Audit Quality Indicators. In fact, one of the four key themes of audit quality outlined by the CAQ was the “engagement team knowledge, experience, and workload.” Among other issues, the report stressed that “The knowledge, experience, and workload of the audit engagement partner and certain other mem- bers of the engagement team are important elements in the execution

of an audit. It is the responsibility of the engagement partner to deter- mine that, collectively, the engagement team has the appropriate experience and competencies, and that specialists are engaged, as needed. The level of detail that may be provided on changes in the composition of the engagement team is dependent on the audit com- mittee’s needs and expectations, size of the engagement team, and other considerations.”*

Sources: CAQ Approach to Audit Quality Indicators, April 24, 2014, available at http://www.thecaq.org/reports-and-publications/caq-approach-to-audit-quality- indicators/caq-approach-to-audit-quality-indicators; Audit Quality Indicators: Journey and Path Ahead, January 12, 2016, available at http://www.thecaq .org/reports-and-publications/audit-quality-indicators-journey-and-path-ahead/ audit-quality-indicators-journey-and-path-ahead.

Plan for QualityAUDITING INSIGHT

These planning meetings help to ensure that the engagement is properly planned and that the audit team (especially new) members are properly supervised. The meetings also are intended to be brainstorming sessions to (1) ensure that all audit team members are informed about potential risks in the engagement and (2) increase team members’ awareness for poten- tial fraud. This required brainstorming session is discussed in more detail in Chapter 4.

In the sections below are further discussions of specific engagement staffing issues, including the role of IT auditors on the engagement team, relying on the work of internal auditors, and the use of audit specialists.

Use of IT Auditors When planning the engagement, the audit team members should consider their train- ing and experience relative to the methods of information processing. A review of the client’s computer hardware could show the extent of complexity involved. Whenever a complex computing environment exists, specialized information technology skills are needed to evaluate the effect of computerized processing on the audit process. IT audi- tors are members of the audit team who are specially trained to evaluate computerized controls and processes. The audit team could need their specialized skills relating to various methods of data processing and extraction, programming languages, software packages, or computer-assisted audit techniques. For audits of large companies in today’s environment, IT auditors will be required and included on the engagement team.

If the client outsources significant accounting applications (e.g., payroll), the audit team might need to coordinate audit procedures with service auditors at the processing center. This topic is covered in more detail in Module A.

Considering the Work of Internal Auditors External auditors must obtain an understanding of a client’s internal audit department and its work as part of the understanding of the client’s internal control system. Internal audi- tors were discussed briefly in Chapter 1 and will be discussed in more detail in Module D,

Center for Audit Quality. “CAQ Approach to Audit Quality Indicators.” Accessed June 24, 2019. https://www.thecaq.org/ wp-content/uploads/2019/03/caq-approach-to-audit-quality-indicators-april-2014.pdf.

First Pages

88 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 88 02/19/20 03:14 PM

but here we talk about the working relationship between internal and external auditors. Audit efficiency can be realized when the two groups work together. However, prior to relying on the work of internal auditors, external auditors should consider internal audi- tors’ objectivity and competence:

∙ Objectivity. Internal auditors can never be considered independent in the same sense that external auditors are because internal auditors are either directly employed or paid as contractors by the client; however, they can (and should) be objective.3 Internal auditors’ objectivity is investigated by learning about their organizational status and lines of com- munication in the company. Objectivity is enhanced when the internal auditors report directly to the audit committee of the board of directors. Objectivity is questioned when

∙ internal auditors report to divisional management, line managers, or other persons with a stake in the outcome of their findings.

∙ managers have some power over the pay or job tenure of the internal auditors. ∙ individual internal auditors have relatives in audit-sensitive areas or are scheduled to

be promoted to positions in the activities under internal audit review. ∙ Competence. Internal auditors’ competence is investigated by obtaining evidence

about their educational and experience qualifications, their certifications (CPA, CIA, CISA, etc.) and continuing education status, the department’s policies and procedures for work quality and for making personnel assignments, the supervision and review activities, and the quality of reports and audit documentation. This evidence enables the external auditors to evaluate internal auditors’ performance.

Favorable conclusions about competence and objectivity enable external auditors to rely on the work completed by the internal audit department related to gaining an under- standing of and testing of a company’s internal control system. Internal auditors also can assist (under the supervision of the independent audit team) with performing some substantive testing of balances on the audit, reducing the external auditors’ work, and avoiding duplication of effort. As an example, internal auditors can conduct observations and make test counts during physical inventory counts thereby allowing auditors to be able to reduce the nature, timing, or extent of their own procedures for these accounts. This utilization of internal auditors’ work, however, cannot be a complete substitute for the external auditors’ own procedures, as it is the work of the external auditors that must always provide the basis for the auditors’ opinion.

The external auditors can never delegate responsibility for audit decisions to the internal auditors. Rather, they must supervise, review, evaluate, and perform independent testing of all the work performed by internal auditors. Internal auditors should never be delegated tasks that require the external auditors’ professional judgment. Following is an illustra- tion of how one Big Four firm addresses the use of internal auditors on its engagements. Note that internal auditors’ work can be utilized more extensively without reperforming a percentage of the work when the account balance involves low professional judgment and risk, and internal auditors are considered to be more competent and objective.

3Internal auditors refer to their level of objectivity as independence. This concept is discussed further in Module D.

Reliance on Internal Auditors

  Objectivity and Competence

  Low High

High judgment/risk Auditor should not rely on internal auditors’ work

Auditor should not rely on internal auditors’ work

Low judgment/risk Auditor can rely on internal auditors’ work but should reperform some of the work

Auditor can rely on internal auditors’ work and may want to reperform some of the work

First Pages

Chapter 3 Engagement Planning and Audit Evidence 89

lou6920x_ch03_078-116.indd 89 02/19/20 03:14 PM

Using the Work of a Auditor-Employed or Auditor-Engaged Specialist  Gaining an understanding of the business can often lead to acquiring information that reveals the need to employ audit specialists on the audit. Audit specialists are persons skilled in fields other than accounting and auditing—actuaries, appraisers, attorneys, environmental engineers, and geologists—who are not members of the audit team. Audi- tors are not expected to be experts in all fields of knowledge that can contribute infor- mation to the financial statements. Audit specialists can be employed by the auditor’s firm (i.e., auditor-employed specialists) or engaged from an outside provider, referred to simply as an auditor-engaged specialist. In other words they should typically be involved in planning meetings and supervised as other team members under AS 1201 (unlike auditor-engaged or company specialists covered by AS 1210). When an auditor-engaged specialist is used, the audit engagement partner should assess the specialist’s knowledge, skill, and ability in that particular area. This includes gaining knowledge about his or her professional qualifications, experience, and reputation. The engagement team must also assess the objectivity of the auditor-engaged specialist. An auditor-engaged special- ist should be unrelated to the company under audit if possible. Regardless of whether the specialist is auditor-employed or auditor-engaged, the engagement partner and team should clearly inform the audit specialist of the work to be performed and of any matters that may affect his or her work. The engagement partner and audit team must also evalu- ate the work of the specialist. The extent of the evaluation is contingent upon the reliance on the specialist’s work, the risk of material misstatement in the area, the experience and skill of the specialist, and the objectivity of the specialists. Provided that some additional auditing work is done on the data that the audit specialist uses in reaching his or her conclusions, auditors may rely on the work of an audit specialist in connection with audit decisions. Normally, audit specialists are not referred to in the auditor’s report unless they are involved in addressing a critical audit matter disclosed in the audit report or unless their findings (e.g., a difference in an estimate from that of management) cause the audi- tors’ report to be modified (e.g., because of a GAAP departure). In these cases, references to the findings of the audit specialists may facilitate a better understanding of the nature of the GAAP departure.

Using the Work of a Company’s Specialist Auditors may also use the work of a company’s specialist as audit evidence. Much like when using the work of internal auditors, external auditors must consider the objectivity and competence, specifically the knowledge, skill, and ability, of the company special- ist. As with the auditor-engaged specialist, the auditor must evaluate the work of the company specialist, including evaluating any data, methods, or assumptions made by the specialist. Similarly, the extent of the evaluation is contingent upon the risk of material misstatement in the area, the significance of the company specialist’s work to the audi- tor’s conclusion, the knowledge, skill, and ability of the specialist, and the objectivity of the specialist’s judgment.

Time Budget The timing of the work and the number of hours that each segment of the engagement is expected to take are detailed in a preliminary time budget. Time budgets are used to main- tain control of the audit by identifying problem areas early in the engagement, thereby ensuring that the engagement is completed on a timely basis. Time budgets are usually based on the prior-year’s performance for continuing clients while considering changes in the client’s business. In a first-time audit, the budget may be based on a predecessor audi- tor’s experience or on general experience with similar companies. Extra time also may be assigned to those accounts containing the highest amount of audit risk. A simple time budget for an audit engagement follows.

First Pages

90 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 90 02/19/20 03:14 PM

  Audit Time Budget (Hours)

  Interim Year-End (Final)

Gain an understanding of business 15   Evaluate internal audit function 10   Understand internal control system 30 10 Prepare audit plan 25   Investigate related party transactions 5 15 Meet with client personnel 10 18 Complete cash substantive testing 10 15 Complete accounts receivable substantive testing 15 5 Complete inventory substantive testing 35 20 Complete accounts payable substantive testing 5 35 Evaluate legal letters   20 Review financial statement   25 Prepare audit report   12

This time budget is illustrative—actual time budgets are much more detailed and com- plex. Most budgets specify the expected time according to the level of staff people on the team (partner, manager, in-charge accountant, staff assistant, IT specialist, tax specialist). The illustration shows time at interim and at year-end. Interim audit work refers to procedures performed several weeks or months before the date of the financial statements. (Account balances audited during interim are later rolled forward at year-end.) Year-end audit work refers to procedures performed shortly before and after the date of the financial statements. Public accounting firms typically spread the workload during the year by scheduling interim audit work so they will have enough time and people available when several audits have year- ends on the same date. (December 31 is quite common.) For many public accounting firms, the auditing “busy season” runs from September through March of the following year. The interim work typically consists of risk assessment work, internal control testing, and substan- tive testing of balances as they exist at the interim date.

Everyone who works on the audit engagement is typically required to report the time taken to perform procedures for each phase of the audit. These time reports are recorded by budget categories for the purposes of (1) evaluating the efficiency of the audit team members, (2) compiling a record for billing the client, and (3) compiling a record for planning the next audit. Although the purposes of a time budget are straightforward, these budgets create job pressures. Staff members are under pressure to meet the budget, and beginning auditors often experience frustration over learning how to complete their audit work in an efficient manner.

REVIEW CHECKPOINTS 3.4 What is the purpose of a planning memorandum? 3.5 List some items normally documented in a planning memorandum. 3.6 What must external auditors do to use the work of internal auditors in the audit of an entity’s finan-

cial statements? 3.7 What must external auditors do to use the work of audit specialists in the audit of an entity’s finan-

cial statements? 3.8 For a typical audit engagement, describe the people and skills that are normally assigned to a full-

service audit team.

First Pages

Chapter 3 Engagement Planning and Audit Evidence 91

lou6920x_ch03_078-116.indd 91 02/19/20 03:14 PM

MATERIALITY As you know, financial statement measurements and information in some footnote disclo- sures are not flawlessly accurate. As noted in the auditors’ report, the financial statements are a function of the “accounting principles used and significant estimates made by man- agement.” The choices of depreciation method, inventory valuation method, or classifica- tion of marketable securities, for example, all affect final financial statement numbers. Furthermore, many financial measurements are based on estimates such as the estimated depreciable lives of fixed assets or the estimated amount of uncollectible accounts receiv- able. Thus, net income is not necessarily the one “true” figure but one possibility in a range of potential net income figures allowable under the relevant reporting framework (e.g., GAAP or International Financial Reporting Standards [IFRS]).

Given this range permitted, some amount of inaccuracy is allowed in financial state- ments. This is because (1) unimportant inaccuracies do not affect users’ decisions and hence are not material, (2) the cost of finding and correcting small misstatements is too high, and (3) the time taken to find them would delay issuance of the financial state- ments. Although not absolutely accurate, accountants and auditors do want to maintain that financial reports are materially accurate and do not contain material misstatements.

As a result, to plan the nature, timing, and extent of further audit procedures to be performed, an auditor “should establish a materiality level for the financial statements as a whole that is appropriate in light of the particular circumstances. This includes consid- eration of the company’s earnings and other relevant factors.” The professional standards also require that the “materiality level for the financial statements as a whole needs to be expressed as a specified amount.”4

Information is considered material if it is likely to influence financial statement users’ decisions. When referring to materiality in the auditing standards, PCAOB AS No. 2105 cites the definition as established by the Supreme Court, that a fact is material if there is “a substantial likelihood that the .  .  . fact would have been viewed by the reasonable investor as having significantly altered the ‘total mix’ of information made available.” The emphasis in this definition is on the financial statement users’ point of view, not on the auditors’ or managers’ point of view. Although financial statement users are expected to have a basic knowledge of business and financial statements as well as an understand- ing of the limitations of the audit process, auditors remain conservative when setting the materiality level.5

Given this, the engagement partner needs to think carefully about the appropriate level of materiality during the planning process. By doing so, the auditor helps to avoid unnec- essary surprises on the audit engagement. Suppose that near the end of an audit, the part- ner decided that all misstatements of more than $50,000 should be considered material but then realized that the nature, timing, and extent of substantive procedures had been completed assuming a materiality level of $250,000! As a result, the nature, timing, and extent of further audit procedures would have to be modified significantly, which would likely be an unpleasant surprise for the engagement team.

The professional standards also require the auditor to evaluate the facts and circum- stances of each engagement carefully to determine whether there are particular accounts or disclosures where amounts lower than established materiality might influence the judgment of a reasonable financial statement user. If that is the case, the auditor must determine an amount that would be considered a tolerable misstatement for that account or disclosure when completing risk assessment procedures and further planning and per- forming the necessary audit procedures in that area.6

LO 3-3 Define materiality and explain its importance in the audit planning process.

4Public Company Accounting Oversight Board. “AS 2105: Consideration of Materiality in Planning and Performing an Audit.” Accessed June 24, 2019. https://pcaobus.org/Standards/Auditing/Pages/AS2105.aspx. 5Ibid. 6Ibid.

First Pages

92 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 92 02/19/20 03:14 PM

Therefore, auditors use performance materiality (an amount less than materiality for the financial statements as a whole) to make sure that the aggregate of uncorrected and undetected immaterial misstatements does not exceed materiality for the financial state- ments as a whole. For example, auditors may use different amounts (smaller than overall financial statement materiality) when auditing particular classes of significant transac- tions, account balances, or disclosures. The audit team cannot look at every significant transaction, so the concept of performance materiality takes this risk into account. When auditors use sampling, performance materiality is referred to as tolerable misstatement.

The extent to which performance materiality is based on the overall materiality is a mat- ter of professional judgment and, as a result, the amount may vary from auditor to audi- tor, as could the methods for assigning performance materiality to accounts. The auditing standards do not even require that the overall materiality amount be assigned to individual accounts in dollar amounts. While there may be many different processes for determin- ing performance materiality, most auditors start with a top-down approach: judging an overall material amount for the financial statements and then determining performance materiality to particular accounts to help determine the amount of work to be done in each area. Such a top-down approach is considered theoretically preferable because this method requires the audit team to think first about the financial statements taken as a whole.

Materiality Calculation Although some accountants wish that standard setters could issue definitive, quantitative materiality guidelines, many fear the rigidity that such guidelines would impose. There- fore, in the end, materiality is a matter of professional judgment that the engagement partner must decide on each audit engagement. However, on each audit engagement, the planning process begins with a calculation of a preliminary materiality amount that is based on a relevant benchmark and a rule of thumb percentage applied to that benchmark.

The choice of appropriate benchmark relates directly back to what is most important for the financial statement users and the industry in which the client operates. Auditors most commonly use profit before tax (PBT), total net assets, or total revenues as the benchmark for their initial determination of materiality, depending on the client industry. Some examples of commonly used benchmarks per industry are noted below:

∙ Asset based entities – total net assets. ∙ Profit based companies, such as manufacturing - PBT. ∙ High technology start-up companies – total revenue. ∙ Nonprofit entities – gross revenue or total contributions.

The rule of thumb percentages applied to the benchmarks often range from 3–5 percent of PBT or 1/2–1 percent of revenue or total assets.

As noted, the percentages and benchmarks per industry are only rules of thumb and will not be appropriate for all clients. If, for example, the PBT for a profit-based company fluc- tuates widely, an average PBT over recent years may be a more appropriate benchmark for materiality. Alternatively, if a profit-based company experienced a net loss, an alternative benchmark may be more appropriate to use to determine materiality. Amazon, the internet retail giant, provides an example of both of these scenarios. For the fiscal year 2018, Ama- zon reported $11.2 billion in income before taxes (i.e., profit before tax). For the years ended 2017 and 2016, Amazon reported $3.8 and $3.9 billion PBT, respectively. Using the rule of thumb of 3% of PBT, the overall materiality set for the 2018 Amazon audit would be approximately $337 million dollars, which is close to 10% of Amazon’s PBT in each of the prior years! In a situation like this, auditors may decide to use the average PBT of the prior years to determine materiality. Although hard to believe today, in 2002, Amazon reported a net loss of $149 million and net sales of $3.9 billion. In a loss scenario such as this, auditors may decide using a percentage of sales or total assets is a more appropriate benchmark for materiality. Of course, in the end, materiality is a matter of professional judgment, keeping in mind what matters most to the financial statement users.

First Pages

Chapter 3 Engagement Planning and Audit Evidence 93

lou6920x_ch03_078-116.indd 93 02/19/20 03:14 PM

Although standards require materiality be expressed as a quantitative amount, auditors must consider qualitative factors as well. The SEC cautions auditors about overreliance on certain quantitative benchmarks to assess materiality, noting that “misstatements are not immaterial simply because they fall beneath a numerical threshold.”7 Thus, auditors must examine both quantitative and qualitative factors when assessing materiality. Some of the more common qualitative factors that auditors use in making materiality judgments are the nature of the item or issue, engagement circumstances, and possible cumulative effects—all discussed in the following paragraphs.

Nature of the Item or Issue An important qualitative factor is the descriptive nature of the item or issue. An illegal pay- ment is important primarily because of its nature as well as because of its absolute or relative amount. In addition, the auditor would consider any type of fraud committed by a member of management material regardless of the amount. Finally, generally speaking, potential errors in the more liquid assets (cash, receivables, and inventory) are considered more important than potential errors in other accounts (such as fixed assets and deferred charges).

Engagement Circumstances An auditor’s legal liability is always a relevant consideration when determining material- ity. That is, auditors generally place extra emphasis on the detection of misstatements in financial statements that will be widely used (such as those of public companies) or used by important outsiders (such as bank loan officers). The likelihood of an engagement being selected for inspection by the PCAOB is also a relevant consideration. In addition, troublesome political events in foreign countries can cause auditors to try to be more accurate with measurements and disclosures. Other circumstances that affect quantitative materiality involve amounts that could turn a net loss into a profit or allow a company to meet earnings expectations. In these circumstances, when management can exercise discretion over an accounting treatment, auditors tend to exercise more care and use a more stringent quantitative materiality criterion. Finally, matters surrounded by uncer- tainty about the outcome of future events usually come under more stringent quantitative materiality considerations.

Possible Cumulative Effects At the end of each audit engagement, auditors must also evaluate the aggregate sum of known or potential misstatements. For example, consider an audit for which overall mate- riality is set at $50,000. If the audit test work revealed five individual $15,000 misstate- ments, they would each, on their own, be considered immaterial. However, what if all five misstatements each had the effect of increasing net income? In that situation, the auditor must factor in the probability that the aggregate of uncorrected and undetected misstatements could exceed overall materiality for the financial statements.

7SEC Staff Accounting Bulletin No. 99, “Materiality,” August 12, 1999.

In early 2019, Hertz, the rental car company giant, agreed to pay a $16 million penalty to the SEC over accounting errors that lead to material misstatements in the audited financial statements for 2012 and 2013, as well as portions of the unaudited 2011 financial state- ments. Hertz identified 17 areas with material accounting errors across several business units, including one misstatement valued at

$48 million. The cumulative effect of the misstatements resulted not only in the hefty SEC fine, but a reduction in previously reported pre- tax income of $235 million.

Source: “SEC Penalizes Hertz $16M for Accounting Violations,” Accounting Today, January 12, 2019, M. Cohn.

Costly Cumulative EffectsAUDITING INSIGHT

First Pages

94 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 94 02/19/20 03:14 PM

Although we have presented a number of different factors affecting overall materiality, decisions about materiality ultimately remain a function of auditors’ professional judg- ment. Many experienced auditors will state that these judgments are among the most difficult they make. And materiality is one of the most important audit concepts you will learn about because of its pervasive effect on the audit engagement. To summarize, on an audit engagement, the audit team uses materiality three ways:

1. As a guide to planning substantive testing procedures—directing attention and audit work to those items or accounts that are important, uncertain, or susceptible to mate- rial misstatements.

2. As a guide for determining performance materiality to help make sure that the aggre- gate of uncorrected and undetected immaterial misstatements does not exceed the materiality level for the financial statements as a whole. For example, auditors may use an amount smaller than overall financial statement materiality when auditing par- ticular classes of significant transactions, account balances, or disclosures.

3. As a guide for making decisions about the audit report. An account such as inven- tory can be material in an audit context because of its size or its place in the financial statements.

AUDIT PROCEDURES FOR OBTAINING AUDIT EVIDENCE Auditors use audit procedures for three purposes. First, they use audit procedures to gain an understanding of the client and the risks associated with the client (risk assessment procedures). These procedures are covered in detail in Chapter 4. Second, auditors use audit procedures to test the operating effectiveness of client internal control activities (tests of controls) discussed in Chapter 5. Finally, auditors use audit procedures to pro- duce evidence about management’s assertions (i.e., relating to existence, occurrence, completeness, cutoff, rights and obligations, valuation and allocation, accuracy, classifi- cation, and understandability) related to the amounts and disclosures in a client’s finan- cial statements. Exhibit 3.2 shows the relationship among the assertions, the types of evidence available to the auditor, and the procedures most closely related to each.

Once the risk assessment procedures have been completed and the relevant financial statement assertions have been identified, an auditor then considers whether specific con- trol activities are in place to prevent or detect a misstatement related to each of the rel- evant financial statement assertions. Ultimately, the audit plan needs to specify a list of procedures that must be completed to gather sufficient and appropriate evidence directed toward achieving particular audit objectives. For example, an internal control audit plan would contain the specific procedures needed to obtain an understanding of the client’s internal control system and test that understanding for those controls that relate to the relevant financial statement assertions. If the auditor decides to rely on specific internal control activities, the plan would also identify the specific types of tests of controls that would need to be completed to validate the operating effectiveness of the internal control activities.

A substantive audit plan would contain a list of audit procedures for gathering evidence related to the relevant assertions identified for an audit client’s significant financial state- ment accounts and disclosures. The substantive audit plan (i.e., the nature, timing, and

LO 3-4 List and describe the eight general types of audit procedures for gathering evidence.

REVIEW CHECKPOINTS  3.9 What is meant by material information in accounting and auditing? 3.10 How does an audit team use materiality on an audit engagement?

First Pages

Chapter 3 Engagement Planning and Audit Evidence 95

lou6920x_ch03_078-116.indd 95 02/19/20 03:14 PM

EXHIBIT 3.2 Assertions, Evidence, and Audit Procedures

PCAOB Assertions ASB Assertions What Could Go Wrong? Examples of Evidence Available

Representative Audit Procedures

Existence or occurrence

Existence Do the assets recorded really exist?

The physical presence of the assets

Inspection of tangible assets

  Occurrence Did the recorded sales transactions really occur?

Client shipping documents Inspection of records or documents (vouching)

Rights and obligations Rights and obligations

Does the entity really own the assets? Are related legal responsibilities identified?

Statements by independent parties

Confirmation

Completeness Completeness Are the financial statements (including footnotes) complete?

Documents prepared by the client

Inspection of records or documents (tracing)

  Cutoff Were all transactions recorded in the proper period?

Client receiving, shipping reports

Inspection of records or documents (tracing or vouching)

Valuation and allocation

Valuation or allocation

Are the accounts valued correctly?

Client-prepared accounts receivable aging schedule

Reperformance

  Accuracy Were transactions recorded accurately?

Vendor invoices Inspection of records or documents (tracing or vouching)

Presentation and disclosure

Classification Were all transactions recorded in the proper accounts?

Comparisons of current-year amounts with those from the prior year

Analytical procedures

  Understandability Are the presentations and disclosures understandable to users?

Management-prepared financial statements and footnotes

Inquiry

extent of further procedures) depends almost exclusively upon the assessment of risk at an audit client. As an example, consider the nature of procedures. There are two ways to conduct substantive tests: (1) substantive analytical procedures and (2) tests of details.

When completing analytical procedures to gather evidence, the auditor must develop an independent expectation of what he or she thinks the account balance should be. Once this is developed, the expectation is compared to the recorded amount. Any significant differences must be investigated and then corroborated with evidence. When applying substantive test of details, the auditor must seek to understand the account balance and/or economic transaction to ensure, based on valid and reliable evidence, that the amount was recorded in accordance with the applicable financial reporting framework. In general, analytical procedures are considered more efficient while a test of details is considered more effective. Thus, an auditor must take great care in determining the nature of the testing procedure (i.e., substantive analytical procedure or test of detail) to specify in the audit plan.

To simplify the audit plan, auditors typically group the accounts into cycles (see Exhibit 3.3A). A cycle is a set of accounts that are logically grouped in the internal con- trol system, which has been designed to produce the financial statements and notes (see Exhibit 3.3B). Most audit firms recognize four cycles, and each of these cycles is featured in a chapter of this book: (1) the revenue and collection cycle (Chapter 7), (2) the acquisi- tion and expenditure cycle (Chapter 8), (3) the production cycle (Chapter 9), and (4) the finance and investment cycle (Chapter 10). Using the revenue and collection cycle as an

First Pages

96 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 96 02/19/20 03:14 PM

example, the idea of the cycle organization is to group accounts (sales, accounts receiv- able, cash) related to one another by the transactions that normally affect them all. This cycle starts with a sale to a customer along with recording an account receivable, which is later collected in cash or provided for in the allowance for doubtful accounts.

REVIEW CHECKPOINTS 3.11 What are the two primary ways to conduct substantive tests? Explain how the tests are different. 3.12 Identify the four cycles featured in Dunder-Mifflin’s accounting system featured in Exhibit 3.3A.

Next, list the financial statement accounts that can be identified within each of the cycles identi- fied as featured in Exhibit 3.3B.

As a rule, auditors use eight general audit procedures to gather evidence: (1) inspection of records and documents (vouching, tracing, scanning), (2) inspection of tangible assets, (3) observation, (4) inquiry, (5) confirmation, (6) recalculation, (7) reperformance, and (8) analytical procedures. Many of these procedures are performed or aided by the use of computer assisted audit techniques (CAATs) such as the IDEA or ACL programs. In this book, we have integrated the IDEA software package, a CAAT program used by many audit professionals, to help students understand how these procedures are performed in practice. The “Using IDEA in the Audit” excerpt following the discussion of the various audit procedures is designed to help you get started in IDEA.

In the following sections, we discuss each of the eight aforementioned audit proce- dures in more detail.

1. Inspection of Records and Documents Much auditing work involves gathering evidence by examining authoritative documents prepared by independent parties and by the client. Auditors frequently inspect such documents to ensure they contain the correct information and/or authorization. Such

EXHIBIT 3.3A Dunder-Mifflin Trial Balance, December 31, 2020

Revenue and collection cycle Acquisition and expenditure cycle

Production cycle Finance and investment cycle

X X X X X X

X X X X X X X

X X X X X X X X

X X

X X X Cash Accounts receivable Allowance for doubtful accounts Sales Sales returns Bad debt expense Inventory Fixed assets Accumulated depreciation Accounts payable Accrued expenses General expense Cost of goods sold Depreciation expense Bank loans Long-term notes Accrued interest Capital stock Retained earnings Dividends declared Interest expense Income tax expense

Debit Credit

14,620,000 120,000

300,000 6,296,000 2,000,000

1,500,000 44,000 200,000

500,000 600,000

3,000,000

60,000 0

14,620,000

720,000 2,000,000 60,000

50,000

40,000

450,000 1,500,000

9,200,000

0 600,000

First Pages

Chapter 3 Engagement Planning and Audit Evidence 97

lou6920x_ch03_078-116.indd 97 02/19/20 03:14 PM

EXHIBIT 3.3B Dunder-Mifflin Unaudited Financial Statements

FINANCIAL POSITION Cash Accounts receivable Inventory Current Assets Fixed assets (net) Accum. depreciation Fixed Assets (net)

Total Assets

Accounts payable Accrued expenses Current debt Current Liabilities

Long-term debt Capital stock Retained earnings Total Liabilities and Stockholder Equity$4,060,000

$1,500,000

1,500,000

$ 600,000 460,000

$2,560,000 $3,000,000 (1,500,000)

$4,060,000

900,000

200,000

$ 450,000 110,000

$ 760,000

$ 400,000 2,000,000

RESULTS OF OPERATIONS Sales (net) $9,000,000

$ 180,000

Cost of goods sold Gross Profit General expenses

Net Income

Income tax expense before taxes Operating income Interest expense Depreciation expense

$2,044,000 $2,704,000 6,296,000

300,000 60,000

$ 300,000 120,000

CASH FLOWS Operations: Net income Depreciation Increase in accounts receivable Decrease in inventory Decrease in accounts payable Decrease in accrued expenses Decrease in accrued interest Cash Flow from Operations Investing Activities: Purchase Fixed Assets Financing Activities: Repay bank loan Repay notes payable Financing Activities

Ending Balance

Beginning balance Increase (decrease) in cash

$ 600,000

746,500 $(146,500)

$(475,000) (200,000) $(275,000)

$ 328,500 ( 20,500) ( 15,000)

(141,500)

( 25,000) 50,000

300,000 $ 180,000

$ 0

NOTES TO FINANCIAL STATEMENTS 1. Accounting Policies 2. Inventories 3. Plant and Equipment 4. Long-Term Debt 5. Stock Options 6. Income Taxes 7. Contingencies Etc.

Revenue and collection cycle Acquisition and expenditure cycle

Production cycle Finance and investment cycle

X X X X X X

X X X X X X X

X X X X X X X X

X X

X X X Cash Accounts receivable Allowance for doubtful accounts Sales Sales returns Bad debt expense Inventory Fixed assets Accumulated depreciation Accounts payable Accrued expenses General expense Cost of goods sold Depreciation expense Bank loans Long-term notes Accrued interest Capital stock Retained earnings Dividends declared Interest expense Income tax expense

Debit Credit

14,620,000 120,000

300,000 6,296,000 2,000,000

1,500,000 44,000 200,000

500,000 600,000

3,000,000

60,000 0

14,620,000

720,000 2,000,000 60,000

50,000

40,000

450,000 1,500,000

9,200,000

0 600,000

documents can provide “evidence of varying degrees of reliability, depending on their nature and source,” regarding many of management’s financial statement assertions.

Documents Prepared by Independent Outside Parties The most reliable form of documentary evidence is external, which means that the document was received directly from an independent outside third party (e.g., a bank). Formal external documents that may have seals, engraving, or other distinctive attri- butes are less susceptible to alteration and are therefore more reliable than ordinary external documents. Examples of formal external documents include bank statements, title papers, and insurance policies, whereas ordinary external documents include ven- dor invoices, simple contracts, and written correspondence. Regardless, when either type of document is received directly from an independent outside party, the evidence is considered reliable.

In addition, a great deal of documentary evidence is considered external-internal, which means that the documents were initially prepared by an external third party but

First Pages

98 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 98 02/19/20 03:14 PM

they were received by the client first and then given to the auditor. Since the client had possession of the documents, there is always a possibility that the client altered the docu- ments. As a result, external-internal documents are not as reliable as external documents.

Documents Prepared and Processed by the Client Documentation of this type is referred to as internal evidence. Some of these documents may be quite informal and not very authoritative or reliable. When such documents are prepared by the client but are mailed to third parties, they become slightly more reliable. However, as a general proposition, the reliability of these documents depends on the quality of internal control under which they were produced and processed. Because the client produces the evidence, an auditor must perform additional testing on this type of information before placing any reliance at all on the internal evidence. Some of the most common of these documents are:

Internal Documents

1. Sales invoice copies 2. Sales summary reports 3. Cost distribution reports 4. Loan approval memos 5. Budgets and performance reports 6. Documentation of significant transactions with

subsidiaries

7. Shipping documents 8. Receiving reports 9. Requisition slips 10. Purchase orders 11. Credit memos 12. Transaction logs

Vouching—Examination of Documents When testing the existence or the occurrence assertion, the auditor will take the vouch- ing direction when examining documents. The important point about vouching is that the auditor begins the search for evidence by focusing on transactions that have already been recorded in the financial statements. In vouching, an auditor selects an item in the financial records, usually from a journal or ledger, and follows its path back through the processing steps to its origin (i.e., the source documentation that supports the item selected from the ledger). Consider a revenue entry made in the financial statements. For that entry, the auditor will find the journal entry, the sales summary, the sales invoice copy, the shipping documents, and, finally, the sales order from the customer. Vouch- ing of documents can help auditors decide whether all recorded significant transactions are adequately supported (the existence and occurrence assertions), but vouching does not provide evidence to show whether all significant transactions were actually recorded (the completeness assertion). However, if the auditors verify amounts during their test- ing, evidence regarding valuation and allocation also may be obtained while vouching documents.

Tracing—Examination of Documents When testing the completeness assertion, the auditor will take the tracing direction when examining documents. When taking the tracing direction, the auditor selects a basic source document and follows its processing path forward to find its final recording in a summary journal or ledger and ultimately the financial statements. For example, samples of ship- ping documents can be obtained from the warehouse and then traced to sales invoices, the sales journal, and ultimately their recording in the financial statements as revenue earned.

Using tracing, an auditor can decide whether all significant transactions and events that should have been recorded actually were recorded (the completeness assertion). In doing so, the auditor complements the evidence obtained by vouching. This implies that an auditor must always be alert to events that were not entered into the accounting sys- tem. For example, the search for unrecorded liabilities for raw materials purchases must include examination of invoices received in the period following the fiscal year-end and examination of receiving reports dated near the year-end. In practice, it is important to

First Pages

Chapter 3 Engagement Planning and Audit Evidence 99

lou6920x_ch03_078-116.indd 99 02/19/20 03:14 PM

remember that the direction of the examination of documents is critical in relation to the assertion being tested.

Summary Listing (Sales Journal)

Source Documents (Shipping Documents)

Vouching (Would be used to test the existence or occurrence assertion. The audit test would be designed to answer the following question: Did all recorded sales occur?)

Tracing (Would be used to test the completeness assertion. The audit test would be designed to answer the following question: Were all shipments made to customers actually recorded as sales?)

Scanning—Examination of Documents Scanning is the way auditors exercise their general alertness to unusual items and events in clients’ documentation. A typical scanning directive in an audit plan is: “Scan the expense accounts for credit entries; vouch any to source documents.”

In general, scanning is an “eyes-open” approach of looking for anything unusual. The scanning procedure usually does not produce direct evidence itself, but it can raise ques- tions related to other evidence that must be obtained. Scanning can be accomplished on digital records by using CAATs to select records that are exceptions to the auditors’ criteria. For example, CAATs can easily scan client’s data for (1) accounts receivable balances for amounts over the credit limit, (2) inventory quantities for negative balances or unreasonably large balances, (3) payroll files for terminated employees, (4) loan files for loans with nega- tive balances, (5) debits in revenue accounts and (6) credits in expense accounts, to name a few. Scanning can contribute some evidence related to the existence of assets and the completeness of accounting records, including the proper cutoff of significant transactions.

2. Inspection of Tangible Assets Inspection of tangible assets includes examining property, plant, and equipment; inven- tory; and securities certificates. Physical inspection of tangible assets provides compel- ling evidence of existence and may provide tentative evidence of valuation. For example, audit team members can verify the existence of specific pieces of equipment listed on the client’s fixed asset register by locating them and noting their condition (valuation). However, inspection does not necessarily provide evidence that the entity owns the assets (rights). For example, fixed assets on the client’s premises may be leased under operating lease agreements, and inventory inspected by auditors may be held on consignment.

3. Observation Although inventory observation often refers to the physical inspection of inventory (i.e., tangible assets), auditors use observation when they view the client’s physical facilities and personnel on an inspection tour, when they watch personnel carry out accounting and control activities (such as observing client inventory counts), and when they participate in a surprise payroll distribution. Observation also can produce a general awareness of events in the client’s offices. In this sense, observation is commonly used as a test of controls.

4. Inquiry Inquiry is a procedure that generally involves the collection of verbal evidence from independent parties and management (commonly referred to as management represen- tations). Important inquiries and responses should be documented by the auditor in the

First Pages

100 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 100 02/19/20 03:14 PM

workpapers. Auditors typically use inquiry procedures during the early planning stages of the engagement. Evidence gathered by formal and informal inquiry generally cannot stand alone as convincing, and auditors must corroborate responses with independent findings based on other procedures. In fact, the professional standards state that “inquiry alone” is never enough to reach an audit conclusion. An exception to this general rule might be a negative statement in which someone volunteers adverse information such as an admission of theft, fraud, or use of an accounting policy that is misleading. However, even in such a situation, an auditor would most likely follow up to obtain documentary evidence to support the negative statement.

Auditors conduct interviews almost every day. Sometimes these seem more like casual conversations than “interviews.” Nevertheless, the following guidelines for the inquiry/interview procedure can help you obtain good information and maintain good relations with client personnel.

1. Prepare. Think about the information you want to obtain, the ques- tions to ask, and the best person to interview.

2. Make an appointment. Call in advance for a time or at least ask permission to interrupt: “Do you have time to talk with me about [subject]?” Introduce yourself and make enough conversation to warm up the person without wasting time.

3. Be conversational. Try to get the person to describe the account- ing, the controls, or whatever the subject in his or her own words. You will get more information. Just firing off questions makes the meeting an interrogation. Most auditors find it difficult to think of all of the right questions ahead of time anyway. Don’t exhibit

a questionnaire or checklist; doing so makes the interview too mechanical. You can take informal notes to remember the sub- stance of the interview.

4. Ask questions. Fill in the gaps in the person’s description or expla- nation by asking prompting questions to elicit additional descrip- tions and explanations. Start with broad, open-ended questions and use specific questions to obtain more detail.

5. Listen carefully. Repeat items you don’t completely understand. 6. Be noncommittal. Refrain from expressing your own value judg-

ments or criticisms while you talk with the client personnel. Don’t reveal any audit-sensitive information.

7. Close gracefully. Thank the person for the time and information. Ask permission to return later for “anything I forgot.”

8. Document the interview. Write a memorandum for the audit docu- mentation. Now you can get out the questionnaire or checklist, complete it, and see whether you overlooked anything important.

Verbal Inquiry = InterviewAUDITING INSIGHT

5. Confirmation Confirmation by direct correspondence with independent parties is a procedure widely used in auditing. It can produce evidence of existence and rights and obligations and sometimes of valuation and cutoff. Auditors typically limit their use of confirmation to significant transactions and balances about which outside parties could be expected to provide information. A selection of confirmation applications includes the following:

∙ Banks—cash and loan balances. ∙ Customers—receivables balances. ∙ Borrowers—note terms and balances. ∙ Agents—inventory on consignment or in warehouses. ∙ Lenders—note terms and balances. ∙ Policyholders—life insurance contracts. ∙ Vendors—accounts payable balances. ∙ Registrar—number of shares of stock outstanding. ∙ Attorneys—litigation in progress. ∙ Trustees—securities held, terms of agreements. ∙ Lessors—lease terms.

Several points about confirmations are important to remember. First, confirmation let- ters are typically printed on the client’s letterhead and signed by a client officer; third

First Pages

Chapter 3 Engagement Planning and Audit Evidence 101

lou6920x_ch03_078-116.indd 101 02/19/20 03:14 PM

parties usually do not release information without client permission. Second, confirma- tion requests should seek information the recipient can supply, such as the amount of a balance or the amounts of specified invoices or notes. Third, the audit firm should control confirmations rather than giving them to client personnel for mailing. The audit team should be very careful that the recipient’s address is reliable and not subject to alteration by the client in such a way as to misdirect the confirmation. Fourth, responses should be returned directly to the audit firm, not to the client. And last, auditors are increasingly using technology to aid and improve the confirmation process.

Auditors are using technology in both the confirmation selection and execution pro- cess. Auditors can use CAATs to program statistical or judgmental criteria for selecting customers’ accounts receivable, loans, and other receivables for confirmation. In addi- tion, the use of electronic confirmations by auditors (e.g., confirmation.com) has led to improvements in both the effectiveness and the efficiency of the confirmation process. The use of electronic confirmations is covered in detail in Chapter 6.

6. Recalculation Auditor recalculation of computations previously performed by client personnel produces compelling evidence. A client calculation must always be mathematically accurate. Cli- ent calculations performed by computer programs can be recalculated using CAATs with differences printed out for further audit investigation. Mathematical evidence can serve the objectives of existence and valuation for financial statement amounts that exist prin- cipally as calculations, for example, depreciation, interest expense, pension liabilities, actuarial reserves, bad debt reserves, and product guarantee liabilities. Recalculation, in combination with other procedures, is also used to provide evidence of valuation for all other financial data.

7. Reperformance Although similar to recalculation, reperformance is much broader in approach. As dis- cussed in Chapter 4, reperformance is commonly used by auditors while completing walkthroughs when gaining an understanding of a client’s internal control system. In fact, reperformance can generally be completed for any client control procedure such as matching vendor invoices with supporting purchase orders and receiving reports. Reper- formance may be done either manually or with the assistance of CAATs. An auditor, for example, can verify that an accounts receivable aging schedule was prepared properly by sorting accounts receivable by due date.

8. Analytical Procedures Auditors can evaluate financial statement accounts by developing expectations about what an account balance should be based on an analysis of relevant financial and nonfi- nancial data. When an auditor compares the expectation to a recorded balance, analytical procedures are being performed. Auditors are required to use them when planning the audit and when performing the review of the financial statements near the end of the audit before the audit report is issued. In addition, auditors use analytical procedures to provide evidence about management’s financial statement assertions during the testing phase of the audit.

Analytical procedures take the five general forms shown in the following table. Audi- tors need to be careful to use independent, reliable information for analyses. The sources of information shown for the analytical procedures are very important, and auditors must gain comfort over the information that is used to develop expectations during analytical procedures. CAATs are useful when developing expectations as they can match data in separate files to help extract the data necessary to make comparisons between financial and nonfinancial information. In addition, CAATs can be used to extract the data neces- sary to make comparisons to other companies in the same industry.

First Pages

102 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 102 02/19/20 03:14 PM

Because analytical procedures completed during planning are required and used only to direct attention to unusual relationships, some auditors are reluctant to use analytical procedures during the substantive testing of balances. Instead, many auditors feel more comfortable with tests of details such as recalculation, observation, confirmation, and the inspection of documents. However, you should resist this temptation. In fact, the professional standards clearly indicate that a well-planned analytical procedure con- ducted during the substantive testing phase can be quite effective if executed properly. Most importantly, when applying substantive analytical reviews to gather evidence in this manner, any significant differences must be investigated and corroborated with evidence.

Because of their effectiveness in directing attention to high-risk areas, professional standards require that analytic procedures be used during planning and during final evaluation phases of the audit. Although not required to be used during the substantive testing phase of the engagement, auditors must consider the value of analytical proce- dures, especially because they are usually less costly than more detailed, document- oriented procedures. Consequently, analytical procedures often take a prominent place in the audit plan.

Analytical Procedures Sources of Information

1.  Comparison of current-year account balances to balances of one or more comparable periods

Financial account information for comparable period(s) Example: Current-year cost of goods sold compared to last year’s balance

2.  Comparison of current-year account balances to anticipated results found in the company’s budgets and forecasts

Company budgets and forecasts Example: Current-year cost of goods sold compared to the company’s budgeted amount

3.  Evaluation of the relationships of current-year account balances to other current-year balances for conformity with predictable patterns based on the company’s experience

Financial relationships among accounts in the current period Example: Relationship between inventory and cost of goods sold

4.  Comparison of current-year account balances and financial relationships (e.g., ratios) with similar information for the industry in which the company operates

Industry statistics Example: Comparing inventory and cost of goods sold levels to comparable companies in the industry

5.  Study of the relationships of current-year account balances with relevant nonfinancial information (e.g., physical production statistics)

Nonfinancial information such as physical production statistics Example: Comparing the number of unfilled orders to inventory and cost of goods sold levels

The first step in using a CAAT like IDEA is to gain access to the cli- ent’s data. The data may be available in multiple forms, depending on the audit client’s unique computing environment. However, IDEA is designed to be flexible enough to handle multiple computing envi- ronments. Your instructor will provide you with access to the IDEA software and the latest electronic version of the IDEA Data Analysis Workbook. Your instructor will also provide you with access to the data

files for the audit procedures to be completed for Accounts Receiv- able, Accounts Payable, and Inventory.

For each set of files, your first step is to import the client’s data into the IDEA software. We suggest that you complete this step for each of the areas that have been assigned by your instructor. To pro- ceed, please refer to the IDEA workbook provided by your instructor for step by step instructions on how to properly import each file.

Accessing Client Data USING IDEA IN THE AUDIT

First Pages

Chapter 3 Engagement Planning and Audit Evidence 103

lou6920x_ch03_078-116.indd 103 02/19/20 03:14 PM

AUDIT DOCUMENTATION An engagement is not complete without preparation of proper documentation. PCAOB AS 1215 defines audit documentation as

The written record of the basis for the auditor’s conclusions that provides the support for the auditor’s representations, whether those representations are contained in the auditor’s report or otherwise.*

In other words, audit documentation provides the auditors’ record of compliance with generally accepted auditing standards. The documentation (often referred to as work- papers despite that it is typically in electronic format) should contain support for the decisions regarding planning and performing the audit, procedures performed, evidence obtained, and overall conclusions reached near the end of the audit. Even though the auditors legally own the audit documentation, professional ethics require that the files not be transferred without the client’s consent because of the confidential information recorded in them.

Audit documentation can be classified in two categories: (1) permanent files (which contain information that is relevant to ongoing client relationships) and (2) current files (which relate to just one year of the client relationship). The following sections describe the information contained in each file in more detail.

Permanent Files The permanent files (or continuing audit files) contain information of continuing audit significance over many years’ audits of the same client. The audit team may use this file year after year, but each year’s current audit documentation is stored after the

LO 3-5 Define what is meant by the proper form and content of audit documentation.

REVIEW CHECKPOINTS 3.13 What is meant by (a) vouching, (b) tracing, and (c) scanning? What is the difference between

vouching and tracing? 3.14 Identify and then briefly explain the eight general audit procedures used to gather evidence. Next,

please provide an example for each of the eight procedures. 3.15 What are the five types of general analytical procedures? List five sources of information for ana-

lytical procedures. 3.16 When are analytical procedures required during an audit engagement?

Technology is changing the look of the traditional inventory observa- tions and asset inspections for the better. The Big 4 audit firms have recently begun using drone technology to help make the audit more efficient and effective. One way drones are being used is to get a bet- ter view of hard to count inventory items, such as crops, livestock, and coal reserves. Inventory observations that would have taken auditors hours to perform now take a fraction of the time with more reliable

results. This allows auditors to focus their attention on identifying and responding to areas of risk.

Sources. “EY Scaling the use of Drones in the Audit Process”, EY.com, June 13, 2017. “PwC uses drone in audit for first time” Economia, January 2, 2019. “How Drones are Being Used in Audit”, Discoveraudit. org, Dec 14, 2017.

Fly-by Audit Procedures?AUDITING INSIGHT

Public Company Accounting Oversight Board. “AS 1215: Audit Documentation.” Accessed June 24, 2019. https://pcaobus.org/ Standards/Auditing/Pages/AS1215.aspx.

First Pages

104 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 104 02/19/20 03:14 PM

files have served their purpose. Documents of permanent interest and applicability include

1. Copies or excerpts of the corporate or association charter, bylaws, or partnership agreement.

2. Copies or excerpts of continuing contracts such as leases, bond indentures, and royalty agreements.

3. A history of the company, its products, markets, and background. 4. Copies or excerpts of minutes of meetings of stockholders and/or directors on matters

of lasting interest. 5. Continuing schedules of accounts with balances that are carried forward for several

years, such as owners’ equity, retained earnings, partnership capital, and the like. 6. Copies of prior-years’ financial statements and audit reports. 7. Client organization chart.

Copies of financial statements and auditors’ reports from prior years also may be included. Public accounting firms collect articles and other information regarding a client and key personnel throughout the year. This information is often placed in the permanent file to facilitate a review of the client prior to continuing the relationship. Because of the importance of the documents contained and summarized in this one place, the permanent file is a ready source of information for familiarization with the client by new personnel on the engagement.

Current Files The current files include all client acceptance or continuance documentation along with planning documentation for the year under audit. They usually include the engagement letter, staff assignment notes, conclusions related to understanding the client’s business, results of preliminary analytical procedures, assessments of audit risks, and determination of audit materiality. Many public accounting firms follow the practice of summarizing these data in a planning memorandum with specific directions about the impact on the audit.

Basically, the planning memo summarizes all important overall planning information and documents that the audit team is following generally accepted auditing standards. All planning becomes a basis for preparing the audit plan, which is a list of the audit procedures to be performed by the audit team to gather sufficient appropriate evidence on which to base the opinion on the financial statements. Auditing standards require a documented audit plan for each relevant assertion on the audit.

The planning documentation must include a listing of each significant account and disclosure in the client’s financial statement. According to the professional standards, if there is a chance the account could contain a misstatement that is material, it should be identified as significant. The documentation also must include a listing of each relevant financial statement assertion related to the significant accounts and disclosures. Accord- ing to the professional standards, if the assertion has “a reasonable possibility of contain- ing a misstatement that would cause the financial statements to be materially misstated,”* it must be categorized as relevant. Documentation of the significant accounts and disclo- sures, along with the relevant assertions, forms the basis of the current file documentation.

Audit documentation should be prepared in sufficient detail to provide a clear under- standing of its purpose, its source, and the overall conclusions reached near the end of the audit. The audit documentation communicates the quality of the audit, so it must be clear, concise, complete, neat, well indexed, and informative. Each workpaper must be com- plete in the sense that it can be removed from the audit documentation file and considered on its own with proper cross-references available to show how the document coordinates

Public Company Accounting Oversight Board. “AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements.” Accessed June 24, 2019. https://pcaobus.org/Standards/Auditing/Pages/AS2201.aspx.

First Pages

Chapter 3 Engagement Planning and Audit Evidence 105

lou6920x_ch03_078-116.indd 105 02/19/20 03:14 PM

with other audit documentation. In other words, the documentation must be sufficient to enable an experienced auditor, having no previous connection with the engagement, to understand (1) the nature, timing, extent, and results of procedures; (2) the overall conclusions reached with respect to the area covered by the audit documentation; and (3) the audit team member performing the work, the date of work, the audit team member reviewing the work, and the date of review. The audit documentation should also be suf- ficient to allow another auditor to reperform the work if necessary.

The most important facet of the current audit evidence documentation files is the requirement that they show the auditors’ conclusions. The documentation must record the management assertions that were audited, the evidence gathered about them, and final conclusions. Professional audit standards require the audit documentation show that (1) the client’s accounting records agree or reconcile with the financial statements, (2) the work was adequately planned and supervised, (3) a sufficient understanding of the client’s internal control was obtained, and (4) sufficient appropriate audit evidence was obtained as a reasonable basis for an audit opinion. Common sense also dictates that the audit documentation be sufficient to show that the financial statements conform to the relevant accounting framework and that the disclosures are adequate. The audit documen- tation also should explain how exceptions, unusual accounting questions, and findings contradictory to the audit team’s final conclusions were resolved or treated. In addition, the resolution of any differences among audit team members must be documented. Taken altogether, these features should demonstrate that all auditing standards were observed and executed.

Audit Documentation Arrangement and Indexing Each public accounting firm has a different method of arranging and indexing audit doc- umentation files. In general, however, the documentation is electronically hyperlinked and numbered in order behind the trial balance according to balance-sheet and income- statement captions. Usually, the current assets are numbered (or indexed) first, followed by fixed assets, other assets, liabilities, equities, income, and expense accounts. A lead schedule is a summary of the accounts or components in an account group. For cash, the lead schedule includes all of the company’s cash accounts. For inventory, the lead sched- ule may include inventory amounts by product line, cost of goods sold, and reserves for obsolescence. The amounts on the lead schedule should agree with prior-year numbers, the current-year general ledger amounts, and, after any adjustments, the audited finan- cial statements. To help better visualize, the typical arrangement is shown in writing in Exhibit 3.5.

Several audit documentation preparation techniques are quite important for the quality of the finished product. The points explained here are illustrated in Exhibit 3.6.

∙ Indexing. Each document (for example, each worksheet an Excel workbook) is given an index number, like a book page number, so it can be found, removed, and replaced without loss.

∙ Cross-referencing. Numbers or memoranda related to other documents carry the index of the other documents so the connections can be followed. Electronic documents will include hyperlinks to documents cross-referenced.

∙ Heading. Each document is titled with the name of the company, the balance-sheet date, and a descriptive title of the document’s contents.

∙ Signatures and initials. The auditor who performs the work and the supervisor who reviews it must sign the audit documentation so personnel can be identified.

∙ Dates of audit work. The dates of performance and review are recorded on the docu- ments so reviewers of the documentation can tell when the work was performed.

∙ Audit marks and explanations. Audit marks (or “tick marks”) are the auditor’s shorthand for abbreviating comments about work performed. Audit marks always must be accompanied by a full explanation of the auditing work. (Notice in

First Pages

106 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 106 02/19/20 03:14 PM

Exhibit 3.6 the auditor’s confirmation of the disputed account payable liability.) On electronic documents, comments can be hyperlinked so that reviewers can find additional explanations of audit procedures performed.

AS 1215 requires that audit documentation, including workpapers and other docu- ments that form the basis of the engagement, be retained for seven years following the conclusion of the engagement (usually the audit report release date). AS 1215 also stresses that audit documentation to be retained include those workpapers that document any discussions and subsequent resolution of differences in professional judgment among the audit team members. PCAOB regulations also require that all documentation be final- ized within 45 days of the audit report’s release date. With sufficient (documented) jus- tification, auditors may subsequently add, but may not remove, documentation after the 45-day period. Although the AS 1215 requirements are only for public companies, most public accounting firms use the same requirements for their nonpublic clients.

EXHIBIT 3.5 Current Audit Documentation File

Dunder-Mi�in Inc. Adjusting Entries

12/31/20

Cash Expenses

C-1Dunder-Mi�in Inc. Inventory Lead Schedule

12/31/20

B-1Dunder-Mi�in Inc. Accounts Receivable Lead Schedule

12/31/20

A-2-1Dunder-Mi�in Inc. Bank Confirmation—First National Bank

12/31/20

A-2Dunder-Mi�in Inc. Bank Reconciliation—1st National Bank

12/31/20

A-1

Ref Account Unaudited AJE Audited Balance

A-2 1st National $484,000 $484,000 $50,000

$486,000 $536,000$50,000

A-3 2nd National 2,000 52,000

Dunder-Mi�in Inc. Cash Lead Schedule

12/31/20

Other Lead Schedules

Supporting Schedules

TB-3

$50,000

Dr. Cr.

$50,000

TB-1

TB-1

Ref Account Unaudited AJE Audited Balance- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

A-1 Cash B-1 A/R C-1 Inventory

$486,000 $536,000$50,000

Dunder-Mi�in Inc. Working Trial Balance

12/31/20

- - - - - -- - - - - - - -

REVIEW CHECKPOINTS 3.17 What information would you expect to find in a permanent audit file? 3.18 What information would you expect to find in a current audit file? 3.19 What is considered the most important content of the auditor’s current audit documentation files? 3.20 What are the documentation retention requirements of AS 1215?

First Pages

Chapter 3 Engagement Planning and Audit Evidence 107

lou6920x_ch03_078-116.indd 107 02/19/20 03:14 PM

EXHIBIT 3.6 Illustrative Audit Documentation

DUNDER-MIFFLIN INC.

(12/31/20) General Account Reviewed

BANK RECONCILIATION—FIRST NATIONAL BANK

(Prepared by client)

Balance per bank statement

Deduct outstanding checks:

Balance per book

Deposit in transit as of 12/31/17

11/30/17 11/31/17 12/15/17 12/28/17 12/30/17 12/30/17 12/30/17 12/30/17

Add:

Prepared

A-2 Indexnumber

Company Name Initials of auditors and dates of work

- - - - - - - - -

Footed. Confirmed by bank standard back confirmation.

Vouched to cutoff bank statement, deposit recorded by bank on 1 3 18. Vouched to duplicate deposit slip validated 1 03 18.

Vouched to paid check cleared with cutoff bank statement. Vouched to statement from attorneys. Amount agrees. Amount in dispute per controller. Confirmation from supplier claims liability of $5,000. See

Note: Obtained cutoff bank statement 1 9 18

Date

842 1280 1372 1412 1417 1418 1419 1420

- - - - - No.

500 1,800 30,760 7,270 20,000 2,820 2,030 8,160 - - - - - - - -

506,100

51,240

557,340

- - - - - - - -

- - - - - - - -

Ace Supply Company Ace Supply Company Northwest Lumber Co. Gibson & Johnson First National payroll Ace Supply Company Windy City Utilities Howard Hardware Supply

- - - - - - - - - - - - - - - - - - - - - - - - - - - - Payee

A-1 A-2-2

A-2-1

K-4 for recommended adjustment.

“Tick mark” symbols

Arithmetic footed

Cross-reference to lead schedule

Cross-index to other workpapers

Explanations of audit work performed

73,340

484,000 - - - - - - - -

F.D. 1 10 21 JRA 1 10 21

This chapter contains a description of the specific set of planning activities that audi- tors undertake when completing an engagement. Pre-engagement activities start with the work of deciding whether to accept a new client and, on an annual basis, whether to continue the engagement for existing clients. Public accounting firms are not obligated to provide audit services to every company or organization that requests them, and they regularly exercise discretion when deciding which they choose to undertake. For audit engagements, the investigation may involve the cooperative task of communicating with the organization’s former (predecessor) auditors. In addition, firms need to make sure that they are in compliance with both independence and ethical requirements before deciding whether to accept a new client or continue with an existing client.

Summary

First Pages

108 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 108 02/19/20 03:14 PM

The audit plan is a comprehensive list of the specific audit procedures that the audit team needs to perform to gather sufficient appropriate evidence on which to base its opin- ion on the financial statements. Although risk assessment (discussed in Chapter 4) pro- vides the basis to determine the nature, timing, and extent of procedures to be performed at an audit client, many other aspects of audit planning are also discussed in this chapter. Other planning issues include properly staffing the audit, including using IT auditors, considering the work of audit specialists and using the work of internal auditors, and creating the time budget.

Because financial statement measurements and footnote disclosure information are not flawlessly accurate, auditors need to ultimately ensure that the financial statements are materially accurate and do not contain material misstatements. Information is mate- rial if it is likely to influence financial statement users’ decisions. As a result, the engage- ment team needs to think carefully about the appropriate level of materiality during the planning process. The auditor will then use this materiality as a guide to (1) plan and execute substantive testing procedures, (2) evaluate audit evidence, and (3) make final decisions about the auditor’s report.

Auditors then use a variety of procedures to gather evidence about management’s assertions related to the amounts and disclosures in a client’s financial statements. In general, auditors use eight different types of audit procedures to gather evidence: (1) inspection of records and documents (vouching, tracing, scanning), (2) inspection of tan- gible assets, (3) observation, (4) inquiry, (5) confirmation, (6) recalculation, (7) reperfor- mance, and (8) analytical procedures. One or more of these procedures may be used no matter what account balance, control procedure, class of transactions, or other informa- tion is under audit. Auditors must consider a number of factors when planning based on the audit client’s computing environment. And of course, the selection of procedures to be completed must always be tailored to the exacting nuances of the client’s computing environment. Finally, CAATs can improve both engagement effectiveness and efficiency and are used by auditors on most engagements.

The closing topic in this chapter is a brief overview of audit documentation with some basic pointers about their form, content, and overall purpose. At this stage in the audit process, we have accepted (or retained) the client, considered the types of audit proce- dures that might be performed to gather evidence, and thought about the impact of a cli- ent’s technological environment. The next step in the audit process is the assessment of inherent risk in both the financial statement account balances and footnote disclosures, which serves as the focus of the next chapter.

analytical procedures: Procedures that allow auditors to evaluate financial information by studying relationships among both financial and nonfinancial data. When used near the end of the audit, analytical procedures allow auditors to assess the conclusions reached during the audit and evaluate the overall financial statement presentation, 101 audit documentation: The written basis for the auditor’s conclusions that provides the necessary support for the auditor’s assertions and representations made in the auditor’s report, 103 audit engagement partner: The person with the final responsibility for the audit, usually an industry specialist, 86 audit plan: A comprehensive list of the specific audit procedures that the audit team needs to perform to gather sufficient appropriate evidence on which to base their opinion on the financial statements, 85 continuing audit files (or permanent files): The audit documentation containing information of continuing audit significance for current and past audits of the same client, 103 engagement letter: This letter sets forth the understanding with the client, including in particular (1) the objectives of the engagement, (2) management’s responsibilities, (3) the auditors’ responsibilities, and (4) any limitations of the engagement, 84

Key Terms

First Pages

Chapter 3 Engagement Planning and Audit Evidence 109

lou6920x_ch03_078-116.indd 109 02/19/20 03:14 PM

Form 8-K: The “current events” report filed periodically at the occurrence of major events, such as earnings releases, major asset sales, acquisitions, and auditor changes, 81 independence in appearance: The extent to which others (particularly financial statement users) perceive auditors to be independent, 83 independence in fact: Auditors’ mental attitude and impartiality with respect to the client, 83 interim audit work: The procedures performed several weeks or months before the balance- sheet date, 90 internal control audit plan: A plan that would contain a list of the specific procedures needed to obtain an understanding of the client’s internal control system and test that understanding for those controls that relate to the relevant financial statement assertions, 94 lead schedule: A summary of the accounts in or components of an account group, 105 materiality: An amount or event that has a substantial likelihood to influence financial statement users’ decisions. Thus, material information is a synonym for important information. The emphasis is on the financial statement users’ point of view, not on the auditors’ or managers’ points of view, 91 permanent files (or continuing audit files): The audit documentation containing information of continuing audit significance for current and past audits of the same client, 103 planning memorandum: The document summarizing the preliminary analytical procedures and the materiality assessment with specific directions about the effect on the audit, 104 predecessor auditor: The public accounting firm that has been terminated or has voluntarily withdrawn from an audit engagement (whether the audit has been completed or not), 81 quality assurance partner: The second audit partner on the audit team as required for audits of financial statements filed with the SEC who reviews the audit team’s work in critical audit areas (those areas with the highest potential audit risk), 87 specialists: The persons skilled in fields other than accounting and auditing—actuaries, appraisers, attorneys, engineers, and geologists—who are not members of the public accounting firm, 89 substantive audit plan: Document that contains a list of audit procedures for gathering evidence related to the relevant assertions identified for the significant financial statement accounts and disclosures on an audit client, 94 termination letter: The documentation provided to former clients dealing with the subject of future services, in particular (1) access to audit documentation by new auditors, (2) reissuance of the auditors’ report when required for SEC reporting or comparative financial reporting, and (3) fee arrangements for such future services. The termination letter also can contain a report of the auditor’s understanding of the circumstances of termination (e.g., disagreements about accounting principles and audit procedures, fees, or other conflicts), 85 tracing: An audit procedure in which the auditor selects a basic source document and follows its processing path forward to find its final recording in a summary journal or ledger. In practice, however, the term tracing may be used to describe following the path in either direction, 98 vouching: An audit procedure in which an auditor selects an item of financial information, usually from a journal or ledger, and follows its path back through the processing steps to its origin (i.e., the source documentation that supports the item selected), 98 year-end audit work: The procedures performed shortly before and after the balance-sheet date, 90

3.21 When initiating communications with predecessor auditors, prospective auditors should expect a. To take responsibility for obtaining the client’s consent for the predecessor to give infor-

mation about prior audits. b. To conduct interviews with the partner and manager in charge of the predecessor public

accounting firm’s engagement. c. To obtain copies of some or all of the predecessor auditors’ audit documentation. d. All of the above.

LO 3-1

All applicable questions are available with Connect.

Multiple-Choice Questions for Practice and Review

First Pages

110 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 110 02/19/20 03:14 PM

3.22 Generally accepted auditing standards require that auditors always prepare and use a. A written planning memorandum explaining the auditors’ understanding of the client’s

business. b. A written client consent to discuss audit matters with prospective auditors. c. A written audit plan. d. The written time budgets and schedules for performing each audit.

3.23 When planning an audit, which of the following is not a factor that affects auditors’ deci- sions about the quantity, type, and content of audit documentation? a. The auditors’ need to document compliance with generally accepted auditing standards. b. The auditors’ need to verify the existence of new sales contracts important for the client’s

business. c. The auditors’ judgment about their independence with regard to the client. d. The auditors’ judgments about materiality.

3.24 Audit documentation that shows the detailed evidence and procedures regarding the balance in the accumulated depreciation account for the year under audit will be found in the a. Current file audit documentation. b. Permanent file audit documentation. c. Administrative audit documentation in the current file. d. Planning memorandum in the current file.

3.25 An auditor’s permanent file audit documentation most likely will contain a. Internal control analysis for the current year. b. The most recent engagement letter. c. Memoranda of conference with management. d. Excerpts of the corporate charter and bylaws.

3.26 Which of the following is not a benefit claimed for the practice of determining materiality in the initial planning stage of an audit? a. Being able to fine-tune the audit work for effectiveness and efficiency. b. Avoiding the problem of doing more work than necessary (overauditing). c. Being able to decide early what type of audit opinion to issue. d. Avoiding the problem of doing too little work (underauditing).

3.27 Which of the following is an advantage of computer-assisted audit techniques (CAATs)? a. All the CAATs programs are written in one computer language. b. The software can be used for audits of clients that use differing computer equipment and

file formats. c. The use of CAATs has reduced the need for the auditor to study input controls for

computer-related procedures. d. The use of CAATs can be substituted for a relatively large part of the required testing.

3.28 An audit engagement letter should normally include which of the following matters of agree- ment between the auditor and the client? a. Schedules and analyses to be prepared by the client’s employees. b. Methods of statistical sampling the auditor will use. c. Specification of litigation in progress against the client. d. Client representations about availability of all minutes of meetings of the board of directors.

3.29 When auditing Vandalay Jewelry, Costanza, CPA, was not familiar with the quality and cut of the company’s precious jewel inventory. To address this shortcoming, Costanza hired Benes, an expert in jewel valuation, to assist as an audit specialist for the inventory valua- tion. Should Costanza refer to Benes’s work in the audit report? a. Yes, the auditors’ report should mention the fact that an audit specialist was used. b. The auditors’ report should mention the use of the audit specialist only when the audit

specialist’s findings affect the auditors’ conclusions.

LO 3-2

LO 3-2

LO 3-5

LO 3-5

LO 3-3

LO 3-4

LO 3-2

LO 3-2

First Pages

Chapter 3 Engagement Planning and Audit Evidence 111

lou6920x_ch03_078-116.indd 111 02/19/20 03:14 PM

c. The use of an audit specialist need not be mentioned if the auditors decide not to take responsibility for the audit specialist’s findings.

d. The auditors’ report should mention the audit specialist only if Vandalay agrees with the audit specialist’s findings.

3.30 Which of the following engagement planning procedures would most likely assist the audi- tor in identifying related-party transactions before the balance-sheet date? a. Interviewing internal auditors about their reporting responsibilities. b. Reviewing accounting records for recurring transactions occurring near year-end. c. Inspecting communications with the client’s legal counsel regarding recorded contingent

liabilities. d. Scanning the minutes for significant transactions with members of the board of

directors.

3.31 Which of the following communications is most likely to be written before the balance- sheet date? a. A report to the audit committee on the results of testing of internal control over cash

receipts. b. Confirmation letters to vendors confirming the amounts they owe to the client. c. An attorney’s letter regarding contingent liabilities. d. An engagement letter.

3.32 Which of the following procedures would most likely be performed during planning? a. Surprise counting of the client’s petty cash fund. b. Reporting internal control deficiencies to the audit committee. c. Performing a search for unrecorded liabilities. d. Identifying related parties.

3.33 Prior to accepting a new audit engagement, a public accounting firm should a. Attempt to contact the predecessor auditors. b. Evaluate the integrity of management. c. Assess the firm’s resources to ensure that they are sufficient to permit the firm to accept

the engagement. d. All of the above.

3.34 An audit plan contains a. Specifications of audit standards relevant to the financial statements being audited. b. Specifications of procedures the auditors believe appropriate for the financial statements

under audit. c. Documentation of the assertions under audit, the evidence obtained, and the conclusions

reached. d. Reconciliation of the account balances in the financial statements with the account bal-

ances in the client’s general ledger.

3.35 The revenue cycle of a company generally includes which accounts? a. Inventory, accounts payable, and general expenses. b. Inventory, general expenses, and payroll. c. Cash, accounts receivable, and sales. d. Cash, notes payable, and capital stock.

3.36 When auditing the existence assertion for an asset, auditors proceed from the a. Financial statement amounts back to the potentially unrecorded items. b. Potentially unrecorded items forward to the financial statement amounts. c. General ledger back to the supporting original transaction documents. d. Supporting original transaction documents to the general ledger.

LO 3-2

LO 3-2

LO 3-2

LO 3-1

LO 3-2

LO 3-4

LO 3-4

First Pages

112 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 112 02/19/20 03:14 PM

3.37 Confirmations of accounts receivable provide evidence primarily about which two assertions? a. Completeness and valuation. b. Valuation and rights and obligations. c. Existence and rights and obligations. d. Existence and completeness.

3.38 With respect to the concept of materiality, which of the following statements is correct? a. Materiality depends only on the dollar amount of an item relative to other items in the

financial statements. b. Materiality depends on the nature of a transaction rather than the dollar amount of the

transaction. c. Materiality is determined by reference to AICPA guidelines. d. Materiality is a matter of professional judgment.

3.39 When evaluating whether accounting estimates made by management are reasonable, the audit team would be most concerned about which of the following? a. Key factors that are consistent with prior periods. b. Assumptions that are similar to industry guidelines. c. Measurements that are objective and not susceptible to bias. d. Evidence of a conservative systematic bias.

3.40 Which of the following would be considered an analytical procedure? a. Testing purchasing, shipping, and receiving cutoff activities. b. Comparing inventory balances to recent sales activities. c. Projecting the deviation rate of a statistical sample to the population. d. Reconciling physical counts to perpetual records and general ledger balances.

(AICPA adapted)

3.41 Which of the following procedures would a CPA most likely perform in planning a financial statement audit? a. Make inquiries of the client’s lawyer concerning pending litigation. b. Perform cutoff tests of cash receipts and disbursements. c. Compare financial information with nonfinancial operating data. d. Recalculate the prior-years’ accruals and deferrals.

(AICPA adapted)

3.42 Which of the following statements is correct concerning analytical procedures used in plan- ning an audit engagement? a. They often replace the tests of controls that are performed to assess control risk. b. They typically use financial and nonfinancial data aggregated at a high level. c. They usually involve the comparison of assertions developed by management to ratios

calculated by an auditor. d. They are often used to develop an auditor’s preliminary judgment about materiality.

(AICPA adapted)

3.43 The company being audited has an internal auditor who is both competent and objective. The independent auditor wants to assign tasks for the internal auditor to perform. Under these circumstances, the independent auditor may a. Allow the internal auditor to perform certain tests of internal controls. b. Allow the internal auditor to audit a major subsidiary of the company. c. Not assign any task to the internal auditor because of the internal auditor’s lack of

independence. d. Allow the internal auditor to perform analytical procedures but not be involved with any

tests of details. (AICPA adapted)

LO 3-4

LO 3-3

LO 3-4

LO 3-4

LO 3-2

LO 3-4

LO 3-2

First Pages

Chapter 3 Engagement Planning and Audit Evidence 113

lou6920x_ch03_078-116.indd 113 02/19/20 03:14 PM

3.44 Which of the following conditions most likely would pose the greatest risk in accepting a new audit engagement? a. Staff will need to be rescheduled to cover this new client. b. There will be a client-imposed scope limitation. c. The firm will have to hire a specialist in one audit area. d. The client’s financial reporting system has been in place for 10 years.

(AICPA adapted)

LO 3-1

3.45 General Audit Procedures and Financial Statement Assertions. The eight general audit procedures produce evidence about the principal management assertions in financial state- ments. However, some procedures are useful for producing evidence about certain asser- tions, and other procedures are useful for producing evidence about other assertions. The assertion being audited can influence the auditors’ choice of procedures.

Required: Opposite each general audit procedure, write the management assertions best tested by using each procedure.

Audit Procedures PCAOB Assertions ASB Assertions

a. Inspection of records or documents (vouching)    

b. Inspection of records or documents (tracing)    

c. Inspection of records or documents (scanning)    

d. Inspection of tangible assets    

e. Observation    

f. Confirmation    

g. Inquiry    

h. Recalculation    

i. Reperformance    

j. Analytical procedures    

3.46 Audit Procedures. Auditors use different types of audit procedures to gather the evidence necessary to conclude that the risk of material misstatement for each relevant assertion has been reduced to an acceptably low level. List eight different types of procedures auditors can use during an audit of financial statements and give an example of each.

3.47 Confirmation Procedure. A CPA accumulates various types of evidence on which to base the opinion on financial statements. Among this evidence is confirmations from third parties.

Required: a. What is an audit confirmation? b. What characteristics of the confirmation process and the recipient are important if a CPA

is to consider the confirmation evidence appropriate?

3.48 Potential Audit Procedure Failures. For each of the general audit procedures of (a) recal- culation, (b) observation, (c) confirmation (accounts receivable, securities, or other assets), (d) inquiry, (e) inspection of internal documents, (f) recalculation, (g) reperformance, and (h) analytical procedures, discuss one way the procedure could be misapplied or the auditors could be misled in such a way as to render the work (audit evidence) misleading or irrel- evant. Give examples that are different from the examples in the chapter.

LO 3-4

LO 3-4

LO 3-4

All applicable Exercises and Problems are available with Connect.

Exercises and Problems

LO 3-4

First Pages

114 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 114 02/19/20 03:14 PM

3.49 Audit Documentation. The preparation of audit documentation is an integral part of an auditor’s examination of financial statements. On a recurring engagement, auditors review the audit plans and audit documentation from the prior audit while planning the current audit to determine their usefulness for the current-year work.

Required: a. (1) What are the purposes or functions of audit documentation? (2) What records may be included in audit documentation? b. What factors affect the auditors’ judgment of the type and content of the audit documen-

tation for a particular engagement? c. What should be included in audit documentation to support auditors’ compliance with

generally accepted auditing standards? d. How can auditors make the most effective use of the prior-year audit plans in a recurring

audit? (AICPA adapted)

3.50 Communications between Predecessor and Successor Auditors. Assume that Smith & Smith, CPAs, audited Apollo Shoes Inc., last year. Now CEO Larry Lancaster wishes to engage Anderson, Olds, and Watershed, CPAs (AOW) to audit its annual financial state- ments. Lancaster is generally pleased with the services provided by Smith & Smith, but he thinks the audit work was too detailed and interfered excessively with normal office routines. AOW has asked Lancaster to inform Smith & Smith of the decision to change audi- tors, but he does not wish to do so.

Required: List and discuss the steps AOW should follow with regard to dealing with a predecessor auditor and a new client before accepting the engagement.

3.51 Predecessor and Successor Auditors. The president of Allpurpose Loan Company had a genuine dislike for external auditors. Almost any conflict generated a towering rage. Conse- quently, the company changed auditors often. The firm of Wells & Ratley (W&R), CPAs, was recently hired to audit the 2020 financial statements. W&R succeeded the firm of Canby & Company (C&C), which had obtained the audit after Albrecht & Hubbard (A&H) had been fired. A&H audited the 2019 financial statements and rendered a report that contained an additional paragraph explaining an uncer- tainty about Allpurpose Loan Company’s loan loss reserve. Goodbye A&H! The president then hired C&C to audit the 2020 financial statements, and Chris Canby started the work, but before the audit could be completed, Canby was fired and W&R was hired to complete the audit. C&C did not issue an audit report because the audit was not finished.

Required: Does the Wells & Ratley firm need to initiate communications with Canby & Company? With Albrecht & Hubbard? With both? Explain your response in terms of the purposes of communications between predecessor and successor auditors.

3.52 Client Selection. You are a CPA in a regional public accounting firm that has 10 offices in three states. Mr. Shine has approached you with a request for an audit. He is president of Hitech Software and Games Inc., a five-year-old company that has recently grown to $500 million in sales and $200 million in total assets. Shine is thinking about going public with a $25 million issue of common stock, of which $10 million would be a secondary issue of shares he holds. You are very happy about this opportunity because you know Shine is the new president of the Symphony Society board and has made quite a civic impression since he came to your medium-size city seven years ago. Hitech is one of the growing employers in the city.

Required: a. Discuss the sources of information and the types of inquiries that you and the firm’s part-

ners may make in connection with accepting Hitech as a new client. b. Do professional audit standards require any investigation of prospective clients? c. Suppose Shine also told you that 10 years ago his closely held hamburger franchise busi-

ness went bankrupt, and on investigation, you learn from its former auditors (your own

LO 3-5

LO 3-1

LO 3-1

LO 3-1

First Pages

Chapter 3 Engagement Planning and Audit Evidence 115

lou6920x_ch03_078-116.indd 115 02/19/20 03:14 PM

firm in another city) that Shine was fraudulent in its application of franchise-fee income recognition rules and presented such difficulties that your firm resigned from the audit (before the bankruptcy). Do you think the partner in charge of the audit practice should accept Hitech as a new client?

3.53 Using the Work of Internal Auditors. North, CPA, is planning an independent audit of the financial statements of General Company. In determining the nature, timing, and extent of the audit procedures, North is considering General’s internal audit function, which is staffed by Tyler.

Required: a. In what ways can the internal auditor’s work be relevant to North, the independent

auditor? b. What factors should North consider, and what inquiries should North make in deciding

whether to use Tyler’s internal audit work? (AICPA adapted)

3.54 Using the Computer to Discover Intentional Financial Misstatements in Transactions and Account Balances. AMI International is a large office products company. Headquarters management imposed pressure on operating division managers to meet profit forecasts. The division managers met these profit goals using several accounting manipulations involving the record-keeping system that maintained all transactions and account balances on com- puter files. Employees who operated the computer accounting system were aware of the modifications of policy the managers ordered to accomplish the financial statement manipu- lations. The management and employees carried out these activities: 1. Deferred inventory write-downs for obsolete and damaged goods. 2. Kept open the sales entry system after the quarterly and annual cutoff dates, recording

sales of goods shipped after the cutoff dates. 3. Recorded as sales transactions that had been coded as leases of office equipment. 4. Recorded shipments to branch offices as sales. 5. Postponed recording vendors’ invoices for parts and services until later, but the actual

invoice date was faithfully entered according to accounting policy.

Required: Describe one or more procedures that could be performed with CAATs to detect signs of each of these transaction manipulations. Limit your answer to the actual work accomplished by the computer software.

3.55 Inspection of Documents and Records. A large portion of audit evidence is gathered through inspection of documents and records. External documents, documents that are gen- erated outside of the organization, provide more reliable evidence than documents generated and maintained at the client.

Required: a. For each of the documents below, indicate if the document is a strictly external document

(obtained from an external party), an external-internal document (generated outside of the organization but given to the auditor by the client), or an internal document (gener- ated and maintained by client). 1. Receiving report. 2. Customer purchase order. 3. Bank statements received directly from the bank. 4. Copies of sales invoices. 5. Utility bill. 6. Departmental budget. 7. Insurance policy. 8. Remittance advice.

b. Why are external documents considered more reliable evidence than internal documents? What aspects of internal documents would help to increase their reliability?

LO 3-2

LO 3-4

LO 3-4

First Pages

116 Part Two The Financial Statement Audit

lou6920x_ch03_078-116.indd 116 02/19/20 03:14 PM

3.56 Audit Documentation - Permanent or Current Year Files. Audit documentation can be clas- sified in two categories: (1) permanent files (which contain information that is relevant for many years’ audits for the client) and (2) current files (which contain information that is relevant to supporting the current year’s audit).

Required: For each of the documents listed below, indicate whether they would appear in the perma- nent or current year files.

1. Audit planning memorandum 2. Client organizational chart 3. Prior years’ financial statements and audit reports 4. Engagement letter 5. Bank confirmations 6. Schedule for current year depreciation calculation 7. Royalty agreements

3.57 Pre-engagement activities - Client acceptance policies and procedures generally include obtaining and reviewing financial information from prospective clients.

Required: Your firm is considering accepting Apple Inc. as a new audit client. You are helping to per- form client acceptance procedures by reviewing prior financial information. Go to the sec. gov website and search for Apple Inc.’s most recent 10-K filing. Read through the Item 1, Business, and Item 1A, Risk Factors, sections. What characteristics are red flags for poten- tial problems? What characteristics would make Apple a desirable client?

LO 3-5

LO 3-1

Apollo Shoes Audit Planning Part Two You are a recently promoted senior (in charge) auditor for Anderson, Olds, and Water- shed and have been assigned to the engagement team of a new client, Apollo Shoes Inc. You have been asked to begin the planning process for the audit. This includes making decisions about the use of audit resources and further familiarizing yourself with the engagement and the client. Detailed instructions regarding the information needed, as well as other procedures you need to perform in this planning phase of the audit, can be found in Connect.

First Pages

117

lou6920X_ch04_117-171.indd 117 02/29/20 06:35 PM

LEARNING OBJECTIVES The professional standards emphasize the importance of an auditor’s identification and assessment of the risks of material misstatement that exist related to an audit client. Once each of the risks is identified and assessed, the auditor needs to plan an appropriate response. Given the importance of risk assessment,

it is not surprising that the professional standards state that the risk assessment process underlies the entire audit process. In Chapter 3, we covered the engagement planning process, beginning with pre- engagement activities, supervision, and materiality. In this chapter, we provide comprehensive coverage of an auditor’s risk assessment and its impact on the audit process.

Risk comes from not knowing what you’re doing.

Warren Buffett.

Profit is the result of risks wisely selected.

Frederick Barnard Hawley.

The Audit Risk Model and Inherent Risk Assessment

C H A P T E R 4

Professional Standards References

Topic AU-C/ISA Section AS Section

Consideration of Fraud in a Financial Statement Audit 240 2401

Consideration of Laws and Regulations 250 2405

Communications with Audit Committees 260 1301

Audit Planning 300 2101

Identifying and Assessing the Risks of Material Misstatement 315 2110

Materiality 320 2105

Auditors’ Responses to Risks of Material Misstatement 330 2301

Audit Evidence 500 1105

Substantive Analytical Procedures 520 2305

Related Parties 550 2410

First Pages

lou6920X_ch04_117-171.indd 118 02/29/20 06:35 PM

118 Part Two The Financial Statement Audit

Your objectives are to be able to:

LO 4-1 Define audit risk and describe how it can be broken down into the three separate compo- nents of the audit risk model to help assess and respond to such risks during the audit planning process.

LO 4-2 Explain auditors’ responsibility for fraud risk assessment and define and explain the differences among several types of fraud and errors that might occur in an organization.

LO 4-3 Explain an auditor’s responsibility to assess inherent risk, including a description of the type of risk assessment procedures that should be performed

when assessing inherent risk on an audit engagement.

LO 4-4 Understand the different sources of information and the audit procedures used by auditors when assessing risks, including analytical procedures, brainstorming, and inquiries.

LO 4-5 Explain how auditors complete and document the overall assessment of inherent risk.

LO 4-6 Explain auditors’ responsibilities with respect to a client’s failure to comply with laws or regulations.

LO 4-7 Describe the content and purpose of an audit strategy memorandum.

INTRODUCTION In October 2015, the PCAOB released a report titled “Inspection Observations Related to PCAOB “Risk Assessment” Auditing Standards,” where they provide information based on their 2012–2014 inspections regarding how well firms were following the risk assessment standards.1 According to the report, firms were not doing too good of a job. In  26% of the audits inspected in 2012 and 27% inspected in 2013, the PCAOB found firms had not complied with one or more of the risk assessment standards. Consistent with that trend, preliminary results from the 2014 inspections indicated that the percent- age still remained high. One of the more common issues noted was that firms did not perform appropriate tests in response to fraud and other risks identified.

Fast-forward to November 2017. The PCAOB released their Staff Inspection Brief, with a preview of observations from the 2016 PCAOB inspections.2 The brief highlights three “key” areas with the most observed audit deficiencies. The first key area mentioned in the brief is “assessing and responding to risks of material misstatement.”

Risk assessment is the foundation of the audit process. It is the auditor’s risk assess- ment that should drive what audit procedures to perform in order for the auditor to obtain reasonable assurance that the financial statements are free of material misstatement. Improper risk assessment can lead to improper audit responses which, in turn, can lead to audit failure. Proper risk assessments yet failure to respond to those assessments can also lead to audit failure. Given the importance of risk, why do auditors continue to struggle with the assessment and response to risk? One reason may be the difficulty and great level of care required by the auditor to simply assess risk, let alone to craft the proper audit response to that risk. In this chapter, we will describe how auditors identify, assess, and then properly respond to the risks of material misstatement that exist at their audit clients.

AUDIT RISK Audit Risk Audit risk is the probability that an audit team will express an inappropriate audit opinion when the financial statements are materially misstated (i.e., give an unmodified opinion on financial statements that are misleading because of material misstatements that the auditors failed to discover). Such a risk always exists, even when audits are well planned

1PCAOB Release No. 2015-007, “Inspection Observations Related to PCAOB “Risk Assessment” Auditing Standards (No. 8 through No. 15),” PCAOB, October 15, 2015 2“Staff Inspection Brief Vol. 2017/4,” PCAOB, November 2017

LO 4-1 Define audit risk and describe how it can be broken down into the three separate components of the audit risk model to help assess and respond to such risks during the audit planning process.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 119

lou6920X_ch04_117-171.indd 119 02/29/20 06:35 PM

and carefully performed. Of course, the risk is much higher in poorly planned and care- lessly performed audits. The auditing profession has no official standard for an acceptable level of overall audit risk except that it should be “appropriately” low. In practice, audit risk is evaluated at both the overall financial statement level (as a whole) and for each sig- nificant account and disclosure through a focus on the relevant assertions identified. A significant account or disclosure is an account or disclosure that has a reasonable possibility of containing a material misstatement regardless of the effect of internal controls. A rel- evant assertion is a management assertion that has a reasonable possibility of containing a material misstatement without regard to the effect of internal controls. The concern an auditor has regarding any particular assertion depends on the significant account that the auditor is testing (or to which the assertion relates). For example, an auditor may deem the occurrence assertion to present more risk when testing revenue than the completeness assertion presents. Most companies want to report a healthy stream of revenue, so it is unlikely that they will omit sales that would violate the completeness assertion. It is more likely that a company reports sales that did not occur to present more revenue, which would violate the occurrence assertion.

To help better understand and ultimately mitigate audit risk, the professional standards break down overall audit risk (see Exhibit 4.1) into the risks (1) that a material misstatement will even occur (inherent risk), (2) that it would not be prevented or detected by client internal controls (control risk), and (3) that is not detected by the auditor’s own procedures (detection risk). Because inherent risk and control risk are related to the company and its overall envi- ronment, these two components are combined into the risk of material misstatement (RMM), which is the risk a material misstatement exists in the financial statements before auditors apply their own procedures. Each of these components is now discussed in detail.

Obtain (or Retain)

Engagement

Engagement Planning

Risk Assessment

Substantive Procedures Reporting

STAGES OF AN AUDIT

Inherent Risk Inherent risk is the probability that, in the absence of internal controls, material errors or frauds could enter the accounting system used to develop financial statements. You can think of inherent risk as the susceptibility of the account to misstatement. Inherent

EXHIBIT 4.1 Inherent, Control, and Detection Risk

Events, Transactions

Financial Statements

Internal Controls

Accounting Information

System Audit Procedures

AUDIT RISK The likelihood that an

error or fraud will occur and not be caught by either internal controls or auditor’s procedures

DETECTION RISK The likelihood that an

error or fraud will not be caught by the auditor’s

procedures

CONTROL RISK The likelihood that an

error or fraud will not be prevented or detected by the client’s internal

controls

INHERENT RISK The likelihood that an

error or fraud will enter the accounting

information system

RISK OF MATERIAL MISSTATEMENT

First Pages

lou6920X_ch04_117-171.indd 120 02/29/20 06:35 PM

120 Part Two The Financial Statement Audit

risk is a function of the nature of the client’s business and strategy to achieve competi- tive advantage, the major types of transactions, and the effectiveness and integrity of its managers and accountants. It is important to understand that for different accounts, various assertions are riskier than others. For cash, existence is riskier than completeness because it is more likely that a client would try to include more cash than it really had on its balance sheet rather than less; and for accounts payable, completeness is riskier than existence because it is more likely that a client would try to understate what it really owed rather than overstate the amount. As a result, auditors focus their attention on relevant assertions. Finally, it is important for students to remember that auditors do not create or control inherent risk. They can only try to assess its magnitude in an appropriate manner. This will be discussed in more detail later in the chapter.

Control Risk Control risk is the probability that the client’s internal control activities will fail to prevent or detect material misstatements provided that such misstatements enter or would have entered the accounting system in the first place. So, for misstatements that could occur, what is the audit client doing about such occurrences? Does it have the proper systems, processes, and controls in place to either prevent or detect misstatements? Recall from our discussion of auditing standards in Chapter 2 that one of the major purposes of an internal control system is to ensure appropriate processing and recording of transactions for the production of reliable financial statements. Similar to inherent risk, auditors do not create or manage control risk. They can only evaluate an entity’s internal control system and assess its magnitude in an appropriate manner.

External auditors’ task of control risk assessment begins with learning about an entity’s internal controls that are designed to prevent and detect material misstatements related to each relevant assertion for each significant account and disclosure. The auditors then perform tests of controls if appropriate to determine whether they are operating effectively. This process is discussed in detail in Chapter 5.

Detection Risk Detection risk is the probability that the auditor’s own procedures will fail to detect material misstatements provided that any have entered the accounting system in the first place and have not been prevented or detected and corrected by the client’s internal controls. In contrast to inherent risk and control risk, auditors are responsible for performing the evidence-gathering procedures that manage and establish detection risk. These audit procedures represent the auditors’ opportunity to detect material misstatements that may exist in the financial statements. In other words, unlike inherent risk and control risk, auditors can and do influence the level of detection risk.

In Chapter 3, you learned about substantive procedures, the procedures used to detect material misstatements that may exist in the significant account balances and disclosures presented in the financial statements and footnotes. The two categories of substantive procedures are (1) tests of details of transactions and balances, which provide specific evidence directly supporting assertions; and (2) substantive analytical procedures, which study plausible relationships among financial and nonfinancial data. Auditors are able to reduce detection risk by completing more and stronger substantive tests. Generally speak- ing, in response to a higher assessed risk of material misstatement for a relevant assertion being audited, auditors must reduce detection risk to an appropriate level by planning appropriate substantive procedures. This relationship is now further illustrated with a discussion of the audit risk model.

Audit Risk Model The three components of audit risk can be expressed in a conceptual model that is designed to help auditors understand how the assessment of each component affects the overall audit risk being faced on the engagement. It is important to stress that the

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 121

lou6920X_ch04_117-171.indd 121 02/29/20 06:35 PM

following discussion is conceptual in nature. It is also important to point out that the audit risk model assumes that each of the elements is independent. Thus, the risks can be expressed in a model form as follows:

Audit risk (AR) = Inherent risk (IR) × Control risk (CR) × Detection risk (DR) Assume that auditors want to perform an audit of a particular assertion or disclosure

well enough to hold the AR to a relatively low level (e.g., 0.05, which means that, on average, 5 percent of audit opinions would be wrong). For example, suppose that an audit team thought valuation of a particular inventory balance was subject to great inherent risk (say, IR = 0.90) and that the client’s internal control was not very effective (say, CR = 0.50). Thus, RMM would be 0.45 (0.90 × 0.50). If auditors wanted to keep audit risk at a low level (say, AR = 0.05), according to the model, this example would produce the following results:

AR = IR X CR X DR 0.05 = 0.90 X 0.50 X DR

Solving for DR: DR = 0.111 (rounded to 0.11)

Set Desired Level of

Audit Risk Assess

Inherent Risk

Assess Control Risk

Solve for Detection Risk

1 2 3 4

[0.05] [0.90] [0.50] [0.11]

You should notice that the assessment of inherent risk (IR) and control risk (CR) led to a determination of detection risk (DR). As a result, detection risk depends on and is planned for based on the assessment of the other risk factors. DR is calculated and derived from the others by solving the risk model equation. It is not an independent judg- ment. Hence,

DR = AR/(IR × CR) DR = 0.11 = 0.05/(0.90 × 0.50)

While detection risk is defined as the risk that the auditors’ procedures fail to detect material misstatements, it is important that you understand that the application of DR is different. The 11 percent represents the amount of risk the auditors can allow and still maintain overall audit risk at 0.05. Conceptually then, auditors must design procedures so that DR will not exceed 0.11 (approximately). Exhibit 4.2 provides a visual display of the steps in the audit risk process.

LOW or very low

set assess

Risk of Material Misstatement (RMM)

assess calculate

AR= IR× CR× DR HIGH if material misstatement is likely to enter the accounting information system

HIGH if material misstatement is not likely to be detected by client’s internal controls

What is the acceptable level of detection risk? HIGH means we can a�ord less e�ective testing, and LOW means we need more e�ective testing.

EXHIBIT 4.2 Audit Risk Model

First Pages

lou6920X_ch04_117-171.indd 122 02/29/20 06:35 PM

122 Part Two The Financial Statement Audit

Based on the allowable or planned level of detection risk (which is always based on the assessment of IR and CR), auditors modify the nature, the timing, and the extent of further audit procedures. The nature of an audit procedure refers to the type of proce- dure (e.g., observation, recalculation, inquiry) and the purpose of the procedure (e.g., test of controls, substantive procedure). When determining the nature of the audit pro- cedure, the auditor is considering what to do. When doing so, the auditor considers the overall effectiveness of different types of audit procedures in detecting misstatements. While inquiry of management about whether accounts receivable listed on the balance sheet really exist is an audit procedure, it would not be an effective one. A much more effective procedure would be to confirm accounts receivable directly with the client’s customers. Timing refers to when the audit procedures will be completed. To do so, the auditor typically considers whether to complete the procedures at an interim date or at the balance sheet date. While confirmation of accounts receivable may be performed at an interim date, auditors are expressing an opinion on year-end balances. The closer the procedures are performed to year-end (the balance sheet date), the more effective they are because there is less chance of a material misstatement occurring between the interim confirmation date and year-end. Finally, extent refers to the number of tests performed. Clearly, the larger the number of accounts receivable confirmations that are mailed to customers, the greater the chance of finding errors and fraud, and therefore, the lower the detection risk.

Note that there is an inverse relationship between RMM (i.e., inherent risk and con- trol risk) and detection risk. In other words, the greater the risk of material misstate- ment, the lower the detection risk that auditors could allow in order to maintain the level of audit risk with which they feel comfortable. This makes sense. If the relevant assertion is risky or the related controls are poor, auditors would want to reduce detec- tion risk by modifying the nature, timing, and extent of further procedures to increase their effectiveness. On the other hand, if the account is not risky and controls are strong, the auditor could employ less effective (and presumably less costly) substantive audit procedures.

The practical problem here is knowing whether the audit has been planned and per- formed well enough to limit the detection risk to as low as 0.11. Remember that the audit risk model is only a conceptual tool. Auditors cannot calculate the exact level of DR (or, for that matter, IR or CR), so the model represents more of a way to think about audit risks than a way to calculate them. However, the AICPA Audit Sampling Guide does use this model to calculate risks and the related sample sizes:

The Impact of Detection Risk Allowed on the Nature, Timing, and Extent of Further Audit Procedures

  Lower Detection Risk Allowed Higher Detection Risk Allowed

Nature More effective tests Less effective tests Timing Testing performed at year-end Testing can be performed at interim Extent More tests Fewer tests

The conceptual model does allow for some additional key insights, including these:

1. Auditors cannot estimate inherent risk to be zero and omit other evidence-gathering procedures.

2. Auditors cannot place complete reliance on internal controls (that is, CR = 0) to the exclusion of other audit procedures.

3. Auditors would not seem to exhibit due professional care if the level of audit risk was too high.

4. Although permissible, audit teams rarely choose to rely exclusively on evidence pro- duced by substantive procedures. Even if they think that control risk is high, auditors often perform some tests of controls to make sure the controls are in place.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 123

lou6920X_ch04_117-171.indd 123 02/29/20 06:35 PM

Up to this point, the components of the audit risk model have been expressed quanti- tatively (as numbers). In practice, largely all firms use qualitative measures of audit risk such as “low,” “moderate,” and “high.” In fact, it is not likely that you will ever “solve” for AR on your audit engagement. Yet whether expressed quantitatively or qualitatively, audit theory places both inherent risk and control risk on a probability continuum. Consider the following illustration for control risk (Exhibit 4.3) where qualitative control risk categories are expressed in terms of representative control risk probabilities.

Control Risk Categories (Qualitative) Representative Control Risk Probabilities (Quantitative)

Low control risk 0.10–0.45 Moderate control risk 0.40–0.70 Control risk slightly below the maximum 0.60–0.95 Maximum control risk 1.00

EXHIBIT 4.3 Qualitative and Quantitative Control Risk

REVIEW CHECKPOINTS 4.1 Define audit risk. 4.2 What are the components of the risk of material misstatement (RMM)? What are the components of

the audit risk model? 4.3 How is the audit risk model used to plan the audit? 4.4 What is meant by the terms nature, timing, and extent of further audit procedures?

EXHIBIT 4.4 Matrix Approach to Detection Risk (DR) Determination HighModerate

Control Risk (CR)

DR—High

DR—Moderate to High

DR—Moderate to High

DR—Moderate

DR—Moderate

DR—Moderate

DR—Low to Moderate

DR—Low to Moderate

DR—Low

Low

Low

Moderate

High

Inherent Risk (IR)

When risk is measured qualitatively, how do firms solve an equation to determine the appropriate level of detection risk? The simple answer is they do not. Rather, firms typi- cally use a matrix approach similar to the one shown in Exhibit 4.4. Auditors find the appropriate detection risk by reading the cell at the intersection of the assessed levels of inherent risk and control risk.

First Pages

lou6920X_ch04_117-171.indd 124 02/29/20 06:35 PM

124 Part Two The Financial Statement Audit

FRAUD RISK In the next section we will discuss the process auditors use to assess inherent risk. Prior to assessing inherent risk, it is important to understand fraud risk and the role it plays in the assessment of risk of material misstatement. You probably noticed that in our previous discussion of the audit risk model, there is no specific mention of fraud risk. While fraud risk is not a specific part of the audit risk model, fraud risk can never be ignored and does have an impact on the risk of material misstatement (that is, inherent risk and control risk) assessments. Auditors are required to consider fraud risk on each audit engagement for each relevant assertion related to each significant account and disclosure identified for an audit client. In effect, fraud risk is a special case of risk of material misstatement related to those situations where management intended to mislead the marketplace by issuing fraudulent financial statements.

When applying the audit risk model and assessing the risk of material misstate- ment, the auditor must always remember that a misstatement in the financial statements may be caused by an error or a fraud. What makes fraud different from errors is intent. Specifically, did a manager at the client intend to commit a fraud? Or, was the misstate- ment due to an error made by an employee? Because of the damage to the capital markets caused by fraudsters who have intentionally misstated their financial statements, and the difficulty of discovering misstatements that management is actively trying to hide, auditors must give separate and careful attention to fraud risk on every audit engagement. The  following Auditing Insight identifies a number of infamous CEO fraudsters.

LO 4-2 Explain auditors’ responsibility for fraud risk assessment and define and explain the differences among several types of fraud and errors that might occur in an organization.

When CEOs Go Bad* AUDITING INSIGHT

Perpetrator (age at trial) Company Verdict Punishment

Bernie Ebbers (63) WorldCom Found guilty on fraud and conspiracy charges related to an $11 billion accounting scandal.

Sentenced to 25 years in federal prison.

Walter Forbes (64) Cendant Found guilty of conspiracy to commit securities fraud and two counts of making false statements.

Sentenced to more than 12 years in prison; ordered to pay $3.3 billion in restitution.

Dennis Kozlowski (59) Tyco International Found guilty of stealing $600 million from the company.

Served a total of 6.5 years in a New York state prison.

Sanjay Kumar (44) Computer Associates 28 International Inc. (CA)

Pleaded guilty to obstruction of justice and securities fraud charges related to CA’s $3.3 billion accounting scandal.

Fined $8 million, sentenced to 12 years in prison, and ordered to pay $798.6 mil- lion in restitution.

Ken Lay (64) Enron Found guilty of securities fraud and related charges.

Suffered a massive coronary and passed away while awaiting sentencing.

Bernie Madoff (71) Madoff Investment Securities

Pleaded guilty to securities fraud, money laundering, filing false statements with the SEC, wire fraud, mail fraud, and sev- eral other charges.

Sentenced to 150 years in prison.

Angelo R. Mozilo (72) Countrywide Financial Settled with the SEC over securities fraud and insider trading charges.

Agreed to pay $67.5 million in fines and accepted a lifetime ban from serving as an officer or director of any public company.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 125

lou6920X_ch04_117-171.indd 125 02/29/20 06:35 PM

Perpetrator (age at trial) Company Verdict Punishment

Nathan Hardwick IV (53) LandCastle Title Found guilty on 21 counts of wire fraud, one count of conspiracy to commit wire fraud, and one count of making false statements to a federally insured finan- cial institution.

Sentenced to serve 15 years in prison.

Richard Scrushy (52) HealthSouth Was acquitted of 36 criminal conspiracy charges related to the fraud but was later found guilty of other bribery, con- spiracy, and mail fraud charges.

Settled civil charges with the SEC for $81 million; also in 2009, judge ruled that Scrushy was responsible for Health- South’s fraud and ordered him to pay $2.87 billion. Served almost 5 years in federal prison.

Jeffrey Skilling (52) Enron Found guilty of securities fraud and related charges.

Originally sentenced to 24 years in prison; after many challenges to the punishment, in 2013 the sentence was reduced to 14 years. Released in August 2018 after serving 11 years.

Calisto Tanzi (70) Parmalat Found guilty of securities laws violations related to his company’s 2003 collapse amid a giant financial fraud.

Currently serving a 17-year prison sentence.

Elizabeth Holmes (34) Theranos Settled fraud charges with the SEC. As of January 2020, awaiting criminal trial for wire fraud and conspiracy to commit wire fraud.

Settled charges with the SEC for $500,000 and $18.9 million shares of stock. Could face up to 20 years in prison for criminal charges.

Billie McFarland (26) Fyre Media (Fyre Festival) Plead guilty to wire charges related to Fyre Festival and to various fraud charges from a separate ticket-selling scheme.

Sentenced to 6 years in prison and ordered to pay $26 million.

Sources: “Ebbers Is Sentenced to 25 Years for $11 Billion WorldCom Fraud,” The Wall Street Journal, July 14, 2005, p. A1;  “Scrushy Is Convicted in Bribery Case,” The Wall Street Journal, June 30, 2006, p. A3;  “Ex-CEO of Cendant Is Found Guilty in Third Trial,” The Wall Street Journal, November 1, 2006, p. C3; “Skilling Gets 24 Years in Prison,” The Wall Street Journal, October 24, 2006, p. C1; “Parmalat Founder Gets Prison Term,” The Wall Street Journal, December 19, 2008, p. B2; Laurence Viele Davidson, “HealthSouth’s Scrushy Liable in $2.88 Billion Fraud (Update 3),” Bloomberg, June 18, 2009; www.bloomberg.com/apps/news?pid=ne wsarchive&sid=a89tFKR4OevM (referenced August 10, 2011); Adam Liptak “Justices Limit Law Used for Corruption Cases,” The New York Times, June 25, 2010, p1; Gretchen Morgenson, “Angelo Mozilo of Countrywide Settles Fraud Case for $67.5 Million,” The New York Times, October 16, 2010, p.1; A. Smith, “Ex-Enron CEO Skilling Has 10 Years Lopped off Sentence,” CNN.com, June 21, 2013, http://money.cnn.com/2013/06/21/news/companies/skilling-enron-resentencing/ index.html;.Taylor Dunn, Victoria Thompson, Rebecca Jarvis, and Ashley Louszko, “Ex-Theranos CEO Elizabeth Holmes says ’I don’t know’ 600-plus times in never-before-broadcast deposition tapes,” Abcnews.go.com, January 23, 2019, https://abcnews.go.com/Business/theranos-ceo-elizabeth-holmes-600-times- broadcast-deposition/story?id=60576630; Rebecca Jarvis and Taylor Dunn, “Theranos founder Elizabeth Holmes settles with SEC in alleged ‘elaborate, years- long fraud’,” Abcnews.go.com, https://abcnews.go.com/Business/theranos-founder-elizabeth-holmes-settles-sec-alleged-elaborate/story?id=53760680; Lindsey Bever and Amy Wang, “The Fyre Festival was a total disaster. Its founder is going to prison for wire fraud.” The Washington Post, October 11, 2018, https://www. washingtonpost.com/arts-entertainment/2018/10/11/fyre-festival-was-total-disaster-its-founder-is-going-prison-wire-fraud/?utm_term=.7c40218e03c6; Doha Madani, “Fyre Festival organizer Billy McFarland sentenced to 6 years on fraud charges,” NBC News, October 11, 2018, https://www.nbcnews.com/news/us-news/ fyre-festival-organizer-billy-mcfarland-sentenced-6-years-fraud-charges-n919086; Ben Lane, “Former LandCastle Title CEO Nat Hardwick found guilty of embez- zling $26 million,” Housingwire.com, February 13, 2019, https://www.housingwire.com/articles/48174-former-landcastle-title-ceo-nat-hardwick-sentenced-to- 15-years-for-embezzling-26-million; Chris Morris, “Former Enron CEO Jeff Skilling Released From Prison,” Fortune, August 31, 2018, http://fortune.com/2018/08/31/ enron-ceo-jeff-skilling-released-prison/

Given the damage that can occur to the capital markets as a result of fraud, auditors are required by professional standards to hold a brainstorming session to consider the risk of fraud in every audit engagement. The required brainstorming session will be discussed later in the chapter in the context of gathering information for risk assessment. It is important for students to recognize that the nature, timing, and extent of audit work should change as a result of the auditor’s ultimate fraud risk assessment. In general, the lower the risk of material misstatement due to fraud, the less persuasive the audit evidence needs to be. It therefore follows that when fraud risk factors are identified, the

First Pages

lou6920X_ch04_117-171.indd 126 02/29/20 06:35 PM

126 Part Two The Financial Statement Audit

auditor generally must obtain more persuasive audit evidence. Most importantly, once fraud risk factors are identified, the auditor should clearly identify the fraud risks and then design and perform procedures that respond directly to fraud risks. The next several paragraphs provide some basic definitions and examples of fraud and fraud risk factors to help further your understanding

Fraud Fraud is the act of knowingly making material misrepresentations of fact with the intent of inducing someone to believe the falsehood and act on it and, thus, suffer a loss or damage. Through both fraud and aggressive financial reporting, some companies have caused financial statements to be misstated, usually by (1) overstating revenues and assets, (2) understating expenses and liabilities, and (3) giving disclosures that are misstated or that omit important information.3 Fraud that affects financial (or other) information and causes financial statements to be materially misstated often arises from the perceived need to get through a difficult period. The difficult period may be characterized by cash shortage, increased competition, cost overruns, and similar events that cause financial difficulty. Managers usually view these conditions as temporary, believing that getting a new loan, selling stock, or otherwise buying time to recover can overcome them. In  the meantime, falsified financial statements are used to benefit the company. Generally, fraudulent financial statements show financial performance and ratios that are more favorable than current industry experience or than the company’s own history. Exhibit 4.5 illustrates three categories of factors that might indicate increased risk of fraudulent financial reporting.

A very common reason cited for falsifying financial statements is so a company can meet its earnings projections either provided by management or set by financial analysts.

3An academic study (see M. Nelson, J. Elliott, and R. Tarpley, “How Are Earnings Managed? Examples from Auditors,” Accounting Horizons, November 2002) examined more than 500 attempts to manage earnings that were detected by auditors. The majority (more than 50 percent) of the attempts involved improper expense reductions, approximately 20 percent involved improper revenue increases, and the remainder involved business combinations and other accounting artifices.

EXHIBIT 4.5 Fraud Risk Factors

Management’s Characteristics and Influence Industry Conditions

Operating Characteristics and Financial Stability

• Management has a motivation (bonus compensation, stock options, etc.) to engage in fraudulent reporting.

• Management decisions are dominated by an individual or a small group.

• Management fails to display an appropriate attitude about internal control and financial reporting.

• Managers’ attitudes are very aggressive toward financial reporting.

• Managers place too much emphasis on earnings projections.

• Management participates excessively in the selection of accounting principles or the determination of estimates.

• The company has a high turnover of senior management.

• The company has a known history of violations.

• Managers and employees tend to be evasive when responding to auditors’ inquiries.

• Managers engage in frequent disputes with auditors.

• Company profits lag those of its industry. • New requirements are passed that could

impair stability or profitability. • The company’s market is saturated due to

fierce competition. • The company’s industry is declining. • The company’s industry is changing rapidly.

• A weak internal control environment prevails.

• The company is not able to generate sufficient cash flows to ensure that it is a going concern.

• There is pressure to obtain capital. • The company operates in a tax haven

jurisdiction. • The company has many difficult accounting

measurement and presentation issues. • The company has significant transactions

or balances that contain estimates that are difficult to audit.

• The company has significant and unusual related-party transactions.

• Company accounting personnel are lax or inexperienced in their duties.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 127

lou6920X_ch04_117-171.indd 127 02/29/20 06:35 PM

Simply stated, when a company fails to meet earnings projections, its stock price usually falls and the managers of the company face great scrutiny. As a result, managers work very hard to meet expectations set by analysts. In fact, sometimes a company’s perfor- mance will exactly meet the earnings targets announced by management months earlier. To avoid the negative outcomes that typically accompany a failure to meet expectations, managers sometimes commit fraud. The accompanying Auditing Insight illustrates an example that occurred at Bankrate.

While reviewing the preliminary financial results for the second quar- ter of 2012, the chief financial officer, VP of finance, and director of accounting at Bankrate Inc. concluded that their quarterly perfor- mance was going to fall dramatically short of analyst expectations. In  order to avoid possible repercussions from Wall Street, the man- agers directed two different divisions to record additional revenue totaling $800,000, without supporting documentation or analysis. Eventually, the company’s auditors, Grant Thornton, discovered and flagged the unsupported revenue. In July 2015, Bankrate restated

its financial statements for the second quarter of 2012. In addition, in September 2015, Bankrate was fined $15 million to settle the accounting fraud charges.

Sources: Accounting and Auditing Enforcement Release No. 3683, September 8, 2015 (available at: https://www.sec.gov/litigation/admin/2015/33-9901. pdf); Michael Cohn, “Bankrate to Pay $15 Million to Settle Accounting Fraud Charges,” Accounting Today, September 8, 2015 (available at: www. accountingtoday.com/news/audit-accounting/bdo-settle-sec-charges- false- misleading-audit-opinions-75733-1.html).

Meeting Analyst Expectations at Bankrate AUDITING INSIGHT

While not as common, there are times when management may find it beneficial to commit fraud by understating assets and revenues and overstating expenses and liabili- ties. This is likely to occur during times when profits are high and management wants to put reserves in a “cookie jar”4 that can be used to increase profits in future years and “smooth earnings” at the discretion of the management team. Understating profits also can be desirable if the company is under scrutiny by governmental bodies, taxing authori- ties, labor unions, or competitors. Therefore, auditors must be aware of the potential for fraudulent activity in both directions, depending on the relevant facts and circumstances.

When assessing the risk of fraud, auditors need to know about the red flags, those telltale signs and indications that have accompanied many frauds that have occurred in the past. Because of the double-entry bookkeeping system, fraudulent accounting entries always affect at least two accounts and two places in financial statements. Because many frauds involve improper recognition of assets, there is a theory of the “dangling debit,” which is an asset amount that can be investigated and found to be false or questionable. Frauds may involve the omission of liabilities, but the matter of finding and investigating the dangling credit is normally very difficult. It “dangles” off the books. In other words, the “dangling credit” is a credit that was never recorded to a liability account, resulting in an omission of a liability that should have been recorded. (Consider the implications for the completeness assertion in this scenario.) Misstated disclosures also present difficulty, mainly because they involve words and messages instead of numbers. Omissions may be difficult to notice, and misleading inferences may be very subtle. Exhibit 4.5 presents some of the other risk factors that have characterized situations in which frauds have occurred. Among the fraud risk factors identified, when a company has difficult accounting issues or has balances that contain difficult estimates to audit, these issues can be very challenging for auditors.

Types of Fraud Remember, financial statements may be materially misstated as a result of errors or fraud. While accounting errors are usually unintentional, fraud consists of knowingly making material misrepresentations of fact with the intent of inducing someone to believe the

4Cookie jar reserves are overaccruals created by a company (credit accrual, debit expense). In times when the company struggles, it reverses the overaccrual (debit accrual, credit expense) to pump up profits. Once the “cookie jar” reserve has been established, auditors are in a fix because it may be difficult to object to the company correcting the overaccrual.

First Pages

lou6920X_ch04_117-171.indd 128 02/29/20 06:35 PM

128 Part Two The Financial Statement Audit

falsehood and act on it and, thus, suffer a loss or damage. This definition encompasses all means by which people can lie, cheat, steal, and dupe other people. There are, in essence, two different types of fraud: Fraudulent financial reporting and misappropriation of assets.

Fraudulent financial reporting is defined in AU-C 240.A2 as “intentional misstatements, including omissions of amounts or disclosures in financial statements to deceive financial statement users. It can be caused by the efforts of management to manage earnings in order to deceive financial statement users by influencing their perceptions about the entity’s performance and profitability.”* Given this definition, fraudulent financial reporting is often referred to as management fraud. Management fraud is deliberate fraud committed by management that injures investors and creditors through materially misstated information.

Misappropriation of assets is defined in AU-C 240.A7 as involving “the theft of an entity’s assets and is often perpetrated by employees in relatively small or immaterial amounts.”* Therefore, misappropriation of assets is often referred to as employee fraud. Employee fraud is the use of fraudulent means to misappropriate funds or other property from an employer. It usually involves falsifications of some kind: using false documents, lying, exceeding authority, or violating an employer’s policies. It consists of three phases: (1) the fraudulent act, (2) the conversion of the funds or property to the fraudster’s use, and (3) the cover-up. Employee fraud can be classified as either embezzlement or larceny. This type of fraud is discussed in detail in Chapter 6. Other definitions related to misap- propriation of assets are

∙ Embezzlement is a type of fraud involving employees or nonemployees wrongfully misappropriating funds or property entrusted to their care, custody, and control, often accompanied by false accounting entries and other forms of deception and cover-up.

∙ Larceny is simple theft; for example, an employee misappropriates an employer’s funds or property that has not been entrusted to the custody of the employee.

∙ Defalcation is another name for employee fraud, embezzlement, and larceny.

Misstatements due to fraudulent financial reporting or misappropriation of assets are distinctly different than errors. Errors are unintentional misstatements or omissions of amounts or disclosures in financial statements. Errors are not considered fraud because they occur unintentionally.

Exhibit 4.6 shows some acts and devices that are often involved in financial frauds. Notice that these actions may be perpetrated by the organization or may be perpetrated upon the organization. Collectively, these are known as white-collar crimes—the misdeeds of people who wear ties to work and steal with a pencil or a computer terminal. White- collar crime produces ink stains instead of bloodstains.

American Institute of Certified Public Accountants. “Consideration of Fraud in a Financial Statement Audit.” Accessed June 24, 2019. https://www.aicpa.org/research/standards/auditattest/downloadabledocuments/au-c-00240.pdf. American Institute of Certified Public Accountants. “Consideration of Fraud in a Financial Statement Audit.” Accessed June 24, 2019. https://www.aicpa.org/research/standards/auditattest/downloadabledocuments/au-c-00240.pdf.

When CFOs are caught fudging the numbers, it’s more likely they were pressured by upper management than looking for some immedi- ate financial benefit. At least that’s the way The Conference Board sees it after analyzing more than 20 years of accounting and auditing enforcement actions by the Securities and Exchange Commission. The study found that CFOs have an inherently higher risk of litigation in

accounting manipulation cases, yet they often do not get the personal financial benefits of cooking the books. However, when CEOs apply enough pressure, CFOs may acquiesce and set aside their role as watchdog of financial reporting quality.

Source: T. Whitehouse, Compliance Week, May 20, 2011.

Wayward CFOs Often Coerced by CEOs, Study Says

AUDITING INSIGHT

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 129

lou6920X_ch04_117-171.indd 129 02/29/20 06:35 PM

Auditing standards require that auditors specifically assess the risk of material misstate- ment due to fraud for each engagement. Fraud risk factors relate to both misstatements arising from fraudulent financial reporting and misstatements arising from misappro- priations of assets (usually as a result of employee theft and the related attempt to con- ceal this theft through erroneous journal entries). Furthermore, auditors should consider these risk factors when determining what audit procedures to perform. With regard to the audit risk model, fraud risk is always considered a key factor when an auditor assesses inherent risk. A complete discussion of inherent risk assessment follows in the next section.

One last note regarding our responsibility for fraud: audit teams are concerned with fraud only as it affects the financial statements. That is, audit teams are not responsible to detect all fraud but are responsible to detect cases where fraudulent activity results in materially misstated financial statements. For example, if a warehouse employee is misappropriating inventory but that embezzlement does not result in materially misstated financial statements, auditors do not necessarily have a responsibility to detect this type of fraud. However, if management is materially misstating revenues in order to meet earnings expectations, auditors are responsible for detecting this misstatement. That is not to say that auditors would ignore immaterial fraud (indeed, any instance of fraud would cause auditors to re-evaluate their assessment of management’s integrity), but only that auditors’ primary responsibility is to design procedures to provide reasonable assur- ance that material frauds that might misstate the financial statements are detected.

EXHIBIT 4.6 Overview of Types of Frauds

Owners Managers

Vendors Suppliers

Consultants

Stockholders Creditors

Fraudulent Financial Statements Securities Fraud

Theft of Trade Secrets Employee Bribery

Short Shipment Double Billing False Invoices Employee Bribery

Expense Account Padding Embezzlement Theft of Cash and Property Kickbacks False Benefits Claims Padded Payroll

False Loss Claims

Tax Evasion Contract Cost Padding False Benefit Claims

Shoplifting False Refunds False Credit Cards Hot Checks

False Advertising Short Shipments Defective Products Price Fixing

Insider Trading Related-Party Transactions

Competitors

Employees Insurers

Government

Customers

COMPANY

REVIEW CHECKPOINTS 4.5 What is the primary difference between a material misstatement due to fraud and one due to error? 4.6 What is the auditor’s responsibility regarding fraud risk? 4.7 What are the defining characteristics of (a) white-collar crime, (b) employee fraud, (c) embezzle-

ment, (d) larceny, (e) defalcation, (f) management fraud, and (g) errors? 4.8 Identify three different categories of fraud risk factors. Next, for each category, what are some of

the conditions that can help contribute to a higher likelihood of financial statement fraud?

First Pages

lou6920X_ch04_117-171.indd 130 02/29/20 06:35 PM

130 Part Two The Financial Statement Audit

INHERENT RISK ASSESSMENT—“WHAT COULD GO WRONG?” The professional standards make clear that risk assessment underlies the entire audit pro- cess. As a result, it is absolutely essential that auditors take great care to appropriately assess the risks of material misstatement, either due to error or fraud that exists on an audit engagement. When performing risk assessment procedures to accomplish this objective, the first step taken by auditors is often to assess inherent risk for each relevant assertion related to each of the significant accounts and disclosures identified on an audit engagement.

Recall that inherent risk is the probability that, in the absence of internal controls, material errors or frauds could enter the accounting system used to develop financial statements. Inherent risks can arise from a variety of different sources, and an auditor’s basis for assessing a client’s inherent risk is often found in his or her familiarity with the types of misstatements that could occur for each assertion in any account balance or class of transactions. Clearly, hundreds of innocent errors and not-so-innocent fraud schemes are possible. Instead of trying to learn about the hundreds of possible errors and frauds, it is better to begin with an introduction to the seven general categories of errors and fraud. In a sense, these seven categories answer the audit question: “What Could go wrong?” in the financial statements. Exhibit 4.7 shows the seven categories with some examples.

In effect, at both the overall financial statement level and at the management financial statement assertion level, inherent risk refers to the exposure or susceptibility of an asser- tion within an entity’s financial statements to a material misstatement without regard to the system of internal controls. A detailed understanding of an audit client’s business model, including its products and services, is an essential part of an auditor’s inherent risk assessment process at both the financial statement and the financial statement assertion

LO 4-3 Explain an auditor’s responsibility to assess inherent risk, including a description of the type of risk assessment procedures that should be performed when assessing inherent risk on an audit engagement.

EXHIBIT 4.7 General Categories of Misstatements

What Could Go Wrong? Error Examples Fraud Examples Assertion Violated

1.  Invalid transactions are recorded.

A computer malfunction causes a sales transaction to be recorded twice.

Fictitious sales are recorded and charged to nonexistent customers.

Occurrence

2.  Valid transactions or disclosures are omitted from the financial statements.

Shipments to customers are never recorded because of problems in the company’s information processing system.

Shipments are made to an employee’s friend and intentionally never recorded.

Completeness

3.  Transaction or disclosure amounts are inaccurate.

An employee calculates depreciation incorrectly.

A company “short ships” a shipment to a customer and bills the customer for the full amount ordered.

Accuracy

4.  Transactions are classified in the wrong accounts.

Sales to a subsidiary company are recorded as sales to external parties instead of intercompany sales, or the amount is charged to the wrong customer account receivable record.

A loan to the company’s CEO (not permitted under Sarbanes–Oxley) is classified as an account receivable to conceal the transaction.

Classification

5.  Transaction accounting and posting are incorrect.

Sales are posted in total to the accounts receivable control account, but some are not posted to individual customer account records.

Repairs and maintenance expenses are recorded as additions to property, plant and equipment accounts to keep expenses off the income statement.

Accuracy

6.  Transactions are recorded in the wrong period.

The company fails to record a shipment that was sent by a supplier FOB shipping point in December, but the shipment was not received (or recorded) until January.

Shipments made in January (of the next fiscal year) are backdated and recorded as sales in December.

Cutoff

7.  Disclosures are incomplete or misleading.

The company did not include the effective tax rate reconciliation in the footnotes.

Management fails to disclose litigation against the company.

Presentation and Disclosure

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 131

lou6920x_ch04_117-171.indd 131 03/06/20 06:32 PM

levels. Inherent risk assessment helps to guide the auditor in allocating more and stron- ger resources to test specific accounts and disclosures that present a higher likelihood of material misstatement and therefore present a higher level of inherent risk. In effect, inherent risk assessment provides the basis for executing an appropriate response to the risks identified. Remember that the assessment of inherent risk can be based on a variety of types of information. The risk assessment process is summarized in Exhibit 4.8.

At a preliminary level, the best indicator of the risk of a material misstatement in the year under audit is a material misstatement that was discovered during the previous audit. Also, changes in transaction types, technology, personnel, or accounting principles may increase the risk of material misstatement. The nature of the client’s business can pro- duce complicated transactions and calculations that are subject to information processing and accounting treatment error. For example, real estate, franchising, and oil and gas transactions are frequently complicated and subject to accounting error. Some types of inventories are more difficult than others to count, value, and keep accurately in perpetual records. The following factors have been suggested as being related to the susceptibility of accounts to misstatement or fraud:

∙ Dollar size of the account. The higher the account balance, the greater the chance of having errors or fraud in the account.

∙ Liquidity. The greater the account’s liquidity (ability to be easily converted to cash), the more susceptible the account is to fraud. For example, cash is more susceptible to theft than, say, a building.

∙ Volume of transactions. The higher the volume of transactions, the higher the chance of error or fraud occurring in the transactions.

EXHIBIT 4.8 The Risk Assessment Process Document

Understand Company and Its

Environment

Industry and

External Factors

Nature of the

Company

Objectives and

Strategies

Required understanding needed to plan audit - will help identify high

risk areas

Accounting Principles

and Disclosures

Measurement and Analysis of

Financial Performance

Understand Internal Control

over Financial Reporting

Information from Client Acceptance and Retention Evaluation, Audit Planning, Past Audits, and Other Engagements

• More E�ective

Substantive Procedures

• Procedures Closer to Year-End

• Specialists • Experienced

Personnel

Brainstorming

Perform Analytical Procedures

Inquire of Audit Committee,

Management, and Others

Information and audit procedures

used to assess risk

Assess Risk Factors

Respond Communicate

First Pages

lou6920X_ch04_117-171.indd 132 02/29/20 06:35 PM

132 Part Two The Financial Statement Audit

∙ Complexity of the transactions. Very complex transactions (e.g., those involving deriv- ative securities or hedging transactions) tend to have a higher percentage of errors than simple transactions.

∙ Subjective estimates. Subjective measurements (e.g., estimating the allowance for doubtful accounts) tend to have more errors and fraud than objective measurements (e.g., counting petty cash). Simply stated, the more subjective the measurement, the easier it is to manipulate.

Understanding the Client’s Business and Its Environment Gaining a detailed understanding and knowledge of the client’s business and its environ- ment within the context of its industry is essential in an audit. Auditing standards require auditors to obtain a thorough understanding of the business to plan and perform the audit work. More specifically, a thorough understanding of the business will help identify areas of increased risk of material misstatement. Obtaining an understanding of the client’s business includes understanding

∙ Relevant industry, regulatory, and other external factors. ∙ The nature of the company and related parties. ∙ The effect of client computerized processing. ∙ The company’s selection and application of accounting principles, including related

disclosures. ∙ The company’s objectives and strategies and those related business risks that might

reasonably be expected to result in risks of material misstatement. ∙ The company’s measurement and analysis of its financial performance.

Industry, Regulatory, and Other External Factors Auditors must obtain an understanding of relevant industry, regulatory, and other external factors that encompasses the client’s competitive environment. This includes a detailed understanding of the regulatory environment, including the applicable financial reporting framework (e.g., U.S. GAAP or IFRS). Auditors must also understand the broad eco- nomic environment in which the client operates, including such things as the effects of national economic policies (e.g., price regulations and import/export restrictions), the geographic location and its economy (e.g., northeastern states versus sunbelt states), and developments in taxation and regulatory areas (e.g., industry regulation, approval processes for products in the drug and chemical industries).

Industry characteristics are also important. There is a great deal of difference in the production and marketing activities of banks, insurance companies, mutual funds, supermarkets, hotels, oil and gas industries, agriculture organizations, manufacturers, and so forth. Industry expertise also involves knowledge of the competition and an understand- ing of the client’s market. Few auditors are experts in all of these areas. Public accounting firms must have experts in all industries they examine and rely on them to supervise audits in their industry of expertise. This is why considering the expertise needed on an engage- ment is crucial to effective audit planning and engagement team assignment in those indus- tries. Indeed, some public accounting firms have reputations for having many audit clients in a particular industry while others have a larger presence in other industries. Further, most large public accounting firms organize their auditors by industry, allowing individuals to become familiar with issues in the industry to which they are assigned.

In addition, auditors should be aware of the effects that economic distress and slow recovery can have on their clients. In the past, PCAOB inspectors have identified instances in which auditors failed to comply with auditing standards in connection with an economic crisis, such as fair value measurements, impairment of goodwill, indefinite- lived intangible assets, and other long-lived assets, allowance for loan losses, off-balance sheet structures, revenue recognition, inventory, and income taxes.5

5Report on Observations of PCAOB Inspectors Related to Audit Risk Areas Affected by the Economic Crisis, September 29, 2010.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 133

lou6920X_ch04_117-171.indd 133 02/29/20 06:35 PM

The Nature of the Company Obtaining an understanding of the nature of the company includes understanding

∙ The company’s organizational structure and management personnel. Is the client cen- tralized or decentralized? Who makes the decisions? Are senior managers familiar with accounting and reporting requirements? Do they value the importance of good controls? Are any officers, employees, or shareholders involved in related-party transactions?

∙ The sources of funding of the company’s operations and investment activities. Is the company funded by debt or equity? Are there restrictions placed by lenders that man- agement must meet (e.g., debt covenants)? Does it have the financing in place to meet future cash requirements? Are any lenders or shareholders involved in related-party transactions?

∙ The company’s significant investments. Is the company invested in other compa- nies for strategic purposes? Do investments provide a significant source of income? What is the company’s investment policy? Do overseas investments present a risk of nationalization? Are any subsidiaries involved in related-party transactions? Is the company planning to acquire another company? As the following Auditing Insight reveals, there are additional risks for auditors if their client is either about to be acquired by or planning to acquire another company.

∙ The company’s operating characteristics, including its size and complexity. Does the company operate internationally? Do subsidiaries operate in diverse industries?

∙ The sources of the company’s earnings, including the relative profitability of key products and services, and key supplier and customer relationships. Are there any threats to loss of revenue from losing suppliers or customers? Could key products be overtaken by competitors’ products? Could advances in technology make the client’s products obsolete? Are any customers or suppliers related parties?

When Hewlett-Packard (HP) admitted that it overpaid when it acquired Autonomy for $11.1 billion in October 2011, the manage- ment team did not accept responsibility for the blunder. Rather, an investigation completed by HP concluded that there were serious “accounting improprieties” and “outright misrepresentations” found on Autonomy’s financial statements. According to HP CEO Meg Whit- man, “There appears to have been a willful sustained effort” to inflate Autonomy’s revenue and profitability. “This was designed to be hidden.” As a result, HP wrote down $8.8 billion of Autonomy’s value just one year after the acquisition. To help recoup some of their losses, HP filed a lawsuit in 2015 against former Autonomy CEO Mike Lynch and CFO Sushovan Hussain for $5 billion that, as of 2019, was still making its way through the UK courts. In the mean- time, in April 2018 the US Department of Justice convicted Sushovan Hussain of falsifying financial statements and exaggerating the com- pany’s value. Criminal charges have also been filed in the US against Mike Lynch.

For its part, Deloitte UK defends its audit work completed at the company. In fact, a spokesman for Deloitte UK “categorically

denies that it had any knowledge of any accounting improprieties or any misrepresentations in Autonomy’s financial statements, or that it was complicit in any accounting improprieties or misrepresenta- tions.”* The Financial Reporting Council (FRC), the auditing regula- tor in the UK, disagrees. In 2018 the FRC filed a formal complaint against Deloitte, accusing them of “failing to adequately challenge Autonomy’s accounting and disclosure of its purchases and sales of computer hardware.” According to the FRC, the conduct of the auditors fell “significantly short of the standards reasonably to be expected.”

Source: “HP Says It Was Duped, Takes $8.8 Billion Charge,” The Wall Street Journal, November 21, 2012, p. A1; Stu Woo, “US Charges Autonomy Founder With Fraud Over Hewlett Packard Deal,” The Wall Street Journal, November 30, 2018, https://www.wsj.com/articles/u-s-charges-autonomy-founder- with-fraud-over-hewlett-packard-deal-1543582883; “Deloitte and Former Autonomy Chiefs Face Action,” BBC News, May 31, 2018, https://www.bbc. com/news/business-44315824; Gareth Corfield, “HPE wants British ex-CFO to testify in UK Autonomy lawsuit before Uncle Sam sentences him,” The Register, February 18, 2019, https://www.theregister.co.uk/2019/02/18/ sushovan_hussain_testimony_hpe_autonomy_lawsuit/.

Worthen, Ben. November 20, 2012. “H-P Says It Was Duped, Takes $8.8 Billion Charge.” The Wall Street Journal. https://www.wsj. com/articles/SB10001424127887324352004578130712448913412.

How Hewlett-Packard Overpaid for AutonomyAUDITING INSIGHT

First Pages

lou6920X_ch04_117-171.indd 134 02/29/20 06:35 PM

134 Part Two The Financial Statement Audit

Related Parties Related parties include those individuals or organizations that can influence or be influ- enced by decisions of the company, possibly through family ties or investment relation- ships. According to the professional standards, an auditor’s primary objective in regard to related parties is to obtain the evidence needed to determine whether “related parties and relationships and transactions with related parties have been properly identified, accounted for, and disclosed in the financial statements.”6 Because one of the basic assumptions of historical cost accounting is that transactions are valued at prices agreed on by two independent parties (i.e., “arm’s-length transactions”), valuation of related-party transac- tions is particularly troublesome. For example, auditors must remember that the economic substance of a particular transaction (and its effect on the financial condition of the entity) could be significantly different from its legal form (e.g., capitalized leases versus operat- ing leases).

Auditors strive to identify related-party relationships and transactions during the planning stage to be able to obtain evidence that the financial accounting and disclosure for them are proper. Some methods include reviewing the board of directors’ meeting minutes, making inquiries of key executives, and reviewing stock ownership records (5 percent ownership in the company is usually used as a good cutoff). Auditors also should question the persuasiveness of the evidence obtained from related parties because the source of the evidence may be biased. Hence, auditors should obtain evidence of the purpose, nature, and extent of related-party transactions and their effect on financial statements, and the evidence should extend beyond inquiry of management.

6Public Company Accounting Oversight Board. “Auditing Standard No. 18: Related Parties.” Accessed June 24, 2019. https:// pcaobus.org/Standards/Archived/PreReorgStandards/Pages/Auditing_Standard_18.aspx.

Client Computerized Processing Clients can exhibit great differences in the way that their computerized processing activi- ties are organized. The degree of centralization inherent in the organizational structure can vary. A highly centralized organizational structure generally has all significant computerized processing controlled and supervised at a central location. The control environment, the computer hardware, and the computerized systems can be uniform throughout the company. Auditors can obtain most of the necessary computerized

For the most part, yes. A recent academic study examines the rela- tionship between related-party transactions and subsequent financial statement restatements, which would signal the previous existence of a material misstatement. Looking at 3,588 observations, the authors find that companies that engage in related-party transactions have a higher likelihood of future restatements, as compared to those that did not have such transactions. In particular, related-party transactions that relate to tone at the top, such as a loan or consulting arrangement with a director, officer, or major shareholder are more greatly associ- ated with restatements then related-party transactions that deal more with normal course of business events.

Interestingly, auditors may not recognize these transactions as the red flags they appear to be. When looking at audit fees, companies

that report related-party transactions have lower audit fees than com- panies that do not. This is counterintuitive, as you would expect the increased risk of material misstatement associated with related-party transactions would require more audit work and therefore higher fees. Companies with related-party transactions also are less likely to hire auditors that are industry specialists. The less frequent hiring of industry specialists and lower audit fees could signal that companies with related-party transactions are, for whatever reason, looking for a lower quality audit.

Sources: M. Kohlbeck and B. Mayhew, “Are Related Party Transactions Red Flags?” Contemporary Accounting Research 35, no. 2 (2017), pp. 900–928.

Are Related Party Transactions Really that Troublesome?

AUDITING INSIGHT

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 135

lou6920X_ch04_117-171.indd 135 02/29/20 06:35 PM

processing information by visiting the central location. At the other extreme, a highly decentralized organizational structure generally allows various departments, divisions, subsidiaries, or geographical locations to develop, control, and supervise computerized processing in an autonomous fashion. In this situation, the computer hardware and the computer systems are usually not uniform throughout the company. Thus, auditors might need to visit many locations to obtain the necessary audit information.

Selection and Application of Accounting Principles, Including Related Disclosures Auditors should evaluate whether the company’s selection and application of accounting principles are appropriate for its business and consistent with the applicable financial reporting framework and accounting principles used in the relevant industry. Auditors should pay attention to significant changes in the company’s accounting principles, financial reporting policies, or disclosures and the reasons for such changes; significant accounting principles in controversial or emerging areas; and the methods the company uses to account for significant and unusual transactions.

Accounting estimates are a concern because numerous fraud cases have involved the deliberate manipulation of estimates to increase net income. Accounting estimates are approximations of financial statement numbers and are often included in financial state- ments. Examples include valuation of investment securities, net realizable value of accounts receivable, depreciation expense, insurance loss reserves, percentage-of- completion contract revenues, impairment of goodwill, pension expense, warranty liabilities, fair value of financial instruments, and many more. Management is responsible for making account- ing estimates. Auditors are responsible for determining that all appropriate estimates have been made, that they are reasonable, and that they are presented in conformity with GAAP and adequately disclosed. The following Auditing Insight provides a brief description of “what went wrong” at Toshiba related to an important accounting estimate.

In early September 2015, the Japanese conglomerate Toshiba announced a $1.9 billion earnings write down that involved the past seven fiscal years. The accounting irregularities were primarily related to “percentage of completion” estimates that were used to account for both revenue and costs for various infrastructure projects that included railway system, hydroelectric, and nuclear projects. The  accounting rules specify that the estimates are supposed to represent reasonable estimates of the extent of contract progress. However, due to the subjectivity involved in the estimates, there is always an opportunity

for management bias to occur during the estimation process and for a fraud to occur. As a result, auditors must always be aware of this pos- sibility whenever they are auditing an accounting estimate.

Sources: Eric Pfanner and Megumi Fugukawa, “Toshiba Slashes Earnings for Past Seven Years,” The Wall Street Journal, September 7, 2015 (avail- able at http://www.wsj.com/articles/toshiba-slashes-earnings-for-past- 7-years-1441589473); David Katz, “Accounting Rife with Estimates Haunted Toshiba,” CFO.com, September 9, 2015 (available at http://ww2.cfo.com/ financial-reporting-2/2015/09/accounting-rife-estimates-haunted-toshiba/).

Percentage of Completion Estimates at ToshibaAUDITING INSIGHT

With respect to auditing accounting estimates, auditors are supposed to monitor the differences between management’s estimates and the closest reasonable estimates sup- ported by the audit evidence and evaluate the differences taken altogether for indications of a systematic bias. For example, management may estimate an allowance for doubt- ful accounts to be $50,000, and the auditors may estimate that the allowance could be $40,000 to $55,000. In this case, management’s estimate is within the auditors’ range of reasonableness. However, the auditors should note that the management estimate leans toward the conservative side (more than the auditors’ $40,000 lower estimate but not much less than the auditors’ higher $55,000 estimate). If other estimates exhibit the same conservatism and the effect is material, the auditors will need to evaluate the overall rea- sonableness of the effect of all estimates taken together.

First Pages

lou6920X_ch04_117-171.indd 136 02/29/20 06:35 PM

136 Part Two The Financial Statement Audit

Company Objectives, Strategies, and Related Business Risks An auditor needs to gain a detailed understanding of the audit client’s strategy to achieve a competitive advantage within its industry. The purpose of obtaining an understand- ing of the company’s objectives and strategies is to identify business risks that could reasonably be expected to result in material misstatement of the financial statements. The best starting point is with management, whose job it is to be knowledgeable about the company’s business risks. Any risks that could adversely affect a company’s ability to achieve its objectives and execute its strategies are called business risks. Although not all business risks are relevant to auditors, the following are examples of potential business risks that might result in material misstatement of the financial statements:

∙ Industry developments for which the company does not have the personnel or expertise to deal with the changes.

∙ New products and services that might not be successful. ∙ Expansion of the business when the demand for the company’s products or services

has not been accurately estimated. ∙ The effects of implementing a strategy that will lead to new accounting requirements. ∙ Financing requirements that the company may be unable to meet, resulting in a loss of

financing.

If you think about the financial statements as a window into the operations and results of a business, you can imagine peering through them to see activities of thousands of employees, suppliers, and customers working to achieve their goals. You should also be able to see the effects of the industry environment, including economic and politi- cal events, weather occurrences, technological advances, and social and demographic patterns. Given this view of financial statements, it’s easier to understand why auditors need to take the time to carefully acquire knowledge about a client’s business, industry, and strategy to achieve competitive advantage. This foundation of company- and indus- try-specific knowledge allows the auditor to better understand the client’s business risk, which is a precursor to assessing inherent risk and audit risk.

Indeed, the professional standards recognize that most business risks are eventually reflected in the financial statements. So auditors devote a significant amount of time to gain an understanding of their clients’ business risks. Firms believe they must learn more about their clients’ business strategies and processes to understand whether the financial statements are fairly presented.

Gaining an understanding of strategies and processes involves gathering evidence in areas not historically addressed by auditors. Auditors might ask production person- nel about labor problems or marketing personnel about product quality or competition. The process has been criticized by some as being more consulting than auditing, but it is essential in order to assess the risk of material misstatements. It addresses factors that audit team members could miss by getting lost in the details of an approach that simply started with the financial statements. Business risk assessment also makes auditors much more knowledgeable about their client’s business and its environment. We should note that, even when taking a top-down approach that starts with an understanding of the risks faced by the client in executing its strategy within the industry, the audit team ultimately still has to focus its procedures on the significant accounts and relevant management assertions.

Company Performance Measures The purpose of obtaining an understanding of the company’s performance measures is to determine what information management and others deem to be key indicators of company performance that may affect the risk of material misstatement. A key step for auditors to consider is to try to understand those measures to which management or financial statement users might be sensitive. For example, measures used to determine

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 137

lou6920X_ch04_117-171.indd 137 02/29/20 06:35 PM

management compensation or analysts’ ratings might place pressure on management to manipulate financial results. Also, auditors might gain a better understanding of their clients by reviewing measures management uses to monitor operations, such as budget variances or trend analysis. Finally, those measures might be indicators of qualitative fac- tors that should be considered when determining materiality, as discussed in Chapter 3.

REVIEW CHECKPOINTS 4.9 Why is it important for an auditor to carefully assess inherent risk on each audit engagement? 4.10 What is meant by the nature of the company, and why is it important to inherent risk assessment? 4.11 Why should auditors understand their clients’ performance measures when assessing inherent

risk? 4.12 What is the major concern for auditors related to evidence obtained from related parties?

GATHERING INFORMATION AND PRELIMINARY ANALYTICAL PROCEDURES

Auditors have a responsibility to keep up with developments within their clients’ busi- nesses, industries, and the overall economy. Remember from our discussion in Chapter 1 that the auditing environment is rapidly being transformed into an environment character- ized by the availability of “Big Data.” Only a few of the many different sources of infor- mation available are described briefly in this section. The AICPA industry accounting and auditing guides are often a very good place to start. These guides explain the typical transactions and accounts used by various types of businesses and not-for-profit organi- zations. Many databases and information sources are available on the Internet, such as the Library of Congress E-resources Online Catalog (http://eresources.loc.gov/).

Auditors should make sure to read public information about the company, such as company-issued press releases, company-prepared presentation materials for analysts or investor groups, and analyst reports, as well as to observe or read transcripts of earnings calls and, to the extent publicly available, of other meetings with investors or rating agen- cies. Auditors also need to obtain an understanding of compensation arrangements with senior management, including incentive compensation arrangements, changes or adjust- ments to those arrangements, and special bonuses, by reviewing the documents and dis- cussing the arrangements with management. Board of directors compensation committee minutes often contain useful information about the intent of such arrangements.

General Business Sources Most industries have specialized trade magazines and journals. You may not choose to read Grocer’s Spotlight for pleasure, but magazines of this special type are very valu- able for learning and maintaining an industry expertise. In addition, specific informa- tion about public companies can be found in registration statements and 10-K reports filed with the SEC. General business magazines and newspapers often contribute insights about an industry, an entity, and individual corporate officers. Many are available, including such leaders as Bloomberg Businessweek, Forbes, Fortune, Harvard Business Review, Barron’s, and The Wall Street Journal. Auditors typically read several of these regularly. Additionally, many companies present “company story” information on their websites. A visit to company websites can provide a wealth of information about products, markets, and strategies. For public companies, auditors should also monitor the client’s daily stock price for any unusual trading activity that might indicate new information that affects the company’s business risk.

LO 4-4 Understand the different sources of information and the audit procedures used by auditors when assessing risks, including analytical procedures, brainstorming, and inquiries.

First Pages

lou6920X_ch04_117-171.indd 138 02/29/20 06:35 PM

138 Part Two The Financial Statement Audit

Company Sources Other early information-gathering activities include (1) reviewing the corporate char- ter and bylaws or partnership agreement; (2) reviewing contracts, agreements, and legal proceedings; and (3) reading the minutes of the meetings of directors and committees of the board of directors. The minutes provide a history of the company, critical events and significant transactions, and future company intentions. A company’s failure to provide minutes is a significant scope limitation that could result in the public accounting firm’s disclaiming an opinion on the company’s financial statements.

Information from Client Acceptance or Continuance Evaluation, Audit Planning, Past Audits, and Other Engagements A great deal of information about the client is gathered in the pre-engagement planning process discussed in Chapter 3. Auditors evaluate the competence and integrity of man- agement and the riskiness of the business before taking or continuing a client. As noted, the best indicator of the risk of a material misstatement is the presence of misstatements in previous audits that required adjusting entries. For example, for nonpublic clients, pub- lic accounting firms often develop client income tax provisions once the audit is com- plete; thus, the income tax adjusting entry would show up as an adjustment every year. Finally, auditors who have industry expertise often have more than one client in that industry, so they can transfer general knowledge of risks encountered in other clients while maintaining confidentiality standards required by the profession.

Boards of directors are responsible for monitoring their companies’ busi- nesses. The minutes of their meetings and the meetings of their com- mittees (e.g., executive committee, finance committee, compensation committee, and audit committee) frequently contain information of vital interest to the independent auditors. Some information examples follow:

• Amount of dividends declared. • Elections of officers and authorization of officers’ salaries. • Authorization of stock options and other incentive compensation

arrangements. • Acceptance of contracts, agreements, and lawsuit settlements. • Approval of major purchases of property and investments. • Discussions of possible mergers and divestitures.

• Authorization of financing by stock issuance, long-term debt issuance, and leases.

• Approval to pledge assets as security for debts. • Discussion of negotiations on bank loans and payment waivers. • Approval of accounting policies and accounting for significant and

unusual transactions. • Authorizations of individuals to sign bank checks.

Auditors take notes or make copies of important parts of these minutes and compare them to information in the accounts and disclosures (e.g., compare the amount of dividends declared to the amount paid, compare officers’ authorized salaries to amounts paid, compare agreements to pledge assets to proper disclosure in the notes to financial statements).

What’s in the Minutes of Meetings?

Preliminary Analytical Procedures Auditors are required to complete preliminary analytical procedures on each engage- ment. When completing analytical procedures, auditors are required to develop an expec- tation about what an account balance should be and then compare that expectation to the recorded balance. When doing so, auditors typically use the prior-year balances as the starting point for their expectation for each account balance. At this stage, analytical procedures are reasonableness tests; auditors compare their expectation for each of the account balances with those recorded by management. According to auditing standards, analytical procedures must be applied in the preliminary stages of each audit. During this critical point of the engagement, auditors use analytical procedures to identify poten- tial problem areas so that subsequent audit work can be designed to reduce the risk of missing something important. Analytical procedures during the preliminary stages also

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 139

lou6920X_ch04_117-171.indd 139 02/29/20 06:35 PM

provide an organized approach—a standard starting place—for becoming familiar with the client’s business and identifying areas of risk. Auditors need to remember that pre- liminary analytical procedures are based on unaudited data, so they should consider the effectiveness of controls over their reliability when deciding how much weight to place on the results.

Auditors should perform five steps when completing analytical procedures: 1. Develop an expectation. A variety of sources can provide evidence for auditors’

expectations of the balance in a particular account: ∙ Balances for one or more comparable periods (e.g., vertical and horizontal analyses). ∙ Anticipated results found in the company’s budgets and forecasts. ∙ Leveraging predictable patterns among account balances based on the company’s

experience. ∙ Relevant information from third-party sources for the industry in which the com-

pany operates. ∙ Relevant nonfinancial information (e.g., physical production statistics, sales orders).

2. Define a significant difference. Basically, the question is, “What percentage (or dollar) difference from your expectation can still be considered reasonable?” It is important that this decision be made before making the comparison to prevent auditors from rationalizing differences and failing to follow up.

3. Compare expectation with the recorded amount. Many auditors start with comparative financial statements and calculate year-to-year changes in balance-sheet and income- statement accounts (horizontal analysis). They next calculate common-size statements (vertical analysis) in which financial statement amounts are expressed as percentages of a base, such as sales for the income-statement accounts or total assets for the balance-sheet accounts. These initial calculations (see Exhibit 4.9) provide a basis for describing the financial activities for the current year under audit. Although vertical and horizontal analyses are fairly basic, other analytical procedures—including math- ematical time series and regression calculations, comparisons of multiyear data, and trend analyses—can be more complex.

4. Investigate significant differences. Auditors typically look for relationships that do not make sense as indicators of problems in the accounts, and they use such indicators to plan additional audit work. In the planning stage, analytical procedures are used to identify potential problem areas so that subsequent audit work can be designed to reduce the risk of missing something important. The application demonstrated here can be described as attention directing: pointing out accounts that could contain errors and frauds. The insights derived from preliminary analytical procedures do not provide direct evidence about the numbers in the financial statements. Although the insights derived from preliminary analytical procedures provide only limited evidence about the numbers in the financial statements, they do help auditors identify risks as an aid in preparing the audit plan.

5. Document each of the preceding steps. For companies that have not undergone any significant changes in operations, current-year recorded amounts should be fairly similar to those of the prior year (step 1). Because changes are not expected, auditors can identify any changes that are more than 10 percent and $100,000 as deserving additional attention (step 2). Note that the threshold is both 10 percent and $100,000 instead of just one trigger or the other. A change in an account balance from $100 to $200 is a 100 percent change, but the change is clearly immaterial. Similarly, an increase in sales from $9.9 million to $10 million meets the $100,000 threshold but does not appear unreasonable in percentage terms. In step 3, auditors compare expec- tations with the recorded balances. Exhibit 4.9 contains financial balances for the prior year (consider them audited) and the current year (consider them unaudited at this stage). Common-size statements (vertical analysis) are shown in parallel columns, and the dollar amount and percentage change (horizontal analysis) are shown in the last two columns.

First Pages

lou6920X_ch04_117-171.indd 140 02/29/20 06:35 PM

140 Part Two The Financial Statement Audit

EXHIBIT 4.9 Dunder-Mifflin Inc.—Preliminary Analytical Procedures Data

  Prior Year Current Year Change

  Balance Common Size Balance Common Size Amount Percent Change

Income            

Sales (net) $ 9,000,000 100.00% $ 9,900,000 100.00% $ 900,000 10.00% Cost of goods sold 6,750,000 75.00 7,200,000 72.73 450,000 6.67 Gross margin 2,250,000 25.00 2,700,000 27.27 450,000 20.00 General expense 1,590,000 17.67 1,734,000 17.52 144,000 9.06 Depreciation 300,000 3.33 300,000 3.03 0 0.00 Operating income 360,000 4.00 666,000 6.46 306,000 85.00 Interest expense 60,000 0.67 40,000 0.40 (20,000) –33.33 Income taxes (40%) 120,000 1.33 256,000 2.59 136,000 113.33 Net income $ 180,000 2.00% $ 370,000 3.74% $ 190,000 105.56% Assets

Cash $ 600,000 14.78% $ 200,000 4.12% ($400,000) –66.67% Accounts receivable 500,000 12.32 900,000 18.56 400,000 80.00 Allowance for doubtful accounts (40,000) –0.99 (50,000) –1.03 (10,000) 25.00 Inventory 1,500,000 36.95 1,600,000 32.99 100,000 6.67  Total current assets 2,560,000 63.05 2,650,000 54.63 90,000 3.52 Equipment 3,000,000 73.89 4,000,000 82.47 1,000,000 33.33 Accumulated depreciation (1,500,000) –36.95 (1,800,000) –37.11 (300,000) 20.00 Total assets $ 4,060,000 100.00% $ 4,850,000 100.00% $ 790,000 19.46% Liabilities and Equity

Accounts payable $ 500,000 12.32% $ 400,000 8.25% ($100,000) –20.00% Bank loans, 11% 0 0.00 750,000 15.46 750,000 Accrued interest 60,000 1.48 40,000 0.82 (20,000) –33.33  Total current liabilities 560,000 13.79 1,190,000 24.53 630,000 112.50 Long-term debt, 10% 600,000 14.78 400,000 8.25 (200,000) –33.33  Total liabilities 1,160,000 28.57 1,590,000 32.78 430,000 37.07 Capital stock 2,000,000 49.26 2,000,000 41.24 0 0.00 Retained earnings 900,000 22.17 1,260,000 25.98 360,000 40.00 Total liabilities and equity $ 4,060,000 100.00% $ 4,850,000 100.00% $ 790,000 19.46%

The investigation of significant differences (step 4) is probably the most critical step in the analytical procedures process. After generating basic financial data and relationships, the next step is to determine whether the financial changes and relationships actually describe what is going on within the company. According to the current-year unaudited financial statements in Exhibit 4.9, the company increased net income by increasing sales 10 percent, reducing cost of goods sold as a proportion of sales, and controlling other expenses. At least some of the sales growth appears to have been prompted by easier access to credit (accounts receivable increased by 80 percent) and more service (more equipment in use). The company also appears to have used most of its cash and borrowed more to purchase equipment, make payments on long-term debt, and pay dividends. Inventory and cost of goods sold, on the other hand, remained fairly consistent compared to the previous year, with both accounts increasing by only 6.7 percent.

The next step is to ask, “What could be wrong?” and “What errors and frauds, as well as legitimate explanations, could account for these financial results?” As an example of how analytical procedures are used, we limit our attention to the Accounts Receivable and Inventory accounts. At this point, some other ratios can help support the analysis. Exhibit 4.10 contains several familiar ratios. (Appendix 4A at the end of this chapter contains these ratios and their formulas.)

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 141

lou6920X_ch04_117-171.indd 141 02/29/20 06:35 PM

∙ Question: Are the accounts receivable collectible? (Alternative: Is the allowance for doubtful accounts large enough?) Easier credit can lead to more bad debts. The company has a much larger amount of receivables, the days’ sales in receivables has increased significantly, the receivables turnover has decreased, and the allowance for doubtful accounts is smaller in proportion to the receivables. If the prior-year allow- ance for bad debts at 8 percent of receivables was appropriate and conditions have not become worse, it could be that the allowance should be closer to $72,000 than $50,000. The auditors should work carefully on the evidence related to accounts receivable valuation.

∙ Question: Could the inventory be overstated? (Alternative: Could the cost of the goods sold be understated?) Overstatement of the ending inventory would cause the cost of goods sold to be understated. The percentage of cost of goods sold to sales shows a decrease. If 75 percent of the prior year represents a more accurate cost of goods sold amount, then the income before taxes could be overstated by $225,000 (75 percent of $9.9 million minus $7.2 million unaudited cost of goods sold). The days’ sales in inventory and the inventory turnover remained the same, but you could expect them to change in light of the larger volume of sales. Careful work on the physical count and valuation of inventory appears to be needed.

Other questions can be asked and other relationships derived when industry statistics are available. Industry statistics can be obtained from such services as Yahoo! Finance, Google Finance, Dun & Bradstreet, and Standard & Poor’s. These statistics include industry averages for important financial benchmarks such as gross profit margin, return on sales, current ratio, debt/net worth, and various others. A comparison with client data can reveal out-of-line statistics, indicating a relatively strong feature of the company, a weak financial position, or possibly an error or misstatement in the client’s financial statements. However, care must be taken with industry statistics. A particular company could or could not be well represented by industry averages.

Comparing reported financial results with internal budgets and forecasts also can be useful. If the budget or forecast represents management’s estimate of probable future outcomes, planning questions can arise for items that fall short of or exceed the budget. If a company that expected to sell 10,000 units of a product sold only 5,000 units, the

  Prior Year Current Year Percent Change

Balance-Sheet Ratios

Current ratio 4.57 2.23 —51.29% Days’ sales in receivables 18.40 30.91 67.98 Doubtful accounts ratio 0.0800 0.0556 —30.56 Days’ sales in inventory 80.00 80.00 0.00 Debt/equity ratio 0.40 0.49 21.93

Operations Ratios

Receivables turnover 19.57 11.65 —40.47 Inventory turnover 4.50 4.50 0.00 Cost of goods sold/Sales 75.00% 72.73% —3.03 Gross margin percentage 25.00% 27.27% 9.09 Return on beginning equity 6.62% 12.76% 92.80

Financial Distress Ratios (Altman)

Working capital/Total assets 0.49 0.30 —38.89 Retained earnings/Total assets 0.22 0.26 17.20 EBIT/Total assets 0.09 0.14 54.87 Market value of equity/Total debt 2.59 1.89 —27.04 Net sales/Total assets 2.22 2.04 —7.92 Discriminant Z-score 4.96 4.35 —12.32

EXHIBIT 4.10 Dunder-Mifflin Inc.— Selected Financial Ratios

First Pages

lou6920X_ch04_117-171.indd 142 02/29/20 06:35 PM

142 Part Two The Financial Statement Audit

auditors would want to plan a careful analysis of the inventory of unsold units for obso- lescence (valuation). If 15,000 were sold, an auditor would want to audit for sales validity (occurrence). Budget comparisons can be tricky, however. Some companies use budgets and forecasts as goals rather than as expressions of probable outcomes. Also, meeting the budget with little or no shortfall or excess can result from managers’ manipulating the numbers to “meet the budget.” Auditors must be careful to know something about an entity’s business conditions from sources other than the internal records when analyzing comparisons with budgets and forecasts to determine inherent risk.

Cash flow analysis enables the auditors to see the crucial information of cash flow from operating, investing, and financing activities. A cash flow deficit from operations can signal financial difficulty. Companies fail when they run out of cash (no surprise) and are unable to pay their debts when they become due. Professional auditing standards state that audi- tors are responsible for letting financial statement users know whether they have substantial doubts as to whether the client will be able to survive into subsequent periods (i.e., whether the company can remain a going concern), and cash flow analysis is a good starting place.

• Auditors noticed large quantities of rolled steel in the company’s inventory. Several 60,000-pound rolls were entered in the inventory list. The false entries were detected because the auditor knew the company’s forklift trucks had a 20,000-pound lifting capacity.

• Auditors could have compared the total quantity of vegetable oils the company claimed to have inventoried in its tanks to the stor- age capacity reported in national export statistics. The company’s “quantity on hand” amounted to 90 percent of the national supply and greatly exceeded its own tank capacity.

• A comparison of the current year’s balance in accrued wages pay- able to the prior year’s balance revealed a dramatic decrease in the current year. Based on the analytical procedure, it was learned that the company failed to accrue for a significant percentage of its wages payable at the end of the current year.

• Auditors developed a complex regression model to estimate the electric utility company’s total revenue. They used empirical rela- tions of fuel consumption, meteorological reports of weather condi- tions, and population census data in the area. The regression model estimated revenue within close range of the reported revenue.

• Auditors for a small regional airline calculated an estimate of air- line revenue by multiplying the number of company planes times an estimate of the number of flights made by each plane in a year times the number of seats on each plane times an estimate of the average ticket price. The revenue reported by the airline was sig- nificantly higher than the auditors’ estimate, meaning that either more than one person was sitting in the same seat at the same time or that the auditors needed to more closely examine recorded revenue transactions. Additional investigation discovered that the airline was in fact fraudulently overstating its revenues.

Some Examples of Analytical Procedures AUDITING INSIGHT

As previously stated, professional standards require auditors to perform analytical pro- cedures during the planning stages of the audit “with the objective of identifying unusual or unexpected relationships” involving significant financial accounts “that might indicate a material misstatement, including material misstatement due to fraud.” When doing so, the auditor should consider all types of relevant data to help improve their understand- ing of risk on the audit. Importantly, professional standards allow the use of “data that is preliminary or data that is aggregated at a high level” when completing analytical proce- dures at the planning stages. As a result, the increased use of big data and analytical tools has the potential to improve the effectiveness of this type of risk assessment procedure.7

Indeed, auditors now have the opportunity to use new types of analyses that utilize third-party data to supplement their “traditional” analytical procedures. The additional data can help auditors refine their expectations and improve the results of preliminary analytical procedures, which form initial beliefs about the nature, timing, and extent of audit evidence to be gathered from an audit client. While this type of access to increased volumes of data on the client has the potential to improve audit effectiveness, it also can have an initial negative impact on audit efficiency if audit professionals are unable to efficiently execute such additional procedures. 7See PCAOB Auditing Standard No. 2110, Identifying and Assessing Risks of Material Misstatement, paragraphs 46–48.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 143

lou6920X_ch04_117-171.indd 143 02/29/20 06:35 PM

While the availability of even more third-party data offers considerable promise for auditors when completing preliminary analytical procedures, audit professionals in today’s environment also need to learn how to make the best use of internal client data when completing such procedures. For example, when completing preliminary analyti- cal procedures, the availability of largely all of the client’s internal data can allow for a more robust trend analysis (i.e., year over year) on a multitude of financial and nonfinan- cial data. Auditors are encouraged to consider the facts and circumstances of each audit engagement and utilize computer-assisted audited techniques to facilitate the most useful trend analyses for the financial statement audit. The following box provides guidance on how IDEA can be used to improve the efficiency of analytical procedures.

The IDEA software package can be helpful when summarizing inter- nal client data for purposes of analytical procedures used during the planning process. For example, in the IDEA Analysis Workbook, it is stated that “IDEA can help with the preparation of figures for an ana- lytical review. In particular, IDEA can generate analyses that would not otherwise be available. The Stratification task (from the Analysis tab on the IDEA Ribbon) generates a profile of the population in value bands, groups of codes, or dates. This is particularly useful when auditing assets such as accounts receivable, inventories, or loans

or for a breakdown of transactions. Additionally, the information can be summarized by particular codes or subcodes. Figures can also be compared against previous years to determine trends. A chart can be produced if required.”

At the end of this chapter, problems 4.66, 4.67 and 4.68 can be completed to illustrate the use of IDEA during preliminary analytical procedures. To be most useful, each of these analyses would have to be completed for multiple years so comparisons could be made and meaningful expectations could be developed.

Analytical ProceduresUSING IDEA IN THE AUDIT

Before moving forward, here are a few more thoughts about analytical procedures. Pro- fessional standards mandate that analytical procedures are performed at the beginning of an audit—the preliminary stage application of analytical procedures discussed in this chapter and at the end of an audit when the partners in charge review the overall quality of the work and look for apparent problems. Analytical procedures can also be used as a substantive testing procedure to gather evidence about the relevant assertion being tested. When using substantive analytical procedures, the auditor must take great care to develop an indepen- dent expectation that is based on reliable information. When this has been developed, the expectation is compared to the recorded amount, and any significant differences must be investigated and corroborated with documentary evidence. The procedure to provide evi- dence about an assertion must be conducted with exacting precision and a high degree of rigor. Regardless of when analytical procedures are performed, auditors conclude their analytical procedures test work by documenting the team’s findings (step 5).

Interviews with 36 practicing auditors found that the corporate scandals that occurred in the late 1990s/early 2000s and the ensuing Sarbanes– Oxley Act, along with the advent of improved technology, have led to the following changes in how firms perform analytical procedures:

• Increased use of analytical procedures. • Development of more precise, quantitative expectations. • Gathering broader industry and company information, including

nonfinancial information.

• Reliance on analytical procedures more to decrease substantive tests of detail.

• Less experienced staff to conduct (but not to design) a larger por- tion of analytical procedures.

• Increased consideration of underlying controls. Source: G. Trompeter and A. Wright, “The World Has Changed—Have Ana- lytical Procedure Practices?” Contemporary Accounting Research 27, no. 2 (2010), pp. 669–700.

Analytical Procedures in Practice AUDITING INSIGHT

First Pages

lou6920X_ch04_117-171.indd 144 02/29/20 06:35 PM

144 Part Two The Financial Statement Audit

Audit Team Brainstorming Discussions On every audit engagement, the risk assessment process includes required audit team brainstorming sessions in which critical audit areas are discussed. These sessions update audit team members on important aspects of the audit and heighten team members’ awareness of the potential for fraud and errors in the engagement. Items typically discussed include previous experiences with the client, how a fraud might be perpetrated and concealed by the client, and procedures that might detect fraud. When studying a business operation, auditors’ ability to think like a criminal and devise ways to steal can help in creating procedures to determine whether fraud has happened. Often, imaginative extended procedures can be employed to unearth evidence of fraudulent activity.

A secondary objective of the discussions is to set a proper tone for the engagement. These sessions address not only fraud risk, but also other client business and audit-related risk assess- ments. While these brainstorming sessions typically begin during the planning stage of engage- ments, they should be held on a continual basis through the conclusion of the engagement.

Many firms have fraud specialists that assist audit teams throughout the risk assess- ment process. If an auditor’s specialists are assigned to the audit, his/her involvement during brainstorming sessions is particularly important because, as a result of his/her experience, he/she is particularly adept at identifying critical audit areas and how these areas influence the risk of misstatement due to fraud.

• An engagement partner or an auditor’s forensic specialist is the best choice to lead the brainstorming session, but the use of group decision software (which protects individuals’ identities) allows each engagement team member to participate freely with- out fear of intimidation or repercussion. Managers and partners should be active participants.

• Audit team members should be reminded of the purpose of the brainstorming session and stress the importance of professional skepticism.

• A good strategy is to discuss material misstatements found in pre- vious audits and/or frauds found on similar engagements.

• When checklists are used, fully discuss each item on the list and don’t limit discussions solely to items on the checklist. In other words, consider what might have been left off the checklist.

• The idea-generation phase should be separated from the idea- evaluation phase. Considering each threat as it is brought up

may cause individuals to feel slighted and may inhibit further idea generation. Engagement team members should be encouraged to discuss why they feel an identified risk is important.

• An information technology audit specialist should attend. • The session should be held during preplanning or early in the plan-

ning stage. • It should include discussion of how management might perpetrate

fraud and audit responses to fraud risk. • Time should be set aside at the end of the session to indicate how

the audit plan should be modified as a result of the discussions.

Sources: M. Landis, S. Jerris, and M. Braswell, “Better Brainstorming,” Journal of Accountancy, October 2008, pp. 70–73; J. F. Brazel, T. D. Carpenter, and J. G. Jenkins, “Auditors’ Use of Brainstorming in the Consideration of Fraud: Reports from the Field,” The Accounting Review 85, no. 4 (2010), pp. 1273–1301.

Some Best Practices in Brainstorming AUDITING INSIGHT

Inquiry of Audit Committee, Management, and Others within the Company Interviewing the entity’s management, internal auditors, directors, the audit committee, and other employees is a required audit process that can bring auditors up to date on changes in the business and the industry. Such inquiries of client personnel have the multiple purposes of building personal working relationships, observing the competence and integrity of client personnel, obtaining a general understanding of the client or company, and probing for problem areas that could harbor financial misstatements. Issues to discuss include selection of accounting principles; susceptibility to errors and fraud, including known or suspected fraud; and how management controls and monitors fraud risks. Other company employees to question might include operations or marketing managers or those involved in significant and unusual transactions.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 145

lou6920X_ch04_117-171.indd 145 02/29/20 06:35 PM

Another source of information is company discussion boards or apps where anony- mous whistleblowers can post information that management may not wish to disclose to auditors.

Blind is an app launched originally in the US in 2015 that allows employees to anonymously post about compensation, workplace harassment, company policies, and more. Employees use company email addresses to create an account with Blind, after which the employee is verified and added to a specific company board that is only visible by employees of that firm. Despite using a work email address to sign up, Blind claims on their website to have a “patented infrastructure” to guarantee the anonymity of posts. Blind has recently begun accepting public domain names such as Gmail and Yahoo, although accounts created with public domains will have limited access to only topics channels, which include HR Issues, office life, etc. Blind is not the first app of it’s kind, it follows apps such as Secret

and Whisper, although it is unique in that it is more focused on sharing “workplace” secrets.

Recently, Blind has received a lot of press for exposing sexual harassment issues and inappropriate accessing of customer data within organizations. As auditors, what kind of information could Blind tell us about management integrity at the client? Could account- ing fraud be the next big trending topic on Blind? Auditors may want to consider thinking out of the box, and looking inside the apps, as another source of information about their clients.

Source: Sara O’Brien, “App lets workers talk about their companies anonymously,” CNN Business, February 12, 2018, https://money.cnn. com/2018/02/12/technology/blind-app/index.html

What do Apps Like “Blind” Mean for Auditors?AUDITING INSIGHT

OVERALL ASSESSMENT AND DOCUMENTATION OF INHERENT RISK ASSESSMENT

The overall goal of the risk assessment process that has been described in this chapter is to identify and then properly assess the risks of material misstatement that exist at an audit client. Once the risk assessment process is complete, auditors have a basis to plan and then implement an appropriate testing response for each of the assessed risks. This process must be completed in a very detailed manner for each relevant assertion related to each significant financial statement account and disclosure. In a sense, auditors need to think about how all of the risks identified at the company and the financial statement level could affect risks of material misstatement at the relevant assertion level. If you recall from our discussion of the audit risk model, the overall risk of material misstatement includes both inherent risk and control risk. We will discuss the assessment of control risk and the effect of tests of control in Chapter 5. For now, we will focus on the assessment of inherent risk, which needs to be evaluated without regard to the system of internal controls.

The assessment of inherent risk needs to occur for each significant financial statement account and disclosure. An account or disclosure is significant if there is a chance that it could contain a material misstatement. When making this determination, the auditor should evaluate both the quantitative and the qualitative risk factors associated with the financial statement account or disclosure. When doing so, clearly the overall materiality level is a critically important factor. However, it is possible that an account or disclo- sure could be significant even though its balance is below materiality. For example, an account balance may be understated or a disclosure could be omitted, among a host of other factors. Once each of the significant accounts and disclosures have been identified, the auditor then needs to identify the relevant financial statement assertions.

Relevant Assertions According to the professional standards (AS 2201.28), a financial statement assertion is relevant if it has a “reasonable possibility of containing a misstatement that would cause the financial statements to be materially misstated.”* Therefore, based on all of the

LO 4-5 Explain how auditors complete and document the overall assessment of inherent risk.

Public Company Accounting Oversight Board. “AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements.” Accessed June 24, 2019. https://pcaobus.org/Standards/Auditing/Pages/AS2201.aspx.

First Pages

lou6920x_ch04_117-171.indd 146 03/06/20 06:00 PM

146 Part Two The Financial Statement Audit

risk assessment procedures performed, auditors must identify those assertions that have a meaningful bearing on whether the account is fairly stated. For example, the valuation assertion would only be relevant to the cash account if the audit client had cash accounts that were denominated in a foreign currency. However, due to the nature of cash, it is likely that the existence assertion would always be relevant.

Once each relevant assertion is identified for each significant account and disclosure, the auditor must then identify the likely sources of misstatements that could cause the financial statements to be materially misstated. It is important that this step is completed at a detailed and almost granular level. To do so, the professional standards suggest that an auditor should consider “what could go wrong” when thinking about each of the relevant financial statement assertions. The comprehensive identification of “what could go wrong” for each relevant financial statement assertion is the foundation for the risk assessment pro- cess and ultimately the audit plan. Exhibit 4.11 provides a summary of this process.

Once the likely sources of misstatements that could cause the financial statements to be materially misstated have been identified, the auditors’ next task is to assess the types of risk present, the likelihood that material misstatement has occurred, the magnitude of the risk, and the pervasiveness of the potential for misstatement. This lays the groundwork for the identification of internal controls that the client should have in place to mitigate the various risks of material misstatement, which will be explored in detail in Chapter 5.

Document Risk Assessment Auditors must carefully document the risk assessment process in the workpapers to pro- vide a record of the procedures performed. Items that must be documented include the following:

∙ Discussions with engagement personnel. ∙ Procedures to identify and assess risk. ∙ Significant decisions during discussion. ∙ Specific risks identified and audit team responses. ∙ Explanation of why improper revenue recognition is not a risk, if so deemed. ∙ Results of audit procedures, particularly procedures regarding management override. ∙ Other conditions causing auditors to believe that additional procedures are required. ∙ Communications to management and those charged with governance, such as the audit

committee.

Fraud and Other Significant Risks In addition to the risk assessment based on factors previously identified, auditing standards require several other fraud risk assessments to be made. First, auditors must presume that improper revenue recognition is a fraud risk. Another risk is that, despite the existence of controls, management might override the controls through force of authority. Because sev- eral major frauds were committed through year-end adjusting entries (such as WorldCom’s capitalization of telephone line expenses), auditors must examine journal entries and other

EXHIBIT 4.11 What Could Go Wrong?

Significant Accounts Relevant Assertions What Could Go Wrong?

Existence The cash balance may not exist in the company’s bank accounts.

 Cash Valuation The cash balance that is held in foreign countries may not have been translated properly.

  Presentation and disclosure There may be restrictions on the cash balance that were not properly disclosed.

Accounts Receivable  

Existence Accounts receivable balances are inflated and don’t really exist.

Completeness Not all accounts receivable have been recorded.

Valuation Receivables are not included in financial statements at the appropriate amount, and valuation adjustments are not recorded properly.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 147

lou6920X_ch04_117-171.indd 147 02/29/20 06:35 PM

adjustments (especially those made close to year-end). If any significant and unusual account- ing entries are identified, auditors must evaluate the business rationale behind the significant transactions. Team members gather information necessary to identify key fraud risk factors (red flags) indicating an increased potential for fraud to occur.

In addition, while completing risk assessment procedures, auditors may determine that an identified risk represents a significant risk. Significant risks are those risks that require special audit consideration because of the nature of the risk or the likelihood and potential magnitude of misstatement related to the risk. By definition, fraud risks are significant risks. Auditors should specifically examine controls and design tests to address significant risks. Auditors should evaluate quantitative and qualitative risk fac- tors based on the likelihood and potential magnitude of misstatements. They should consider whether the risk is related to recent significant economic, accounting, or other developments; the complexity of transactions; whether the risk involves related parties; the degree of complexity or judgment required and uncertainty involved; and whether the risk involves significant transactions that are unusual or outside the company’s normal course of business.

Auditors must next respond to the results of the risk assessments. Using the audit risk model, the auditor adjusts detection risk for significant accounts and relevant disclosures. Additional considerations must be made for risks identified as significant risks. For example, if the potential for fraud is high, auditors should include more experienced team members. Other responses include examining more transactions, performing extended procedures, including targeting tests toward higher risk areas, performing more tests of transactions at year-end rather than at interim points, and gathering higher quality evidence. Finally, the auditors should use less predictable audit procedures such as “ surprise” inventory observations in which management is not told at which company warehouse locations auditors will show up to watch the client counting inventory or extended procedures such as using larger sample sizes.

Finally, when collecting evidence to support the financial statements throughout the audit, auditors must remain vigilant against the potential for fraud. Discrepancies in the accounting records, conflicting evidence, and missing documentation are all symptom- atic of financial statement fraud. When such instances are identified, auditors must follow up with management to identify the source of the problems. Management’s response is a key source of evidence; vague, implausible, or inconsistent responses to inquiries can be a key indicator of the pervasiveness of the fraud. Similarly, problematic or unusual reac- tions such as refusal to cooperate, hostility, or management delays in responding to the auditors are often present in financial statement frauds. The evaluation for potential fraud continues throughout the audit. Audit team members must be on the lookout for unusual findings or events and, upon discovery, not simply write them off as isolated occurrences.

Communication of Fraud Risks Auditors must always exercise significant care because accusations of fraud are taken very seriously by audit clients. For this reason, if preliminary findings indicate fraud pos- sibilities, auditors should enlist the cooperation of management and assist fraud examina- tion professionals when bringing an investigation to a conclusion.

Standards for external auditors contain materiality thresholds related to auditors reporting their knowledge of frauds. Auditors may consider some minor frauds clearly inconsequential, especially when they involve misappropriations of assets by employees at low organizational levels. Auditors should report these to management at least one level above the people involved. The idea is that small matters can be kept in the manage- ment family. Having said this, fraud has often been compared to an iceberg: most of it can be hidden from sight. For this reason, auditors should be extremely cautious in deciding whether a fraud is “clearly inconsequential.”

On the other hand, frauds involving senior managers or employees with significant internal control roles are never inconsequential and should be reported (along with any frauds that cause material misstatement in the financial statements) directly to those charged with governance, usually the entity’s audit committee of its board of directors.

First Pages

lou6920X_ch04_117-171.indd 148 02/29/20 06:35 PM

148 Part Two The Financial Statement Audit

All companies with securities traded on the exchanges (e.g., New York, American, and NASDAQ) are required to have audit committees. Audit committees are composed of independent, outside members of the board of directors (those not involved in the company’s day-to-day operations) who can provide a buffer between the audit firm and management. Auditing standards set forth requirements intended to ensure that audit committees are informed about the scope and results of the independent audit.8 External auditors are required to make oral or written communications about other topics, including the discovery of fraud.

Auditors are normally required to keep client information confidential. However, under AICPA auditing standards, limited disclosures to outside agencies of frauds and clients’ noncompliance are permitted. If the audit firm resigns or is fired, the firm can cite these matters in the letter attached to SEC Form 8-K, which requires explanation of an organization’s change of auditors. The predecessor auditor may tell the succes- sor auditor about the client when the successor makes the inquiries required by auditing standards. Auditors must respond when answering a subpoena issued by a court or other agency with authority. When performing work under generally accepted government auditing standards (mandated by the Government Accountability Office), auditors are required to report frauds and noncompliance to the client agency under the audit contract.

8Audit standards have broadened communications to include groups that serve in a similar role for private companies and refers to such groups as “those charged with governance.” Audit committees serve in this role for public companies.

REVIEW CHECKPOINTS 4.13 What are some types of knowledge and understanding about a client’s business and industry that

an auditor is expected to obtain? What are some of the methods and sources of information for understanding a client’s business and industry?

4.14 What is the purpose of performing preliminary analytical procedures in audit planning? 4.15 What are the five steps involved with the use of preliminary analytical procedures? 4.16 What are some of the ratios that can be used in preliminary analytical procedures? 4.17 When are analytical procedures required, and when are they optional?

AUDITORS’ RESPONSIBILITIES FOR NONCOMPLIANCE WITH LAWS AND REGULATIONS

In addition to errors and fraud, a client’s noncompliance with laws and regulations can cause financial statements to be materially misstated, and external auditors are advised to be aware of circumstances that could indicate noncompliance (Exhibit 4.12). Auditors are not required to be legal experts, but they must understand the legal and regulatory framework under which their client operates and how the entity is compliant with that framework. Auditing standards deal with two types of noncompliance: (1) direct-effect noncompliance, which produces direct and material effects on financial state- ment amounts (e.g., violations of pension laws or government contract regulations for revenue and expense recognition) that require the same assurance as errors and frauds (i.e., auditors must plan their work to provide reasonable assurance there are no material misstatements), and (2) indirect-effect noncompliance, which refers to violations of laws and regulations that are not directly connected to financial statements (e.g., occupational health and safety, food and drug administration regulations, environmental protection, and equal employment opportunity).

For direct-effect noncompliance, an auditor should consider the laws and regulations that are typically known by auditors to have a direct and potentially material effect on the financial statements. A classic example would be the corporate income tax code. Under

LO 4-6 Explain auditors’ responsibilities with respect to a client’s failure to comply with laws or regulations.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 149

lou6920X_ch04_117-171.indd 149 02/29/20 06:35 PM

tax law, the auditor knows that corporate taxes will impact both the accrued tax payable account and the income tax expense account in the financial statements. Another exam- ple might involve regulations that dictate the amount of revenue to be recorded by a client for a government contract. As you consider these examples and their direct effect on the financial statements, it is not surprising that (AS 2405.05) an “auditors responsibility to detect and report misstatements resulting from illegal acts having a direct and material effect on the determination of financial statement amounts is the same as that for mis- statements caused by error or fraud.”*

The responsibility for detecting indirect-effect noncompliance is not the same as the responsibility to detect a material misstatement resulting from fraud, as an auditor cannot possibly be expected to know all the relevant laws and regulations that affect their clients. As a result, the professional standards (AS 2405.06) recognize that for indirect-effect non- compliance “an auditor ordinarily does not have sufficient basis for recognizing possible violations of such laws and regulations.”* For example, consider an audit client who has violated environmental regulations. Ultimately, such a violation may result in a contingent liability being recorded in the financial statements. However, the auditor may not become aware of the violation until an investigation occurs or the resultant fine is reported to the auditor by the client. Thus, auditor responsibility for detecting indirect-effect noncompli- ance is limited as follows. If the auditor becomes aware of the possibility that an illegal act occurred that might have a material effect on the financial statements, the auditor should perform procedures that are directly focused on whether such an illegal act occurred. Oth- erwise, because the auditor cannot be considered an expert in all laws and regulations, an auditor is not required to provide assurance about indirect-effect noncompliance.

Of course, auditors must always respond to any type of noncompliance or suspected noncompliance that is identified during the audit. To do so, they must gain an understand- ing of the nature and circumstances of the noncompliance and then evaluate the possible effect on financial statements. The noncompliance should be discussed with manage- ment at a level above the person responsible for the noncompliance. If noncompliance is “clearly inconsequential,” that may be the extent of the follow-up. Noncompliance or suspected noncompliance having financial statement effects of more than this threshold should be reported to those charged with governance such as the audit committee, and the financial statements should contain adequate disclosures about the organization’s non- compliance. Discussion with the client’s legal counsel may also be necessary. External auditors always have the option to withdraw from an engagement if management and directors do not take satisfactory action under the circumstances.

Public Company Accounting Oversight Board. “AS 2405: Illegal Acts by Clients.” Accessed June 24, 2019. https://pcaobus.org/ Standards/Auditing/Pages/AS2405.aspx. Public Company Accounting Oversight Board. “AS 2405: Illegal Acts by Clients.” Accessed June 24, 2019. https://pcaobus.org/ Standards/Auditing/Pages/AS2405.aspx.

The following can be indicators of a company’s noncompliance: • Investigations, fines, or penalties • Payments for unspecified services or loans to consultants, related parties, employees, or government

employees • Excessive sales commissions or agent’s fees • Purchases significantly above or below market • Unusual payments in cash, cashiers’ checks to bearer, or transfers to numbered accounts • Unusual transactions with companies in tax havens • Payments to countries other than origination • Inadequate audit trail • Unauthorized or improperly recorded transactions • Media comment • Noncompliance cited in reports of examinations • Failure to file tax returns or pay government duties or fees

EXHIBIT 4.12 Indicators of Noncompliance

First Pages

lou6920X_ch04_117-171.indd 150 02/29/20 06:35 PM

150 Part Two The Financial Statement Audit

The Private Securities Litigation Reform Act of 1995 imposed another reporting obli- gation. Under this law, when auditors believe an illegal act that is more than “clearly inconsequential” has or may have occurred, the auditors must inform the organization’s board of directors. When the auditors believe the illegal act has a material effect on the financial statements, the board of directors has one business day to inform the U.S. Secu- rities and Exchange Commission (SEC). If the board decides not to inform the SEC, the auditors must (1) within one business day give the SEC the same report they gave the board of directors or (2) resign from the engagement and, within one business day, give the SEC the report. If the auditors do not fulfill this legal obligation, the SEC can impose a civil penalty (e.g., monetary fine) on them.

In April 2018, Panasonic agreed to pay the Department of Justice $137 million and another $143 million to the SEC for a total penalty of $280 million related to violations of the Foreign Corrupt Practices Act (FCPA). Panasonic Avionics Corp. (PAC), the in-flight entertainment unit of Panasonic, hired a “consultant” who was in reality a foreign official that worked at an airline in the middle east, paying the official over $875,000 over 6 years for little or no work to show for it. The official, however, did have some influence over the choice of the in- flight entertainment provider at the airline. As a result, PAC earned more than $92 million in profits from portions of a contract with the airline. In another “in-flight” mishap, PAC paid a consultant who was employed with an unnamed US airline for “inside” or other “sensitive” information about one of their competitors.

The turbulence didn’t stop there for PAC. On record, PAC appro- priately terminated sales agents in their Asia region for not meeting

company compliance requirements. However, PAC continued to use the employees secretly by re-hiring them as subagents of another company. This allowed PAC to hide more than $7 million in payments to at least 13 subagents. The mischaracterization of payments made to consultants and sales agents caused the parent company of Panasonic to falsify their accounting records, in violation of the FCPA.

Source: The United States Department of Justice: Office of Public Affairs, “Panasonic Avionic Corporation Agrees to Pay $137 Million to Resolve Foreign Corrupt Practices Act Charges,” April 30, 2018, https://www.justice.gov/opa/ pr/panasonic-avionics-corporation-agrees-pay-137-million-resolve-foreign- corrupt-practices-act. Aaron Smith, “Panasonic agrees to pay US government $280 million for anti-bribery violations,” CNN Business, April 30, 2018, https:// money.cnn.com/2018/04/30/news/companies/panasonic-us-government- penalty/index.html

That’s Some Costly In-flight Entertainment AUDITING INSIGHT

REVIEW CHECKPOINT 4.18 How do the professional audit standards differ for (a) errors, (b) frauds, (c) direct-effect

noncompliance, and (d) indirect-effect noncompliance?

AUDIT STRATEGY MEMORANDUM The audit plan discussed in Chapter 3, which summarizes all of the important planning information and serves to document that auditors have followed generally accepted audit- ing standards, includes a description of the audit strategy memorandum. After assessing the overall financial statement risks, determining which accounts are significant, and which assertions are relevant to those accounts, the auditor should establish an overall audit strategy that sets the scope, timing, and direction for auditing each relevant assertion. The strategy is a result of the audit risk model. If auditors believe they can rely on company controls to mitigate risks, they test the controls as described in Chapter 5. Depending on the results of such tests, the auditors determine the nature, timing, and extent of substan- tive procedures. If the auditors identified fraud risk or other significant risks or noncom- pliance with laws and regulations, they specifically address them in the strategy, including the possibility of adding fraud specialists to the team or by expanding testing.

In establishing the overall audit strategy, the auditor should take into account (1) the reporting objectives of the engagement and the nature of the communications required

LO 4-7 Describe the content and purpose of an audit strategy memorandum.

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 151

lou6920X_ch04_117-171.indd 151 02/29/20 06:35 PM

by auditing standards, (2) the factors that are significant in directing the activities of the engagement team, and (3) the results of preliminary engagement activities and the auditor’s evaluation risk assessment. Also, various laws or regulations may require other matters to be communicated. The strategy should outline the nature, timing, and extent of resources necessary to perform the engagement. Planned tests of controls, substan- tive procedures, and other planned audit procedures required to be performed so that the engagement complies with auditing standards should be documented with specific direc- tions about the effect on the audit.

The audit strategy memorandum becomes the basis for preparing the audit plan that lists the audit procedures to be completed for each relevant assertion related to each sig- nificant account and disclosure identified on the audit engagement. Since the audit pro- cedures to be performed by the auditors are designed to gather sufficient appropriate evidence on which to base their audit opinion on the financial statements, the professional auditing standards require a written audit plan that documents the audit strategy on each engagement. An example of an audit strategy memorandum is presented in Appendix 4B.

REVIEW CHECKPOINT 4.19 What is the purpose of an audit strategy memorandum? What information should it contain?

According to AS 1101.03, “To form an appropriate basis for expressing an opinion on the financial statements, the auditor must plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement due to error or fraud. Reasonable assurance is obtained by reducing audit risk to an appro- priately low level through applying due professional care, including obtaining sufficient appropriate audit evidence.”* In order to accomplish this objective, the auditor must take the time to carefully assess audit risk on each audit engagement.

Audit risk is the risk assumed by the auditors that they could express an incorrect opinion on financial statements that are materially misstated as a result of errors or fraud. The audit risk model breaks down audit risk into three components: inherent risk, control risk, and detection risk. Inherent risk involves the susceptibility of accounts to misstate- ment (assuming that no controls are present). Control risk addresses the effectiveness (or lack thereof) of the controls in preventing or detecting misstatements. Inherent and control risk are often combined and referred to as the risk of material misstatement. Detection risk involves the effectiveness of the auditors’ procedures in detecting fraud or misstatement. Solving for detection risk in the audit risk model yields guidance for the preparation of the audit plan and the nature, timing, and extent of further audit procedures to be performed.

Risk assessment starts with knowledge of the types of errors and frauds that can be perpetrated. It involves understanding the company, its industry, and its environment. Auditors assess risk by obtaining public and internal information, holding team brain- storming discussions, performing analytical procedures, and inquiring of management, directors, and key employees. The culmination of the auditor’s risk assessment process is the identification of the risk of material misstatement for each relevant assertion for each significant account and disclosure on each audit engagement. During the engagement, auditors respond to identified risks by increasing the effectiveness of their procedures and employing specialists and experienced personnel when necessary. Audit strategies are the auditors’ summaries of their assessments and how they will respond to identified risks, particularly significant risks, which include the risk of fraud. Audit strategies are documented in the audit plan.

Public Company Accounting Oversight Board. “Auditing Standard No. 14: Evaluating Audit Results.” Accessed June 24, 2019. https://pcaobus.org/Standards/Archived/PreReorgStandards/Pages/Auditing_Standard_14.aspx.

Summary

First Pages

lou6920X_ch04_117-171.indd 152 02/29/20 06:35 PM

152 Part Two The Financial Statement Audit

accounting estimates: The approximations of financial statement numbers often included in financial statements, 135 analytical procedures: Procedures that allow auditors to evaluate financial information by studying relationships among both financial and nonfinancial data. When used near the end of the audit, analytical procedures allow auditors to assess the conclusions reached during the audit and evaluate the overall financial statement presentation, 138 audit committee: A subcommittee of the board of directors that is generally composed of three to six “outside” members of the organization’s board of directors, 148 audit risk: The risk that the auditor will express an inappropriate audit opinion when the financial statements are materially misstated (e.g., giving an unmodified opinion on financial statements that are misleading because of material misstatements the auditors failed to discover), 118 audit strategy memorandum: The scope, timing, and direction for auditing each relevant assertion based on the results of the audit risk model, 150 business risks: Those factors, events, and conditions that could prevent the organization from achieving its business objectives, 136 control risk: The likelihood that the client’s internal control policies and procedures fail to prevent or detect a material misstatement, 120 defalcation: Another name for employee fraud and embezzlement, 128 detection risk: The likelihood that the auditors’ substantive procedures will fail to detect a material misstatement that exists within an account balance or class of transactions, 120 direct-effect noncompliance: The violations of laws or government regulations by the entity or its management or employees that produce direct and material effects on dollar amounts in financial statements, 148 embezzlement: A type of fraud involving employees or nonemployees wrongfully taking money or property entrusted to their care, custody, and control, often accompanied by false accounting entries and other forms of lying and cover-up, 128 employee fraud: The use of fraudulent means to take money or other property from an employer. It consists of three phases: (1) the fraudulent act, (2) the conversion of the money or property to the fraudster’s use, and (3) the cover-up, 128 errors: The unintentional misstatements or omissions of amounts or disclosures in financial statements, 128 extended procedures: The audit procedures used in response to heightened fraud awareness as the result of the identification of significant risks, 147 fraud: The misrepresentation of facts that the individual knows to be false with the intention to deceive, 126 fraudulent financial reporting: Intentional misstatements, including omissions of amounts or disclosures in financial statements intended to deceive financial statement users, 128 horizontal analysis: The comparative analysis of year-to-year changes in balance-sheet and income-statement accounts, 139 indirect-effect noncompliance: The violation of laws and regulations that does not directly affect specific financial statement accounts or disclosures (e.g., violations relating to insider securities trading, occupational health and safety, food and drug administration regulations, environmental protection, and equal employment opportunity), 148 inherent risk: The probability that in the absence of internal controls, material errors or frauds could enter the accounting system used to develop financial statements, 119 larceny: The simple theft of an employer’s property that is not entrusted to an employee’s care, custody, or control, 128 management fraud: The deliberate fraud committed by management that injures investors and creditors through materially misleading information, 128 misappropriation of assets: Asset theft from an entity. It is often perpetrated by employees in small amounts and is sometimes referred to as employee fraud, 128 related parties: Those individuals or organizations that are closely tied to the audit client, possibly through family ties or investment relationships, 134 relevant assertion: A financial statement assertion that has a reasonable possibility of containing a misstatement or misstatements that would cause the financial statements to be materially misstated, 119 risk of material misstatement (RMM): The combined inherent and control risk; in other words, the likelihood that material misstatements may have entered the accounting system and not been detected and corrected by the client’s internal control, 119

Key Terms

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 153

lou6920X_ch04_117-171.indd 153 02/29/20 06:35 PM

significant account or disclosure: An account or disclosure that has a reasonable possibility of containing a material misstatement individually or when aggregated with others regardless of the effect of controls, 119 significant risk: A risk of material misstatement that requires special audit consideration. Fraud risk is always considered significant risk, 147 vertical analysis: The common-size analysis of financial statement amounts created by expressing amounts as proportions of a common base such as sales for the income-statement accounts or total assets for the balance-sheet accounts, 139 white-collar crime: Fraud perpetrated by people who work in offices and steal with a pencil or a computer terminal. The contrast is with violent street crime, 128

4.20 Auditing standards do not require auditors of financial statements to a. Understand the nature of errors and frauds. b. Assess the risk of occurrence of errors and frauds. c. Design audits to provide reasonable assurance of detecting errors and frauds. d. Report all errors and frauds found to police authorities.

4.21 If sales were overstated by recording a false credit sale at the end of the year, where could you find the false “dangling debit”? a. Inventory. b. Cost of goods sold. c. Bad debt expense. d. Accounts receivable.

4.22 One of the typical characteristics of management fraud is a. Falsification of documents in order to misappropriate funds from an employer. b. Victimization of investors through the use of materially misleading financial statements. c. Illegal acts committed by management to evade laws and regulations. d. Conversion of stolen inventory to cash deposited in a falsified bank account.

4.23 Which of the following circumstances would most likely cause an audit team to perform extended procedures? a. Supporting documents are produced when requested. b. The client made several large adjustments at or near year-end. c. The company has recently hired a new chief financial officer after the previous one

retired. d. The company maintains several different petty cash funds.

4.24 The likelihood that material misstatements may have entered the accounting system and not been detected and corrected by the client’s internal control is referred to as a. Inherent risk. b. Control risk. c. Detection risk. d. Risk of material misstatement.

4.25 The risk of material misstatement is composed of which audit risk components? a. Inherent risk and control risk. b. Control risk and detection risk. c. Inherent risk and detection risk. d. Inherent risk, control risk, and detection risk.

LO 4-2

LO 4-2

LO 4-2

LO 4-2

LO 4-3

LO 4-1

All applicable questions are available with Connect.

Multiple-Choice Questions for Practice and Review

First Pages

lou6920X_ch04_117-171.indd 154 02/29/20 06:35 PM

154 Part Two The Financial Statement Audit

4.26 The risk that the auditors’ own testing procedures will lead to the decision that material mis- statements do not exist in the financial statements when in fact such misstatements do exist is a. Audit risk b. Inherent risk c. Control risk d. Detection risk

4.27 The auditors assessed risk of material misstatement at 0.50 and said they wanted to achieve a 0.05 risk of failing to express a correct opinion on financial statements that were materially misstated. What detection risk do the auditors plan to use for planning the remainder of the audit work? a. 0.20 b. 0.10 c. 0.75 d. 0.00

4.28 If tests of controls induce the audit team to change the assessed level of control risk for fixed assets from 0.4 to 1.0 and audit risk (0.05) and inherent risk remain constant, the acceptable level of detection risk is most likely to a. Change from 0.1 to 0.04. b. Change from 0.2 to 0.3. c. Change from 0.25 to 0.1. d. Be unchanged.

4.29 Which of the following is a specific audit procedure that would be completed in response to a particular fraud risk in an account balance or class of transactions? a. Exercising more professional skepticism. b. Carefully avoiding conducting interviews with people in areas that are most susceptible

to fraud. c. Performing procedures such as inventory observation and cash counts on a surprise or

unannounced basis. d. Studying management’s selection and application of accounting principles more carefully.

4.30 Analytical procedures are generally used to produce evidence from a. Confirmations mailed directly to the auditors by client customers. b. Physical observation of inventories. c. Relationships among current financial balances and prior balances, forecasts, and

nonfinancial data. d. Detailed examination of external, external-internal, and internal documents.

4.31 Which of the following relationships between types of analytical procedures and sources of information are most logical?

LO 4-1

LO 4-1

LO 4-1

LO 4-2

LO 4-4

LO 4-4

Type of Analytical Procedure Source of Information

a. Comparison of current account balances with prior periods Physical production statistics b. Comparison of current account balances with expected balances Company’s budgets and forecasts c.  Evaluation of current account balances with relation to

predictable historical patterns Published industry ratios

d.  Evaluation of current account balances in relation to nonfinancial information

Company’s own comparative financial statements

4.32 Analytical procedures can be used in which of the following ways? a. As a means of overall review near the end of the audit. b. As “attention-directing” methods when planning an audit at the beginning. c. As substantive audit procedures to obtain evidence during an audit. d. All of the above.

LO 4-4

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 155

lou6920X_ch04_117-171.indd 155 02/29/20 06:35 PM

4.33 Analytical procedures used when planning an audit should concentrate on a. Weaknesses in the company’s internal control activities. b. Predictability of account balances based on individual significant transactions. c. Management assertions in financial statements. d. Accounts and relationships that can represent specific potential problems and risks in the

financial statements. 4.34 When a company that sells its products with a positive gross profit increases its sales by

15 percent and its cost of goods sold by 7 percent, the cost of goods sold ratio will a. Increase. b. Decrease. c. Remain unchanged. d. Not be able to be determined with the information provided.

4.35 Auditors are not responsible for accounting estimates with respect to a. Making the estimates. b. Determining the reasonableness of estimates. c. Determining that estimates are presented in conformity with GAAP. d. Determining that estimates are adequately disclosed in the financial statements.

4.36 An audit strategy memorandum contains a. Specifications of auditing standards relevant to the financial statements being audited. b. Specifications of procedures the auditors believe appropriate for the financial statements

under audit. c. Documentation of the assertions under audit, the evidence obtained, and the conclusions

reached. d. Reconciliation of the account balances in the financial statements with the account bal-

ances in the client’s general ledger. 4.37 It is acceptable under generally accepted auditing standards for an audit team to

a. Assess risk of material misstatement at high and achieve an acceptably low audit risk by performing extensive substantive tests.

b. Assess control risk at zero and perform a minimum of detection work. c. Assess inherent risk at zero and perform a minimum of detection work. d. Decide that audit risk can be 40 percent.

4.38 Under the Private Securities Litigation Reform Act (the Act), independent auditors are required to first a. Report in writing all instances of noncompliance with the act to the client’s board of directors. b. Report to the SEC all instances of noncompliance with the act they believe have a mate-

rial effect on financial statements if the board of directors does not first report to the SEC. c. Report clearly inconsequential noncompliance with the act to the audit committee of the

client’s board of directors. d. Resign from the audit engagement and report the instances of noncompliance with the

act to the SEC. 4.39 When evaluating whether accounting estimates made by management are reasonable,

auditors would be most interested in which of the following? a. Key factors that are consistent with prior periods. b. Assumptions that are similar to industry guidelines. c. Measurements that are objective and not susceptible to bias. d. Evidence of a conservative systematic bias.

4.40 An audit committee is a. Composed of internal auditors. b. Composed of members of the audit team. c. Composed of members of a company’s board of directors who are not involved in the

day-to-day operations of the company. d. A committee composed of persons not associating in any way with the client or the board

of directors.

LO 4-4

LO 4-4

LO 4-3

LO 4-7

LO 4-1

LO 4-6

LO 4-3

LO 4-3

First Pages

lou6920X_ch04_117-171.indd 156 02/29/20 06:35 PM

156 Part Two The Financial Statement Audit

4.41 When auditors become aware of noncompliance with a law or regulation committed by client personnel, the primary reason that the auditors should obtain a better understanding of the nature of the act is to a. Recommend remedial actions to the audit committee. b. Evaluate the effect of the noncompliance on the financial statements. c. Determine whether to contact law enforcement officials. d. Determine whether other similar acts could have occurred.

4.42 Which of the following statements best describes auditors’ responsibility for detecting a client’s noncompliance with a law or regulation? a. The responsibility for detecting noncompliance exactly parallels the responsibility for

errors and fraud. b. Auditors must design tests to detect all material noncompliance that indirectly affects the

financial statements. c. Auditors must design tests to obtain reasonable assurance that all noncompliance with

direct material financial statement effects is detected. d. Auditors must design tests to detect all noncompliance that directly affects the financial

statements.

4.43 Auditors perform analytical procedures in the planning stage of an audit for the purpose of a. Deciding the matters to cover in an engagement letter. b. Identifying unusual conditions that deserve more auditing effort. c. Determining which of the financial statement assertions are the most important for the

client’s financial statements. d. Determining the nature, timing, and extent of further audit procedures for auditing the

inventory.

4.44 A primary objective of analytical procedures used in the final review stage of an audit is to a. Identify account balances that represent specific risks relevant to the audit. b. Gather evidence from tests of details to corroborate financial statement assertions. c. Detect fraud that may cause the financial statements to be misstated. d. Assist the auditor in evaluating the overall financial statement presentation.

(AICPA adapted)

4.45 An auditor’s analytical procedures indicate a lower than expected return on an equity method investment. This situation most likely could have been caused by a. An error in recording amortization of the excess of the investor’s cost over the invest-

ment’s underlying book value. b. The investee’s decision to reduce cash dividends declared per share of its common stock. c. An error in recording the unrealized gain from an increase in the fair value of available-

for sale securities in the income account for trading securities. d. A substantial fluctuation in the price of the investee’s common stock on a national stock

exchange. (AICPA adapted)

4.46 Which of the following risk types increase when an auditor performs substantive analytical audit procedures for financial statement accounts at an interim date? a. Inherent b. Control c. Detection d. Sampling

(AICPA adapted)

4.47 Which of the following matters relating to an entity’s operations would an auditor most likely consider as an inherent risk factor in planning an audit? a. The entity’s fiscal year ends on June 30. b. The entity enters into significant derivative transactions as hedges.

LO 4-6

LO 4-6

LO 4-4

LO 4-4

LO 4-4

LO 4-4

LO 4-3

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 157

lou6920X_ch04_117-171.indd 157 02/29/20 06:35 PM

c. The entity’s financial statements are generated at an outside service center. d. The entity’s financial data is available only in computer-readable form.

(AICPA adapted)

4.48 What is the primary objective of the fraud brainstorming session? a. Determine audit risk and materiality. b. Identify whether analytical procedures should be applied to the revenue accounts. c. Assess the potential for material misstatement due to fraud. d. Determine whether the planned procedures in the audit plan will satisfy the general audit

objectives. (AICPA adapted)

LO 4-2

4.49 Analytical Procedures and Interest Expense. Weyman Z. Wannamaker is the chief finan- cial officer of Cogburn Company. He prides himself on being able to manage the company’s cash resources to minimize the interest expense. Consequently, on the second business day of each month, Weyman pays down or draws cash on Cogburn’s revolving line of credit at First National Bank in accordance with his cash requirements forecast.

You are the auditor. You find the information on this line of credit in the following table. You inquired at First National Bank and learned that Cogburn Company’s loan agreement specifies payment on the first day of each month for the interest due on the previous month’s outstanding balance at the rate of “prime plus 1.5 percent.” The bank gave you a report that showed the prime rate of interest was 8.5 percent for the first six months of the year and 8.0 percent for the last six months.

Cogburn Company Notes Payable Balances

Date Balance

Jan 1 $150,000 Feb 1 200,000 Apr 1 225,000 May 1 285,000 Jun 1 375,000 Aug 1 430,000 Sep 1 290,000 Oct 1 210,000 Nov 1 172,000 Dec 1 95,000

Required: a. Prepare an audit estimate of the amount of interest expense you expect to find as the bal-

ance of the interest expense account related to these notes payable. b. Which of the types of analytical procedures did you use to determine this estimate? c. Suppose that you find that the interest expense account shows expense of $23,650 related

to these notes. What could account for this difference? d. Suppose that you find that the interest expense account shows expense of $24,400 related

to these notes. What could account for this difference? e. Suppose that you find that the interest expense account shows expense of $25,200 related

to these notes. What could account for this difference?

4.50 Appropriateness of Evidence and Related Parties. Johnson & Company, CPAs, audited Guaranteed Savings & Loan Company. M. Johnson had the assignment of evaluating the collectability of real estate loans. Johnson was working on two particular loans:

LO 4-4

LO 4-3

All applicable Exercises and Problems are available with Connect.

Exercises and Problems

First Pages

lou6920X_ch04_117-171.indd 158 02/29/20 06:35 PM

158 Part Two The Financial Statement Audit

(1) a $4 million loan secured by Smith Street Apartments and (2) a $5.5 million construction loan on Baker Street Apartments now being built. The appraisals performed by Guaranteed Appraisal Partners Inc. showed values in excess of the loan amounts. On inquiry, Bumpus, the S&L vice president for loan acquisition, stated, “I know the Smith Street loan is good because I myself own 40 percent of the partnership that owns the property and is obligated on the loan.”

Johnson then wrote in the audit documentation: (1) the Smith Street loan appears collect- ible as Bumpus personally attested to knowledge of the collectability as a major owner in the partnership obligated on the loan; (2) the Baker Street loan is assumed to be collectible because it is new and construction is still in progress; and (3) the appraised values all exceed the loan amounts.

Required: a. Do you perceive any problems with related-party involvement in the evidence used by

Johnson? Explain. b. Do you perceive any problems with Johnson’s reasoning or the appropriateness of

evidence used in that reasoning?

4.51 Risk of Misstatement in Various Accounts. An auditor must identify the relevant assertions about each significant financial statement account and disclosure and then gather evidence to conclude whether a material misstatement exists for each assertion. The nature of each financial statement account and disclosure contributes to the likelihood that a material misstatement exists. a. In general, which accounts are most susceptible to overstatement? To understatement? b. Why do you think a company could permit asset accounts to be understated? c. Why do you think a company could permit liability accounts to be overstated? d. Which direction of misstatement is most likely: income overstatement or income

understatement?

4.52 Analysis of Accounting Estimates. Oak Industries, a manufacturer of radio and cable TV equipment and an operator of subscription TV systems, had a multitude of problems. Subscription services in a market area, for which $12 million of cost had been deferred, were being terminated, and the customers were not paying on time ($4 million receivables in doubt). The chances are 50-50 that the business will survive another two years.

An electronic part turned out to have defects that needed correction. Warranty expenses are estimated to range from $2 million to $6 million. The inventory of this part ($10 million) is obsolete, but $1 million can be recovered in salvage, or the parts in inventory can be rebuilt at a cost of $2 million. (The selling price of the inventory on hand would then be $8 million, with 20 percent of the selling price required to market and ship the products, and the normal profit is expected to be 5 percent of the selling price.) If the inventory were scrapped, the company would manufacture a replacement inventory at a cost of $6 million, excluding marketing and shipping costs and normal profit.

The company has defaulted on completion of a military contract, and the government is claiming a $2 million refund. Company attorneys think the dispute might be settled for as little as $1 million.

The auditors had previously determined that an overstatement of income before taxes of $7 million would be material to the financial statements. These items were the only ones left for audit decisions about possible adjustment. Management has presented the following analysis for the determination of loss recognition:

Write off deferred subscription costs $ 3,000,000 Provide allowance for bad debts 4,000,000 Provide for expected warranty expense 2,000,000 Lower-of-cost-or-market inventory write-down 2,000,000 Loss on government contract refund ????????

Required: Prepare your own analysis of the amount of adjustment to the financial statements. Assume that none of these estimates have been recorded yet, and give the adjusting entry you would

LO 4-3

LO 4-3

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 159

lou6920X_ch04_117-171.indd 159 02/29/20 06:35 PM

recommend. Give any supplementary explanations you believe necessary to support your recommendation.

4.53 Horizontal and Vertical Analysis. Horizontal analysis refers to changes of financial state- ment numbers and ratios across two or more years. Vertical analysis refers to financial statement amounts expressed each year as proportions of a base such as sales for the income- statement accounts and total assets for the balance-sheet accounts. Exhibit 4.53.1 contains Retail Company’s prior-year (audited) and current-year (unaudited) financial statements, along with amounts and percentages of change from year to year (horizontal analysis) and common-size percentages (vertical analysis). Exhibit 4.53.2 contains selected financial ratios based on these financial statements. Analysis of these data can enable auditors to discern relationships that raise questions about misleading financial statements.

Required: Study the data in Exhibits 4.53.1 and 4.53.2. Write a memorandum identifying and explain- ing potential problem areas where misstatements in the current-year financial statements could exist. Additional information about Retail Company is as follows:

LO 4-4

EXHIBIT 4.53.1 Retail Company

  Prior Year (Audited) Current Year (Unaudited) Change

  Balance Common Size Balance Common Size Amount Percent

Assets:              Cash $ 600,000 14.78% $ 484,000 9.69% $ (116,000) –19.33%  Accounts receivable 500,000 12.32 400,000 8.01 (100,000) –20.00  Allowance doubt. accts. (40,000) –0.99 (30,000) –0.60 10,000 –25.00  Inventory 1,500,000 36.95 1,940,000 38.85 440,000 29.33   Total current assets 2,560,000 63.05 2,794,000 55.95 234,000 9.14  Fixed assets 3,000,000 73.89 4,000,000 80.10 1,000,000 33.33  Accum. depreciation (1,500,000) –36.95 (1,800,000) –36.04 (300,000) 20.00 Total assets $ 4,060,000 100.00% $ 4,994,000 100.00% $ 934,000 23.00% Liabilities and equity:  Accounts payable $ 450,000 11.08% $ 600,000 12.01% $ 150,000 33.33%  Bank loans, 11% 0 0.00 750,000 15.02 750,000 NA  Accrued interest 50,000 1.23 40,000 0.80 (10,000) –20.00  Accruals and other 60,000 1.48 10,000 0.20 (50,000) –83.33   Total current liab. 560,000 13.79 1,400,000 28.03 840,000 150.00  Long-term debt, 10% 500,000 12.32 400,000 8.01 (100,000) –20.00   Total liabilities 1,060,000 26.11 1,800,000 36.04 740,000 69.81  Capital stock 2,000,000 49.26 2,000,000 40.05 0 0  Retained earnings 1,000,000 24.63 1,194,000 23.91 194,000 19.40 Total liabilities and equity $ 4,060,000 100.00% $ 4,994,000 100.00% 934,000 23.00% Statement of operations:  Sales (net) $ 9,000,000 100.00% $ 8,100,000 100.00% $ (900,000) –10.00%  Cost of goods sold 6,296,000 69.96 5,265,000 65.00 (1,031,000) –16.38  Gross margin 2,704,000 30.04 2,835,000 35.00 131,000 4.84  General expense 2,044,000 22.7 2,005,000 24.75 (39,000) –1.91  Depreciation 300,000 3.33 300,000 3.70 0 0  Operating income 360,000 4.00 530,000 6.54 170,000 47.22  Interest expense 50,000 0.56 40,000 0.49 (10,000) –20.00  Income taxes (40%) 124,000 1.38 196,000 2.42 72,000 58.06 Net income $ 186,000 2.07% $ 294,000 3.63% $ 108,000 58.06%

“NA” means not applicable.

First Pages

lou6920X_ch04_117-171.indd 160 02/29/20 06:35 PM

160 Part Two The Financial Statement Audit

∙ The new bank loan, obtained on July 1 of the current year, requires maintenance of a 2:1 current ratio.

∙ Principal of $100,000 plus interest on the 10 percent long-term note obtained several years ago in the original amount of $800,000 is due each January 1.

∙ The company has never paid dividends on its common stock and has no plans for a dividend.

4.54 Analysis and Judgment. As part of your regular year-end audit of a public client, you must estimate the probability of success of its proposed new product line. The client has experienced financial difficulty during the last few years and, in your judgment, a suc- cessful introduction of the new product line is necessary for the client to remain a going concern.

Five elements are necessary for the successful introduction of the product: (1) success- ful labor negotiations before the strike deadline between the construction firms contracted to build the necessary addition to the present plant and the building trades unions, (2) suc- cessful defense of patent rights, (3) product approval by the Food and Drug Administration (FDA), (4) successful negotiation of a long-term raw material contract with a foreign sup- plier, and (5) successful conclusion of distribution contract talks with a large national retail distributor.

In view of the circumstances, you contact experts who have provided your public account- ing firm with reliable estimates in the past. The labor relations expert estimates that there is an 80 percent chance of successfully concluding labor negotiations. Legal counsel advises that there is a 90 percent chance of successfully defending patent rights. The expert on FDA product approvals estimates a 95 percent chance of new product approval. The experts in the remaining two areas estimate the probability of successfully resolving (1) the raw materials contract and (2) the distribution contract talks to be 90 percent in each case. Assume that these estimates are reliable.

Required: What is your assessment of the probability of successful product introduction? (Hint: You can assume that each of the five elements is independent of the others.)

4.55 Analytical Procedures. Kelly Griffin, an audit manager, had begun preliminary analytical procedures of selected statistics related to the Majestic Hotel. Her objective was to obtain an understanding of the hotel’s business in order to draft a preliminary audit plan. She wanted to see whether she could detect any troublesome areas or questionable accounts that could require special audit attention. Unfortunately, Griffin caught the flu and was hospitalized. From her sickbed, she sent you the schedule she had prepared (Exhibit 4.55.1) and has asked you to write a memorandum identifying areas of potential misstatements or other matters that the preliminary audit plan should cover.

LO 4-3

LO 4-4

  Prior Year (audited)

Current Year (unaudited)

Percent Change

Balance-sheet ratios:        Current ratio 4.57 2.0 −56.34%  Days’ sales in receivables 18.40 16.44 −10.63    Doubtful accounts ratio 0.0800 0.0750 −6.25    Days’ sales in inventory 85.77 132.65 54.66    Debt/equity ratio 0.35 0.56 40.89   Operations ratios:        Receivables turnover 19.57 21.89 11.89    Inventory turnover 4.20 2.71 −35.34    Cost of goods sold/sales 69.96% 65.00% −7.08    Gross margin % 30.04% 35.00% 16.49    Return on equity   6.61%   9.80% 48.26  

EXHIBIT 4.53.2 Retail Company

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 161

lou6920X_ch04_117-171.indd 161 02/29/20 06:35 PM

  Majestic (percent)

Industry (percent)

Sales:      Rooms 60.4% 63.9%  Food and beverage 35.7 32.2  Other 3.9 3.9 Costs:      Rooms department 15.2 17.3  Food and beverage 34.0 27.2  Administrative and general 8.0 8.9  Management fee 3.3 1.1  Advertising 2.7 3.2  Real estate taxes 3.5 3.2  Utilities, repairs, maintenance 15.9 13.7 Profit per sales dollar 17.4 25.4 Rooms dept. ratios to room sales dollars:      Salaries and wages 18.9 15.7  Laundry 1.1 3.7  Other 5.3 7.6 Profit per rooms sales dollar 74.8 73.0 Food/beverage (F/B) ratios to F/B sales dollars:      Cost of food sold 42.1 37.0  Food gross profit 57.9 63.0  Cost of beverages sold 43.6 29.5  Beverages gross profit 56.4 70.5  Combined gross profit 57.7 64.6  Salaries and wages 39.6 32.8  Music and entertainment — 2.7  Other 13.4 13.8 Profit per F/B sales dollar 4.7 15.3 Average annual percent of rooms occupied 62.6 68.1 Average room rate per day $160 $120 Number of rooms available per day 200 148

EXHIBIT 4.55.1 Analytical Procedure Documentation

Required: Write a memorandum describing Majestic’s operating characteristics compared to the indus- try average insofar as you can tell from the statistics. Do these analytical procedures identify any areas that could represent potential misstatements in the audit?

4.56 Preliminary Analytical Procedures. Dunder-Mifflin Inc. wanted to expand its manu- facturing and sales facilities. The company applied for a loan from First Bank, presenting the prior-year audited financial statements and the forecast for the current year shown in Exhibit 4.56.1. (Dunder-Mifflin Inc.’s fiscal year-end is December 31.) The bank was impressed with the business prospects and granted a $1,750,000 loan at 8 percent interest to finance working capital and the new facilities that were placed in service July 1 of the current year. Because Dunder-Mifflin Inc. planned to issue stock for permanent financing, the bank made the loan due on December 31 of the following year. Interest is payable each calendar quarter on October 1 of the current year and January 1, April 1, July 1, October 1 of the following year.

The auditors’ interviews with Dunder-Mifflin Inc. management near the end of the cur- rent year produced the following information: The facilities did not cost as much as previ- ously anticipated. However, sales were slow and the company granted more liberal return privilege terms than in the prior year. Officers wanted to generate significant income to impress First Bank and to preserve the company dividend ($120,000 paid in the prior year).

LO 4-4

First Pages

lou6920X_ch04_117-171.indd 162 02/29/20 06:35 PM

162 Part Two The Financial Statement Audit

  Prior Year (audited) Forecast

Current Year (unaudited)

Revenue and Expense:      

Sales (net) $ 9,000,000 $ 9,900,000 $ 9,720,000 Cost of goods sold 6,296,000 6,926,000 7,000,000 Gross margin 2,704,000 2,974,000 2,720,000 General expense 2,044,000 2,000,000 2,003,000 Depreciation 300,000 334,000 334,000 Operating income 360,000 640,000 383,000 Interest expense 60,000 110,000 75,000 Income taxes (40%) 120,000 212,000 123,200 Net income 180,000 318,000 184,800 Assets: Cash 600,000 880,000 690,800 Accounts receivable 500,000 600,000 900,000 Allowance for doubtful accounts (40,000) (48,000) (90,000) Inventory 1,500,000 1,500,000 1,350,000  Total current assets 2,560,000 2,932,000 2,850,800 Fixed assets 3,000,000 4,700,000 4,500,000 Accumulated depreciation (1,500,000) (1,834,000) (1,834,000) Total assets $ 4,060,000 $ 5,798,000 $ 5,516,800 Liabilities and Equity: Accounts payable $ 450,000 $ 450,000 $ 330,000 Bank loans, 8% 0 1,750,000 1,750,000 Accrued interest 60,000 40,000 40,000 Accruals and other 50,000 60,000 32,000  Total current liabilities $ 560,000 $ 2,300,000 $ 2,152,000 Long-term debt, 10% 600,000 400,000 400,000  Total liabilities $ 1,160,000 $ 2,700,000 $ 2,552,000 Capital stock 2,000,000 2,000,000 2,000,000 Retained earnings 900,000 1,098,000 964,800 Total liabilities and equity $ 4,060,000 $ 5,798,000 $ 5,516,800

EXHIBIT 4.56.1 Dunder-Mifflin Inc.

The production managers had targeted inventory levels for a 4.0 turnover ratio and were largely successful even though prices of materials and supplies had risen about 2 percent relative to sales dollar volume. The new facilities were depreciated using a 25-year life from the date of opening.

Dunder-Mifflin Inc. has now produced the current-year financial statements (Exhibit 4.56.1, Current Year column) for the auditors’ work on the current audit.

Required: Perform preliminary analytical procedures on the current-year unaudited financial state- ments for the purpose of identifying accounts that could contain errors or frauds. Use your knowledge of Dunder-Mifflin Inc. and the forecast in Exhibit 4.56.1. Calculate comparative and common-size financial statements as well as relevant ratios. (Assume that the market value of the equity for the company is $3 million.) Once your calculations are complete, identify the accounts that could be misstated.

4.57 Audit Risk Model. Audit risks for particular accounts and disclosures can be conceptual- ized in the model: Audit risk (AR) = Inherent risk (IR) × Control risk (CR) × Detection risk (DR). Use this model as a framework for considering the following situations and deciding whether the auditor’s conclusion is appropriate. a. Paul, CPA, has participated in the audit of Tordik Cheese Company for five years, first

as an assistant accountant and the last two years as the senior accountant. Paul has never seen an accounting adjustment recommended and believes the inherent risk must be zero.

LO 4-1

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 163

lou6920X_ch04_117-171.indd 163 02/29/20 06:35 PM

b. Hill, CPA, has just (November 30) completed an exhaustive study and evaluation of the internal controls of Edward Foods Inc. (fiscal year ending December 31). Hill believes the control risk must be zero because no material errors could possibly slip through the many error-checking procedures and review layers that Edward used.

c. Fields, CPA, is lazy and does not like audit jobs in Philadelphia. On the audit of Philly Manufacturing Company, Fields decided to use substantive procedures to audit the year- end balances very thoroughly to the extent that the risk of failing to detect material errors and irregularities should be 0.02 or less. Fields gave no thought to inherent risk and con- ducted only a very limited review of Philly’s internal control system.

d. Shad, CPA, is nearing the end of a “dirty” audit of Allnight Protection Company. All of Allnight’s accounting personnel resigned during the year and were replaced by inexperi- enced people. The comptroller resigned last month in disgust. The journals and ledgers were a mess because the one computer specialist was hospitalized for three months dur- ing the year. “Thankfully,” Shad thought, “I’ve been able to do this audit in less time than last year when everything was operating smoothly.”

(AICPA adapted)

4.58 Auditing an Accounting Estimate. Suppose management estimated the market valuation of some obsolete inventory at $99,000; this inventory was recorded at $120,000, which resulted in recognizing a loss of $21,000. The auditors obtained the following information: The  inventory in question could be sold for an amount between $78,000 and $92,000. The costs of advertising and shipping could range from $5,000 to $7,000.

Required: a. Would you propose an audit adjustment to the management estimate? Prepare the appro-

priate accounting entry. b. If management’s estimate of inventory market (lower than cost) had been $80,000, would

you propose an audit adjustment? Prepare the appropriate accounting entry.

4.59 Risk Assessment. This question consists of a number of items pertaining to an auditor’s risk analysis for a company. Your task is to tell how each item affects overall audit risk—that is, the probability of issuing an unmodified audit report on materially misleading financial statements.

Bond, CPA, is considering audit risk at the financial statement level in planning the audit of Toxic Waste Disposal (TWD) Company’s financial statements for the year ended December 31, 2020. TWD is a privately owned company that contracts with municipal governments to remove environmental wastes. Audit risk at the overall financial statement level is influenced by the risk of material misstatements, which may be indicated by a combination of factors related to management, the industry, and the company.

Required: Based only on the following information, indicate whether each of the following factors (items 1 through 15) would most likely increase overall audit risk, decrease overall audit risk, or have no effect on overall audit risk. Discuss your reasoning.

Company Profile 1. This was the first year TWD operated at a profit since 2017 because the municipalities

received increased federal and state funding for environmental purposes. 2. TWD’s board of directors is controlled by Mead, the majority stockholder, who also acts

as the chief executive officer. 3. The internal auditor reports to the controller, and the controller reports to Mead. 4. The accounting department has experienced a high rate of turnover of key personnel. 5. TWD’s bank has a loan officer who meets regularly with TWD’s CEO and controller to

monitor TWD’s financial performance. 6. TWD’s employees are paid biweekly. 7. Bond has audited TWD for five years.

Recent Developments 8. During 2020, TWD changed the method of preparing its financial statements from the

cash basis to the accrual basis under generally accepted accounting principles.

LO 4-3

LO 4-1

First Pages

lou6920X_ch04_117-171.indd 164 02/29/20 06:35 PM

164 Part Two The Financial Statement Audit

9. During 2020, TWD sold one-half of its controlling interest in United Equipment Leas- ing (UEL) Co. TWD retained significant interest in UEL.

10. During 2020, the state dropped litigation filed against TWD in 2016 alleging that the company discharged pollutants into state waterways. Loss contingency disclosures that TWD included in prior-years’ financial statements are being removed for the 2019 financial statements.

11. During December 2020, TWD signed a contract to lease disposal equipment from an entity owned by Mead’s parents. This related-party transaction is not disclosed in TWD’s notes to its 2020 financial statements.

12. During December 2020, TWD completed a barter transaction with a municipality. TWD removed waste from a municipally owned site and acquired title to another con- taminated site at below-market price. TWD intends to service this new site in 2021.

13. During December 2020, TWD increased its casualty insurance coverage on several pieces of sophisticated machinery from historical cost to replacement cost.

14. Inquiries about the substantial increase in revenue that TWD recorded in the fourth quarter of 2020 disclosed a new policy. TWD guaranteed several municipalities that it would refund the federal and state funding paid to it if any municipality fails federal or state site cleanup inspection in 2021.

15. An initial public offering of TWD’s stock is planned for late 2021.

4.60 Auditing Standards Review. Management fraud (fraudulent financial reporting) is not the expected norm, but it happens from time to time. In the United States, several cases have been widely publicized. They happen when motives and opportunities overwhelm manage- rial integrity. a. What distinguishes management fraud from a defalcation? b. What are an auditor’s responsibilities under auditing standards to detect management

fraud? c. What are some characteristics of management fraud that an audit team should consider to

fulfill the responsibilities under auditing standards? d. What factors might an audit team notice that should heighten the concern about the exis-

tence of management fraud? e. Under what circumstances might an audit team have a duty to disclose management’s

frauds to parties other than the company’s management and its board of directors? (AICPA adapted)

4.61 Analytical Procedures: Ratio Relationships. The following situations represent errors and frauds that could occur in financial statements.

Required: State how the ratio in question would compare (higher, equal, or lower) to what the ratio should have been had the error or fraud not occurred. a. The company recorded fictitious sales with credits to sales revenue accounts and debits to

accounts receivable. Inventory was reduced, and cost of goods sold was increased for the profitable “sales.” Is the current ratio higher than, equal to, or lower than what it should have been?

b. The company recorded cash disbursements by paying trade accounts payable but held the checks past the year-end date, meaning that the “disbursements” should not have been shown as credits to cash and debits to accounts payable. Is the current ratio higher than, equal to, or lower than what it should have been? Consider cases in which the current ratio before the improper “disbursement” recording was (1) higher than 1:1, (2) equal to 1:1, and (3) lower than 1:1.

c. The company uses a periodic inventory system for determining the balance-sheet amount of inventory at year-end. Very near the year-end, merchandise was received, placed in the stockroom, and counted, but the purchase transaction was neither recorded nor paid until the next month. What was the effect of this on inventory, cost of goods sold, gross profit, and net income? How were these ratios affected compared to what they would have been without the error: current ratio [remember three possible cases from part (b)], gross mar- gin ratio, cost of goods sold ratio, inventory turnover, and receivables turnover?

LO 4-2

LO 4-4

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 165

lou6920X_ch04_117-171.indd 165 02/29/20 06:35 PM

d. The company is loath to write off customer accounts receivable even though the financial vice president makes entirely adequate provision for uncollectible amounts in the allow- ance for bad debts. The gross receivables and the allowance both contain amounts that should have been written off long ago. How are these ratios affected compared to what they would have been if the old receivables had been properly written off: current ratio, days’ sales in receivables, doubtful account ratio, receivables turnover, return on begin- ning equity, and working capital/total assets?

e. Since last year, the company has reorganized its lines of business and placed more emphasis on its traditional products while selling off some marginal businesses merged by the previous management. Total assets are 10 percent less than they were last year, but working capital has increased. Retained earnings remained the same because the dispos- als created no gains, and the net income after taxes is still near zero, which is the same as last year. Earnings before interest and taxes (EBIT) remained the same, a small positive EBIT. The total market value of the company’s equity has not increased, but that is better than the declines of the past several years. Proceeds from the disposals have been used to retire long-term debt. Net sales have decreased 5 percent because the sales’ decrease resulting from the disposals has not been overcome by increased sales of the traditional products. Is the discriminant Z-score of the current year higher or lower than the one of the prior year? (See Appendix 4A for the Z-score formula.)

4.62 Audit Strategy Memorandum. The auditor should establish an overall audit strategy that sets the scope, timing, and direction of the audit and guides the development of the audit plan. In establishing the overall audit strategy, the auditor should develop and document an audit plan that includes a description of (a) the planned nature, timing, and extent of the risk assessment procedures, (b) the planned nature, timing, and extent of tests of controls and substantive procedures, and (c) other planned audit procedures that must be performed so that the engagement complies with auditing standards.

Required: Select a public company and determine a significant risk that could affect its financial state- ments. (Hint: Go to the EDGAR database at www.sec.gov and select the company’s form 10-K. The 10-K will have a list of risk factors the company faces.) Describe the risk and how it could affect the financial statements, including what assertions might be misstated. Prepare an audit strategy memorandum for the risk describing what controls the company might use to mitigate the risk, how you could test the controls, and what substantive proce- dures you might use to determine whether there is a misstatement. Because this is early in your auditing class, do not worry about specific procedures; just be creative and think about a general strategy an auditor might use.

4.63 Errors and Frauds. Give an example of an error or fraud that would misstate financial statements to affect the accounts as follows, taking each case independently. (Note: “Over- state” means the account has a higher value than would be appropriate under GAAP and “understate” means it has a lower value.) a. Overstate one asset; understate another asset. b. Overstate an asset; overstate stockholders’ equity. c. Overstate an asset; overstate revenue. d. Overstate an asset; understate an expense. e. Overstate a liability; overstate an expense. f. Understate an asset; overstate an expense. g. Understate a liability; understate an expense.

4.64 Compliance with Laws and Regulations. Audit standards distinguish auditors’ responsi- bility for planning procedures for detecting noncompliance with laws and regulations having a direct effect on financial statements versus planning procedures for detecting noncompli- ance with laws and regulations that do not have a direct effect on financial statements.

Required: a. What are the requirements for auditors to plan procedures to detect direct-effect compli-

ance versus indirect-effect compliance?

LO 4-7

LO 4-2

LO 4-6

First Pages

lou6920X_ch04_117-171.indd 166 02/29/20 06:35 PM

166 Part Two The Financial Statement Audit

b. For each of the following instances of noncompliance, explain why they are either direct-effect (D) or indirect-effect (I) noncompliance: 1. A manufacturer inflates expenses on its corporate tax return. 2. A retailer pays men more than women for performing the same job. 3. A coal mining company fails to place proper ventilation in its mines. 4. A military contractor inflates the overhead applied to a combat vehicle. 5. An insurance company fails to maintain required reserves for losses. 6. An exporter pays a bribe to a foreign government official so that government will buy

its products. 7. A company backdates its executive stock options to lower the exercise price. 8. A company fails to fund its pension plan in accordance with ERISA.

4.65 Identifying Significant Accounts – Auditors gather information from a variety of sources, including 10-K reports, to help assess risk and identify significant accounts and relevant assertions.

Required: You are performing risk assessment procedures for Apple Inc. One source of information you will use to help assess risk and identify significant accounts is Apple’s most recent 10-K filing. Go to the sec.gov website and search for Apple Inc.’s most recent 10-K filing. Read through the Item 1, Business, and Item 1A, Risk Factors, sections. Based off this discussion, what accounts do you believe might be susceptible to misstatement and why?

4.66 Preparing and Analyzing an Aging Schedule — Using IDEA. For this exercise, your client, Bright IDEAs Inc., has provided you with a listing of sales invoices. To test whether the client appears to have a receivables collectability problem, the auditor must complete a series of related steps: 1. Import the client’s database of sales invoices. You may have already completed this step

in Chapter 3. 2. Perform an aging analysis by following the instructions in the IDEA Workbook.

Required Data and additional instructions available on McGraw-Hill Connect.

Required: Complete the preceding steps and answer the following questions: a. What percentage of customers have accounts that are aged greater than 90 days? b. What percentage of customer balances are aged greater than 90 days? c. What effects would the findings in parts (a) and (b) have on the auditor’s assessment of

the risk of material misstatement? What accounts and assertions are most likely influ- enced by these findings?

4.67 Summarizing Obsolete Inventory — Using IDEA. For this exercise, your client, Bright IDEAs Inc., has provided you with a listing of inventory as of year end. To analyze the amount of obsolete inventory, as reported by the client, the auditor must complete a series of related steps: 1. Import the client’s database of inventory on hand. You may have already completed this

step in Chapter 3. 2. Summarize items identified as obsolete by the client by following the instructions in the

IDEA Workbook.

Required Data and additional instructions available on McGraw-Hill Connect. Complete the preceding steps and answer the following questions:

a. What percentage of the dollar amount of the client’s inventory has been identified as obsolete?

b. What effects would the findings in part (a) have on the auditor’s assessment of the risk of material misstatement? What accounts and assertions are most likely influenced by these findings?

LO 4-5

LO 4-4

LO 4-4

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 167

lou6920X_ch04_117-171.indd 167 02/29/20 06:35 PM

4.68 Analyzing Profit Margins — Using IDEA. For this exercise, your client, Bright IDEAs Inc., has provided you with a listing of inventory as of year end, which includes current sell- ing prices. To test whether profit margins appear adequate to justify the inventory valuation provision, the auditor must complete a series of related steps: 1. Import the client’s database of inventory on hand. You may have already completed this

step in Chapter 3 or Ex 4.67. 2. Create an analysis of selling price changes by following the instructions in the IDEA

Workbook. 3. Create an analysis of profit margins by following the instructions in the IDEA Workbook.

Required Data and additional instructions available on McGraw-Hill Connect.

Required: Complete the preceding steps and answer the following questions: a. What percentage of inventory items have price movements in excess of 50%? How many

of these items experienced price increases? How many experienced price decreases? Which direction of change would be most concerning to the auditor?

b. What percentage of items have negative profit margins? c. What effects would the findings in part (a) and (b) have on the auditor’s assessment of the

risk of material misstatement? What accounts and assertions are most likely influenced by these findings?

LO 4-4

Preliminary Analytical Procedures You are a recently promoted senior (in charge) auditor for Anderson, Olds, and Watershed and have been assigned to the engagement team of a new audit client, Apollo Shoes Inc. You have been asked to perform preliminary analytical procedures in an effort to help identify significant accounts and relevant assertions and assess risk of material misstatement. Detailed instructions for performing the preliminary analytical procedures, as well as working papers, can be found in Connect.

Apollo Shoes

Audit Risk Model You are a recently promoted senior (in charge) auditor for Anderson, Olds, and Watershed and have been assigned to the engagement team of a new audit client, Apollo Shoes Inc. You have been asked to evaluate a set of facts to determine the relationship of each with inherent or control risk, in an effort to determine the impact on detection risk. Detailed instructions for performing the audit risk case, as well as working papers, can be found in Connect.

Apollo Shoes

First Pages

lou6920X_ch04_117-171.indd 168 02/29/20 06:35 PM

Selected Financial Ratios

Appendix 4A

Balance-Sheet Ratios Formula*

Current ratio Current assets _______________ Current liabilities

Days’ sales in receivables Ending net receivables

___________________ Credit sales / 360

Doubtful account ratio Allowance for doubtful accounts ___________________________ Ending gross receivables

Days’ sales in inventory

Ending inventory ___________________

Cost of goods sold / 360

Debt-to-equity ratio Current and long-term debt

_______________________ Stockholder equity

Operations Ratios  

Receivables turnover Credit sales ___________________ Ending net receivables

Inventory turnover Cost of goods sold

________________ Ending inventory

Cost of goods sold ratio Cost of goods sold

________________ Net sales

Gross margin ratio Net sales − Cost of goods sold

________________________ Net sales

Return on stockholder equity Net income _____________________________________ Stockholder equity (beginning balance)

Financial Distress Ratios (Altman)

The discriminant Z-score is an index of a company’s financial health. The higher the score, the healthier the company. The lower the score, the closer financial failure approaches. The score that predicts financial failure is a matter of dispute. Research suggests that companies with scores above 3.0 never go bankrupt. Generally, companies with scores below 1.0 experience financial difficulty of some kind. The score can be a negative number.

(X1) Working capital/Total assets Current assets − Current liabilities ___________________________ Total assets

(X2) Retained earnings/Total assets Retained earnings (ending)

___________________________ Total assets

(X3) Earnings before interest and taxes/Total assets Net income + Interest expense + Income tax expense

__________________________________________ Total assets

(X4) Market value of equity/Total debt Market value of common and preferred stock

_____________________________________ Current liabilities and long-term debt

(X5) Net sales/Total assets Net sales __________ Total assets

Discriminant Z-score (Altman) 1.2 * X1 + 1.4 * X2 + 3.3 * X3 + 0.6 * X4 + 1.0 * X5 *These ratios are shown to be calculating using year-end rather than year-average, numbers for balances such as accounts receivable and inventory. Other accounting and finance reference books could contain formulas using year-average numbers. As long as no dramatic changes have occurred during the year, the year-end numbers can have much audit relevance because they reflect the most current balance data. For comparative purposes, the ratios should be calculated on the same basis for all years being compared.

First Pages

lou6920X_ch04_117-171.indd 169 02/29/20 06:35 PM

Sample Audit Memorandum

OVERVIEW Integrated Care Health Insurance Inc. (Integrated) offers a variety of valuable products and services ranging from medical, dental, and behavioral health coverage to life insur- ance and disability plans as well as management services for Medicaid plans. Purchas- ing health coverage ensures future security with respect to high and unexpected costs of health care for individuals, families, and businesses. Benefits offered by Integrated include not only coverage for medical expenses but access to a wide network of doctors, hospitals, and specialists.

PRODUCT PRICING Integrated uses a special process to calculate premiums charged for services offered. The method involves pooling customers with similar characteristics into a single risk group based on age, gender, medical history, lifestyle, and other factors such as benefits desired, administration costs, and tax obligations. After Integrated pools customers into their respective risk groups, Integrated has the responsibility to balance projected future costs with premiums charged. The most important factor in determining financial success for Integrated is its ability to predict trends and future medical costs. Therefore, faulty forecasts can lead to huge risks and downfalls for Integrated if expectations fall short of actual results. Competing in an industry where new technology and medical break- throughs are discovered almost daily means that sustaining profitability is an increasing concern.

GOVERNMENT INFLUENCES Along with a great deal of risk being inherent in its business, Integrated operations are impacted by the U.S. economy and unemployment rate. Additionally, the health care reform legislation passed in 2010 has caused significant changes to many facets of the industry’s operation. Given that the new legislation requires coverage for those who are currently uninsured, the insurance companies acquired millions of new customers virtu- ally overnight. Health care reform is a constant source of debate in the government, there- fore it is uncertain how future legislation will impact the industry.

CUSTOMERS, SUPPLIERS, AND COMPETITORS Integrated’s customers include employer groups, self-employed individuals, part-time and hourly workers, governmental organizations, labor groups, and immigrants. Although there are a considerable number of companies competing, experts have noted a trend that competition is virtually disappearing due to the domination of markets by only a few providers. In a study published by the American Medical Association, 24 of 43 states have one or two insurers comprising a market share of a staggering 70 percent.9 These statistics may suggest that there is essentially no competition in the market. However, 1,300 companies are competing in the health insurance industry, and Integrated faces significant competition in highly concentrated markets. In addition to the competition and

INTEGRATED CARE HEALTH INSURANCE INC AUDIT MEMORANDUM (ABRIDGED)

9D. W. Emmons, J. R. Guardado, C. K. Kane, “Competition in Health Insurance: A Comprehensive Study of U.S. Markets, 2010 Update,” American Medical Association.

Appendix 4B

First Pages

lou6920X_ch04_117-171.indd 170 02/29/20 06:35 PM

170 Part Two The Financial Statement Audit

governmental influences already present, Integrated is also facing competition from hos- pitals that play a pertinent role in determining the amounts billed for services provided.

RISK ASSESSMENT The following analysis provides an overview of the identified risks and expected controls for Integrated for one accounting cycle.

REVENUE AND COLLECTION CYCLE Risks Due to the contract nature of the insurance industry, revenue recognition is not a high-risk area when compared to other industries. Integrated has set contracts with commercial organizations, individuals, and the government. Therefore, large fluctuations through- out the year do not typically occur. However, one area of significant risk involves the Medicare risk adjustment. The Centers for Medicare & Medicaid Services (CMS) deter- mines Medicare and Medicaid premium payments employing a risk-based formula using coding provided by the insurance companies based on data from the diagnosis. Members with Medicare and Medicaid benefits associated with the health insurance entity are given a risk category based on their health conditions. However, because these contracts are preset for a year, patients’ risk categories might fluctuate, causing an increase in needed payment from the CMS. Integrated must ensure that revenue is recognized properly by recording a risk adjustment for the difference between what CMS paid and what should have been paid based on the appropriate risk categories. CMS also performs audits known as Risk Adjusted Data Validation (RADV) audits to ensure CMS remits premium payments to insurance organizations appropriately.

Another area of significant risk around revenue recognition involves the Medicare Part D risk-sharing provision. With Medicare Part D, insurance entities contract with CMS for set premiums on an annual basis. The ultimate payment of total premiums, however, depends on certain thresholds that might require additional payment by CMS or reim- bursement to CMS. A reconciliation (true-up) is performed after year-end to account for these differences. However, because this true-up process might occur six to nine months after year-end, Integrated must account for this process by recording receivables or pay- ables that estimate these differences. Significant estimates are used to develop these adjustments and require the company to plan the audit procedures to provide reasonable assurance that these estimates do not include material misstatements.

Controls The difficulty in predicting revenue adjustment amounts from these two programs con- cerns Integrated management’s assertions of completeness, accuracy, valuation of finan- cial statement accounts, and proper disclosure of required revenue recognition elements. To meet disclosure assertions, Integrated established a disclosure committee to deter- mine what revenue-related disclosures should be made regarding Medicare and Medic- aid. This committee meets prior to the release of each quarter’s financial statements or as often as management requires. Valuation and accuracy assertions are met by requiring that qualified personnel utilize acceptable models commonly used in industry practice when estimating the amounts for the varying revenues. Appropriate supervisors review all estimates for accuracy and verify that estimates conform to the company’s operational objectives.

AUDIT APPROACH Due to the high-risk nature of the unique business and audit risks detailed here, an audit plan for Integrated must include both test of controls and substantive procedures to pro- vide for the appropriate level of detection risk. As mentioned, significant estimates are

First Pages

Chapter 4 The Audit Risk Model and Inherent Risk Assessment 171

lou6920X_ch04_117-171.indd 171 02/29/20 06:35 PM

included in the financial statements for almost every accounting cycle within the health insurance industry. The amount of management judgment needed to determine these esti- mates requires the use of extensive substantive testing to provide reasonable assurance that material misstatements do not exist within the financial statements. The following detailed audit plan provides guidance on the types of control testing and substantive test- ing that would provide reasonable assurance that material misstatements do not exist in relation to the risks outlined within this report.

AUDIT STRATEGY MEMORANDUM Integrated Care Health Insurance Inc.

Overview This audit strategy is intended to provide our responses to the risks identified for Integrated and generally detail the associated tests of controls and substantive procedures that will be required during the audit.

Risks Revenue recognition related to participation in Medicare and Medicaid programs (Revenue and Collection Cycle)

Assertions Tests of Controls Substantive Procedures

Valuation or allocation Test information technology and manual controls relative to calculation of revenues from Medicare and Medicaid contracts.

Reperform revenue calculations for a sampling of Medicare- and Medicaid- issued contracts.

Confirm that management estimates for risk-sharing and risk- adjustment provisions (reviews include determining whether qualified personnel perform the estimates, making estimates conform to industry practices, and verifying that estimates are accurate).

Reperform estimates for risk-sharing and risk-adjustment provisions.

Confirm that assumptions and methodologies for estimates of risk-sharing and risk-adjustment provisions are documented and approved by management.

Produce independent estimates for risk- sharing and risk-adjustment provisions.

Obtain an understanding of assumptions and methodology of estimates for risk-sharing and risk-adjustment provisions.

Presentation and disclosure Confirm that a disclosure committee has been established. Review disclosure committee meeting minutes

Confirm that comparisons of actual and budgeted Medicare and Medicaid revenues are conducted by management and significant variances are monitored.

Review board of directors meeting minutes, agreements, budgets, and plans for Medicare and Medicaid revenues that should be included in financial statements.

  Test whether disclosures and classifications conform to accounting principles.

Source: Mark Fedewa, Emily O’Bryan, Amela Pajazetovic, and Susan Schmidt, “An Analysis of Business and Audit Risk for a Health Insurance Provider,” unpublished working paper, University of Kentucky. February 28, 2011.

First Pages

172

lou6920x_ch05_172-219.indd 172 03/06/20 02:55 PM

C H A P T E R 5

Risk Assessment: Internal Control Evaluation

As stated on January 29, 2019, by SEC Chief Accountant Wesley Bricker when commenting on the issuance of separate “cease and desist” orders against four public companies for failure to maintain proper internal controls (https://www. sec.gov/news/press-release/2019-6).

Adequate internal controls are the first line of defense in detecting

and preventing material errors or fraud in financial reporting . . .

when internal control deficiencies are left unaddressed, financial

reporting quality can suffer.

Professional Standards References

Topic AU-C/ISA Section

AS Section

Overall Objectives of the Independent Auditor 200 1001, 1005, 1010, 1015

Audit Documentation 230 1215

Consideration of Fraud in a Financial Statement Audit 240 2401

Communications with Audit Committees 260 1301

Communicating Internal Control-Related Matters Identified in an Audit 265 1305

Consideration of Internal Control in an Integrated Audit 265 2201

Reporting on Whether a Previously Reported Material Weakness Continues to Exist 265 6115

Audit Planning 300 2101

Identifying and Assessing the Risks of Material Misstatement 315 AS 12

Materiality 320 2110

Auditors’ Responses to Risks of Material Misstatement 330 2301

Audit Considerations Relating to an Entity Using a Service Organization 402 2601

Audit Evidence 500 1105

Audit Evidence—Specific Considerations for Selected Items 501 2503, 2505, 2510

Consideration of the Internal Audit Function in a Financial Statement Audit 610 2605

Compliance Auditing Considerations in Audits of Recipients of Governmental Financial Assistance 935 6110

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 173

lou6920x_ch05_172-219.indd 173 03/06/20 02:55 PM

LEARNING OBJECTIVES An important objective of the internal control system is to help ensure that the financial statement information being presented by an organization is credible and can be relied upon. Therefore, it is essential that an auditor take the time to understand whether an entity’s internal control system has been designed and is operating effectively. In fact, the fundamental principles of auditing state that, to fulfill auditors’ responsibility “[t]o obtain reasonable assurance . . . the auditor identifies and assesses risks of material misstatement, whether due to fraud or error, based on an understanding of the entity and its environment, including the entity’s internal control” [emphasis added]. The responsibility is even greater for most public companies because the law and professional standards require that the auditor express an opinion on management’s assessment of the effectiveness of the company’s internal control system. As a result, the evaluation of an entity’s internal control system is a critical phase of most every public company audit engagement.

Beyond its importance in the production of reliable financial statement information, the establishment of an internal control system is an important management function to help ensure the effectiveness and efficiency of operations and the entity’s compliance with laws and regulations. As a result, understanding the elements of internal control and how to evaluate their effectiveness is an important skill that every accountant should have. Even if you do not go into auditing, you probably will

have responsibility for maintaining internal controls at some point in your accounting career.

This chapter presents a general introduction to the theory and definitions you will find useful for internal control evaluation and control risk assessment. The chapter uses the payroll cycle to provide specific examples of internal control activities and related audit procedures.

Your objectives are to be able to:

LO 5-1 Define and describe what is meant by internal control.

LO 5-2 Distinguish between the responsibilities of management and auditors regarding an entity’s internal control.

LO 5-3 Define and describe the five basic components of internal control and specify some of their characteristics.

LO 5-4 Explain the process the audit team uses to assess control risk; understand its impact on the risk of material misstatement; and, ultimately, know how it affects the nature, timing, and extent of further audit procedures to be performed on the audit.

LO 5-5 Describe additional responsibilities for management and auditors of issuers required by Sarbanes–Oxley and PCAOB Auditing Standard No. 2201.

LO 5-6 Explain the communication of internal control deficiencies to those charged with governance, such as the audit committee and other key management personnel.

INTRODUCTION On January 29, 2019, the SEC issued “cease and desist” orders against four public com- panies: Lifeway Foods Inc., Digital Turbine Inc., CytoDyn Inc., and Grupo Simec S.A.B de C.V. According to the SEC’s orders, each company had acknowledged that their internal control systems had material weaknesses. However, after providing each of these companies with as many as 10 years to address their problems, the SEC finally had enough and decided to take action.

It seems clear that the substantial penalties levied by the SEC sends a message to all public companies that if a material weakness exists in your internal control system, the management team had better take remedial action to fix any problems that exist. Because, if not, the SEC will take action. As stated in their “cease and desist” orders, “disclosure of material weaknesses is not enough without meaningful remediation. We are committed to holding corporations accountable for failing to timely remediate material weaknesses.” (https://www.sec.gov/news/press-release/2019-6)

Why the emphasis on internal controls by the SEC? To start, maintaining a system of internal controls for the accounting system is required under the law by the Securities and Exchange Act of 1934 for public companies (i.e., issuers). In addition, Section 404 of the

First Pages

lou6920x_ch05_172-219.indd 174 03/06/20 02:55 PM

174 Part Two The Financial Statement Audit

Sarbanes-Oxley Act of 2002 requires the management team of issuers to assess the effec- tiveness of its own system of internal control and then have an independent CPA firm assess the effectiveness of its internal control system during its annual audit.

By holding both management and the auditor responsible for evaluating the effective- ness of the internal control system, the act appears to have imposed the necessary over- sight to improve the accuracy and reliability of the financial statements reported by the entity. Indeed, the act places an emphasis on the internal control system as an important mechanism to prevent or detect material misstatements in the financial statements due to fraud. Simply stated, the intense scrutiny on both the design and operating effective- ness of internal control systems over financial reporting improves the reliability of the financial statements which clearly benefits the capital markets, as shown in the following auditing insight. This chapter focuses on the importance of the internal control system in the financial statement auditing process.

Elon Musk, the billionaire co-founder of Tesla Inc., will pay a $20 million fine to the SEC for a tweet made on August 7, 2018, which indicated that he had secured financing to take the company public, causing an increase of over six percent in the company’s stock price.

The SEC’s complaint against Tesla relates to the lack of con- trols or procedures in place as to whether Musk’s tweets contained

information required in SEC disclosures. The SEC also contends that Tesla did not have sufficient processes in place to determine whether the tweets were accurate or complete.

Source: https://www.sec.gov/news/press-release/2018-226.

Was The Tweet Worth $20 Million?AUDITING INSIGHT

INTERNAL CONTROL DEFINED For purposes of the financial statement auditing process, as you will soon learn in this chapter, if the system of internal control is properly designed and is also operating effec- tively, it should be producing reliable financial statements. As the figure below clearly illustrates, the most important goal of the system should be to produce reliable financial statements, and as long as the system is operating effectively, auditors should be able to rely on the internal control system to reduce substantive testing procedures. Of course, audit professionals need to follow a required process in order to reach this conclusion, which we cover in this chapter.

The Committee of Sponsoring Organizations (COSO)1 is responsible for defining what is meant by internal control effectiveness. COSO comprises leaders in the auditing profession from the Financial Executives Institute, the American Accounting Associa- tion, the Institute of Internal Auditors, the Institute of Management Accountants, and the American Institute of Certified Public Accountants. It publishes an integrated frame- work which is used by management teams and auditors as the benchmark to assess inter- nal control effectiveness. The resulting report, known as the COSO framework, was last updated in 2013 and defined internal control as follows:

Internal control is a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following three categories:

∙ Reliability of financial reporting. ∙ Effectiveness and efficiency of operations. ∙ Compliance with applicable laws and regulations.

LO 5-1 Define and describe what is meant by internal control.

1COSO, “Internal Control—Integrated Framework Executive Summary,” May 2013, New York: AICPA

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 175

lou6920x_ch05_172-219.indd 175 03/06/20 02:55 PM

Stated differently, internal control is a set of policies and procedures designed to achieve management objectives in three different categories. In the financial reporting category, the management objectives are related to producing reliable financial reports and safe- guarding assets. In the operations category, some examples of management objectives are maintaining a good business reputation, ensuring a positive return on investment, increasing market share, promoting new product innovation, and using assets effectively and efficiently. In the compliance category, the broad management objective is to comply with laws and regulations that affect the entity. It is important to point out that external auditors are primarily concerned with a client’s internal control system as it relates to the financial reporting category.

The updated framework acknowledges the widespread use of the COSO framework and provides enhancements that were specifically designed to make it easier to be used as a benchmark for evaluating internal control effectiveness by auditors across the world. In fact, the Auditing Standards Board has even integrated important aspects of the COSO framework into the professional standards (i.e., AU-C 315).2 We believe that the frame- work can be very helpful as students learn about the underlying concepts and principles of an effective internal control system. As a result of its importance, throughout this chapter we will highlight how the COSO framework has impacted the auditor’s role in evaluating a client’s system of internal control during the audit.

2AU-C 315–Communications Between Predecessor and Successor Auditors.

REVIEW CHECKPOINTS 5.1 What is the Committee of Sponsoring Organizations (COSO)? Briefly describe the purpose of the

COSO framework of internal control effectiveness. 5.2 What are the three goals of an internal control system according to the COSO report? Which of the

three is most important to auditors?

The Sarbanes–Oxley Act of 2002 defines internal control in a manner that is consistent with the COSO definition. However, the Sarbanes– Oxley definition focuses on the role of the internal control system over financial reporting and notes that control policies and procedures should allow

1. Records to be maintained in reasonable detail to accurately reflect transactions.

2. Transactions to be recorded to permit financial statements to be prepared in accordance with GAAP.

3. Transactions to be executed in accordance with authorization from the entity’s management.

4. Unauthorized acquisition, use, or disposition of the entity’s assets to be prevented or detected on a timely basis.

Source: U.S. Congress, Sarbanes–Oxley Act of 2002, Pub. L. No. 107-204, 116 Stat. 745 (2002).

Sarbanes–Oxley Definition of Internal ControlAUDITING INSIGHT

MANAGEMENT VERSUS AUDITORS’ RESPONSIBILITY FOR INTERNAL CONTROL

Management’s Internal Control Responsibilities Section 302 of the Sarbanes–Oxley Act stipulates criminal penalties for both CEOs and CFOs if they issue materially misleading financial statements. A clear intention of this section of the act is to make sure that the upper management team takes full responsibility

LO 5-2 Distinguish between the responsibilities of management and auditors regarding an entity’s internal control.

First Pages

lou6920x_ch05_172-219.indd 176 03/06/20 02:55 PM

176 Part Two The Financial Statement Audit

for establishing and maintaining a system of internal control. Simply stated, the threat of criminal penalties is usually enough to make sure that management takes their responsibility for internal control effectiveness seriously.

To accomplish this objective, management is responsible for assessing the full range of risks it would like to control, including financial reporting risks. Such a risk assessment process generally leads to the establishment of important objectives for the internal control system. For example, management must make sure that transactions are properly authorized, and that the accounting records and other system-generated reports are complete and accurate. In addition, management must ensure the security of their assets, including their data. It is also important that an appropriate control environment is established that allows for the implementation of appropriate internal control activi- ties, appropriate information and communication channels, and proper monitoring of the operation of all internal control activities.

Management is also responsible for maintaining documentation that is sufficient to provide evidence that the system of internal control has been designed and is operat- ing effectively. For example, such documentation needs to provide evidence about how important internal control decisions were considered and ultimately how the final decisions were reached for key professional judgments. Finally, the documentation must be robust enough to allow auditors to gain an understanding of the internal control system and ultimately conduct an audit of the effectiveness of the internal control system.

In addition to requiring that the CEO and CFO certify the entity’s financial statements and disclosures under Section 302, Sarbanes–Oxley requires management to assess and report on the entity’s internal control over financial reporting in Section 404. Specifically, the entity’s annual report must include the following:

∙ A statement that management is responsible for establishing and maintaining adequate internal control over financial reporting.

∙ A statement identifying the framework (e.g., the COSO framework) that management uses as a benchmark for evaluating the effectiveness of the entity’s internal control.

∙ A statement providing management’s assessment of the effectiveness of the entity’s internal control.

Under Section 302, management must also disclose any material weaknesses in internal control. If any material weaknesses exist, management cannot conclude that the entity’s internal control over financial reporting is effective. See Exhibit 5.1 for excerpts from a Costco Wholesale Corporation management report on internal control over financial reporting, which identified a material weakness in its system of internal control. This report was issued on October 26, 2018.

Auditors’ Internal Control Responsibilities Auditors have at least three reasons for conducting an evaluation of an entity’s internal control system. First, Sarbanes–Oxley requires an audit of effectiveness of internal con- trol over financial reporting for issuers. The internal control audit is conducted along with the financial statement audit as part of an overall integrated audit that is completed at issu- ers. In essence, the audit firm employs one integrated process that culminates in the issu- ance of two opinions: one on the entity’s financial statements and one on management’s assessment of the effectiveness of the entity’s internal control over financial reporting.

The second reason for evaluating an entity’s internal control is to assess preliminary risk of material misstatement (RMM) for each relevant assertion. The assessment of RMM at the assertion level is completed for all financial statement audits in order to give the audit team a basis for planning the audit and determining the nature, timing, and extent of further audit procedures to be conducted for the financial statement audit. RMM is composed of inherent risk and control risk. The assessment of inherent risk, the susceptibility of an account to misstatement, was the focus of Chapter 4; this chap- ter focuses on control risk assessment. Recall that control risk is the probability that an

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 177

lou6920x_ch05_172-219.indd 177 03/06/20 02:55 PM

Our management is responsible for establishing and maintaining adequate internal control over financial reporting . . . Our internal control over financial reporting is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with U.S. GAAP and includes those policies and procedures that: (1) pertain to the maintenance of records that in reasonable detail accurately and fairly reflect our transactions and the dispositions of our assets; (2) provide reasonable assurance that our transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles and that our receipts and expenditures are being made only in accordance with appropriate authorizations; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on our financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Projections of any evaluation of effectiveness for future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. Under the supervision of and with the participation of our management, we assessed the effectiveness of our internal control over financial reporting as of September 2, 2018, using the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control—Integrated Framework (2013). A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.

We identified a material weakness in internal control related to ineffective information technology general controls (ITGCs) in the areas of user access and program change-management over certain information technology (IT) systems that support the Company’s financial reporting processes. Our business process controls (automated and manual) that are dependent on the affected ITGCs were also deemed ineffective because they could have been adversely impacted. We believe that these control deficiencies were a result of: IT control processes lacking sufficient documentation such that the successful operation of ITGCs was overly dependent upon knowledge and actions of certain individuals with IT expertise, which led to failures resulting from changes in IT personnel; insufficient training of IT personnel on the importance of ITGCs; and risk-assessment processes inadequate to identify and assess changes in IT environments that could impact internal control over financial reporting. The material weakness did not result in any identified misstatements to the financial statements, and there were no changes to previously released financial results. Based on this material weakness, the Company’s management concluded that at September 2, 2018, the Company’s internal control over financial reporting was not effective.

The Company’s independent registered public accounting firm, KPMG LLP has issued an adverse audit report on the effectiveness of the Company’s internal control over financial reporting as of September 2, 2018, which appears in Item 8 of this Form 10-K. Following identification of the material weakness and prior to filing this Annual Report on Form 10-K, we completed substantive procedures for the year ended September 2, 2018. Based on these procedures, management believes that our consolidated financial statements included in this Form 10-K have been prepared in accordance with U.S. GAAP. Our CEO and CFO have certified that, based on their knowledge, the financial statements, and other financial information included in this Form 10-K, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this Form 10-K. KPMG LLP has issued an unqualified opinion on our financial statements, which is included in Item 8 of Form 10-K.

Management has been implementing and continues to implement measures designed to ensure that control deficiencies contributing to the material weakness are remediated, such that these controls are designed, implemented, and operating effectively. The remediation actions include: (i) creating and filling an IT Compliance Oversight function; (ii) developing a training program addressing ITGCs and policies, including educating control owners concerning the principles and requirements of each control, with a focus on those related to user access and change management over IT systems impacting financial reporting; (iii) developing and maintaining documentation underlying ITGCs to promote knowledge transfer upon personnel and function changes; (iv) developing enhanced risk assessment procedures and controls related to changes in IT systems; (v) implementing an IT management review and testing plan to monitor ITGCs with a specific focus on systems supporting our financial reporting processes; and (vi) enhanced quarterly reporting on the remediation measures to the Audit Committee of the Board of Directors. We believe that these actions will remediate the material weakness. The weakness will not be considered remediated, however, until the applicable controls operate for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively. We expect that the remediation of this material weakness will be completed prior to the end of fiscal 2019. http://investor.costco.com/static-files/c812aa61-1f39-4ee8-b1bd-314b3d8b0b20

EXHIBIT 5.1 Excerpts from Costco Wholesale Corporation’s Management Report on Internal Control over Financial Reporting

entity’s controls will fail to prevent or detect material misstatements due to errors or frauds that would otherwise have entered the system. The audit team assesses control risk to complete the preliminary determination of RMM for each relevant assertion identified in the audit plan; the higher the assessment of control risk, the higher the assessment of RMM. Most audit teams express their control risk assessment decision with descriptive terminology (e.g., high, moderate, low), which recognizes the imprecise nature of evalu- ating risk.

First Pages

lou6920x_ch05_172-219.indd 178 03/06/20 02:55 PM

178 Part Two The Financial Statement Audit

An audit team’s assessment of control risk as high implies that the controls are not effective at preventing or detecting material misstatements and could not be relied upon by the audit team. In this situation, the audit team would likely use substantive tests of details designed to obtain evidence (nature) at or near the entity’s fiscal year-end (timing) with large sample sizes (extent).

On the other hand, an audit team’s assessment of control risk as low implies that the controls are effective at preventing or detecting material misstatements and could possi- bly be relied upon by the audit team. In this situation, the audit team might be able to use less time-consuming substantive analytical procedures to obtain evidence (nature) at an interim date before the entity’s fiscal year-end (timing) with much smaller sample sizes (extent).

Of course, an audit team might assess control risk as moderate (between low and high) and adjust the substantive procedures accordingly in order to obtain enough evidence to mitigate the risk of material misstatement to a low level for the relevant assertion being tested. Ultimately, the final decision about nature, timing, and extent of testing is a matter of professional judgment for the audit team. Exhibit 5.2 illustrates the trade-off between testing and relying on internal controls and how it impacts the nature, timing, and extent of further audit procedures to be performed.

Third, for each fraud risk identified during the planning stage, the audit team should evaluate whether the client has implemented control activities that are specifically designed to address the risk of fraud that has been identified. These might include control activities that are designed to address fraud risks for specific financial statement accounts or, more generally, control activities that are designed to promote a culture of honest and ethical behavior. For example, the audit team evaluates the controls related to the use of period-end journal entries on each audit engagement due to their frequent use in the past to commit frauds at companies such as WorldCom, Waste Management, and Dell Inc.

  Less Reliance on Internal Control(higher control risk; lower detection risk)

More Reliance on Internal Control(lower control risk; higher detection risk)

Nature More effective tests (for example, use of substantive tests of detail)

Less effective tests (for example, use of substantive analytical procedures)

Timing Testing performed at year-end Testing can be performed at interim Extent Higher sample size Lower sample size

EXHIBIT 5.2 Relationship between Internal Control Reliance and Audit Procedures

REVIEW CHECKPOINTS 5.3 What are management’s and auditors’ respective responsibilities regarding internal control? 5.4 Define control risk and explain the role of control risk assessment in audit planning. 5.5 What are the primary reasons for conducting an evaluation of an audit client’s internal control? 5.6 How does control risk affect the nature, timing, and extent of further audit procedures?

COMPONENTS OF INTERNAL CONTROL According to the COSO3 framework, an internal control system that is designed and operat- ing effectively will have met three overarching goals within an organization (Exhibit 5.3). First, the system will allow for effective and efficient operations. Second, it will allow for reliable financial reporting. And, third, the system will allow the organization to comply with laws and regulations.

LO 5-3 Define and describe the five basic components of internal control and specify some of their characteristics.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 179

lou6920x_ch05_172-219.indd 179 03/06/20 02:55 PM

To achieve the specific objectives for each of these three goals, the COSO frame- work defines five interrelated components of a properly designed internal control system: (1) control environment, (2) risk assessment, (3) control activities, (4) monitoring, and (5) information and communication. It is important to point out that the five components should not operate independently of each other. Instead, they should be considered as working in an integrated manner to support the internal control system’s overall effectiveness.

To help facilitate the evaluation of internal control effectiveness, the COSO frame- work identifies 17 principles of an effective internal control system. These principles are designed to provide clarity in determining what is meant by internal control effectiveness for each component (i.e., is it present and functioning) and are used by auditors to help evaluate whether the internal control system is indeed operating effectively. The principles are now also used to help illustrate each of the five components.

Control Environment The control environment sets the tone of the organization. It is the foundation for all other components of internal control. It provides discipline and structure to all participants and stakeholders. Control environment factors include the integrity, ethical values, and com- petence of the entity’s people. According to the COSO framework, a well-functioning internal control environment is characterized by philosophies such as the following:

∙ Integrity and ethical values. Sound integrity and ethical values, particularly of top management, are developed and understood and set the standard of conduct for finan- cial reporting.

∙ Board of directors. The board of directors understands and exercises oversight respon- sibility related to financial reporting and related internal control.

∙ Management’s philosophy and operating style. Management’s philosophy and operat- ing style support achieving effective internal control over financial reporting.

∙ Organizational structure. The company’s organizational structure supports effective internal control over financial reporting by establishing clear and unambiguous report- ing lines.

∙ Financial reporting competencies. The company retains individuals who are compe- tent in financial reporting and related oversight roles.

EXHIBIT 5.3 Internal Control— Integrated Framework (COSO)

Definition

Compliance with laws and regulations

Control environment Risk assessment Control activities

Reliable financial reporting

Reliable financial annual and interim reports (e.g., GAAP)

Control environment Risk assessment Control activities Monitoring Information and communication

Monitoring Information and communication

E�ectiveness and e�ciency of operations

Risk assessment Control activities Monitoring Information and communication

Various company- specific objectives

Control environment

Goals

Specific Objectives

Components

Internal control is a management process

designed to achieve

Compliance with laws and regulations that apply to the company

First Pages

lou6920x_ch05_172-219.indd 180 03/06/20 02:55 PM

180 Part Two The Financial Statement Audit

∙ Authority and responsibility. Management and employees are assigned appropriate levels of authority and responsibility to facilitate effective internal control over finan- cial reporting.

∙ Human resources. Human resource policies and practices are designed and imple- mented to facilitate effective internal control over financial reporting.

Most importantly, the effectiveness of the control environment is influenced heavily by a company’s management team and is strongly and unquestionably related to the “tone at the top” set by management. The key is for management to be deliberate in trying to impact the attitudes toward internal controls throughout the organization by setting the proper example for the organization to follow. It has been said that the control environ- ment has a “pervasive” effect on the reliability of financial reporting because it affects all other components of an organization’s internal control system.

In February 2019, Hertz Global Holdings Inc. agreed to pay the SEC $16 million to settle accounting fraud charges. Feeling the pressure to meet internal budgets, business plans and earnings estimates, execu- tives at Hertz overstated pre-tax income by $235 million from 2012 to 2014. The managers used improper accounting methodologies that were inconsistent with GAAP in order to meet expectations.

However, Hertz isn’t taking this lying down. The company has sued its former CEO, CFO, General Counsel, and others in an effort to clawback $70 million in incentive compensation that was tied to

the fraudulent financials. According to Hertz’s board, the former CEO “created a pressure-cooker work environment in which he leaned on subordinates to make “inappropriate accounting decisions” so the firm could hit its financial targets” sometimes “berating subordinates who did not come up with “non-traditional” accounting approaches to fill the gaps between Hertz’s actual and expected performance.”

Sources: https://www.sec.gov/enforce/33-10601-s; https://www.bloomberg.com/news/articles/2019-04-01/ hertz-seeks-70-million-in-clawbacks-tied-to-accounting-scandalack,

Tone at the Top - How Hertz Got It WrongAUDITING INSIGHT

Because the control environment sets the overall foundation for internal control, profes- sional auditing standards require an auditor to obtain an understanding of the control environ- ment on all engagements. As part of this understanding, auditors also have to take the time to consider the functioning of the client’s board of directors and, in particular, the impact of its audit committee on the client’s control environment. The audit committee is a subcommit- tee of the board of directors that is generally composed of three to six independent members (those not involved in the entity’s day-to-day management) of the organization’s board of directors. Each member must be financially literate, and one member must be a financial expert. The purpose of including independent members is to provide a buffer between the audit team and the operating management team of the company. The buffer allows the audit team (and the corporate internal audit department) to report any controversial findings to members of the board of directors without fear of reprisal.

For example, should the internal auditors find wrongdoing in the CEO’s office, it would do no good to report the matter to the CEO. Similarly, if management does not have control over appointing auditors, management is prevented from threatening to dis- miss the auditors if they do not agree with an inappropriate accounting practice. Some of the more important duties of the audit committee are

∙ Appointment, compensation, and oversight of the public accounting firm conducting the entity’s audit.

∙ Resolution of disagreements between management and the audit team. ∙ Oversight of the entity’s internal audit function. ∙ Approval of nonaudit services provided by the public accounting firm performing the

audit engagement. ∙ Oversight of the anonymous fraud hotline that is designed to provide employees a con-

fidential and effective manner in which to report possible financial reporting issues. ∙ Authority to engage legal counsel in the event of management fraud.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 181

lou6920x_ch05_172-219.indd 181 03/06/20 02:55 PM

Small and midsize entities may implement the control environment factors differently than larger entities. For example, smaller entities might not have a written code of con- duct but instead develop a culture that emphasizes the importance of integrity and ethical behavior through oral communication and by management example. Similarly, a smaller entity may not have an independent or outside member on its board of directors. Regard- less of the size of the entity, the COSO framework establishes five principles which, if applied properly, will result in an effective control environment component. The five principles of the control environment component are listed in Exhibit 5.4.

Risk Assessment In recent years, entities of all sizes have increasingly recognized the need for a formalized process to identify, properly assess, and ultimately manage the full range of business risks that they face: factors, events, and conditions that can prevent organizations from achiev- ing their business objectives. One way managers address these concerns is to employ an enterprise risk management (ERM) framework such as the one developed by COSO to facilitate the assessment and mitigation of business risks that the entity faces. COSO defines ERM as “a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”3 In other words, management, boards, and employees have to be constantly thinking about what could go wrong with the business and how they can prevent it.

Although not all entities will employ a robust ERM framework, at a minimum, an effective internal control system will include some type of process where management takes the steps necessary to identify risks, estimate their significance and likelihood, and consider how to manage the risks. By setting management objectives, management can identify critical success factors and institute policies and procedures to ensure that they are met. (Note: The risk assessment element of the COSO framework is management’s responsibility and is not related to an auditor’s assessment of inherent risk, control risk, and the overall risk of material misstatement at the assertion level.) Although an audit client’s risk assessment process should relate to all its objectives, the professional stan- dards require the auditor to specifically gain an understanding of the process as it relates to financial reporting risks, including fraud risk. When gaining such an understanding, the auditor should determine whether management is actually assessing the likelihood of fraud risks and how it is managing such risks.

In completing their work, the audit team members seek to understand whether man- agement is specifying financial reporting objectives with sufficient clarity and criteria to

3COSO, “Enterprise Risk Management—Integrated Framework Executive Summary,” September 2004, New York: AICPA, p. 2.: COSO. “Enterprise Risk Management—Integrating with Strategy and Performance,” June 2017, New York: AICPA.

  Principles of Control Environment as per the COSO Framework

1. The organization demonstrates a commitment to integrity and ethical values.

2. The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

3. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

4. The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

5. The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

EXHIBIT 5.4 Five Principles of the Control Environment

First Pages

lou6920x_ch05_172-219.indd 182 03/06/20 02:55 PM

182 Part Two The Financial Statement Audit

enable the identification of risks of material misstatement in financial reporting, in par- ticular due to fraud. Once identified, the audit team also would like to see that manage- ment has a basis for determining how to manage the identified risks. For smaller entities, the risk assessment process is likely to be less formal and less structured. Although all entities should have established financial reporting management objectives, they may be recognized implicitly rather than explicitly in smaller entities. Regardless of the size of the entity, the COSO framework establishes four principles that, if applied properly, will result in an effective risk assessment component when evaluating the system of internal control. The four principles of the risk assessment component are listed in Exhibit 5.5.

EXHIBIT 5.5 Four Principles of the Risk Assessment

  Principles of Risk Assessment as per COSO Framework

1. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

2. The organization identifies risks to the achievement of its objectives across the entity and analyzes the risks as a basis for determining how the risks should be managed.

3. The organization considers the potential for fraud in assessing risks to the achievement of objectives.

4. The organization identifies and assesses changes that could significantly impact the system of internal control.

REVIEW CHECKPOINTS 5.7 What are the five components of management’s internal control? 5.8 What is the control environment? 5.9 What is an audit committee? What are its duties? 5.10 What is the purpose of risk assessment for an entity?

Control Activities In a well-functioning internal control system, once the risks to management’s objectives have been identified, internal control activities are established to eliminate, mitigate, or compensate for the risks. Control activities are specific actions that a client’s management and employees take to help ensure that management’s directives are carried out. The pro- fessional standards require the audit team members to document their understanding of the internal control system on each audit, which includes their understanding of whether management has implemented control activities that are sufficient to address the risks of material misstatement for each relevant assertion related to each significant account or disclosure.

To answer this important question, the audit team members usually begin the process by considering what they learned about the internal control system as they were gaining an understanding of the other components of the COSO framework—in particular, the control environment and risk assessment components described earlier. The next step in the process requires the audit team members to document their understanding of the extent to which each of the client’s control activities has been designed to sufficiently address a relevant financial statement assertion. To do so, an auditor first considers “what could go wrong” for each of the identified relevant assertions. That is, an auditor must consider how a material misstatement could occur for each relevant assertion. Once each “what could go wrong” is identified, an auditor must then determine if management has implemented a control activity that is designed to mitigate the risk of material misstate- ment identified for that assertion. This step will be covered in more depth later in the chapter. However, for now, see Exhibit 5.6 for several examples of this process that might occur for several relevant assertions related to the revenue account.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 183

lou6920x_ch05_172-219.indd 183 03/06/20 02:55 PM

Importantly, when documenting their understanding of the internal control system, the audit team should keep in mind the following questions related to control activities:

∙ Information technology. Has the audit client taken full advantage of their existing tech- nological platform (e.g., SAP) by using entirely automated control activities whenever it is efficient and effective?

∙ Level of integration with their risk assessment process. Has the audit client’s manage- ment team taken the actions necessary to sufficiently address the identified risks of material misstatement for each relevant assertion?

∙ Selection and development of control activities. Has the audit client’s management team designed and implemented control activities with full consideration of their cost and their potential effectiveness in mitigating the risks of material misstatement identified?

∙ Policies and procedures. Have the policies related to reliable financial reporting been documented and communicated throughout the company by the audit client’s manage- ment team?

In addition, regardless of the size of the entity, the COSO framework establishes three principles that, if applied properly, will result in an effective evaluation of the control activities component. The three principles of the control activities component are listed in Exhibit 5.7.

There are a number of different types of controls in today’s financial statement audit environment. Ultimately, financial reporting control activities are imposed on the account- ing system for the purpose of preventing, detecting, and correcting errors and frauds that could enter and flow through to the financial statements. Clearly, preventive controls, procedures that prevent misstatements before they occur (those that ensure hiring compe- tent people, limiting access, requiring approval, separating duties, etc.), are preferable to detective controls, procedures that detect misstatements after they occur. In some sense, all control activities can be thought of as preventive controls because the possibility of being caught by a detective control might prevent someone from committing an error or a fraud. Control activities also include management review controls, information process- ing controls, physical security controls, and controls that allow for proper separation of duties. Each of these additional categories is now discussed in turn.

Relevant Assertion What Could Go Wrong? Control Activity

Occurrence Sales revenue is recorded when the goods had not been shipped to the customers.

All sales invoices are matched to shipping documents before recording them in the general ledger.

Valuation Goods will be shipped to a new customer who is unable to pay for the goods.

The credit department performs a detailed credit check for all new customers.

Completeness Goods will be shipped to a customer, and the revenue is not recorded.

All shipping documents are matched to sales invoices that have been recorded in the general ledger.

EXHIBIT 5.6 Relevant Assertions, What Could Go Wrong and Control Activities for the Revenue Account

EXHIBIT 5.7 Three Principles of the Control Activities

  Principles of Control Activities as per COSO Framework

1. The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

2. The organization selects and develops general control activities over technology to support the achievement of objectives.

3. The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

First Pages

lou6920x_ch05_172-219.indd 184 03/06/20 02:55 PM

184 Part Two The Financial Statement Audit

Management Review Controls An audit client’s management team has primary responsibility for ensuring that the organization’s objectives are being met. As a result, management review controls are an important way for a management team to actively participate in the supervision of opera- tions. For example, management’s study of budget variances with follow-up action is an example of a management review control. In general, a management team that performs more frequent reviews has more opportunities to detect errors in the records than man- agement that does not perform frequent reviews. The frequency, of course, is governed by the costs and benefits. In addition, subsequent action to investigate or correct differences is critically important to demonstrate that the control is truly operating in an effective manner. Without a doubt, periodic management reviews and subsequent follow-up action to correct identified errors tends to lower the risk that material misstatements exist in the financial statement accounts.

Information Processing Control Activities Information processing control activities are essential to the effectiveness of an internal control system. Generally speaking, all organizations employ computerized information processing on a routine basis. When entities use computerized information processing, the professional standards make clear that information technology (IT) poses specific risks to an entity’s internal control system. And, although the focus of this chapter is on providing a broad understanding of internal control, you should be aware that the use of computerized information processing requires entities to implement specific control activities to enable it to support the relevant financial statement assertions.

For staff auditors in today’s financial statement audit environment, the most important information processing control activities are the ones that are designed to ensure the com- pleteness and accuracy of system generated reports. Recall from Chapter 1 that a system generated report is a report generated by the audit client’s information system that is used to execute its internal control procedures or produce its financial statements. If such a report is used by the audit client’s management for either of these purposes, the client must have control activities in place to ensure that each report is complete and accurate. See Exhibit 5.8 for several examples of system generated reports and the related control activity where the report is needed for its proper execution.

The full range of auditing considerations that are relevant to an audit client’s comput- erized information processing environment are discussed in detail in Module H. How- ever, before moving on, it is important to realize that even “spreadsheet goofs” can pose risks to an entity’s internal control system, as shown in the following Auditing Insight. In addition, although almost all organizations employ computerized information process- ing, manual controls over certain information processing activities remain important in many systems. For example, important manual control activities over the purchasing and cash disbursement cycle include using purchase orders to ensure proper authorization (the occurrence assertion), matching vendor invoices with receiving reports and purchase orders to ensure that the quantity billed agrees with the quantity ordered and received

EXHIBIT 5.8 System Generated Reports and Internal Control Activities

System Generated Reports Internal Control Activities

Accounts Receivable Aging Report The accounts receivable aging report is generated on a monthly basis by the information system. The report is reviewed by the Chief Financial Officer to evaluate the adequacy of the allowance for doubtful accounts.

Three-Way Match Exception Report The three-way match exception report is generated on a weekly basis by the information system. The report is reviewed by the accounts payable clerk and all exceptions are followed up on and resolved by the clerk.

New Hires Report The new hires report is generated on a quarterly basis by the information system. The report is reviewed by the payroll clerk to ensure that all new employees are reflected in payroll expense.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 185

lou6920x_ch05_172-219.indd 185 03/06/20 02:55 PM

at previously agreed-upon prices (the accuracy assertion), and using and accounting for prenumbered documents (checks, purchase orders, and receiving reports) to ensure that all transactions have been recorded (the completeness assertion). (Note: Failure to account for the numeric sequence of documents eliminates the benefit of prenumbering.) The specific control activities for each cycle are discussed in more detail in Chapters 6 through 10.

TransAlta Corp. confessed that a “clerical error” was a costly one— $24 million, to be exact—for the power producer. The Calgary-based company said a spreadsheet goof by an employee caused the com- pany to pay higher than intended rates to ship power in New York. CEO Steve Snyder explained via a conference call that a “cut-and- paste” foul-up within an Excel spreadsheet on a bid to New York’s power grid operator led TransAlta to secure 15 times the capacity of power lines at 10 times the price. The costly human error couldn’t be reversed by the grid operator, and although TransAlta has since tried to recoup the mammoth losses, it was left with a $24 million lesson.

In October 2003, about two weeks after releasing its third- quarter earnings figures, Fannie Mae had to restate its unrealized gains account by $1.2 billion for errors in “mark-to-market” calcula- tions. This was apparently the result of “honest mistakes made in a spreadsheet used in the implementation of the new accounting standard.”

Sources: “Cut-and-Paste Oops Costly for TransAlta,” Canadian Press, June 4, 2003; “Fannie Mae Corrects Mistakes in Results,” The New York Times, October 30, 2003, p. C1.

Spreadsheet GoofsAUDITING INSIGHT

Physical Security Controls Physical access to assets, data and important records, documents, and blank forms should be limited to only authorized personnel. Assets such as inventory and securities should not be available to persons who have no need to handle them. Likewise, access to records should be denied to people who do not have a record-keeping responsibility for them. Some blank forms are very important for accounting and certain control activities, and their availability should also be restricted.

In addition, given the importance of the computerized information processing system, physical security of computer equipment and restricting access to the organization’s data and computer application files are important to achieving effective internal control. Access controls help prevent the improper use or manipulation of data files, unauthorized use of computer programs, and improper use of the computer equipment. Overall, in today’s environment, it is essential that organizations have a robust set of cyber security control activities in place and operating effectively. As illustrated in the following Auditing Insight, sometimes a weakness in cyber security control activities can lead to the loss of assets.

In late 2018, the SEC reported that nine public companies, from a variety of industries including technology, real estate, financial and consumer goods, energy, and more, recently lost nearly $100 million to cyber criminals. The companies were defrauded by two different schemes, emails from fake executives and emails from fake vendors.

According to the report, the spoofed emails from fake executives “were not sophisticated frauds in general design or the use of technol- ogy. In fact, from a technological perspective they only required creat- ing an email address to mimic the executive’s address.” The emails

actually included spelling mistakes! However, the fake vendor emails were more sophisticated and were generally not discovered as fraud until the real vendor contacted the company for payment for its past due invoices. In each case, company personnel wired money to the fraudulent accounts costing each of the nine companies anywhere from $1 million to $45 million dollars that will not be recovered.

Sources: https://www.sec.gov/news/press-release/2018-236: https://www. sec.gov/litigation/investreport/34-84429.pdf.

Did They Really Lose $100 million?AUDITING INSIGHT

Also, locked doors, security passes, passwords, and check-in logs can be used to limit access to the computer system hardware. One way to detect inappropriate computer usage is by specifying a planned schedule for running large-scale computerized applications.

First Pages

lou6920x_ch05_172-219.indd 186 03/06/20 02:55 PM

186 Part Two The Financial Statement Audit

A schedule can help detect unauthorized access because most software can produce usage reports that can be compared to the planned schedule. Applications that are being run at unauthorized times can then be investigated for inappropriate use of computer resources.

Separation of Duties A very important characteristic of an effective internal control system is that an appro- priate separation of duties (or functional responsibilities) plan is in place. Four types of functional responsibilities should be performed by different departments (see Exhibit 5.9), or at least by different persons on the entity’s accounting staff:

1. Authorization to execute transactions. This duty belongs to people who have the authority and the responsibility for initiating or approving transactions. Authorization may be general, referring to a class of transactions (e.g., all purchases up to $100,000), or it may be specific (e.g., sale of a major asset).

2. Recording transactions. This duty refers to the accounting and record-keeping func- tion, which in most organizations is delegated to a computerized information system. People who control computerized processing are the record keepers.

3. Custody of assets involved in the transactions. This duty refers to the actual physical possession or effective physical control of property.

4. Periodic reconciliation of existing assets to recorded amounts. This duty refers to making comparisons at regular intervals and taking appropriate action with respect to any differences.

Incompatible responsibilities are combinations of responsibilities that place a person alone in a position to create and conceal misstatements due to errors or frauds in her or his normal job. Duties should be divided so that no one person can control more than one of these responsibilities. If different departments or persons are forced to deal with these different facets of transactions, frauds are more difficult to commit because they would then require collusion of two or more persons, and most people hesitate to seek the help of others in order to conduct wrongful acts. A second benefit of separating duties is that by acting in a coordinated manner (handling different aspects of the same transaction), innocent errors are more likely to be found and corrected. The old saying “Two heads are better than one” is often proven to be true.

In most computerized information processing environments, employees who have access to an application (such as payroll) might be in a position to perform incompat- ible functions. As a result, to achieve proper separation of duties, it is essential for an organization to have a well-thought-out plan that limits employees’ access to the com- puterized information processing system (e.g., SAP, Oracle) to only those applications that are necessary for such employees to complete their jobs. In effect, companies must design internal control activities that will effectively limit opportunities for any one indi- vidual to both perpetrate and conceal misstatements or losses due to errors or fraud. In most situations, these often include password access controls that are designed to align the computer access rights to transactions, data, key documents, and assets with only those employees who require such access to complete their clearly defined role within the internal control system. In a sense, proper separation of duties is accomplished through appropriate system access controls.

EXHIBIT 5.9 Separation of Duties

Authorization

Reconciliation

RecordingCustody

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 187

lou6920x_ch05_172-219.indd 187 03/06/20 02:55 PM

Level of Automation When gaining an understanding of an internal control system, it is important for the audi- tor to consider the level of automation used to execute each control activity. In general, control activities are categorized by auditors as purely manual controls, manual controls that rely on a system generated report, and entirely automated controls.

Manual controls are control activities that operate in a completely manual manner with full dependence on a person. An example of this control would be a three-way match control in the purchases cycle where the accounts payable clerk was responsible for phys- ically matching the details of a purchase order, receiving report, and a vendor invoice before authorizing the amount for payment. Since the control is operated manually with- out the use of the computer information system, there is no reliance on the computer information system for it to operate effectively.

Like purely manual controls, manual controls that rely on a system generated report depend on a person. However, the difference is that the person operating the control must rely on a report that is generated by the computer information system. An example would be a control, executed by the controller, that was designed to evaluate the accounts receiv- able aging report to determine the reasonableness of the allowance for doubtful accounts. Importantly, the proper execution of the control is dependent on the completeness and accuracy of the accounts receivable aging report.

Entirely automated control activities operate completely within the computer infor- mation system. An example of this would be an automated credit approval control that is used by a bank to ensure that it does not extend credit beyond each customer’s credit limit. The proper execution of the control is entirely automated. Thus, when a customer attempts to use the credit card, the amount of the sale is added to that customer’s existing balance and the amount is compared to the credit limit for that customer. If you have ever been denied when attempting to pay for dinner or purchase clothes, you certainly know about this automatized control.

REVIEW CHECKPOINTS 5.11 What is a control activity? 5.12 What is the difference between preventive controls and detective controls? Give an example of each. 5.13 What kinds of functional responsibilities should be performed by different departments or persons

in a control system with good separation of duties?

Information and Communication When evaluating the information and communication component of internal control, the “auditor should obtain an understanding of the information system [emphasis added] includ- ing the related business processes, relevant to financial reporting. As part of that process, the auditor must seek to understand the nature of the underlying accounting records, sup- porting information and the accounts that are used to fully execute a transaction.” The audi- tor should also understand “how the information system captures events and conditions, other than transactions, that are significant to the financial statements.”4 Clearly, the size of the entity will have an impact on this component. However, regardless of the entity’s size. the COSO framework establishes three principles that, if applied properly, will result in an effective evaluation of the information and communication component. The three prin- ciples of the information and communication component are listed in Exhibit 5.10.

The professional standards recognize that to make effective decisions, managers must have access to timely, reliable, and relevant information. As a result, an entity’s infor- mation system should be devised to identify data from reliable external sources such as 4PCAOB Auditing Standard 2110, “Identifying and Assessing Risks of Material Misstatement.”

First Pages

lou6920x_ch05_172-219.indd 188 03/06/20 02:55 PM

188 Part Two The Financial Statement Audit

suppliers, customers, economic databases, and so on, as well as internal sources. Having superior information systems can be a part of an entity’s strategy and competitive advan- tage (e.g., Amazon.com). Management evaluates the quality of information by determin- ing whether the content is appropriate and the information is timely, current, accurate, and accessible. Note that these sometimes are contradictory. For example, waiting to ensure that information is accurate can cause it not to be timely.

Communication includes report production and distribution. The account balances are summarized in internal management reports and external financial statements. The inter- nal reports are management’s feedback for monitoring operations. The external reports are the financial information for outside investors, creditors, and others. Communication also involves expectations, responsibilities of individuals and groups, and other important matters. Specific duties must be made clear, and people need to know how their activities relate to the work of others. People also need to know what behavior is expected. In addi- tion, personnel need a means of communicating significant information upstream in an organization. Outsiders also should know that fraudulent and unethical behavior by entity personnel is unacceptable and should be reported to management.

The information system produces a trail of activities (often referred to as an audit trail) from data identification to reports. You can visualize that the audit trail begins with the source documents (purchase orders, sales orders, etc.) and proceeds through to the financial reports. Auditors often follow this trail frontward and backward, identifying and testing relevant control activities along the way (Exhibit 5.11). They follow it backward from the financial reports to the source documents to determine whether everything in the financial reports is supported by appropriate source documents (the occurrence asser- tion). They follow it forward from source documents to reports to determine whether everything that happened (i.e., transactions) was recorded in the accounts and reported in the financial statements (the completeness assertion).

Information systems in small or midsize organizations are likely to be less formal than in larger organizations, but their role is just as significant. Smaller entities with active management involvement may not need extensive descriptions of accounting procedures, sophisticated accounting records, or written policies. Communication may be less formal and easier to achieve in a small or midsize company than in a larger enterprise because the smaller organization has fewer levels, and management has more visibility and availability.

One final and very important consideration made by the audit team when gaining an understanding of this component relates to the use of information produced by the company

EXHIBIT 5.11 Occurrence and Completeness of a Sales Transaction

Sales Order SalesAuthorization Shipping

Documents

Occurrence Direction

Completeness Direction

Sales Invoice FinancialStatements

  Principles of Information and Communication as per COSO Framework

1. The organization obtains or generates and uses relevant quality information to support the functioning of internal control.

2. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

3. The organization communicates with external parties regarding matters affecting the functioning of internal control.

EXHIBIT 5.10 Three Principles of Information and Communication

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 189

lou6920x_ch05_172-219.indd 189 03/06/20 02:55 PM

Monitoring The COSO framework recognizes that in order to allow for continuous improvements and consider changes in the entity’s operating environment, management needs to monitor its internal control systems. According to COSO, a well-functioning monitoring system is characterized by philosophies such as the following:

∙ Ongoing and separate evaluations. Ongoing evaluations of controls that are separate from other types of evaluations (e.g., operational) enable management to determine whether the other components of internal control continue to function over time.

∙ Reporting deficiencies. Internal control deficiencies are identified and communicated in a timely manner to those parties responsible for taking corrective action and to management and the board as appropriate.

It is important to note that monitoring does not include regular management and supervisory control activities and other actions that employees take in performing their everyday duties. Effective monitoring involves ongoing evaluation of the controls. Some common monitoring controls include

∙ Periodic evaluation of controls by the internal audit department. ∙ Analysis of and appropriate follow-up of operating reports or metrics that might iden-

tify anomalies indicative of a control failure. ∙ Supervisory review of controls, such as reconciliation reviews as a normal part of

processing. ∙ Self-assessments by boards and management regarding the tone they set in the organi-

zation and the effectiveness of their oversight functions. ∙ Audit committee inquiries of internal and external auditors. ∙ Quality assurance reviews of the internal audit department.5

5Guidance on Monitoring Internal Control Systems, COSO, January 2009.

In a recent public report about its inspections program, the PCAOB specifically discussed a recurring finding related to information that is produced by the entity being audited. Specifically, the PCAOB noted that its “inspections staff has continued to observe instances in which auditors selected controls for testing but did not sufficiently test the controls over completeness and accuracy of system-generated data or reports used in the operation of those controls.” For example, “man- agement used reports that were generated by the issuer’s information system to perform its review control; however, the engagement team did not test controls over the accuracy and completeness of these reports. In addition, the engagement team did not test the reports to verify the completeness and accuracy of the individual variance

calculations to determine whether the investigation of other variances was necessary.” Because an entity’s use of IT affects the fundamental manner in which information is produced, it is essential that an auditor is comfortable with the completeness and accuracy of all information used by management to execute control activities that are deemed important to the auditor.

Source: PCAOB Staff Inspection Brief - Preview of Observations from 2016 Inspections of Auditors of Issuers. Volume 2017/4. November 2017; PCAOB Observations from 2010 Inspections of Domestic Annually Inspected Firms Regarding Deficiencies in Audits of Internal Control over Financial Reporting. PCAOB Release No. 2012-006. December 10, 2012 (both available at www. pcaobus.org).

PCAOB Identifies Deficiencies Related to System-Generated Data

AUDITING INSIGHT

during the audit (like System Generated Reports discussed previously). The professional standards are clear that an auditor cannot ever rely on information produced by the com- pany’s information system without investigation. Instead, the audit team is required to per- form audit procedures that are designed either to test the controls that have been designed to ensure that the information is complete and accurate or to test the completeness and accu- racy of the information using substantive testing procedures. The following Auditing Insight demonstrates the focus of the PCAOB on the importance of this issue.

First Pages

lou6920x_ch05_172-219.indd 190 03/06/20 02:55 PM

190 Part Two The Financial Statement Audit

As you can see, some of the control activities explained earlier in this chapter also serve as monitoring activities. For example, analyzing customer complaints for follow-up is a control activity, but analyzing them to determine whether the complaints result from a weakness in other controls (e.g., a failure to compare shipping documents to customer orders) is a monitoring activity.

Although the preceding procedures provide management daily monitoring opportuni- ties, the oversight provided to the entity by the board of directors (and, more specifically, the audit committee) provides the highest level of monitoring. In addition, management’s close involvement in operations often will identify significant variances from expecta- tions and inaccuracies in financial data. Finally, ongoing monitoring activities of small and midsize entities are more likely to be informal and are typically performed as a part of the overall management of the entity’s operations. However, regardless of the entity’s size, the COSO framework establishes two principles that, if applied properly, will result in an effective evaluation of the monitoring component. The two principles of the moni- toring component are listed in Exhibit 5.12.

Limitations of Internal Control Internal control provides reasonable assurance, not absolute assurance, that management’s objectives will be achieved. Because people operate the controls, breakdowns can occur. Internal control can help prevent and detect many errors, but it cannot guarantee that they will never happen. In that spirit, several limitations to internal control systems prevent management from obtaining complete assurance that controls are absolutely effective:

∙ Human error due to mistakes in judgment, fatigue, and carelessness can still occur. ∙ Although controls are implemented to prevent and detect errors, deliberate circumven-

tion by people in the system can still occur. ∙ Because most internal controls are directed at lower-level employees, management

override can occur. For example, it is often possible for management to override con- trols by force of authority (i.e., if the CEO says to do something, most employees will).

∙ Although separation of duties can be extremely effective in an internal control system, collusion among people who are supposed to act independently can lead to a failure in the achievement of relevant internal control objectives.

In addition, one other limitation deserves special consideration. That is, an internal control system is always subject to cost–benefit considerations. Internal control could be made perfect, or nearly so, but at great expense. For example, at the lowest level of con- trol, a company’s inventory could be left completely unlocked and unguarded (i.e., with no controls at all); next, a fence could be used; locks could be installed; lighting could be used all night; television monitors could be put in place; or at the highest level of control, armed guards could be hired. Each of these successive safeguards costs additional money (as does extensive supervision of clerical personnel in an office). At some point, the cost of protecting the inventory from theft (or the cost of supervisors catching every clerical error) exceeds the benefit of the internal control activity. In the professional auditing standards, the concept of reasonable assurance recognizes that the costs of controls should not exceed the benefits that are expected from the controls. Hence, an entity can decide that certain controls are too costly considering the risk of loss that can occur. Finally, it is important for students to remember that internal control is a process, a means for

EXHIBIT 5.12 Two Principles of Monitoring Activities

  Principles of Monitoring Activities as per COSO Framework

1. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

2. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 191

lou6920x_ch05_172-219.indd 191 03/06/20 02:55 PM

REVIEW CHECKPOINTS 5.14 What is meant by the information and communications component of an effective internal control

system? How can an auditor evaluate whether a client’s internal control system is functioning properly for this component?

5.15 Give some examples of everyday work an entity’s management can use to enact the monitoring component of internal control. When are such activities control activities, and when are they monitoring activities?

5.16 What is the concept of reasonable assurance? What are the key limitations of an internal control system?

INTERNAL CONTROL EVALUATION To this point, we have defined internal control, identified management’s and the audit team’s responsibility for internal control, and described the five components of internal control defined by COSO. These components are considered to be criteria for evaluating an entity’s internal control over financial reporting and the bases for an auditor’s assess- ment of control risk for each relevant assertion about each significant financial statement account or disclosure. In assessing control risk, audit teams typically use a three-phase procedure illustrated in Exhibit 5.13. It is important to note that these phases must be com- pleted for each relevant financial statement assertion level if the auditor plans to rely on a control activity to modify the nature, timing, and extent of substantive audit procedures.

Phase 1: Understand and Document the Client’s Internal Control The process of obtaining an understanding of internal controls should occur early in the audit engagement. On every audit engagement, the audit team should evaluate the design of internal control and determine whether controls have been implemented over all rel- evant assertions related to each significant account and financial statement disclosure. The  procedures used to gain an understanding of internal controls provide the audit team an overall acquaintance with the control environment and management’s risk assessment, the flow of transactions through the accounting system, and the design of some client control activities. Gaining an understanding of internal controls should be performed in a “top-down” risk-based manner that first identifies significant accounts and disclosures and their relevant assertions. This was discussed in Chapter 4. Recall that an account’s significance is based on its inherent risk (i.e., the likelihood of containing a material mis- statement before the consideration of internal control). Thus, audit teams focus on likely sources of significant misstatements. This determination is not based on quantitative mea- sures alone, but it is unlikely that a large, material account balance would ever be omitted from consideration. Relevant assertions are those that represent the possibility of a material misstatement. Thus, an assertion that does not represent a meaningful risk of misstatement (e.g., completeness of cash) is not relevant and should not be considered by the audit team.

LO 5-4 Explain the process the audit team uses to assess control risk; understand its impact on the risk of material misstatement; and, ultimately, know how it affects the nature, timing, and extent of further audit procedures to be performed on the audit.

Understand and Document the Client’s Internal Control

Assess the Control Risk (Preliminary)

Identify Controls to Test and Perform Tests of Control

management to achieve its objectives, not an end in itself. It is also dynamic, operating every day within an entity’s operating structure, which can and does evolve as the entity and its operating environment change over time.

First Pages

lou6920x_ch05_172-219.indd 192 03/06/20 02:55 PM

192 Part Two The Financial Statement Audit

EXHIBIT 5.13 Phases of Internal Control Evaluation Obtain an understanding

of internal control

Control environment Risk assessment Control activities Information and Communication Monitoring

Narrative memo Flowchart Questionnaire

Assess control risk (preliminary assessment)

Perform tests of controls of the specified controls

Specify the controls to be tested and the degree of compliance required

Perform the planned (or revised) substantive procedures

Document the basis for assessing control risk less than 100%

Can control risk

be low or less than maximum?

Is reduction of the control risk

assessment cost e�ective?

Document the understanding

Ph as

e 3:

T es

tin g

Ph as

e 1:

U nd

er st

an di

ng Ph

as e

2: A

ss es

sm en

t

Design a preliminary program of substantive procedures for auditing the relevant assertions about significant financial statement accounts and disclosures

Yes

Yes

No

No

No

Yes Is the

actual degree of compliance comparable

to the required degree?

Assess high or maximum (100%) control risk and design the audit program for more e�ective substantive procedures

Identifying Entity-Level Controls For all the relevant assertions for each significant account and disclosure, audit teams begin by examining entity-level controls, controls that are pervasive to the internal control system and the reliability of the financial statements taken as a whole. See Exhibit 5.14 for the PCAOB’s list of entity-level controls from the professional standards and the audit team’s methods of obtaining an understanding of such controls. Notice that the PCAOB explicitly includes parts or all of the COSO framework elements. This is deliberate. If the audit team decides that an entity-level control sufficiently reduces a specific risk of material misstatement for a relevant assertion, it may not need to delve further into transaction-level controls (discussed next) related to that risk. For example, if a chief financial officer who is very familiar with the company’s payroll process performs reviews

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 193

lou6920x_ch05_172-219.indd 193 03/06/20 02:55 PM

Types of Entity-Level Controls Assessment

• Controls related to the control environment • Controls related to management override • Centralized processing and controls

including shared service environments • Controls to monitor results of operations • Controls to monitor other controls.

The primary evidence to test these controls is gathered through observation and inquiry and some document examination. Ultimately, the auditor needs to determine whether management’s integrity, values, and operating style promote effective control consciousness throughout the entity.

• Management’s risk assessment The audit team next needs to gain an understanding of how the client assesses and responds to risk. If the client already uses enterprise risk management, inquiring and obtaining documentation of such processes is usually enough.

• Period-end financial reporting process The auditor should assess the processes that are used to produce its annual and quarterly financial statements, including the extent to which IT is involved in the period-end process. The auditor must document who is actually participating from the management team and where the process actually takes place. Finally, the auditor needs to understand and document the types of adjusting entries that have occurred and the extent of process oversight by the management team, the board, and the audit committee.

• Policies that address significant business control and risk management practices

An entity’s internal auditors and systems staff often review and evaluate this documentation. Independent auditors may review and study their work instead of doing the same tasks over again. Other sources of information include (1) previous experience with the entity as found in the prior-year audit, (2) responses to inquiries directed to client personnel, and (3) examination of documents and records.

EXHIBIT 5.14 Entity-Level Controls and Their Assessment

of weekly payroll reports and investigates discrepancies thoroughly, this may provide a control that is sufficient to meet the internal control objectives for payroll reporting (i.e., address or mitigate the risk of material misstatement for each of the relevant assertions for payroll expense).

In addition to entity-level controls, the audit team also identifies transaction-level controls, controls that pertain to specific classes of transactions, account balances, and disclosures. The most effective method used to gain an understanding of (1) the flow of transactions; (2) the points at which a material misstatement could occur; and (3) the controls that management has implemented to mitigate each risk of material misstatement identified is to perform a walkthrough of a single transaction through the entire accounting system. During the walkthrough, the auditor is able to learn by observing the activities that occur and the documents that are used within an internal control process. The auditor must come to understand internal control in order to evaluate design effectiveness.

Design effectiveness determines whether the controls over financial reporting, if operating effectively, would be expected to prevent or detect errors or fraud that could result in a material misstatement in the financial statements. A walkthrough consists of a combination of inquiry of personnel, observation of an entity’s operations, and docu- ment examination while tracing a single transaction through the entire audit trail from the beginning or the initiation of the transaction to its final inclusion in the financial statements. Each client employee involved is asked to demonstrate the procedures that he or she follows in processing the transaction. The walkthrough is an important step in awareness because, often, the information that is contained in manuals and understood by supervisors may not be the same as the procedures actually being performed. People can change procedures to make them more efficient, they can forget to perform procedures, they may go on vacation, they may intentionally not perform procedures, or the proce- dures may not be understood by a new person taking over that position.

At this point, the audit team has learned the design of controls (or how those controls are intended to function). However, this does not inform the audit team as to the operat- ing effectiveness of controls unless there is some automation that provides for the con- sistent application of the operation of the control. Additionally, reperformance of critical controls along the transaction trail can take place at this time to provide evidence of

First Pages

lou6920x_ch05_172-219.indd 194 03/06/20 02:55 PM

194 Part Two The Financial Statement Audit

operating effectiveness. Operating effectiveness refers to whether the control is operat- ing as designed and whether the person performing the control possesses the necessary authority and qualifications to perform the control effectively. Evidence of this nature will be obtained in a subsequent phase of the audit team’s study of internal control.

Document the Internal Control Understanding Once the audit team has completed the walkthrough and learned about the design and implementation of the entity’s internal control system, it is required to document that understanding. The understanding can be summarized and documented effectively in the form of narratives, flowcharts, and even questionnaires. Each of these is now discussed.

The most common way for documenting the audit team’s understanding of internal con- trol is to write a narrative description of each significant process within the internal control system. Such a narrative simply describes all environmental elements, the process flow of transactions through the accounting system, and all control activities. The narrative description can be quite useful for all audits. However, for a large entity, this description may make it difficult to identify the points in the process where a material misstatement might occur, also known as process risk points.

Another method for documenting the auditors’ understanding of an entity’s internal control system is to construct an accounting process flowchart. In today’s financial state- ment audit environment, many companies have their own flowcharts that the audit team may use as a starting point instead of constructing their own from scratch. The advan- tages of flowcharts can be summarized by an old adage: “A picture is worth a thousand words.” Flowcharts tend to help the audit team better assess the points in the process where a material misstatement can occur which helps to reveal key points in the process where a control activity is needed. This of course can be quite beneficial in helping audit teams identify missing control activities in the process.

Construction of a flowchart can be quite time-consuming because an auditor must take the time to learn about the operating personnel involved in the system and gather samples of relevant documents. Thus, the information for the flowchart, like the narrative descrip- tion, involves much effort and observation. When the flowchart is complete, however, the result is an easily evaluated, informative description of the system that shows the various duties performed by individuals and provides graphic evidence of any conflicting responsibilities (i.e., lack of separation of duties). Further, once a flowchart is complete, subsequent audits can easily access the flowchart and update it for changes that have been made in the process since the prior year. In recent years, flowcharting has become even more popular as a way to document an auditor’s understanding of the internal con- trol system, primarily because of its effectiveness in evaluating internal control design. In  addition, advances in technological tools have also made the construction of a flow- chart much more efficient.

For any flowcharting application, the chart must be understandable to an audit super- visor. Flowcharts are created with audit-specific flowcharting software but also can be created rather easily in Excel or PowerPoint. The flowchart should communicate all rel- evant information and evidence about separation of responsibilities, authorization, and accounting and control activities in an understandable, visual form. The starting point in the system, if possible, should be placed at the upper-left-hand corner. The flow of procedures and documents should be from left to right and from top to bottom as much as possible. The shapes of the symbols are commonly understood and fairly obvious. For example, rectangles are processes, circles are connectors, quadrilaterals are manual processes, and so on. Narrative explanations should be written on the face of the chart as annotations or in a readily available reference key.

Refer to Exhibit 5.15 for a partial flowchart representation of the beginning stages of a payroll processing system. The connectors shown by the circled numbers indicate con- tinuation on the flowchart. Ultimately, the flowchart ends showing entries in accounting journals and ledgers. In Exhibit 5.15, you can see some characteristics of both flowchart construction and this specific accounting system. By reading down the columns for each

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 195

lou6920x_ch05_172-219.indd 195 03/06/20 02:55 PM

department, you can see that transaction-initiation authority (both hiring and time card preparation) and custody of checks are separated.

A third way to document the auditor’s understanding of an internal control system is to conduct a formal interview with knowledgeable managers using an internal control questionnaire illustrated in Exhibit 5.16. Such a questionnaire is typically organized under headings that identify questions related to relevant themes like the control environment and relevant management assertions. Not all questionnaires are organized like this, so audit teams need to know the general objectives in order to know whether the question- naire is complete. Likewise, if you are assigned to prepare an internal control question- naire, you will need to be careful to include questions about each relevant assertion.

Internal control questionnaires are designed to help the audit team obtain evidence about the control environment and the accounting and control activities that are con- sidered appropriate for normal circumstances. All organizations have unique features, and answers to the questions should not be taken as final and definitive evidence about how well controls actually function. Evidence obtained through the interview process is categorized as inquiry-level information that is not sufficient to demonstrate the operat- ing effectiveness of a control activity. The person being interviewed could always give answers that reflect what the system should be rather than what it really is. The person can be unaware of informal ways in which duties have been changed or can be innocently ignorant of the system details. Nevertheless, interviews and questionnaires can be useful for detecting internal control weaknesses.

One key advantage of using internal control questionnaires is that audit teams are less likely to forget to cover some important point. Questions are worded such that a “no” answer points out a weakness or control deficiency, thus making analysis easier. However, audit teams should be aware that entity personnel often fully understand that “yes” answers are “good” and “no” answers are “bad,” so they tend to tell audit teams yes all the time. Good auditors often change a question when they ask it, just to ensure that the interviewee is listening and not giving only yes answers. Also, internal control

EXHIBIT 5.15 Payroll System Flowchart

Employment Authorization

Employment Authorization

Operating Department

Human Resources Payroll

Information Technology

Review Review

Payroll Program

1

2

1 3

Initiates Hiring

Approved by

Supervisor

Time Record

Labor Distribution

Payroll Register

Tax and Payroll Reports

Update Master

File

Approves Hiring To

Employee

2

3

Paycheck or

Direct Deposit Payroll Master

File

Labor Distribution

Payroll Register

Tax and Payroll Reports

First Pages

lou6920x_ch05_172-219.indd 196 03/06/20 02:55 PM

196 Part Two The Financial Statement Audit

  Yes/No Comments

Control Environment    

1. Are all employees paid by check or direct deposit?    

2. Is a special payroll bank account used?    

3. Are payroll checks signed by persons who do not prepare checks or keep cash funds or accounting records?

4. If a check-signing machine is used, are the signature plates controlled?    

5. Is the payroll bank account reconciled by someone who does not prepare, sign, or deliver paychecks?    

6. Are payroll department personnel rotated in their duties? Required to take vacations? Bonded?    

7. Is there a timekeeping department (function) independent of the payroll department?    

8. Are authorizations for deductions signed by the employees on file?    

Occurrence    

9. Are time cards or piecework reports prepared by the employee approved by her or his supervisor?    

10. Is a time clock or other electromechanical or computerized system used?    

11. Is the payroll register sheet signed by the employee preparing it and approved prior to payment?    

12. Are names of terminated employees reported in writing to the payroll department?    

13. Is the payroll periodically compared to personnel files?    

14. Are checks distributed by someone other than the employee’s immediate supervisor?    

15. Are unclaimed wages deposited in a special bank account or otherwise controlled by a responsible officer?

16. Do internal auditors conduct occasional surprise distributions of paychecks?    

Completeness    

17. Are names of newly hired employees reported in writing to the payroll department?    

18. Are blank payroll checks prenumbered and the numerical sequence checked for missing documents?    

Accuracy    

19. Are all wage rates determined by contract or approved by a personnel officer?    

20. Are timekeeping and cost accounting records (such as hours, dollars) reconciled with payroll department calculations of hours and wages?

21. Are payrolls audited periodically by internal auditors?    

22. Are individual payroll records reconciled with quarterly tax reports?    

Classification    

23. Do payroll accounting personnel have instructions for classifying payroll debit entries?    

Cutoff    

24. Are monthly, quarterly, and annual wage accruals reviewed by an accounting officer?    

EXHIBIT 5.16 Internal Control Questionnaire—Payroll Processing

questionnaires tend to be inflexible. If a key question is not included on the list because the question is unique to a client, the auditor might not even know to ask the question. Thus, for new clients, other methods of gaining an understanding that are tailored to the client are preferable. In practice, audit teams typically use a combination of methods to document their understanding of the client’s internal control.

Key Decision: Deciding Whether to Continue to Test Controls For an integrated audit at an issuer, the auditor must test controls for all relevant assertions for each significant account and disclosure. This will be discussed in detail later in this chapter. However, for audits of non-issuers, after the audit team members have documented their understand- ing of the entity’s internal control, an important decision needs to be made: Should the

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 197

lou6920x_ch05_172-219.indd 197 03/06/20 02:55 PM

audit team perform tests of the operating effectiveness of those controls? Audit teams may choose not to do so for one of two reasons. First, the audit team may conclude that the internal control system is too ineffective in preventing or detecting misstatements to rely upon and justify reductions of subsequent substantive audit procedures for the rel- evant assertions. This conclusion is equivalent to assessing control risk at the highest level and planning more extensive substantive testing procedures. Consider for a moment the Costco management report presented earlier that identified a material weakness in the internal control system. In such a situation, since the audit team would not likely be able to rely upon the internal control system, they would have no choice but to conduct significant substantive testing to make sure that the audit is conducted in an effective manner.

For the audits of non-issuers, a second reason that audit teams might not test controls would be the team’s decision that it would take more time to test the operating effective- ness of the control activities than it would take to perform the substantive tests necessary for a relevant assertion (even if the controls turn out to be working well). In this situation, the cost of obtaining a low control risk assessment can be high. In this case, the conclu- sion is also equivalent to assessing control risk at 100 percent, but this time it is because the audit team has not conducted the tests of operating effectiveness of control activities, not because the team has concluded that controls are ineffective.

For either reason, however, the result is the same: More extensive and effective substantive procedures are required to be completed in order to reduce the risk of mate- rial misstatement for a relevant assertion to an acceptably low level. For example, sup- pose the extensive testing of controls over the accuracy of payroll expenses is estimated to take 40 hours. Also suppose that, if controls were excellent, the substantive tests of payroll accuracy (e.g., confirmation sent to employees) could be reduced by 30 hours. The additional work to test controls is not economical. The decision to stop work on control risk assessment in this case is a matter of audit efficiency—it doesn’t make sense to spend 40 hours testing controls to reduce substantive tests by 30 hours. Of course, the auditors’ rationale for their final decision must be carefully documented. Before moving on, remember that this decision is appropriate only for non-issuers; audit teams must extensively test internal control over financial reporting for issuers.

REVIEW CHECKPOINTS 5.17 What is meant by a “top-down” approach to evaluation of internal controls? 5.18 Must the overall understanding of internal control always be followed by assessment and testing

phases? Explain. 5.19 Where can an auditor find a client’s documentation of the accounting system? 5.20 What are the advantages and disadvantages of documenting internal control by using (1) an

internal control questionnaire, (2) a narrative memorandum, and (3) a flowchart?

Phase 2: Assess the Control Risk (Preliminary)

Understand and Document the Client’s Internal Control

Assess the Control Risk (Preliminary)

Identify Controls to Test and Perform Tests of Control

After completing phase 1—understanding and documenting internal control—the audit team should be able to make a preliminary assessment of control risk. At this prelimi- nary stage, the audit team members also may use their internal control findings from the

First Pages

lou6920x_ch05_172-219.indd 198 03/06/20 02:55 PM

198 Part Two The Financial Statement Audit

Significant Account

Relevant Assertions What Could Go Wrong? Internal Control Activity

Cash

Existence The cash balance may not exist in the company’s bank accounts.

The CFO performs a detailed review of the bank reconciliation on a monthly basis.

Valuation The cash balance that is held in foreign countries may not have been translated properly.

The treasurer reviews the cash translation adjustment calculation monthly and independently checks that the appropriate spot rate has been used for each foreign currency.

Presentation and disclosure

There may be restrictions on the cash balance that were not properly disclosed.

The corporate secretary reviews the cash footnote disclosure on a quarterly basis to ensure that all legal restrictions on the cash balance have been properly disclosed.

Accounts Receivable

Existence Accounts receivable balances are inflated and don’t really exist.

Check sales order and shipping document to make sure sales were earned and a customer owes a balance.

Completeness Not all accounts receivable have been recorded.

Check invoices with shipping document to A/R ledger.

Valuation Receivables are not included in financial statements at the appropriate amount, and valuation adjustments are not recorded properly.

Management evaluates the collectability of delinquent receivables on a timely basis.

EXHIBIT 5.17 What Could Go Wrong and Control Activities

previous year’s audit. At this stage of the process, auditors seek to identify internal con- trol activities that are explicitly designed to support reliable financial statement reporting for the relevant financial statement assertion identified about each significant account and disclosure. It is important to remember that a well-designed internal control system will clearly link key internal control activities to the relevant financial statement asser- tions being supported. Exhibit 5.17 provides an illustration of this step by extending the exhibit that was developed in Chapter 4 (Exhibit 4.12) with a fourth column.

At this stage of the process, auditors are trying to identify the controls that may be relied upon as part of the overall audit process. To do so, auditors need to identify the controls that they believe will mitigate the risks of material misstatement that have been identified for each of the relevant assertions. As part of this process, auditors will often categorize controls as either preventive or detective, automated or manual, and will also note how often the control is performed (e.g., daily, weekly, monthly, etc.). The categori- zation process helps an auditor to better understand each control which facilitates internal control testing. Indeed, it is important to remember that any control that may be relied upon would have to be tested before the audit team could rely on them to reduce substan- tive testing. However, it is important to point out that audit teams should not perform tests of controls for those controls that will not be relied upon because there is no need to prove that they are operating effectively. Doing so would be inefficient. Instead, the audit team would have to perform additional substantive procedures to compensate for the lack of internal controls that could be relied upon to obtain sufficient appropriate evidence that would allow the auditor to reach a conclusion for the related relevant assertions.

Tests of controls must be performed to obtain evidence about whether control activi- ties that are candidates to be relied upon actually operate as described. The test of con- trols audit plan consists of procedures designed to produce evidence of how effectively the controls operate in practice. If they are determined to be operating effectively after testing, control risk can be assessed below the maximum. If they do not operate with the

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 199

lou6920x_ch05_172-219.indd 199 03/06/20 02:55 PM

required level of effectiveness, the final conclusion is to assess a high or maximum con- trol risk, revise the audit plan to consider the control weakness, and then proceed with additional substantive audit procedures.

The distinction between the understanding and documenting phase and the prelimi- nary control risk assessment phase is useful for understanding the audit team’s study and evaluation of internal control. However, the audit team typically performs these phases together, not as separate and distinct audit tasks. For non-issuers, the audit team can halt the control evaluation process for efficiency or effectiveness reasons. However, if the audit team wants to justify a low risk assessment to reduce the substantive audit proce- dures, the evaluation must be continued in phase 3, the testing phase.

To summarize, then, at this stage, the audit team members have established an assess- ment of the level of control risk based on its understanding of internal control and iden- tified control strengths and weaknesses. If this assessment is at a level less than the maximum level (i.e., the audit team members want to rely on internal controls to modify the nature, timing, and extent of further audit procedures), the auditors must next perform tests of controls. This final phase is discussed in the next section.

Phase 3: Identify Controls to Test and Perform Tests of Controls When audit teams reach the third phase of an evaluation of internal control, they already have identified specific control activities for relevant assertions on which risk could be assessed below the maximum (100 percent). This is often referred to as controls on which the audit team intends to rely. To support the reduced control risk assessment and the reduction of related substantive procedures for each relevant assertion, audit teams must test the control activities to determine whether they are operating effectively throughout the period. The required level of effectiveness is a matter of professional judgment. Audit  teams know that compliance cannot realistically be expected to be perfect. The  auditors could decide, for example, that evidence such as 98 percent of recorded payroll being supported by validated time cards is sufficient to assess a “low” control risk for the occurrence assertion. Most public accounting firms have internal guidelines to determine the acceptable rate of compliance for an internal control activity to be con- sidered effective. Generally, if a control is judged to be more important and would result in a more significant reduction in substantive testing, the level of compliance must be higher. Factors to consider in determining appropriate levels of compliance are discussed in more detail in Module E.

Understand and Document the Client’s Internal Control

Assess the Control Risk (Preliminary)

Identify Controls to Test and Perform Tests of Control

The professional standards make clear that when designing tests of controls, the auditor needs to consider the means of selecting items for testing. For tests of internal controls, there are two approaches that are commonly used: (1) testing all items in a population and (2) testing a sample from a population. The decision of which approach to use depends on the nature of the control that is being tested, along with the availability of data. For example, a control activity that is entirely automated might best be tested by an automated audit procedure that can be efficiently and effectively applied to the entire population of occurrences of that control activity. However, for a manual control activity, the auditor is likely to take a sample from the population of occurrences of that control activity. In addition, it should be noted that some manual controls (such as locking a door to safeguard assets) may have little documentation and may require other means of

First Pages

lou6920x_ch05_172-219.indd 200 03/06/20 02:55 PM

200 Part Two The Financial Statement Audit

testing (e.g., observation and inquiry). In today’s auditing environment, the increased use of computers by both the client and the auditor has dramatically increased the number of tests of control that can be effectively applied to the entire population of control occur- rences in an efficient manner (such as exception testing).

Exception Testing One way to subject all items in a population of occurrences for a particular control activ- ity is to use exception testing. Exception testing is designed to identify a violation of a particular control activity through the use of an automated test procedure designed to test all items in a population. For example, consider an entirely automated control activity that is designed to compare a customer’s credit limit to the sum of (1) a potential sales transaction and (2) that customer’s outstanding credit balance before approval of that sales transaction. If the control activity operated effectively throughout the year, a cus- tomer’s outstanding credit balance would not exceed its credit limit.

Given the nature of the control activity, one way to test the operating effectiveness would be through the use of exception testing. That is, an auditor could obtain evidence about the control’s operating effectiveness by using a procedure that compares each cus- tomer’s credit limit to that customer’s outstanding credit balance at the end of each day for the year under audit. Such a testing strategy would not have been possible (at least economically) in previous years. However, due to advances in information technology, such testing is now possible. As a direct result, entry-level audit professionals are now expected to consider the full extent of client data available for testing purposes, before they move forward with audit tests.

IDEA can be helpful to audit professionals when completing excep- tion tests and conducting audit sampling. This addendum sum- marizes several useful assignments that are available to students in the IDEA Data Analysis Workbook: IDEA Version Ten (the IDEA Workbook). The assignments allow students to experience a hands- on application of the IDEA software to exception testing. Ultimately, exception tests provide evidence about the operating effectiveness

of internal control activities by testing all items in a population. Module F provides a detailed illustration of how auditors use the sampling features of IDEA to select a representative sample from a complete population of control occurrences for a control activity to be tested.

At the end of this chapter, problems 5.72 and 5.73 can be com- pleted to illustrate the use of IDEA during internal control testing.

Internal Control TestingUSING IDEA IN THE AUDIT

Audit Sampling Of course, there are many control activities that do not lend themselves to automated audit testing. In such situations, auditors are likely to take a sample from the population of occurrences for the control activity being tested. Most importantly, in such situations, the population being sampled must include all occurrences of the relevant control activity for the entire period of reliance, and the sample must be representative of that population to be considered appropriate audit evidence.

Tests of controls, when performed, should be applied to samples of transactions and control activities executed throughout the period under audit. The reason for this require- ment is that the conclusions about controls will be generalized to the whole period under audit. If the auditor obtains audit evidence about the operating effectiveness of controls during an interim period, additional audit evidence should be obtained for the remain- ing period. There are certain situations when audit teams can rely on tests from previous periods if they have evidence that the procedure has not changed and the auditor does not believe there is a significant risk of material misstatement. However, in an annual audit, the auditor may not rely on audit evidence about the operating effectiveness of controls

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 201

lou6920x_ch05_172-219.indd 201 03/06/20 02:55 PM

obtained in prior audits for controls that have changed since they were last tested or for controls that mitigate a significant risk. Audit sampling is discussed in detail in Module E.

Perform Tests of Controls Once the items have been selected for testing, the four methods of testing controls are inquiry, observation, document examination, and reperformance. Generally, audit teams use inquiry about the existence of control activities and then corroborate the oral evidence by observing that the client-described control activities are actually being performed. Observation occurs when auditors have eyewitness observation of employees at their jobs performing control activities. Observation is typically used when certain control activities, such as separation of employees’ duties, leave no documentary evidence for subsequent examination. Observation also can produce evidence of access controls such as the use of password-secured access to the computerized information system, locked doors, and security guards. The limitation of observation is that this test of control is performed as of one point in time (usually near year-end), and what is observed at that point in time may not be representative of prior time periods.

Some tests of controls depend on documentary evidence such as a payroll entry supported by a time card. In these cases, document examination for evidence of signatures, initials, checklists, reconciliations, and the like provides better evidence than procedures that leave no documentary tracks. Document examination might be enough; the audit team may look to see whether the documents were marked with an initial, signature, or stamp to indicate they had been checked. For example, audit teams could examine canceled checks for authorized signatures, inspect voucher packets for the initials of the employee who matched vendor invoices with supporting purchase orders and receiving reports, or examine bank reconciliations to make sure that they have been performed on a timely basis.

Generally, the most effective test of controls is reperformance. Reperformance can involve any client internal control activity, such as the detailed review of the monthly bank reconciliation by the entity’s CFO. For this control, the auditor would follow up on each reconciling item reviewed by the CFO and then reperform each of the mathemati- cal calculations. The key difference between document examination and reperformance is that with the former, audit teams inspect documents for evidence that employees have performed the control activity; reperformance provides direct evidence that the control activity was (or was not) done correctly. Exhibit 5.18 puts control testing within the perspective of the payroll function with examples of specific assertions being supported. Appendix 5A illustrates a sample audit plan for these tests.

Overall, the audit team’s choice of which test of controls to use depends on the nature and importance of the control activity being tested. Not surprisingly, certain types of tests produce more evidence about the operating effectiveness of a control activity than others. The following hierarchy lists the type of control tests from the least persuasive (inquiry) to the most persuasive type of evidence:

∙ Inquiry of client personnel. ∙ Observation of the control activity being performed. ∙ Inspection of relevant documentation. ∙ Reperformance of the control activity.

Importantly, if the control activity has high risk, the audit team needs more persuasive evidence about its operating effectiveness than it would for a lower risk control in order to determine if it is operating effectively. Since gathering more persuasive evidence is typi- cally associated with a higher cost than gathering less persuasive evidence, if the audit team wants to achieve a lower control risk assessment, it will be more costly. This is why it may be more efficient for the auditor to choose not to rely on controls and instead rely on substantive testing procedures to gain assurance for certain significant accounts.

First Pages

lou6920x_ch05_172-219.indd 202 03/06/20 02:55 PM

202 Part Two The Financial Statement Audit

Relevant Assertion Control to Mitigate the Risk of Material Misstatement Tests of Controls

Occurrence. Payroll and related events that have been recorded have occurred and pertain to the entity.

1. Payroll accounting is separated from personnel and supervision.

2. Labor usage reports are compared to job time tickets or lists of amount of time clocked.

3. Payroll supervisor approved labor usage.

1. Observe separation of duties. 2a. Vouch labor costs to labor reports. 2b. Vouch labor reports to time tickets

authorized by management. 3. Examine documentary evidence of

supervisor approval.

Completeness. All payroll events that occurred should have been recorded.

1. All documents are prenumbered and numerical sequence reviewed.

2. Labor costs were reviewed by supervisors and compared to budgets.

3. The personnel department notified the payroll department of new hires to include in payroll.

1. Inspect numerical sequence of selected job cost tickets and paychecks.

2. Examine documentary evidence of supervisor review of labor costs.

3. Trace a sample of employees in the personnel file to payroll time logs and the payroll register.

Accuracy. Payroll amounts and related data have been recorded accurately.

1. Payroll entries are reviewed by a person independent of preparation.

2. Budgeted payroll expenses by department are compared to actual expenses.

1. Examine evidence of review and ensure that a party independent of preparation conducted the review.

2. Examine documentary evidence of budget comparison.

Classification. Payroll-related events are recorded in the proper accounts.

1. Job cost sheets are posted weekly and summary journal entries of work-in- process and of work completed prepared monthly.

2. Payroll supervisor is required to approve distribution of payroll expense accounts and to compare payroll costs to budget.

1. Observe that payroll account distribution and job cost sheets agree.

2. Examine supervisor signature on payroll reports. Note evidence of comparison to budget.

Cutoff. Payroll-related events have been recorded in the correct accounting period.

1. Payroll reports are prepared weekly and transmitted to cost accounting.

1. Observe that the date of payroll reports agrees with dates in weekly journal entries.

EXHIBIT 5.18 Relevant Assertions about Payroll Cycle Transactions

Of course, the level of automation of the control activity will also have a big impact on the nature of the control testing performed. That is, for manual controls that rely on a system generated report, the audit team would have to separately test whether the report is being generated by the system in a complete and accurate manner. In addition, for auto- mated control activities that operate entirely within the entity’s computer information system, the audit team would have to perform tests on the system to make sure that the control is operating effectively. The auditing considerations that are relevant to testing the completeness and accuracy of system generated reports and testing the operating effec- tiveness of purely automated controls are discussed in detail in Module H.

Direction of the Tests of Controls The tests of controls in Exhibit 5.18 are designed to test the payroll accounting cycle in two directions. One is the completeness direction, whereby the audit team is interested in ensuring that all valid hours are included in the entity’s payroll; as a result, time logs (which represent valid hours worked) are traced to payroll department files and the payroll register (which represents hours included in the payroll). Exhibit 5.19 shows that the sample for this direction is taken from the popula- tion of time logs (including listings of electronic clock-ins).

The purpose of the occurrence test of payroll is to ensure that all labor hours included in the payroll (represented by the payroll register) were actually worked (represented by time logs). As a result, entries would be selected from the payroll register and vouched back to the time logs by the auditor. Because payroll provides access to cash, this cycle is

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 203

lou6920x_ch05_172-219.indd 203 03/06/20 02:55 PM

highly susceptible to fraudulent activity on the part of an organization’s employees. If a fictitious employee were created and added to the payroll, his or her pay could be depos- ited into another person’s account. This is relatively difficult to detect in the era of direct deposit of paychecks.

Reassess the Control Risk The audit team should evaluate the evidence obtained from an understanding of the cli- ent’s internal control and from the related tests of control activities. If control risk (and the related RMM) is assessed very low, the substantive procedures on the relevant asser- tions for significant account balances can be limited in cost-saving ways. For example, a surprise payroll distribution as a substantive test might be considered unnecessary or the audit team might decide it is appropriate to place considerable reliance on control activi- ties in the payroll system. On the other hand, if tests of control activities reveal weak- nesses (e.g., improper separation of duties, inaccurate cost reports, inaccurate tax returns, or lax personnel policies), the RMM would be assessed at higher levels and substantive procedures would need to be increased to lower the risk of failing to detect material mis- statements in the financial statements.

Final assessment of control risk (and consequently, the RMM) is complicated. In the detailed sampling module (Module F), you will find explanations of sampling methods for performing tests of controls of the type illustrated in Exhibit 5.18. Further discussion of assessing the RMM (including control risk) is saved for those modules. However, rec- ognize that the final evaluation of an entity’s internal control is the assessment of the con- trol risk related to each relevant assertion. These assessments are the auditors’ expression of the effectiveness of control activities for preventing, detecting, and correcting specific errors and frauds in management’s relevant financial statement assertions.

An assessment of control risk should be coordinated with the final audit plan, which includes the list of substantive procedures to detect material misstatements in account balances and financial statement disclosures for each relevant assertion. Note that the reassessment of control risk can go only one direction: upward. If the controls are not functioning as described, they cannot be relied upon. On the other hand, even if weak controls are functioning, they are still weak and do not reduce the risk of material mis- statement. There is one exception: You find that you were in error during the understand- ing of controls phase; there are additional controls about which you were unaware. In that case, lowering control risk could be justified.

Thus far, our discussion of tests of control activities and substantive procedures has assumed that these are easily distinguishable. Be advised, however, that general audit procedures can at times be used as dual-purpose tests. That is, a single audit test can

EXHIBIT 5.19 Dual-Direction Test of Payroll Controls

Summary Listing [Payroll Journal]

Vouching/Tracing (Payroll Cycle)

Source Documents [Time Logs]

Q: Did all recorded labor hours actually occur?

Q: Were all labor hours recorded?

Vouching (Occurrence)

Tracing (Completeness)

First Pages

lou6920x_ch05_172-219.indd 204 03/06/20 02:55 PM

204 Part Two The Financial Statement Audit

produce both control testing and substantive testing evidence and, thus, serve both pur- poses. For example, a selection of recorded payroll entries could be used to (1) vouch payroll to time cards and (2) calculate the correct dollar amount of payroll. The first procedure provides relevant information about an important control activity. The second provides dollar value information that can help offer substantive evidence to support the account balance in the financial statements.

REVIEW CHECKPOINTS 5.21 What are tests of control activities? 5.22 What is the difference between document examination and reperformance when conducting tests

of controls? 5.23 What purposes are served by a dual-purpose test?

RESPONSIBILITIES IN THE AUDITS OF ISSUERS REQUIRED BY PCAOB AUDITING STANDARD NO. 2201

PCAOB Auditing Standard No. 2201 (AS 2201) details the work that the external audit team of an issuer must perform to comply with section 404 of Sarbanes–Oxley. The audit team must plan and perform the audit to obtain reasonable assurance about whether the entity maintained effective control over financial reporting. The SEC understands reason- able assurance not to be absolute but a “high level of assurance” is expected. The focus in the professional standard is to determine whether a material weakness exists at the end of the year being reported on. If a material weakness exists, the entity’s internal control over financial reporting cannot be considered effective. For the audit team, this duty entails an increased amount of testing for the internal control system.

According to GAAS, when auditing non-issuers, the audit team must obtain an under- standing of internal controls to determine the nature, timing, and extent of further audit procedures to be performed. If the team members plan to rely on controls to reduce sub- stantive procedures, they must test the controls for operating effectiveness. However, if they do not plan to rely on controls, tests of operating effectiveness are not required. Under Sarbanes–Oxley, an audit of the internal control system over financial reporting is required. The audit of internal controls must be integrated with the financial statement audit and cannot be performed as a separate engagement. Thus, the procedures related to internal control in an integrated audit performed under AS 2201 are far more extensive than those in a GAAS audit for a nonissuer.

Requirements Much of the initial work, including documenting and testing controls, is done by employ- ees of the client, management, the internal audit staff, and even outside consultants hired by management. AS 2201 encourages the audit team to use the work of internal auditors and others, but the audit team members must evaluate the internal auditors’ competence and objectivity and must perform some tests of their work. For more risky areas, audit teams should perform more of the work and the assessment of likely sources of misstate- ment themselves or supervise any others who assist them in the evaluation.

Another important difference between AS 2201 internal control audits and GAAS financial statement audits is that the audit of internal control is as of the end of the fiscal year, whereas, for audits of the financial statements, the audit team must understand and evaluate internal control for the entire period to determine its effect on the nature, timing, and extent of further audit procedures.

LO 5-5 Describe additional responsibilities for management and auditors of issuers required by Sarbanes–Oxley and PCAOB Auditing Standard No. 2201.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 205

lou6920x_ch05_172-219.indd 205 03/06/20 02:55 PM

  Internal Control Audit Financial Statement Audit

Scope Test each relevant control activity each year Test relevant control activities if relying on them

Reporting Opinion on the effectiveness of internal control No opinion on internal control

Timing Evaluate effectiveness of internal control as of the fiscal year-end

Evaluate effectiveness of internal control throughout the fiscal year

AS 2201 emphasizes the use of a six-step audit process that is designed to evaluate the effectiveness of the internal control system over financial reporting:

1. Planning the engagement. The audit team must evaluate controls for all relevant assertions and for all significant accounts or disclosures. Thus, significant accounts, locations, and assertions must be identified. A difficult decision in auditing controls of global organizations is determining which locations are significant and must be visited. Each location is evaluated based on size, risks, and whether risks are mitigated by entitywide controls. The key to determining whether an account, location, or asser- tion is significant is whether there is more than a remote possibility that a material misstatement could be associated with it. Just as control risk is used to determine the nature, timing, and extent of further audit procedures, inherent risk is used to determine the nature, timing, and extent of tests of controls.

2. Using a top-down approach. As mentioned earlier, the top-down approach focuses on the threats to the integrity of the external financial reporting process. The audit team’s first step in gaining an understanding of the client’s internal control system should focus on entity-level controls (ELCs) because they can have a pervasive impact on control activities at the process, transaction, or application level. The team next moves down to the significant accounts and disclosures and their relevant assertions. By relevant, we mean that the assertion has a reasonable possibility of containing a material misstatement. The audit team is required to understand the internal control process over financial reporting. This aspect of the standard emphasizes performing a walkthrough of the internal control process by the audit team members. The top-down approach recommended in AS 2201 is illustrated in Exhibit 5.20.

3. Testing controls. After identifying significant controls over financial reporting in the previous step, the audit team decides which controls to test. The evaluation and testing for each assertion must be performed on an annual basis. After an understanding of internal controls is gained through inquiry, document examination, and observation, the controls are evaluated for the possibility that they would not prevent or detect a misstatement. The tests of operating effectiveness are similar to a test of controls discussed previously. A sample of transactions is examined using inquiry, observation, document examination, and reperformance. The more risk associated with a control,

EXHIBIT 5.20 Top-Down Process

Begin at Financial Statement Level

Understand Overall Risks

Focus on Entity- Level Controls

Work to Significant Accounts,

Disclosures, and Relevant Assertions

Attend to Possibility of Material

Misstatement

Select Controls for Testing

Top-Down Process

Verify Understanding of

Process Risks

First Pages

lou6920x_ch05_172-219.indd 206 03/06/20 02:55 PM

206 Part Two The Financial Statement Audit

the more persuasive evidence is required for testing. Tests of controls are not per- formed if the internal control system design is not considered effective. Only the con- trol activities for each relevant assertion that the auditor is relying on to mitigate the risk of material misstatement need to be tested.

4. Evaluating identified deficiencies. An internal control deficiency—whether resulting from a design or an operating deficiency—exists when either the design or the opera- tion of the control under consideration does not allow the entity’s management or employees to detect or prevent misstatements in a timely fashion. A design deficiency is a problem relating to either a necessary control that is missing or an existing control that is so poorly designed that it fails to satisfy the control’s objective. An operat- ing deficiency, on the other hand, occurs when a properly designed control is either ignored or inappropriately applied (possibly because employees are poorly trained). More serious internal control deficiencies can be categorized into one of two groups— material weaknesses or significant deficiencies—depending on their severity.

∙ A material weakness in internal control is defined as a deficiency, or combination of deficiencies, that results in a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis. The following circumstances should be regarded as strong indicators that a material weakness exists:

∙ Restatement of previously issued financial statements to reflect the correction of a material misstatement.

∙ Evidence of material misstatements (identified by the audit team) that were not prevented or detected by the client’s internal controls.

∙ Ineffective oversight of the financial reporting process by the entity’s audit committee. ∙ Indication of fraud (either material or immaterial) by senior management.

∙ A significant deficiency is a deficiency or a combination of deficiencies in internal con- trol that is less severe than a material weakness yet important enough to merit attention by those charged with governance. The primary difference between a significant deficiency and a material weakness

involves the magnitude of the potential misstatement that could occur and would not be detected on a timely basis. As the potential misstatement reaches overall materiality, an auditor may conclude that a material weakness exists. The final conclusion is always a matter of professional judgment. 5. Wrapping up. Audit teams are required to issue an opinion on the effectiveness of internal

controls. They do so by evaluating evidence obtained from all sources, including the team’s testing of controls, any misstatements detected during the financial statement audit, and any identified control deficiencies and material weaknesses. Audit teams then form an opinion on the effectiveness of internal control over financial reporting. Audit teams can issue one of three types of opinions on internal controls:

∙ Unqualified. No material weaknesses exist. ∙ Disclaimer of opinion. The audit team cannot perform all of the procedures

considered necessary and is unable to determine whether material weaknesses exist. ∙ Adverse opinion. One or more material weaknesses exist.

Note that because the opinion on internal controls is as of the end of the fiscal year, the entity may be able to correct or remediate deficiencies or weaknesses after they have been detected. However, the audit team must have sufficient time to test the design effectiveness and operating effectiveness of the remediated control before providing an unqualified opinion.6

In addition to expressing an opinion on the effectiveness of the entity’s internal con- trol over financial reporting, the audit team also should evaluate the completeness and

6Clients may request auditors to report separately on the elimination of material weaknesses. Guidance on preparing such a report is provided by PCAOB’s AS 4.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 207

lou6920x_ch05_172-219.indd 207 03/06/20 02:55 PM

presentation of management’s annual report on internal control over financial reporting. Among other factors, the audit team also must obtain written representations from man- agement that explicitly acknowledges

∙ It is responsible for effective internal control over financial reporting. ∙ It has evaluated the effectiveness of the internal control over financial reporting. ∙ It has disclosed all internal control deficiencies and frauds to the audit team.

6. Reporting on internal control. The next step in the process is reporting on internal con- trol over financial reporting. For the auditors’ report on internal control, two options are available. One option is to have two separate reports: one on the fairness of the entity’s financial statements (presented earlier in Chapter 2) and a separate report on internal control over financial reporting. Each report would be separately titled, dated (although using the same date), and signed. The auditors’ separate report on internal control is discussed in detail in the following section. The second option is to prepare a combined report that expresses one opinion on the financial statements and a second on the effectiveness of internal control over financial reporting. An example of a com- bined auditors’ report on internal control over financial reporting and financial statements is shown in Chapter 12.

Since the passage of Sarbanes-Oxley, much debate has taken place about the costs and benefits on Section 404b, the provision that requires auditors to opine on the internal control effectiveness of their clients.

Well, a recent academic study focuses on this aspect of the law by attempting to measure the benefits and the costs associated with exempting small issuers from this section of the law.

In their study, the authors report a benefit of exemption as “an aggregate $388 million in audit fee savings from 2007–2014.” The costs

“stem from internal control misreporting: an aggregate $719 million of lower operating performance due to non-remediation and a $935 million delay in aggregate market value decline due to the failure to disclose ineffective internal controls.”

Source: Benefits and costs of Sarbanes-Oxley Section 404(b) exemption: Evidence from small firms’ internal control disclosures. Journal of Accounting and Economics 63, 2017, W. Ge. S. Koester, and S. McVay, pp. 358–384.

The Cost and Benefits of Section 404AUDITING INSIGHT

REVIEW CHECKPOINTS 5.24 What is management’s responsibility for reporting on internal control over financial reporting? 5.25 What steps do audit teams follow in examining internal control over financial reporting? 5.26 What are (a) an internal control deficiency, (b) a significant deficiency, and (c) a material

weakness? 5.27 What options are available to the auditor for presenting reports on the entity’s financial state-

ments and internal control over financial reporting?

INTERNAL CONTROL COMMUNICATIONS Whether auditing a non-issuer under GAAS or an issuer in an audit conducted under PCAOB standards, the audit team must communicate significant deficiencies and mate- rial weaknesses in internal control that come to their attention during the performance of the audit. Auditors’ communications of significant deficiencies and material weaknesses are intended to help management carry out its responsibilities for internal control moni- toring and change. However, external auditors’ observations and recommendations are usually limited to external financial reporting matters.

LO 5-6 Explain the communication of internal control deficiencies to those charged with governance, such as the audit committee and other key management personnel.

First Pages

lou6920x_ch05_172-219.indd 208 03/06/20 02:55 PM

208 Part Two The Financial Statement Audit

For issuers, the auditors’ report must be in writing and presented to those in charge of governance (usually the audit committee) before their report on internal control over financial reporting is issued to the public. The report is to be addressed to management, the board of directors, or the audit committee. See Exhibit 5.21 for an illustration of such a report. In addition, all deficiencies noted must be communicated in writing to management.

If the audit team members do not identify any significant deficiencies, they should not issue a report stating that “no significant deficiencies were noted during the audit.” Doing so might be misleading because an integrated audit is not designed to detect all signifi- cant deficiencies. A manager receiving such a report could conclude (incorrectly) that the audit team is stating positively that the entity has no internal control problems.

Audit teams often issue another type of report to management called a management letter. This letter may contain commentary and suggestions on a variety of matters in addition to internal control matters. Examples include issues identified during the audit related to operational and administrative efficiency, business strategy, and profit-making possibilities. Auditing standards do not require management letters, but they represent a type of value-added management advice rendered as part of an audit.

Michael Scarn, LLP, CPAs Scranton, PA

March 7, 2021

Board of Directors Dunder-Mifflin Inc. Scantron, ME

In planning and performing our audit of the financial statements of Dunder-Mifflin Inc. for the year ended December 31, 2020, we considered its internal control in order to determine our audit procedures for the purpose of expressing our opinion on the financial statements as well as the effectiveness of the company’s internal control over financial reporting. Our consideration of internal control would not necessarily disclose all deficiencies in internal control that might be significant deficiencies. However, we noted a certain matter involving the internal control and its operation that we consider to be a significant deficiency under standards established by the Public Company Accounting Oversight Board. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

The matter noted is that shipping personnel have both transaction-initiation and alteration authority as well as custody of inventory assets. If invoice/shipping copy documents are altered to show a shipment of smaller quantities than actually shipped, customers or accomplices can receive your products without charge. The sales revenue and accounts receivable could be understated, and the inventory could be overstated. This deficiency caused us to spend more time auditing your inventory quantities.

A material weakness in internal control is defined as a deficiency, or combination of deficiencies, that results in a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis. We do not believe that the significant deficiency described above is a material weakness.

This report is intended solely for the information and use of the board of directors and its audit committee, and is not intended to be, and should not be, used by anyone other than these specified parties.

Respectfully yours, Michael Scarn, LLP, CPAs

EXHIBIT 5.21 Internal Control Letter

REVIEW CHECKPOINT 5.28 What reports (other than auditors’ report) on internal control do audit teams give to an entity’s

management, board of directors, or audit committee?

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 209

lou6920x_ch05_172-219.indd 209 03/06/20 02:55 PM

The purposes of the audit team’s evaluation of internal control are to assess the control risk (as part of the overall assessment of the RMM) in order to make the substantive audit plan and to report control deficiencies to management and the board of directors. The PCAOB’s AS 2201 defines additional responsibilities for management and public accounting firms’ reports on internal control stipulated by the Sarbanes–Oxley Act.

Internal control consists of five components: control environment, risk assessment, information and communication system, control activities, and monitoring of the control system. The auditor is required to gain an understanding of each of these components and to document this understanding in the audit files. The control environment and man- agement’s risk assessment are explained in terms of understanding the client’s business. Elements of the accounting system are explained in conjunction with control activities designed to prevent, detect, and correct misstatements that occur in transactions. Docu- mentation of an entity’s internal control system is accomplished through the use of ques- tionnaires, flowcharts, and narratives.

Internal control is assessed in a top-down manner by which audit teams first identify accounts that may contain significant risks of material misstatement. Audit teams then identify which relevant assertions may be misstated. After determining “what could go wrong,” audit teams examine entity-level controls that might mitigate the risk of material misstatement. Finally, audit teams identify transaction level controls that would mitigate any residual risks. If the audit team relies on controls, it must test the controls to ensure they are operating effectively. Where controls are not in place to reduce the risk, or if test- ing the controls would not be cost effective, substantive tests are designed to identify any material misstatements.

It is important to distinguish the “client’s control activities” from the “audit team’s tests of controls.” Control activities are part of the internal control designed and operated by the entity. The audit team’s procedures are the audit team’s own evidence-gathering work performed to obtain evidence about the client’s control activities.

Sarbanes–Oxley requires that management of issuers report on their assessments of the effectiveness of their financial reporting controls and that audit teams provide opin- ions on the controls over financial reporting. This may involve more extensive procedures than those required by GAAS.

Summary

adverse opinion on internal control over financial reporting: The opinion issued when the auditors conclude that the financial statements do not present the financial condition, results of operations, and cash flows in accordance with GAAP, 207. audit committee: A subcommittee of the board of directors that is generally composed of three to six “outside” members of the organization’s board of directors, 180. auditors’ report on internal control over financial reporting: A report required by the Sarbanes–Oxley Act that provides an opinion on the effectiveness of the entity’s internal control over financial reporting, 207. business risks: Those factors, events, and conditions that could prevent the organization from achieving its business objectives, 181. control activities: The specific actions taken by a client’s management and employees to help ensure that management directives are carried out, 182. control risk: The likelihood that the client’s internal control policies and procedures fail to prevent or detect a material misstatement, 176. design effectiveness: A condition expressing whether controls would be expected to prevent or detect errors or fraud that could result in a material misstatement in the financial statements, 193. detective controls: The activities that detect misstatements after they occur, 183. disclaimer of opinion on internal control over financial reporting: A report issued when auditors do not express an opinion on the fairness of the entity’s financial statements. Disclaimers of opinion are issued for pervasive going-concern uncertainties, pervasive scope limitations, situations in which auditors’ are associated with (but did not audit) financial statements, and situations in which the auditors are not independent, 207.

Key Terms

First Pages

lou6920x_ch05_172-219.indd 210 03/06/20 02:55 PM

210 Part Two The Financial Statement Audit

dual-purpose test: An audit procedure used as both a test of controls and a substantive test, 203. enterprise risk management (ERM): A process effected by an entity’s board of directors, management, and other personnel applied in strategy setting and across the enterprise that is designed to identify potential events that may affect the entity and to manage risks to be within its risk appetite to provide reasonable assurance regarding the achievement of entity objectives, 181 entity-level controls: The controls that are pervasive to the financial statements taken as a whole, 192. flowchart: The audit documentation that provides a visual display of the accounting system and control activities in an entity’s internal control system, 194. information system: An entity’s system, usually built on some type of technological platform that has been designed to produce the information necessary for the entity to operate and control its business operations, 187. integrated audit: The term used to describe an audit process that is designed to provide an opinion on both the financial statements and the internal control system of an entity, 176. internal control: A process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the reliability of financial reporting, the effectiveness and efficiency of operations, and compliance with applicable laws and regulations, 195. internal control deficiency: A condition that exists when the design or operation of a control does not allow the entity’s management or employees to detect or prevent misstatements in a timely fashion, 206. internal control questionnaire: The audit documentation that uses a checklist of internal control–related questions to gain and document an understanding of the client’s internal control, 195. issuer: An issuer is an entity that registers and sells securities (e.g., common stock) to the investing public, 173. management’s annual report on internal control over financial reporting: A report required by the Sarbanes–Oxley Act that states that management is responsible for establishing and maintaining adequate internal control over financial reporting, identifies the framework management uses to evaluate the effectiveness of the entity’s internal control, and provides management’s assessment of the effectiveness of the entity’s internal control, 207. material weakness: A deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis, 206. non-issuer: A nonissuer is an entity that does not offer securities to the investing public, 197. narrative description: The audit documentation that describes the environmental elements, the accounting system, and the control activities in an entity’s internal control, 194. operating effectiveness: Description of a condition expressing whether a control is operating as designed and whether the person performing the control possesses the necessary authority and qualifications to perform the control effectively, 194. preventive controls: The activities that prevent misstatements before they occur, 183. reasonable assurance: The concept that recognizes that the costs of control activities should not exceed the benefits that are expected from the control activities, 190. significant deficiency: A deficiency or a combination of deficiencies in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance, 206. system generated report: Any report that is generated by the audit client’s information system that is used to execute its internal control procedures or produce its financial statements. It is important to test that each system generated report is complete and accurate if it is being used for either of these purposes, 184. substantive procedures: The detailed audit and analytical procedures designed to detect material misstatements in account balances and footnote disclosures, 203. transaction-level controls: The controls that relate to specific classes of transactions, account balances, and disclosures, 193. unqualified opinion on internal control over financial reporting: The report issued when no material weaknesses in internal control over financial reporting are identified and no scope limitations on the audit of internal control exist, 177. walkthrough: The tracing of one or more transactions through the audit trail from initiation of the transaction to its inclusion in the financial statements, 193.

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 211

lou6920x_ch05_172-219.indd 211 03/06/20 02:55 PM

5.29 The most important foundational component of an entity’s internal control system is a. Effectiveness and efficiency of operations. b. The control environment. c. Reliability of financial reporting. d. Compliance with applicable laws and regulations.

5.30 The primary purpose for obtaining an understanding of internal control during the audit of a non-issuer is to a. Provide a basis for making constructive suggestions in a management letter. b. Determine the nature, timing, and extent of further audit tests to be performed. c. Provide the rationale for the inherent risk assessment at the financial statement assertion

level. d. Provide information for a communication of internal control–related matters to management.

5.31 Effectiveness of audit procedures would be reduced by a. Selecting larger sample sizes for audit. b. Performing audit procedures at the fiscal year-end date as opposed to the interim period. c. Deciding to obtain external evidence instead of internal evidence. d. Performing procedures during the interim period as opposed to at the fiscal year-end date.

5.32 According to the PCAOB, during the audit of internal controls for an issuer, the ultimate objective of testing the design effectiveness of internal controls is to a. Determine whether the company’s controls are processing company data effectively. b. Determine that the company’s controls will satisfy the company’s control objectives and

can effectively prevent or detect errors or fraud that could result in material misstate- ments, if they operate as prescribed.

c. Determine that the company’s employees are processing the controls according to the policy and procedures manuals at the company.

d. None of the above.

5.33 To test the operating effectiveness of a control, an audit team might use a combination of each of the following tests except for a. Inquiry of client personnel. b. Observation of company operations. c. Confirmation of balances. d. Inspection of documentation.

5.34 Which of the following is a preventive control? a. Reconciliation of a bank account. b. Recalculation of a sample of payroll entries by internal auditors. c. Separation of duties between the payroll and personnel departments. d. Detailed fluctuation analysis completed by the CFO for revenue.

5.35 In most audits of large entities, control risk assessment contributes to audit efficiency, which means that a. The cost of substantive procedures will exceed the cost of control evaluation work. b. Auditors will be able to reduce the cost of substantive procedures by an amount more

than the control evaluation costs. c. The cost of control evaluation work will exceed the cost of substantive procedures. d. Auditors will be able to reduce the cost of substantive procedures by an amount less than

the cost of tests of controls.

LO 5-3

LO 5-4

LO 5-4

LO 5-5

LO 5-4

LO 5-4

LO 5-4

All applicable Exercises and Problems are available with Connect.

Multiple-Choice Questions for Practice and Review

First Pages

lou6920x_ch05_172-219.indd 212 03/06/20 02:55 PM

212 Part Two The Financial Statement Audit

5.36 Which of the following is a device designed to help the audit team obtain evidence about the accounting and control activities of an audit client? a. A narrative memorandum describing the control system. b. An internal control questionnaire. c. A flowchart of the documents and procedures used by the company. d. All of the above.

5.37 Tests of controls in a GAAS audit are required for a. Obtaining evidence about the financial statement assertions. b. Accomplishing control over the occurrence of recorded transactions. c. Applying analytical procedures to financial statement balances. d. Obtaining evidence about the operating effectiveness of client control activities.

5.38 A transaction-level internal control activity is best described as a. An action taken by auditors to obtain evidence. b. An action taken by client personnel for the purpose of preventing, detecting, and correcting

errors and frauds in transactions to eliminate or mitigate risks identified by the company. c. A method for recording, summarizing, and reporting financial information. d. The functioning of the board of directors in support of its audit committee.

5.39 When planning the audit of internal controls for an issuer, the audit team should a. Identify significant accounts, locations, and relevant assertions. b. Conduct a walkthrough of the internal control process. c. Make inquiries of employees regarding the existence of control activities. d. Reperform control activities performed by client employees to determine their effectiveness.

5.40 A material weakness is a situation in which a. It is probable that an immaterial financial statement misstatement would not be detected

on a timely basis. b. There is a remote likelihood that a material misstatement would be detected on a timely

basis. c. It is reasonably possible that a material misstatement would not be detected on a timely

basis. d. It is reasonably possible that an immaterial misstatement would not be detected on a

timely basis.

5.41 When completing the audit of internal controls for an issuer, the severity of an internal con- trol deficiency depends on a. Whether there is a reasonable possibility that the company’s controls will fail to prevent

or detect a misstatement of an account balance or disclosure. b. Whether a misstatement has actually occurred as a result of the deficiency. c. The magnitude of the potential misstatement resulting from the deficiency or the

deficiencies. d. Both a and c are correct. e. All of the above are correct.

5.42 Which of the following does not accurately summarize auditors’ requirements regarding internal control?

  Issuer Non-issuer

a. Understanding Yes Yes

b. Documenting Yes Yes

c.  Evaluating control risk Yes Yes

d. Test controls Yes Yes

LO 5-4

LO 5-4

LO 5-4

LO 5-5

LO 5-5

LO 5-5

LO 5-5

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 213

lou6920x_ch05_172-219.indd 213 03/06/20 02:55 PM

5.43 When completing the audit of internal controls for an issuer, the PCAOB requires the audit team to audit internal controls over a. Operations. b. Compliance with regulations. c. Financial reporting. d. All of the above.

5.44 When completing the audit of internal controls for an issuer, AS 2201 requires auditors to report on

Management’s Report on Internal Control

An Audit of Internal Control

a. No No

b. Yes No

c. No Yes

d. Yes Yes

5.45 When completing the audit of internal controls for an issuer, AS 2201 requires auditors to test a. Operating effectiveness only. b. Design effectiveness only. c. Both operating and design effectiveness. d. Neither operating nor design effectiveness

5.46 Which of the following would probably not be considered an indication of a material weakness? a. Evidence of a material misstatement. b. Ineffective oversight by the audit committee. c. Immaterial fraud committed by senior management. d. Overproduction by the manufacturing plant.

5.47 Which report would not be appropriate for a public accounting firm to provide on financial reporting controls? a. Unqualified—no material weaknesses found. b. Disclaimer of opinion—unable to perform all necessary procedures. c. Disclaimer of opinion—significant deficiencies exist. d. Adverse—material weaknesses exist.

5.48 The purpose of separating the duties of hiring personnel and distributing payroll checks is to separate the a. Authorization of transactions from the custody of related assets. b. Operational responsibility from the record-keeping responsibility. c. Human resources function from the controllership function. d. Administrative controls from the internal accounting controls.

(AICPA adapted)

5.49 If the auditors encounter a significant scope limitation in evaluating an issuer’s internal con- trol over financial reporting, which of the following types of opinions on the effectiveness of the company’s internal control over financial reporting would be appropriate? a. Unqualified opinion or adverse opinion. b. Qualified opinion or adverse opinion. c. Unqualified opinion or disclaimer of opinion. d. Disclaimer of opinion.

LO 5-5

LO 5-5

LO 5-5

LO 5-5

LO 5-5

LO 5-4

LO 5-5

First Pages

lou6920x_ch05_172-219.indd 214 03/06/20 02:55 PM

214 Part Two The Financial Statement Audit

5.50 If the auditor plans to assess control risk at less than the maximum and rely on controls, and the nature, timing, and extent of further audit procedures are based on that lower assessment, the auditor must a. Obtain evidence that the controls selected for testing are designed effectively and oper-

ated effectively during the entire period of reliance. b. Assess control risk at less than the maximum for all relevant assertions. c. Perform only substantive procedures. d. Provide additional examples of responses to assessed fraud risks relating to fraudulent

financial reporting.

5.51 When testing a control activity’s operating effectiveness, procedures the auditor performs to test operating effectiveness would likely include a. Inquiry of appropriate personnel. b. Reading over the company’s code of conduct. c. Reperformance of the control activity. d. Both a and c are correct.

5.52 Matters that could affect the necessary extent of testing for a control activity as it related to the degree of auditor reliance on a control activity would not include the following: a. The frequency of the performance of the control by the company during the period being

audited. b. The length of time that the auditor is planning to rely on the operating efficiency of the

control activity. c. The expected rate of deviation for a control activity. d. The relevance and reliability of the audit evidence to be obtained to test the operating

effectiveness of a control activity.

5.53 The auditor should assess control risk for each relevant assertion by evaluating the evidence obtained from all sources, including a. The auditor’s testing of controls for the audit of internal control on a public company. b. Misstatements detected during the financial statement audit. c. Any control deficiencies identified during the audit. d. All of the above.

5.54 Once the auditor detects a control deficiency, which of the following steps must he or she take first? a. Perform tests of other controls related to the same assertion as the control deemed

ineffective. b. Evaluate the severity of the deficiency on the auditor’s control risk assessment for that

assertion. c. Modify the planned substantive procedures as a result of the deficiency. d. Test the deficient control, assuming a maximum level of risk.

LO 5-4

LO 5-5

LO 5-5

LO 5-4

LO 5-5

5.55 Internal Control Audit Standards. Auditors are required to obtain a sufficient under- standing of each component of a client’s internal control. This understanding is used to assess control risk and plan the audit of the client’s financial statements.

Required: a. For what purposes should an auditor’s understanding of the internal control components

be used in planning an audit? b. What is required for an audit team to assess control risk below the maximum level?

LO 5-4

All applicable Exercises and Problems are available with Connect.

Exercises and Problems

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 215

lou6920x_ch05_172-219.indd 215 03/06/20 02:55 PM

c. What should an audit team consider when seeking to reduce the planned assessed level of control risk below the maximum?

d. What are the documentation requirements concerning a client’s internal control compo- nents and the assessed level of control risk?

(AICPA adapted)

5.56 Separation of Duties. Your small business client, Phillip’s Computer Repair Shop, is experiencing financial difficulties and has to lay off one of its four employees in the account- ing area. Phillip has asked you to determine what duties should be assigned to the three remaining employees—Abigail, Bryan, and Chris—to maintain the best separation of duties.

Required: Assign the following 10 duties to each of the three employees. a. Reconcile bank statement. b. Open mail and list checks. c. Prepare checks for Phillip’s signature. d. Prepare payroll checks. e. Maintain personnel records. f. Prepare deposit and take to bank. g. Maintain petty cash. h. Maintain accounts receivable records. i. Maintain general ledger. j. Reconcile accounts receivable records to general ledger account.

5.57 Types of Audit Tests. Indicate whether each of the following audit procedures is a test of controls, a substantive test, or a dual-purpose test. Next, indicate the financial statement assertion most closely related to each audit procedure.

Required: a. Vouch recorded sales invoices to supporting shipping documents. b. Inspect recorded sales invoices for credit approval. c. Vouch recorded sales invoices prices to the approved price list. d. Send confirmations to all customers regarding accounts receivable. e. Recalculate the arithmetic accuracy of the recorded sales invoices. f. Compare the shipment date of recorded sales invoices with the invoice record date. g. Trace recorded sales invoices to posting in the general ledger control account and in the

correct customer’s account. h. Select a sample of shipping documents from the shipping department file and trace ship-

ments to recorded sales invoices. i. Scan recorded sales invoices and shipping documents for missing numbers in sequence. j. Vouch sales invoices and shipping documents. k. Evaluate the adequacy of the allowance for doubtful accounts. l. Obtain financial statements or credit reports on large past due accounts and inquire of the

credit manager about collections. m. Calculate an estimate of the allowance for doubtful accounts using prior relations of

write-offs and sales.

5.58 Impact of Sarbanes–Oxley Act. Your long-time client, Central Office Supply, has been rapidly expanding, and the board of directors is considering taking the company public. CEO Terry Puckett has heard that costs of operating a public company have increased sig- nificantly as a result of the Sarbanes–Oxley Act. Puckett is particularly concerned with reports that audit fees have doubled because of internal control provisions of the act and PCAOB Auditing Standard No. 2201. Puckett has asked you to explain the possible effects on the audit of complying with the requirements of Sarbanes–Oxley.

Required: Draft a letter to Puckett outlining the changes in the company’s responsibilities for internal con- trol and changes in the audit due to Sarbanes–Oxley and PCAOB Auditing Standard No. 2201.

LO 5-3

LO 5-4

LO 5-5

First Pages

lou6920x_ch05_172-219.indd 216 03/06/20 02:55 PM

216 Part Two The Financial Statement Audit

5.59 Internal Control Questionnaire Items: Assertions, Tests of Controls, and Possible Errors or Frauds. Following is a selection of items from the payroll processing internal control questionnaire in Exhibit 5.15. 1. Are names of terminated employees reported in writing to the payroll department? 2. Are authorizations for deductions signed by the employee on file? 3. Is there a timekeeping department (function) independent of the payroll department? 4. Are timekeeping and cost accounting records (such as hours, dollars) reconciled with

payroll department calculations of hours and wages?

Required: For each of the four preceding questions a. Identify the assertion to which the question applies. b. Specify one test of controls an auditor could use to determine whether the control was

operating effectively. c. Provide an example of an error or fraud that could occur if the control were absent or

ineffective. d. Identify a substantive auditing procedure that could detect errors or frauds that could

result from the absence or ineffectiveness of the control items.

5.60 Obtaining a “Sufficient” Understanding of Internal Control. The 12 partners of a regional public accounting firm met in special session to discuss audit engagement effi- ciency. Jones spoke up, saying, “We all certainly appreciate the firmwide policies set up by Martin and Smith, especially in connection with the audits of the large clients that have come our way recently. Their experience with a large public accounting firm has helped build our practice. But I think the standard policy of conducting tests of internal control on all audits is raising our costs too much. We can’t charge our smaller clients fees for all of the time the staff spends on this work. I would like to propose that we give engagement partners discretion to decide whether to do a lot of work on assessing control risk. I may be old-fashioned, but I think I can finish a competent audit without it.” Discussion on the subject continued but ended when Martin said, with some emotion, “But we can’t disregard generally accepted auditing standards like Jones proposes!”

Required: What do you think of Jones’s proposal and Martin’s view of the issue? Discuss.

5.61 Fraud Opportunities. Simon Blank Construction Company has two divisions. The president (Chris Simon) manages the roofing division. Simon delegated authority and responsibility for management of the modular manufacturing division to John Gault. The company has a competent accounting staff and a full-time internal auditor. Unlike Simon’s procedures, however, Gault and his secretary handle all bids for manufacturing jobs, pur- chase all materials without competitive bids, control the physical inventory of materials, contract for shipping by truck, supervise the construction activity, bill the customer when the job is finished, approve all bid changes, and collect the payment from the customer. With Simon’s tacit approval, Gault has asked the internal auditor not to interfere with his busy schedule.

Required: Discuss this situation in terms of internal control and identify frauds that could occur.

5.62 Internal Control Questionnaire Items: Errors That Could Occur from Control Weak- nesses. Refer to the internal control questionnaire on a payroll system (Exhibit 5.15). a. Assume that the answer to each question is no. Prepare a table matching the questions

to errors or frauds that could occur because of the absence of the control. Your column headings should be

Question Possible Error or Fraud Due to Weakness

b. Which controls are preventive controls and which are detective?

LO 5-4

LO 5-4

LO 5-4

LO 5-4

First Pages

Chapter 5 Risk Assessment: Internal Control Evaluation 217

lou6920x_ch05_172-219.indd 217 03/06/20 02:55 PM

5.63 Role of a Board of Directors in Internal Control. Assume that the local newspaper just ran the following headline and article: “Audit Results: Airport executives from Kentucky racked up $500K in lavish expenses, concert tickets, and even gentlemen’s club tabs”

LEXINGTON, Ky. (AP)—A small commercial airport in Kentucky—and the taxpayers who support it—picked up top executives’ tabs in recent years for Hannah Montana concert tickets, Nintendo Wii video game bundles and even a $4,400 gentlemen club check, according to a state auditor’s report.

The report released Wednesday outlines indulgences ranging from pricey electronics and exercise equipment to lavish meals and champagne. In three years, officials tallied more than $500,000 in questionable personal expenses. [Author’s note: General fund expenses were approximately $10,000,000 annually.]

Kentucky Auditor Crit Luallen said the former executive director at Lexington’s Blue Grass Airport created a culture of wasteful spending so vast, employees sometimes were paid twice for the same expense and used airport credit cards as if they were personal checkbooks.

“I don’t think we have ever seen an audit where so many different individuals involved in the management of a public agency abused the trust with such arrogance and lack of ethical standards,” she said.

Luallen says she has forwarded the case to the Kentucky attorney general, the U.S. attor- ney’s office, and the FBI.

Although the audit only covered the past three years, it does refer to one of the more glar- ing examples reported by the Herald-Leader: a $4,400 charge Michael Gobb and two other directors incurred at a Dallas strip club in 2004.

The charge, which appeared on the credit card statement of the airport’s director of plan- ning, was listed as going to Millennium Restaurant. The word “marketing” was handwritten next to the amount. The Associated Press obtained that receipt and others through an open records request.

The audit found that airport employees also used the coffers for tuxedos and other expen- sive clothing; more than 400 DVDs—many of them currently missing—for the internal airport library; $14,000 in holiday hams given out as gifts; and $7,400 for a NASCAR driving experi- ence excursion for staff described as “team building.”

More than 92 percent of the things Gobb charged to his airport card lacked proper docu- mentation, Luallen said.

While Luallen acknowledged that Gobb was responsible for the free-spending culture, she said the board and its public accounting firm should have supervised the airport more closely.*

Source: Excerpted from Ky. Airport Execs Racked Up Lavish Expenses, Jeffrey McMurray, Associated Press, February 26, 2009.

Required: a. Discuss the role of the board of directors in monitoring the behavior of a chief executive

officer. b. If the chief executive officer has subordinates incur expenses that he or she approves,

how can the board prevent abuse? c. Should external auditors be expected to detect abuses such as these? d. How should the use of credit cards be controlled?

5.64 Authorization of Credit Tests of Controls — Using IDEA For this exercise, your cli- ent, Bright IDEAs Inc., has provided you with data for two related files, a listing of sales invoices, and a listing of customers with credit limits. To test whether credit authorization controls are in place, the auditor must complete a series of related steps: 1. Import the client’s database of sales invoices (pp. 28–45 of the IDEA Workbook). 2. Summarize the Accounts Receivable balance by customer (pp. 67–79 of the IDEA

Workbook).

LO 5-3

Reprinted with permission from the February 26, 2009, online edition of the Daily Report © 2009 ALM Media Proper- ties, LLC. All rights reserved.

LO 5-4

First Pages

lou6920x_ch05_172-219.indd 218 03/06/20 02:55 PM

218 Part Two The Financial Statement Audit

3. Import the client’s customer credit limit data into IDEA (pp. 70–79 of the IDEA Workbook).

4. Join the Accounts Receivable balances by customer with the credit limit data (pp. 80–87 of the IDEA Workbook).

5. Extract customers with exceeded credit limits (pp. 88–89).

Required Data Available on Connect ∙ ACC_REC2015.ACCDB ∙ CUSTOMER.TXT

Required: Complete the preceding steps and answer the following questions: a. How many customers were granted credit with no indication that they had any credit

limit assigned to them? b. How many customers exceeded their credit limit? c. What effects would the findings in parts (a) and (b) have on the auditor’s assessment of

the risk of material misstatement? What accounts and assertions are most likely influ- enced by these findings?

Source: C1202 IDEA Data Analysis Workbook: IDEA Version Ten. 2016. CaseWare IDEA, Inc. Toronto, CA.

5.65 Identifying Payments to Unauthorized Suppliers — Using IDEA For this exercise, your client, BrightIDEAs Inc., has provided you with data for two related files: an accounts payable history file and a supplier master file. To test the authorization of purchases to only legitimate suppliers, the auditor must complete a series of related steps: ∙ Import the client’s database of accounts payable (pp. 98–109 of the IDEA Workbook). ∙ Import the client’s authorized supplier list (pp. 110–113 of the IDEA Workbook). ∙ Merge the accounts payable and supplier databases (pp. 169–175 of the IDEA Workbook). ∙ Identify payments to unauthorized suppliers (pp. 175–176 of the IDEA Workbook). ∙ ACCPAY2015.TXT ∙ Supplier.xls

Required: Complete the preceding steps and answer the following questions:

∙ How many different unauthorized suppliers were paid during the year? ∙ What was the total dollar amount of the payments to unauthorized suppliers? ∙ What effects would the findings in parts (a) and (b) have on the auditor’s assessment of

the risk of material misstatement? What accounts and assertions are most likely influ- enced by these findings?

Source: C1202 IDEA Data Analysis Workbook: IDEA Version Ten. 2016. CaseWare IDEA, Inc. Toronto, CA.

LO 5-4

Internal Control Testing You are a recently promoted senior (in charge) auditor for Anderson, Olds, and Water- shed and have been assigned to the engagement team of a new audit client, Apollo Shoes Inc. You have been asked to perform certain procedures related to the internal control system for Apollo Shoes. A detailed audit program for performing the procedures related to the internal control system, as well as working papers and supporting documentation, can be found on Connect.

Apollo Shoes

First Pages

lou6920x_ch05_172-219.indd 219 03/06/20 02:55 PM

Audit Plan

Appendix 5A

DUNDER-MIFFLIN INC. Audit Plan for Tests of Controls in the Payroll Cycle

12/31/20

  Performed By Ref.

1. Observe the separation of duties between the personnel, timekeeping, and payroll departments.

2. Select a sample of payments from the payroll distribution for the year.    

a. Vouch labor costs to labor reports.    

b. Vouch labor reports to time tickets or computerized listing.    

c. Examine documentary evidence of supervisor review of labor costs.    

d. Examine documentary evidence of supervisor approval.    

3. Account for numerical sequence of selected job cost tickets and paychecks. Trace a sample of employees in the personnel file to payroll department files and the payroll register.

4. Examine documentary evidence of budget comparison.    

5. Reconcile the payroll account distribution report and the job cost sheets.    

6. Examine supervisor signature on payroll reports. Note evidence of comparison to budget.

First Pages

220

lou6920x_ch06_220-268.indd 220 03/06/20 02:53 PM

Employee Fraud and the Audit of Cash

C H A P T E R 6

Rather fail with honor than succeed by fraud. Sophocles, Greek playwright and scholar (496–406 BC)

Professional Standards References

Topic AU-C/ISA Section

AS Reference

Consideration of Fraud in a Financial Statement Audit 240 2401

Consideration of Laws and Regulations 250 2405

Audit Planning 300 2101

Consideration of Internal Control in an Integrated Audit 265 2201

Identifying and Assessing the Risks of Material Misstatement 315 2110

Auditors’ Responses to Risks of Material Misstatement 330 2301

Audit Considerations Relating to an Entity Using a Service Organization 402 2601

Audit Evidence 500 1105

External Confirmations 505 2310

Using the Work of an Audit Specialist 620 1210

LEARNING OBJECTIVES In Chapter 5, we emphasized the important role of the internal control system in helping to ensure that the financial statement information being presented by an organization is credible and can be relied upon. Beyond its critical nature in the production of reliable financial statement information, the establishment of an internal control system is also important to help protect an organization’s assets from being stolen. In this chapter, we focus on the auditor’s role in helping clients prevent and/or detect the misappropriation (or theft) of assets in their organization.

Recall that in Chapter 4 we focused on the auditor’s responsibilities related to fraudulent financial reporting, that is when an organization intentionally issues false or misleading financial statements to the investing marketplace. The professional standards make clear that auditors are also responsible for considering the possibility of misstatements that arise from the misappropriation of assets, otherwise known as employee theft. As a result, this chapter begins with a comprehensive discussion of this type of fraud.

Next, because cash is often the primary target of employee theft, the chapter logically transitions to a discussion of how the cash balance is audited.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 221

lou6920x_ch06_220-268.indd 221 03/06/20 02:53 PM

This discussion includes a description of the most common relevant financial statement assertions, along with a focus on the control and substantive testing procedures that are typically performed during the audit of cash balances. Importantly, our discussion of controls includes specific examples of additional internal control activities that can be put in place to help prevent or detect employee theft, also known as a misappropriation of assets fraud.

Your objectives are to be able to:

LO 6-1 Define and explain the differences among several kinds of employee frauds that might occur at an audit client.

LO 6-2 Identify and explain the three conditions (i.e., the fraud triangle) that often exist when a fraud occurs.

LO 6-3 Describe techniques that can be used to prevent employee fraud.

LO 6-4 Identify the relevant assertions and risks of material misstatement that are typically related to the cash balance.

LO 6-5 Identify important internal control activities present in a properly designed system to mitigate the risk of material misstatements for each relevant assertion related to cash and to help prevent or detect employee fraud.

LO 6-6 Give examples of substantive procedures used to test cash and relate them to the relevant assertions.

LO 6-7 Describe some extended procedures for detecting employee fraud schemes involving cash.

INTRODUCTION Fraud examinations can be very exciting for auditors. A fraud examination has the aura of detective work—finding things that people want to keep hidden. However, such examina- tions are not easy and are not activities to be pursued without special training, experience, and care. While Module D presents a more detailed discussion of fraud examinations, this chapter presents a general introduction to the theory and definitions related specifi- cally to misappropriation of assets-type fraud. In addition, you will learn how auditors evaluate the design and operating effectiveness of internal controls that are designed to mitigate the risk of this type of employee fraud. Importantly, because cash is often the primary target of fraudsters in these schemes, we illustrate internal controls as they relate to cash. Next, we present a discussion of the audit of the cash account on the balance sheet, with specific examples of internal control activities and related control tests and substantive audit procedures.

It is essential that auditors maintain their professional skepticism at all times through- out the engagement. In fact, professional standards require that when auditors brainstorm about the potential for all types of fraud in an engagement, the activity should “occur with an attitude that includes a questioning mind, and the key engagement team members should set aside any prior beliefs they might have that management is honest and has integrity.”1 Why is it so important that auditors maintain such a high degree of skepti- cism? Because a fraud is often committed by a person that an auditor least expects. Con- sider a Little League coach ripping off the league to buy expensive jewelry by using a routing number from a league payroll check.2 Or consider an executive assistant at a large public accounting firm who wrote more than $1 million in checks to herself that were drawn on a client’s bank account.3 You just never know from where the next fraud might originate!

LO 6-1 Define and explain the differences among several kinds of employee frauds that might occur at an audit client.

1PCAOB Auditing Standard No. 2110, “Identifying and Assessing Risks of Material Misstatement.” 2“Little League Coach Accused of Fraud,” St. Petersburg Times, p. 3B, July 4, 2009. 3“Aide Gets 2 Years in Fraud Case,” San Francisco Chronicle, p. D2, October 28, 2010.

First Pages

222 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 222 03/06/20 02:53 PM

Not surprisingly, whenever a fraud risk exists, the professional standards require that auditors gain an understanding of the internal controls that are in place to mitigate the assessed fraud risk. At a minimum, auditors are required to document that under- standing in the workpapers. In fact, auditors are also likely to evaluate the design, implementation, and operating effectiveness of identified internal control activi- ties related to fraud risks that exist. Importantly, an entity’s internal control cannot thwart or detect all fraud schemes. Inherent limitations in internal control (such as collusion among employees) prevent complete assurance that every fraud scheme will be detected before a loss is incurred. For this reason, the entity’s auditors, accoun- tants, and security personnel must be acquainted with the basics of fraud awareness. Although the professional auditing standards concentrate on fraudulent financial reporting—the production of materially false and misleading financial statements— the standards also require auditors to pay particular attention to employee fraud per- petrated against a client for several reasons. First, it is possible that employee fraud can result in a material financial statement misstatement to the extent that a crime was covered up using the financial statements. Second, employee fraud can be indicative of control deficiencies which can influence the auditor’s assessment of control risk. Finally, audit clients always want to know if they are being robbed by their employees, regardless of the amount being stolen!

Employee Fraud Overview Fraud consists of knowingly making material misrepresentations of fact with the intent of inducing someone to believe the falsehood and act upon it and, thus, suf- fer a loss or damage. This definition encompasses all ways by which people can lie, cheat, steal, and deceive other people. Employee fraud (often referred to as misappro- priation of assets) is the use of fraudulent means to take money or other property from an employer. It usually involves falsifications of some kind—false documents, lying, exceeding authority, or violating an employer’s policies. Employee frauds generally consist of (1) the fraudulent act itself, (2) the conversion of assets to the fraudster’s use (very easy if cash is involved), and (3) the cover-up. Catching people in the fraudu- lent act is difficult to accomplish. The act of conversion is equally difficult to observe because it typically takes place in secret away from the entity’s offices (e.g., selling stolen inventory). By noticing signs and signals of fraud and then following the trail of missing, mutilated, or false documents that are part of the accounting records cover- up, alert auditors uncover many frauds. Being able to notice red flags, oddities, and unusual events takes some experience, but this chapter provides you with some ideas about where and when to look.

This is exactly the plan that was put into action by James Hammes after stealing $8.7 million from his employer, a Pepsi-Cola bottler based in Ohio. Amazingly, his plan almost worked as he eluded capture by hik- ing and then living on the Appalachian Trail using an assumed name.

Hammes committed the crime while working as a controller at the company from 1998 to 2009. Because he had access to both the cash and the accounting records, he was able to divert company cash into a personal bank account and then cover up his crime by manipulating the

accounting records. When the FBI started to ask him questions about the missing cash, Hammes decided to take a hike. Eventually, another hiker became aware of his story and tipped off the authorities. Hammes was sentenced to eight years in prison and must repay the money stolen.

Source: Michael Cohn, “Accountant Who Hid on Appalachian Trail Jailed for Embezzling Millions from Pepsi Bottler,” Accounting Today, June 23, 2016, available at: http://www.accountingtoday.com/news/audit-accounting/ accountant-appalachian-trail-jailed-embezzling-pepsi-78488-1.html.

Let’s Go for a Hike on the Appalachian Trail . . . for Life

AUDITING INSIGHT

First Pages

223

lou6920x_ch06_220-268.indd 223 03/06/20 02:53 PM

Employee Fraud Red Flags Employee fraud can involve all types of employees from high-level executives to hourly employees in the warehouse. For most people, committing a fraudulent act is stressful. Observation of changes in a person’s habits and lifestyle may reveal some red flags.4 Fraudsters often exhibit these behaviors:

∙ Experience sleeplessness. ∙ Drink too much. ∙ Take drugs. ∙ Become irritable easily. ∙ Can’t relax. ∙ Get defensive, argumentative. ∙ Can’t look people in the eye. ∙ Sweat excessively. ∙ Go to confession (e.g., priest, psychiatrist). ∙ Find excuses and scapegoats for mistakes. ∙ Work standing up. ∙ Work alone. ∙ Work late frequently. ∙ Don’t take vacations.

Personality red flags are difficult because (1) honest people often show them as well, (2) they often are hidden from view, and (3) auditors are not in a good position to notice these characteristics. Managers are in the best position to notice changes, especially when a person varies his or her lifestyle or spends more money than his or her salary seems to justify—for example, on homes, furniture, jewelry, clothes, boats, autos, vacations, and the like. Therefore, it is imperative that the auditor make specific inquiries of manage- ment regarding changes in an employee’s demeanor and lifestyle.

Characteristics of Fraudsters White-collar criminals are not like typical bank robbers who are often described as “young and dumb.” Bank robbers and other strong-arm criminals often make comical mistakes such as writing their holdup note on the back of a probation identification card, leaving the getaway car keys on the convenience store counter, using a zucchini as a holdup weapon, going through a fast-food restaurant’s drive-through window backward,

4Long lists of red flags can be found in G. J. Bologna and R. J. Lindquist, Fraud Auditing and Forensic Accounting (New York: John Wiley & Sons, 1995), pp. 49–56; W. S. Albrecht et al., in R. K. Elliott and J. J. Willingham, Management Fraud: Detection and Deterrence (New York: Petrocelli Books Inc., 1980), pp. 223–226; Statement on Auditing Standards No. 99 (New York: AICPA, 2002); Auditing for Fraud courses of the Association of Certified Fraud Examiners; and courses offered by other organizations such as the AICPA and The Institute of Internal Auditors.

Management fraud is an intentional deception that is orchestrated by management and is designed to injure investors and creditors by provid- ing materially misleading information.

Errors are unintentional misstatements or omissions of amounts or dis- closures in financial statements.

Direct-effect illegal acts are violations of laws or government regulations by the company, or its management or employees, that

produce direct and material effects on dollar amounts in financial statements.

Embezzlement is a type of fraud that typically involves an employee wrongfully stealing assets that were entrusted to his or her care, custody, or control. In many situations, embezzlement is accompanied by false accounting entries or lying to try to cover up the crime.

Other Definitions Related to Fraud and Illegal Acts

First Pages

224 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 224 03/06/20 02:53 PM

and timing the holdup to get stuck in rush hour traffic. Then there’s the classic story about the robber who ran into his own mother at the bank. (She turned him in!)

Burglars and robbers average about $400–$500 for each hit. Employee frauds often range from $20,000 up to $500,000 or even in the millions if a computer is used. Yet employee frauds are not usually the intricate, well-disguised ploys you find in espionage novels. Who are these thieves wearing ties? What do they look like? Unfortunately, they look like most everybody else, including you and me. A typical white-collar criminal

∙ Has education beyond high school. ∙ Is likely to be married. ∙ Is a member of a church, mosque, or temple. ∙ Ranges in age from teens to over 60. ∙ Is socially conforming. ∙ Has an employment tenure from 1 to 20 years (although the scale of the fraud typically

increases with tenure as the employee becomes more trusted). ∙ Has no arrest record. ∙ Usually acts alone (70 percent or more of incidents).

In February 2013, investigators arrested Craig Haber, a partner in tax and advisory services in the New York City office of Grant Thornton for stealing payments made by clients to the firm. Allegedly, his crimes began in July 2004 and continued through July 2012. In total, he is alleged to have stolen approximately $4 million from Grant Thornton. Apparently, Haber provided instructions to his clients to send checks or wire transfers directly to him in New York instead of sending the

payments to Grant Thornton’s headquarters in Chicago. He then took the checks and deposited them in a bank account that was opened “in the name of a sham business that was very similar to Grant Thornton’s name.” Haber then would transfer the funds from this account to his personal account. Source: M. Cohn, “Former Grant Thornton Partner Arrested for Stealing $4 Million in Client Payments,” Accounting Today, February 7, 2013.

Are You Kidding Me?AUDITING INSIGHT

In July 2012, almost a year after MF Global filed for bankruptcy on October 31, 2011, investigators reported that they had located the more than $1.6 billion of customer funds that were miss- ing from the company. The report ended a difficult process that revealed a complete lack of internal control in handling clients’ funds. Scott O’Malia, a commissioner at the Commodity Futures

Trading Commission, commented that the books at MF Global “are a disaster” and it is difficult to “figure out what numbers are the real numbers.”

Sources: “Inside the Hunt for MF Global Cash,” The Wall Street Journal, November 10, 2011, p. c1; “$1.6 Billion in Missing MF Global Funds Traced,” http://money.cnn.com/2012/04/24/news/companies/mf-global/index.htm.

How Can $1.6 Billion of Cash Be Missing?AUDITING INSIGHT

White-collar criminals do not make themselves obvious, although they may leave telltale signs or red flags. Older individuals (usually over 50) who hold high executive positions, have long tenure, and are respected and trusted employees have often gained the trust and confidence of others and, therefore, are in a position to commit the largest frauds. After all, these are the people who have access to the largest amounts of money and have the power to give orders and override controls. When managers minimize the significance of a weak or missing control by rationalizing that the employee involved is a “long-time trusted employee,” most experienced auditors will actually escalate their level of fraud risk awareness. You should as well.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 225

lou6920x_ch06_220-268.indd 225 03/06/20 02:53 PM

THE FRAUD TRIANGLE The three conditions that are likely to be present when a fraud occurs (Exhibit 6.1) are com- monly referred to as the fraud triangle. The first condition (incentive/pressure) recognizes that an employee or manager of a company is likely to either have incentives in place (e.g., bonus compensation) or be under significant pressure to meet specific estimates, forecasts, or expectations about net income. The second condition (opportunity) recognizes that in order for a fraud to be perpetrated, there must either be a weakness in the system of inter- nal control or an ability to circumvent the system. Finally, the third condition (attitude/ rationalization) recognizes that for an employee or a manager of a company to perpetrate a fraud, the individual must possess an “attitude” that allows her or him to rationalize why he or she is knowingly committing a crime. Each of these conditions is now discussed.5

LO 6-2 Identify and explain the three conditions (i.e., the fraud triangle) that often exist when a fraud occurs.

5For further reference, see D. R. Cressey, “Management Fraud, Accounting Controls, and Criminological Theory,” pp. 117–147, and Albrecht et al., “Auditor Involvement in the Detection of Fraud,” pp. 207–261, both in R. K. Elliott and J. J. Willingham, Management Fraud: Detection and Deterrence (New York: Petrocelli Books Inc., 1980); J. K. Loebbecke, M. M. Eining, and J. J. Willingham, “Auditors’ Experience with Material Irregularities: Frequency, Nature, and Detectability,” Auditing: A Journal of Practice and Theory, Fall 1989, pp. 1–28.

REVIEW CHECKPOINTS 6.1 What are the defining characteristics of employee fraud? Embezzlement? 6.2 What does a fraud perpetrator look like? How does one act?

• A small business owner hired his best friend to work as his accountant. The friend was given full, unlimited access to all aspects of the business and was completely responsible for the accounting. Five years later, the owner finally terminated the friend’s employment because the business was not profitable. Upon taking over the accounting responsibilities, the owner’s wife found that cash receipts from customers were twice the amounts formerly recorded by the accountant “friend.” An investi- gation revealed that the friend had stolen $450,000 in cash sales receipts from the business while the owner had never made more than $16,000 a year. (The friend had even used the stolen money to make loans to the owner to keep the business going!)

• An electrical supply company employed only one bookkeeper. She wrote the checks and reconciled the bank account. In the cash disbursements journal, she coded some checks as inventory, but she wrote the checks to herself, using her own name. When

the checks were returned with the bank statement, she simply destroyed them. Confronting continuous guilt over doing some- thing she knew was wrong, she contacted a lawyer and turned herself in but not before she had stolen $416,000 over a five-year period. Because of the lack of separation of duties and her trusted status in the company, the fraud might have continued indefinitely (or at least until she bankrupted the company).

• Alex W. was a 47-year-old treasurer of a credit union. Over a seven- year period, he stole $160,000 from it. He was a good husband and father of six children, and he was a highly regarded credit union offi- cial. His crime came as a stunning surprise to his associates. Why did he do it? He owed significant amounts on his home, cars, col- lege for two children, two side investments, and five credit cards. His monthly payments significantly exceeded his take-home pay.

Source: Association of Certified Fraud Examiners (ACFE), “Auditing for Fraud.”

Trusted Employees?AUDITING INSIGHT

EXHIBIT 6.1 Fraud Conditions Source: W. Hillison, D. Sinason, and C. Pacini, “The Role of the Internal Auditor in Implementing SAS 82,” Corporate Controller, July/August 1998, p. 20.

Motivation Opportunity

Highest Risk

Rationalization

First Pages

226 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 226 03/06/20 02:53 PM

Incentive/Pressure Incentive or pressure gives rise to a motive to commit fraud. A motive, in the fraud con- text, is essentially a reason for a person to take a fraudulent action that is believed to be unshareable with friends and confidants. Psychotic motivation is relatively rare, but it is characterized by the habitual criminal who steals simply for the sake of stealing. In general, egocentric motivations drive people to steal to achieve more personal prestige. Ideological motivations are held by people who think their cause is morally superior and they are justified in making someone else a victim. However, economic benefits are by far the most common motivations in business frauds.

Incentives for employees to commit fraud can come from many places. In the case of Wells Fargo employees, the source may have been as simple as a rhyme. Over a four year period, over 5,000 lower-wage employees fraudulently opened over a million fake bank accounts and credit cards to make their ‘cross-sell’ goals of eight new accounts to existing custom- ers. By opening these fake accounts, and sometimes transferring money into them from the customers’ other accounts, Wells Fargo earned huge

amounts of fraudulent fees and employees met their quotas. But why eight? According to the CEO in the 2010 Wells Fargo annual report, “I’m often asked why we set a cross-sell goal of eight. The answer is, it rhymed with ‘great.’ Perhaps our new cheer should be: ‘Let’s go again, for 10!’”

Source: “How Wells Fargo Encouraged Employees to Commit Fraud”, October 6, 2016, http://theconversation.com/how-wells-fargo-encouraged-employees- to-commit-fraud-66615

Driven by a Rhyme!AUDITING INSIGHT

Kirbyjon Caldwell, a Houston pastor known for advising Presidents George W. Bush and Barack Obama, and Gregory Smith, a former financial advisor previously banned by the Financial Industry Regula- tory Authority, defrauded 29 elderly investors of $3.4 million by selling them old Chinese bonds that had been in default for over 75 years. The men are facing charges from the SEC.

Caldwell used his portion of the funds to pay for his living expenses, including his mortgage payment. Smith chose to purchase luxury automobiles.

Despite facing SEC charges, Caldwell still plans to preach to his congregation on Sundays.

Source: C. English, “Famed Pastor Defrauded $3.4M from Elderly Investors: SEC” NY Post, March 30, 2018.

Do You Prefer a Mortgage Payment or a Luxury Vehicle?

AUDITING INSIGHT

The economic motive is simply a need or desire for money, and at times it can be intertwined with egocentric and ideological motivations. Ordinary, honest people can experience circumstances in which they have a new or unexpected need for money. If the need arises and the legitimate channels to raise the money are closed, fraud may become an option for some individuals. Consider the following needs:

∙ Making a house payment. ∙ Pay uninsured medical bills. ∙ Pay gambling debts. ∙ Pay for drugs and alcohol. ∙ Pay alimony and child support. ∙ Pay for high lifestyle (vacation homes, cars, boats). ∙ Finance business or stock speculation losses.

Opportunity An opportunity is an open door that enables a would-be fraudster to violate some type of trust. The violation may be a circumvention of existing internal control activities, or it

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 227

lou6920x_ch06_220-268.indd 227 03/06/20 02:53 PM

may be simply taking advantage of an absence or lapse of a control activity in an entity. In general, the higher the position in an organization, the higher the degree of trust, the more likely that controls can be overridden, and, hence, the greater the opportunity for larger frauds. Here are some examples:

∙ Inventory is not counted on a regular basis, so inventory shortages and losses are not known.

∙ Proper separation of duties related to cash receipts or payments is compromised because of a termination or retirement.

∙ The vice president of finance has investment authority without review. ∙ Frequent emergency jobs leave a lot of excess material in a manufacturing plant just

lying around.

Two lunch ladies in New Canaan, CT, were charged with embezzling nearly $500,000 from two schools in the area. Over the course of at least five years, the sisters devised a plan to steal cash payments made by students because the controls over the cash receipts were weaker than at other area schools. Their free lunches were stopped when employees from nearby schools noticed the financial inconsistencies

between school lunch programs. Once a point of sale system was put in place to track individual sales and the amount of cash received, daily deposits increased to appropriate levels.

Source: Beverly Yaa Danquah, “Lunch lady sisters accused of stealing nearly $500,000” NBC News, August 14, 2018. https://www.nbcnews.com/news/ us-news/lunch-lady-sisters-accused-stealing-nearly-500-000-n900596

That’s a Lot of Lunches!AUDITING INSIGHT

The second in command and heir-apparent to the CEO of a company apparently couldn’t wait her turn. It was discovered that she was forg- ing the CEO’s signature on expense reimbursements. Initially, the company attributed this to a lapse in judgment and a desire to get reimbursed faster. However, an investigation quickly discovered that she had received nearly $1.4 million in fraudulent reimbursement.

Included in this were many personal expenses reclassified as business expenses, such as toys labeled as “meals while out of town.”

Source: T. Couch, “Skimming and Scamming: Detecting and Preventing Expense Reimbursement Fraud” Accounting Today, June 25, 2018. https:// www.accountingtoday.com/opinion/skimming-and-scamming-detecting-and- preventing-expense-reimbursement-fraud

Her Time Was ComingAUDITING INSIGHT

Attitude/Rationalization Practically everyone, even the most violent criminal, knows the difference between right and wrong. Unimpeachable integrity is the ability to act in accordance with the high- est moral and ethical values at all times. Thus, it is the lapses in integrity that permit a person’s incentives or pressures to motivate fraudulent action when the opportunity pres- ents itself. But people normally do not make deliberate decisions to “lack integrity today while I steal some money.” They find a way to describe (rationalize) the act in words that make it acceptable for their self-image. Here are some of these rationalizations:

∙ I need it more than other people. ∙ I am borrowing the money and will pay it back. ∙ Nobody will get hurt. ∙ The company is big enough to afford it. ∙ A successful image is the name of the game. ∙ Everybody is doing it. ∙ I am underpaid, so this is due compensation.

First Pages

228 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 228 03/06/20 02:53 PM

FRAUD PREVENTION Building a good fraud prevention program is an extremely difficult task. Most day-to-day business activities require some trust in the processes for which controls will never be absolute. Further, in an electronic payment environment, lack of controls can quickly lead to costly fraud from both inside and outside the organization. For example, if we entrust an individual with authorization for cash expenditures, a stolen or shared password enables anyone who acquires access to the employee’s account to obtain physical custody of the asset. As a result, taking steps to “fraud proof” an organization is a tall order.

Accountants and auditors have often been exhorted to be the leaders in fraud preven- tion by employing their skills in designing “tight” control systems. This strategy is, at best, a short-run solution to a large and pervasive problem. Business activity is built on the trust that people at all levels will do their jobs properly. As a result, it is essential that management establish a strong control environment. A strong control environment and tone at the top can have a pervasive effect on the prevention of fraud at an entity because it can impact all components of an organization’s internal control system. For example, a CEO who always acts with ethics and integrity sends a strong message to all employees that management is serious about internal controls and fraud prevention.

Beyond a strong control environment, management must be sensitive to the needs of the business by instituting controls that will prevent or detect fraud without impeding business activity. Control systems limit trust and, in the extreme, can strangle business in bureaucracy. The challenge is to have useful controls and to avoid picky rules that are “fun to beat.” Managers and employees must have freedom to do business, which may mean giving them some freedom that can result in committing frauds. Effective long-run prevention measures are complex and difficult, involving the elimination of the causes of fraud by mitigating the effect of motive, opportunity, and lack of integrity.

Managing People and Pressures in the Workplace From time to time, people experience financial and other pressures. The pressures can- not be eliminated, but forums and facilities for sharing such pressures can and have been created by leading organizations. Some companies have “ethics officers” to serve this purpose. Their job is to be available to talk over various ethical dilemmas faced in the workplace and help employees identify legitimate responses. However, it is important to remember that the ethics officers are not normally psychological counselors.

Many companies have anonymous hotlines for reporting ethical problems. Indeed, companies that must comply with the Sarbanes–Oxley Act of 2002 are required to main- tain an anonymous employee hotline. Usually, the best kind of hotline arrangement is to have the responding party be a third-party agency outside the organization. In the United States, some external providers are in the business of being the recipients of hotline calls and coordinating their activities with the audit committee or the internal audit department of the various organizations to whom they provide this service.

LO 6-3 Describe techniques that can be used to prevent employee fraud.

REVIEW CHECKPOINTS 6.3 What are some pressures that can cause honest people to contemplate fraud? List some egocentric

and ideological pressures as well as economic ones. 6.4 What conditions provide opportunities for employee fraud? 6.5 Give some examples of rationalizations that people have used to excuse fraud. Can you imagine

using them? 6.6 Is capability required to commit a fraud? Is capability part of opportunity, or should it be considered

a separate element of fraud?

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 229

lou6920x_ch06_220-268.indd 229 03/06/20 02:53 PM

Another method of long-term fraud prevention, however, lies in the treatment of peo- ple within an organization. Managers and supervisors at all levels can exhibit a genuine concern for the personal and professional needs of their subordinates and fellow man- agers, and subordinates can show the same concern for each other and their managers. Many companies facilitate this caring attitude with an organized employee assistance program (EAP). They offer a range of counseling referral services dealing with substance abuse, mental health issues, family problems, crisis help, legal matters, health education, retirement, career paths, job loss troubles, and family financial planning. These program types are not guaranteed to prevent fraud, but they can have a positive impact for an organization.

When external auditors are engaged in the audit of an entity’s financial statements, they must obtain an understanding of and evaluate the control environment. In so doing, the audit team should consider how management addresses these types of employee issues. Using devices such as those discussed here can enhance an entity’s control envi- ronment and represents the start of an effective internal control system.

Internal Control Activities and Employee Monitoring As discussed in Chapter 5, internal control activities may include job descriptions and performance specifications that help people know the specific tasks they are supposed to accomplish. An entity whose only control is “trustworthy employees” has no control.6 The possibility of being detected by a control activity can be an effective deterrent to a potential fraudster. Stated simply, control activities often take away the opportunity for a fraudster to commit a fraud.

As previously discussed, concealment of the crime is a distinguishing attribute of a fraud. Often, the audit team’s first indication of a fraud is the identification of a control violation. Cover-up attempts generally appear in the accounting records. The key for an auditor is to be aware of and notice exceptions and oddities such as the following:

∙ Transactions recorded at unusual times of the day, month, or year. ∙ An unusual (either large or small) number or dollar amount of transactions. ∙ Transactions for “round” dollar amounts (e.g., $50,000). ∙ Transactions associated with unusual branches or locations of a multilocation entity. ∙ Cash shortages and overages. ∙ Excessive voids and credit memos. ∙ General ledgers that do not balance. ∙ An increase in past due receivables. ∙ Inventory shortages. ∙ Unexplained adjustments to inventory or accounts receivable balances, especially

without adequate supporting documentation. ∙ Increased scrap or waste in a manufacturing plant. ∙ Alterations on official documents. ∙ Duplicate payments made to the same vendor. ∙ Employees who cannot be found. ∙ Use of copies instead of originals for supporting documentation. ∙ Missing documentation to support transactions. ∙ Unusual endorsements on checks. ∙ Unusual patterns in deposits in transit. ∙ Common names or addresses for refunds. ∙ Consistent customer complaints about account balances or missing shipments.

6W.S. Albrecht, “How CPAs Can Help Clients Prevent Employee Fraud,” Journal of Accountancy, December 1988, pp. 110–114.

First Pages

230 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 230 03/06/20 02:53 PM

As noted previously in Chapter 5, an important feature of an effective internal control system is the separation of duties and responsibilities for (1) transaction authorization, (2) record keeping, (3) custody of or access to assets, and (4) reconciliation of actual assets to the accounting records. In general, a person acting alone or in a conspiracy who can perform two or more of these functions can commit a fraud by taking assets, convert- ing them, and then covering up the crime. Proper separation of duties and responsibilities can prevent such fraudulent actions. For example, as it relates to cash disbursements, effective internal control begins with different people and different departments handling the cash disbursement authorization; custody of blank documents (checks); record keep- ing for payments; and bank reconciliation. Auditing with fraud awareness often involves the combination of observing client control activities that were put in place and trying to “think like a crook” and imagine ways that theft could occur. When controls are missing, the ways and means for theft may be obvious. Otherwise, it might take significant plan- ning and collusion to figure out how to steal from an employer.

According to fraud experts Joseph Wells and John Gill of the Asso- ciation of Certified Fraud Examiners, when assessing fraud risk, answering a set of 15 questions is a good starting point for sizing up a company’s vulnerability to fraud and creating an action plan for less- ening the risks. Their key questions are

1. Is the company dominated by one or two key employees?

2. Do any key employees appear to have a close association with vendors?

3. Do any key employees have outside business interests that might conflict with their job duties?

4. Does the organization conduct pre-employment background checks to identify previous dishonest or unethical behavior?

5. Does the organization educate employees about the importance of ethics and antifraud programs?

6. Does the organization have antifraud policies and provide an anonymous way to report suspected violations of ethics?

7. Is job or assignment rotation mandatory for employees who han- dle cash receipts and accounting duties?

 8. Has the company established positive pay controls with its bank by supplying the bank with a daily list of checks issued and autho- rized for payment?

 9. Are refunds, voids, and discounts evaluated on a routine basis to identify patterns of activity among employees, departments, shifts, or merchandise?

10. Are purchasing and receiving functions separate from invoice pro- cessing, accounts payable, and general ledger functions?

11. Is the employee payroll list periodically reviewed for duplicate or missing Social Security numbers?

12. Are there policies and procedures that address the identification, classification, and handling of proprietary information?

13. Do employees who have access to proprietary information sign nondisclosure agreements?

14. Is there a company policy that addresses the receipt of gifts, dis- counts, and services offered by a supplier or customer?

15. Are the organization’s financial goals and objectives realistic?

Source: Joseph T. Wells and John D. Gill, “Assessing Fraud Risk,” Journal of Accountancy, October 2007, pp. 63–65.

When Assessing Fraud Risk, Answer These Questions

AUDITING INSIGHT

When collecting corroborating evidence to support the financial statements, the audit team must remain vigilant against the potential for fraud. Discrepancies in the accounting records, conflicting evidence, and missing documentation are all symptomatic of finan- cial statement fraud. When the audit team identifies such instances, members must follow up with management to identify the source of the problems. Management’s response is a key source of evidence; vague, implausible, or inconsistent responses to inquiries can be a key indicator of the pervasiveness of the fraud. Similarly, problematic or unusual relationships between the audit team and management are often present in financial state- ment frauds.

Module D presents a comprehensive discussion of fraud examinations and how they differ from financial statement audits. However, an example to illustrate the difference

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 231

lou6920x_ch06_220-268.indd 231 03/06/20 02:53 PM

between the engagements relates to evidence. The collection of evidence in a fraud examination (which can lead to prosecution and court scrutiny) is fundamentally dif- ferent from the collection of evidence to support the auditor’s opinion. If the auditors do come across questionable documents or any other evidence that may indicate fraud, they should immediately work to preserve the chain of custody of evidence. The chain of custody is the crucial link of the evidence to the criminal suspect that bears directly on the relevance of evidence often referred to by attorneys and judges. If documents are lost, mutilated, coffee stained, or otherwise compromised (so a defense attorney can argue that they were altered to frame the suspect), they lose their effectiveness for the prosecution. When completing a fraud examination, auditors should learn to mark the evidence, writing an identification of the location, condition, date, time, and circumstances as soon as it appears to be a signal of fraud. This marking should be on a separate tag or page; the original document should be put in a protective (plastic) envelope for preservation and locked away for protection. Then audit work should proceed with copies of the documents instead of originals. A record should be made of the safekeeping and of all persons who use the original. Any eyewitness observations should be recorded in a timely manner in a memorandum or on tape (audio or video) with corroboration of colleagues, if possible.

Similarly, an auditor may be involved in collecting evidence that is found in computers or stored in a digital manner. This type of computer forensic work must be completed with great care, and the goal is to examine the evidence in a manner that would be appropriate in reaching the goal of “identifying, preserving, recovering, analyzing, and presenting facts and opinions about the information.” Generally, the evidence that is gathered from a computer forensic investigation is subject to the same rules of evidence as manual data in the eyes of law enforcement. This brief example underscores the importance of an auditor being properly trained to conduct a fraud examination.

Tone at the Top Establishing the right tone at the top is an essential step toward building a strong fraud prevention program. This tone is established by upper management, in large part, to dem- onstrate a commitment to integrity and high ethical standards in the completion of all activities throughout the organization. The upper management team is responsible for setting the tone at the top. To send the right message from the top, many organizations publish codes of conduct for employees. Some of these codes are simple, and some are very elaborate. Government agencies and defense contractors typically have the most elaborate rules for employee conduct. Sometimes these codes are effective; sometimes they are not. However, a code can be effective only if the control environment and tone at the top support it. When the chairman of the board and the president make themselves visible and living examples of the code of conduct, other people will then believe it is real. Subordinates tend to follow the boss’s lead.

One of the large public accounting firms was conducting an “ethical compliance” attestation engagement of a Fortune 500 company. An ethical compliance attestation engagement is designed to ensure, among other things, that client personnel are following the company’s code of ethical conduct. Believing that the control environment and tone at the top were the most important elements of the client’s ethi- cal compliance control system, the engagement team started in the

CEO’s office. They found that the CEO was using the company plane to fly his fashion designer wife and her friends back and forth to Paris on a regular basis. When confronted in a board of directors meeting with the evidence, the CEO chastised the engagement team: “You weren’t supposed to check on me; you were supposed to check on the employees.” The board of directors disagreed and then requested the CEO’s resignation.

You’re Not Supposed to Audit Me!AUDITING INSIGHT

First Pages

232 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 232 03/06/20 02:53 PM

Hiring and firing policies are important. Background checks on prospective employ- ees are advisable and very good business practice. A new employee who has been a fraudster in some other organization’s accounting department has a higher probability of being a fraudster in a new organization. As a result, organizations have even been known to hire private investigators to make background checks. Fraudsters should be fired and, in most cases, prosecuted. Experience has shown that they have a low rate of repeat offenses if they are prosecuted, but they have a high rate if not. Prosecution has the added benefit of sending the message that management does not believe that fraudulent activity is acceptable.

Unfortunately, the accompanying Auditing Insight, while incredibly disappointing, is far more common than it should be. As a result, auditors must always be vigilant and remain skeptical about the possibility of discovering employee fraud at their audit clients. This is why we have just provided so much coverage of the topic to begin this chapter. We now turn our attention to the account that is most frequently targeted by employee thieves—cash.

REVIEW CHECKPOINT 6.7 What are some red flags that may indicate a cover-up or concealment of a fraud? 6.8 Is there anything odd about these two situations? (a) A check to Larson Electric Supply was

endorsed with “Larson Electric” above the signature of “Eloise Garfunkle.” (b) Numerous electronic payments were made and dated December 25, January 1, and July 4.

In April 2013, a Roman Catholic nun pleaded guilty to stealing $128,000 from two different parishes in New York over a five-year period. As it turns out, the nun had a gambling addiction and appar- ently felt that she had nowhere else to turn to pay the debts except by

committing a crime. She now faces up to six months in jail and must repay the stolen money. Source: “NY Gambling Nun Admits Taking $128K from Churches,” The Wall Street Journal, April 9, 2013.

Did She Really Steal from the Church?AUDITING INSIGHT

THE AUDIT OF CASH This section of the chapter is focused on the procedures that are completed as part of the financial statement audit for cash. However, our discussion of controls also includes examples of internal control activities that are specifically put in place to help prevent or detect employee fraud. In addition, because cash is relevant to each of an audit client’s accounting cycles, we also discuss cash when describing the audits of the different cycles in the following chapters. For example, the basic activities in the revenue and collection cycle (Chapter 7) are (1) receiving and processing cus- tomer orders, including credit granting; (2) delivering goods and services to custom- ers; (3)  billing customers and accounting for accounts receivable; (4) collecting and depositing cash received from customers; and (5) reconciling bank statements. The basic acquisition and expenditure activities (Chapter 8) are (1) purchasing goods and services and (2) paying the bills. Similarly, the production and conversion cycle (Chapter 9) and the investing and financing cycle (Chapter 10) also feature the collec- tion or expenditure of cash.

LO 6-4 Identify the relevant assertions and risks of material misstatement that are typically related to the cash balance.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 233

lou6920x_ch06_220-268.indd 233 03/06/20 02:53 PM

Management Reports and Data Files in an Audit of Cash There are a number of different management reports, documents, and data files that are typically used by auditors when completing work on the cash account. These include the cash receipts journal, the cash disbursements journal, bank reconciliations, canceled checks, and bank statements.

Cash Receipts Journal The cash receipts journal contains all of the detailed entries for all receipts of cash by the entity (debits to the cash account), including cash deposits. It contains the popula- tion of credit entries that should be reflected in the credits to accounts receivable for customer payments. It also contains the adjusting and correcting entries that can result from the bank account reconciliation. These entries are important because they may signal the types of accounting errors or manipulations that occur in the cash receipts accounting.

Cash Disbursements Journal The cash disbursements journal is the company’s detailed record of entries for checks written and electronic payments made during the period being audited (cash disburse- ments). Because all cash disbursements (other than those from a petty cash or payroll account) should be made via check or electronic transfer, the cash disbursements journal contains the cash credit entries that provide a population for testing cash disbursements. It also contains the adjusting and correcting entries that can result from the bank account reconciliation. These entries are important because they may signal the types of account- ing errors or manipulations that occur in the cash disbursements accounting. The cash disbursements journal is usually inspected for suspect items such as checks made out to “cash” or “bearer” or electronic payments made to unauthorized vendors. In addi- tion, company procedures should require that “voided” checks be retained and auditors should review these checks to ensure they were in fact actually voided and have not been recorded in bank statements.

Bank Reconciliations The company’s bank reconciliation is the primary document used to test the cash bal- ance in the financial statements. The amount of cash in the bank is almost always differ- ent from the amount in the general ledger (financial statements), and the reconciliation is designed to explain the difference between these two amounts. In addition, a bank account reconciliation that compares the book cash balance to the bank cash balance provides management with an opportunity to monitor the separation of duties for cash receipts and cash disbursements. The timely preparation of bank reconciliations is, there- fore, an important element of a company’s internal control activities over cash.

Canceled Checks Exhibit 6.2 describes the information found on the front of a typical check. Although companies do not receive the actual check back, a scanned image obtained of the check front is generally included with most bank statements and can be used to test for payees, amounts, or dates that do not match the cash disbursements journal. Further, check fronts obtained directly from a bank statement can be used to verify appropriate use of certain important internal controls, such as dual signatures for expenditures greater than a cer- tain amount.

Individuals engaging in fraudulent schemes involving cash often try to conceal their crimes by removing canceled checks they made payable to themselves or endorsed on the back with their own names. Missing canceled checks are a red flag. However, banks no longer return the canceled checks to their customers. Instead, copies of the front of the checks are included with the bank statement, often received electronically. This infor- mation is sufficient for reconciling an account, but it does not provide the information

First Pages

234 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 234 03/06/20 02:53 PM

EXHIBIT 6.2 How to Read a Canceled Check

Naomi, an employee at a check-cashing business in Brooklyn, New York, received only the basics of detecting check fraud from her super- visors: Look for watermarks, compare encoded check numbers, and question customers to see whether they can keep their stories straight if a check looks suspicious.

Earlier in the month, the main office of Naomi’s business warned workers to look for a Roberta Kane who had been successfully passing false checks in other branches. When Roberta walked into Naomi’s branch, Naomi closely examined her ID and the $200 check. The check’s routing numbers were larger than they should be, the check felt softer than others, and there was no watermark. Naomi asked Roberta how she had received the check and Roberta said it was a paycheck from her employer. Naomi called the number of the com- pany that supposedly wrote the check. When the number appeared to

be out of service, Naomi told Roberta that she had presented a false check and that the police would have to get involved. Roberta franti- cally ran for the door, leaving behind her fake check and ID. Even with the most basic knowledge of detecting check fraud, this teller was able to deter a thief. As you can see, it is important for auditors to review the fundamentals of check fraud detection.

In an unrelated case, four people were under investigation for an easily discovered counterfeit check-cashing scheme. Despite using high-tech computer equipment to generate the counterfeit checks, the fraudsters mistakenly misspelled the payer (Broyhill Furniture) as “Boryhill Furniture.”

Sources: Suzanne Mahadeo, “Check Fraud: Separating Money from Worthless Paper,” Fraud Magazine, September/October 2005, pp. 21–23, 50; “News of the Weird,” Funny Times, May 2003.

Who Was That Check from Again?AUDITING INSIGHT

that may assist a company or auditor in detecting or investigating possible frauds. Other banks retain images of checks (generally only the front) on their Internet sites. Given the reduction in ability to detect fraud through canceled check documentation, auditors, controllers, and CFOs should strongly recommend that their client or company pay close attention to the information that is available, and an increased emphasis on internal con- trols over checks is warranted.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 235

lou6920x_ch06_220-268.indd 235 03/06/20 02:53 PM

EXHIBIT 6.3 Small Business Bank Statement

Bank Statements Most of the information shown on the bank statement in Exhibit 6.3 is self-explanatory. However, auditors should not overlook the usefulness of some of the information: The num- ber and dollar amount of deposits and checks can be compared to the detail data on the bank statement; the account holder’s federal business identification number is on the statement, and this can be used in other databases; and the statement itself can be studied for alterations.

REVIEW CHECKPOINTS 6.9 Since checks are not received back by clients, how can an auditor tell whether the amount on a

check was altered prior to payment by a bank? 6.10 Take a closer look at Exhibit 6.3. Is there anything wrong with the bank statement? What are some

ways to tell whether any of the amounts have been altered?

First Pages

236 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 236 03/06/20 02:53 PM

Significant Accounts and Relevant Assertions According to the professional standards, an account or disclosure is significant if there is a reasonable chance that it could contain a material misstatement. The auditor identifies significant accounts and relevant assertions by applying the audit risk model.

Chapter 4 introduced the audit risk model. As noted there, this model allows auditors to reduce audit risk to desired levels. Audit risk is defined as the risk that auditors will issue an unmodified opinion on financial statements that contain a material misstatement. Audit risk is manifested when a material misstatement enters the financial reporting pro- cess (inherent risk) that the client’s internal controls do not prevent or detect (control risk) and that the auditors’ substantive procedures do not detect (detection risk). Recall the basic three-step approach for using the audit risk model to plan an engagement:

1. Set audit risk at desired levels (normally, low). 2. Assess risk of material misstatement, which incorporates inherent risk based on the

nature of the account balance or class of significant transactions and control risk based on gaining an understanding of internal control.

3. Determine detection risk at the significant account and assertion level based on the level of audit risk and risk of material misstatement.

The components of the audit risk model are assessed for each significant account and relevant assertion. This assessment recognizes that certain accounts and assertions assume an increased level of importance and are of more interest to auditors than oth- ers. For cash, existence is always a relevant assertion in the audit plan. Other assertions may also be relevant, depending on the facts and circumstances of the engagement. For example, if an audit client has worldwide operations, valuation may be relevant because certain cash balances may be denominated in foreign currencies, necessitating a transla- tion adjustment.

Once all of the significant accounts and disclosures have been identified, the auditor then needs to identify the relevant assertions. According to the professional standards, a financial statement assertion is relevant if it has a “reasonable possibility of containing a misstatement that would cause the financial statements to be materially misstated.” Exhibit 6.4 identifies the relevant assertions that are typical for cash. Although different companies may have other risks, in general the most significant risks relate to the exis- tence of cash and the presentation and disclosure of cash. As previously stated, depending on the nature of the audit client’s operations, valuation may also be a relevant assertion for cash. Although we will focus our discussion on these assertions, other assertions may be relevant depending on the facts and circumstances at the audit client.

Significant Account Relevant Assertions

Cash

Existence

Valuation

Presentation and disclosure

EXHIBIT 6.4 Significant Accounts and Relevant Assertions

Risk of Material Misstatement As part of the planning process, the auditor must determine the source of a misstatement that could cause the financial statements to be materially misstated. One way to assess the risk of material misstatement is to use the “what could go wrong?” (WCGW) approach when thinking of each financial statement assertion. WCGW is a part of each audit firm’s process and enables a thorough assessment of the risk of material misstatement.

When considering WCGW for cash, auditors consider three primary concerns: (1) Does the reported cash balance really exist? (2) Is the cash balance valued properly? (3) Is the reported cash balance presented properly and have the appropriate disclosures been made? Exhibit 6.5 summarizes the WCGW analysis for cash.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 237

lou6920x_ch06_220-268.indd 237 03/06/20 02:53 PM

Significant Account Relevant Assertions What Could Go Wrong?

Cash Existence The cash balance may not exist in the company’s bank accounts.

Valuation The cash balance that is held in foreign countries may not have been translated properly.

Presentation and disclosure There may be restrictions on the cash balance that were not properly disclosed.

EXHIBIT 6.5 What Could Go Wrong?

Evaluating the Design and Operating Effectiveness of Internal Controls When evaluating the design of internal controls related to cash, an auditor must always consider whether the controls have been designed to mitigate the risk of material mis- statement for each relevant assertion identified for the cash balance. In addition, because cash is so frequently a favorite target of employee thieves, controls over cash must be unusually strong and include special considerations related to employee fraud. As a con- sequence, when evaluating the design of internal controls related to cash, an auditor must also consider whether the controls have been designed to mitigate the risk of employee fraud. Clearly, there is overlap between these two goals (i.e., mitigating the risk of mate- rial misstatement and preventing employee fraud), meaning that certain control activities may help to achieve objectives at an audit client. However, to help improve your under- standing of both objectives, we now consider these topics separately.

Internal Control Evaluation for Mitigating the Risk of Material Misstatement Recall from the audit risk model that the auditor assesses inherent risk to determine where in the financial statements it is reasonably possible that a material misstatement could enter the process before the consideration of any internal controls. However, risk of material misstatement is the combination of both inherent risk and control risk.

Professional standards require auditors to first gain an understanding of the internal controls that have been designed to mitigate the risk of material misstatement for each relevant assertion identified by the auditor. In a well-designed system, the internal control activity should be explicitly designed to be aligned with this relevant assertion that was identified in a WCGW analysis.

In effect, the question an auditor should ask is, “Has the audit client designed and implemented a control that, if operating effectively, would mitigate the identified risk of material misstatement? Would it prevent or detect the material misstatement?” Impor- tantly, we have already discussed how auditors would gain an understanding of the inter- nal controls related to cash earlier in this chapter, including the control environment and tone at the top. This discussion remains relevant when auditing the cash balance.

However, when auditing the cash balance, for each WCGW identified, the auditor seeks to identify a control activity that has been placed in operation to mitigate the identified risk of material misstatement. For example, as shown in Exhibit 6.6, for the WCGW scenario related to the existence of cash (i.e., the cash does not exist in the com- pany’s bank account), the auditor must consider what management can do to prevent this misstatement from entering the financial statements or from going undetected. One control that the auditor would expect management to implement involves periodic rec- onciliation of the bank balance to the book balance. If an employee regularly completes the reconciliation and a supervisor reviews the reconciliation, the control should miti- gate the risk that a material misstatement can proceed through the accounting system undetected.

In order to rely on the design of the client’s internal controls and support a reduction in control risk, the auditor must determine if each identified control is operating as designed and whether the person operating the control has the authority and competence to do so. The auditor’s ultimate responsibility is to document enough support to conclude whether the control activity was operating effectively to mitigate the risk of material misstatement for the relevant assertion identified.

LO 6-5 Identify important internal control activities present in a properly designed system to mitigate the risk of material misstatements for each relevant assertion related to cash and to help prevent or detect employee fraud.

First Pages

238 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 238 03/06/20 02:53 PM

Auditors can perform tests of controls to determine whether company personnel are properly performing controls that are said to be in place. In general, the procedures used in tests of controls are inquiry, observation, inspection, and reperformance. Understand that if a control is missing or ineffective, the risk of a material misstatement increases, but an error or fraud may or may not exist. Thus, if controls are not in place or personnel in the organization are not performing their control activities effectively, auditors need to design substantive procedures to try to detect whether control failures have produced material misstatements in the financial statements. Exhibit 6.6 includes a column that identifies the type of test of controls that may be performed in order to support a reduc- tion in control risk and ultimately a reduction in the amount of substantive testing.

Once the tests of control are completed, auditors must evaluate the body of evidence related to internal controls. The initial process of obtaining an understanding of the com- pany’s controls and the later process of obtaining evidence from actual tests of controls are two of the phases of control risk assessment. If the control risk is assessed to be very low, the substantive procedures on the account balances can be reduced, resulting in audit efficiency. On the other hand, if tests of controls reveal weaknesses, the substantive pro- cedures need to be designed to lower the risk of failing to detect material misstatement in the account balances.

Internal Control Evaluation for Preventing or Detecting Employee Fraud We now take a step back from the financial statement audit to consider how an organiza- tion can help to prevent or detect employee fraud with properly designed control activi- ties. Recall that because cash is highly liquid, not easily identifiable as company property, and portable, it tends to be a favorite target of employee thieves. Thus, controls over cash must be unusually strong and include special considerations related to employee fraud. In that spirit, it is essential that an audit client implement control activities for both cash receipts and disbursements that are designed to help “fraud-proof” the organization. Of course, many of the control activities that we are about to discuss are also designed to help mitigate material misstatements in the financial statements. However, for now, please focus on the following control activities as they are designed to prevent the misap- propriation (or theft) of cash in an organization.

Control Activities for Cash Receipts Cash can be received in several ways—over the counter, through the mail, and by electronic funds transfer. It can also be received

EXHIBIT 6.6 Tests of Internal Control

Significant Account

Relevant Assertions What Could Go Wrong? Internal Control Activity Tests of Internal Control

Cash

Existence The cash balance may not exist in the company’s bank accounts.

The CFO performs a detailed review of the bank reconciliation on a monthly basis.

For a sample of bank reconciliations, reperform the reconciliation. Trace several reconciling items to the appropriate supporting documentation.

Valuation The cash balance that is held in foreign countries may not have been translated properly.

The treasurer reviews the cash translation adjustment calculation monthly and independently checks that the appropriate spot rate has been used for each foreign currency.

Inspect the monthly cash translation adjustment calculation for evidence of the treasurer’s review.

Presentation and disclosure

There may be restrictions on the cash balance that were not properly disclosed.

The corporate secretary reviews the cash footnote disclosure on a quarterly basis to ensure that all legal restrictions on the cash balance have been properly disclosed.

For a sample of cash accounts, reperform the work completed by the corporate secretary to ensure that all cash restrictions have been properly disclosed.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 239

lou6920x_ch06_220-268.indd 239 03/06/20 02:53 PM

in a lockbox arrangement in which payments are remitted by customers to an external location (i.e., a lockbox). In a lockbox arrangement, a fiduciary (usually a bank) opens the box on a daily basis, lists the receipts, deposits the money, and sends the remit- tance advices (stubs showing the amount received from each customer) to the com- pany. Refer to Exhibit 6.7 for some cash receipts processing procedures in a manual accounting setting.

In many situations, an individual employee initially receives cash and checks and thus has custody of the physical cash for a short time. Because this initial custody cannot be avoided, it is always a good control to (1) have two people open the mail containing cus- tomer receipts, if possible, resulting in joint custody; (2) endorse the checks immediately after removing them from the envelope; (3) prepare a list of the cash receipts as early in the process as possible; and then (4) separate the actual cash from the record-keeping documents. The cash should be sent to the cashier or treasurer’s office where a bank deposit is prepared and the money is sent to the bank daily and intact. (No money should be withheld from the deposit.) The list of remittance advices go to the accountants (con- troller’s office), who record the cash receipts. (You have prepared a “remittance advice” each time you write the amount enclosed on part of your credit card bill, tear it off, and enclose it with your check.)

The accountants who record cash receipts and credits to customer accounts should never handle the cash. They should use the remittance list or remittance advice to make the entries to the cash and accounts receivable control accounts and to the customers’ accounts receivable subsidiary account records. A good internal control activity is to

EXHIBIT 6.7 Cash Receipts Processing

Cash Remittance List

Prepare cash remittance

list.

Prepare monthly

reconciliation.

Post to customer accounts.

Approve discounts. Prepare deposit.

Prepare cash receipts journal. Post to general

ledger.

C.R.L. C.R.L.

Treasurer’s O�ce Controller’s O�ce

2 1

21

START Cash received

Marketing Department (salesclerks) Cashier Cash Management Accounts Receivable General Ledger

Operations Department (mailroom)

1 2

3

Deposit Slip Deposit Slip

C.R.L. Money

1

Cash Remittance List

2

2 3

Deposit Slip

Monthly Bank Statement

C.R.L. 2

3

Approval of discounts noted on remittance list.

All cash receipts are deposited intact, daily.

Individual Customer Accounts Subsidiary

Accounts Receivable Control

Cash AccountsTo

bank

Date Date

Cash Receipts Journal

Cash Remittance List

1

First Pages

240 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 240 03/06/20 02:53 PM

have the control account and subsidiary account entries made by different people, and later the accounts receivable entries and balances can be compared (reconciled) to deter- mine whether they agree in total. Most computerized accounting programs post the cus- tomers’ accounts automatically by keying in the customer identification number, and the computer program controls agreement.

At the end of the day, an independent employee should receive (1) a copy of the check listing, (2) a report of payments recorded in accounts receivable, and (3) a copy of the deposit slip from the bank. Commercial deposit slips have multiple copies. The bank runs these copies through the teller machine, which imprints the time, date, account, and amount on each copy. At least one copy is returned to the person mak- ing the deposit, who returns the copy to the company as evidence that the deposit was made. If the cash received during the day is maintained intact, the information on all three items should match.

Take a close look at Exhibit 6.7. Suppose that the cashier who prepares the remit- tance list had stolen and converted Customer A’s checks to personal use. It might work for a short time until Customer A complained that the entity had not credited the account for payments. The cashier, of course, knows this. So, the cashier later puts Customer B’s check in the bank deposit but shows Customer A on the remittance list; thus, the accountants give Customer A credit. So far, so good for preventing Customer A’s com- plaint. But now Customer B needs to be covered. To detect this type of lapping scheme, a detailed audit should include a comparison of the checks listed on a sample of deposit slips (Customer B) to the detail of customer remittances recorded to customer accounts (Customer A). Doing so is an attempt to find credits given to customers for whom no pay- ments were received on the day in question.

Holly Dalton used her business as a property manager in Colorado Springs, CO, to steal nearly $100,000 from landlords and tenants. Dal- ton stole damage deposits and used a lapping scheme to steal rents. She would embezzle rent checks for her own use and would apply rent payments from other customers to the receivables to hide her

crime. Dalton was sentenced to four years probation and restitution, but did not serve any jail time for her crimes.

Source: “Property Management in Colorado Springs Sentenced to Probation,” KKTV News, January 9, 2018. https://www.kktv.com/content/news/Property-management- owner-wanted-for-allegedly-stealing-almost-100000-415338153.html

Lapping Up the RentsAUDITING INSIGHT

Employees outside the normal cash operations (recording and custody) should pre- pare bank account reconciliations on a timely basis. Deposit slips should be compared to the details on cash remittance lists, and the total should be traced to the general ledger accounts receivable entries. (This reconciliation would reveal whether money was with- held from the deposit.) This care is required to establish that all the receipts recorded in the books were deposited and that credit was given to the right customer.

A common feature of cash management is to require that persons who handle cash be insured under a fidelity bond, which is an insurance policy that covers most kinds of cash embezzlement losses. Fidelity bonds do not prevent or detect embezzlement, but the fail- ure to carry the insurance exposes the company to complete loss if embezzlement occurs. Moreover, bonding companies often perform their own background checks of employees before bonding them. Auditors often recommend fidelity bonding to small companies that might not know about such coverage.

Tests of Controls over Cash Receipts The first step in testing the controls over both cash receipts and cash disbursements (discussed later) is to gain an understanding of the controls and document that understanding. Information about a company’s internal control activities can be gathered in different ways, which may include completing an

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 241

lou6920x_ch06_220-268.indd 241 03/06/20 02:53 PM

internal control questionnaire. A selection of this type of questionnaires for both manual and entirely automated controls over cash receipts is found in Appendix 6A at the end of this chapter. You can study these questionnaires for details related to other desirable control activities as well.

Another more common way to obtain general information about controls can be achieved by conducting a walkthrough. In conducting walkthroughs, the auditors select examples of a transaction (in this case, customer remittance advices) and “walk them through” the information-processing system from their initial receipt all the way to their recording in the accounting records. Sample documents are collected, and employees in each department are questioned about their specific duties. The walkthrough, com- bined with inquiries, can contribute evidence about appropriate separation of duties, which might be a sufficient basis for a preliminary assessment of control risk. However, a walkthrough is too limited in scope to provide evidence of whether the client’s control activities were operating effectively during the period under audit. Rather, to justify a low control risk assessment and a reduction of substantive testing procedures, an audi- tor would have to conduct a test of operating effectiveness for the control activity under consideration.

An entity should establish input, processing, and output control activities to pre- vent, detect, and correct accounting errors. Auditors can perform tests of controls to determine whether the internal control activities related to the correct handling of cash receipts are operating effectively. If the internal control activities are not operating effectively (e.g., because personnel in the organization are not performing the cash con- trol activities very well), auditors may need to expand substantive audit procedures to ensure that the cash balance is not materially misstated and to identify possible fraudu- lent acts related to cash.

Exhibit 6.8 contains a selection of tests of controls for cash receipts transactions. Many of these procedures can be characterized as steps taken to verify the content and character of sample documents from one file with the content and character of documents in another file. These steps are designed to enable the audit team to obtain objective evi- dence about the effectiveness of control activities and about the reliability of accounting records. An audit plan for tests of controls over cash is found in Appendix 6B.

Control Activities for Cash Disbursements As described in the previous section, the first step in testing the controls for cash disbursements is to gain an understanding of the controls and document that understanding. Similar to cash receipts, for cash disburse- ments, effective internal control begins with making sure that appropriate separation of duties has been achieved in an organization. Proper separation involves different people

Internal Control Test of Control

• Cash receipts are deposited intact and daily. 1. Observe the opening of the mail and ensure that:

  a. Two employees are opening the mail, remittance advice is received, and checks are properly endorsed.

  b. A listing of all checks is being prepared and compared to the total of the deposit ticket for the total of checks.

  c. The total amount of the deposit listed in the bank statement was recorded in the proper period.

• Deposits are reconciled with totals posted to the accounts receivable

2. For a sample of daily postings to the accounts receivable subsidiary ledger, trace the amount to the amount of cash subsidiary ledger.

EXHIBIT 6.8 Tests of Controls for Cash Receipts

First Pages

242 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 242 03/06/20 02:53 PM

and different departments handling custody of blank documents (checks), cash disburse- ment authorization, record keeping for payments, and bank reconciliation:

∙ Custody. Blank documents such as blank checks should be kept secure at all times. If unauthorized persons can obtain a blank check, they can be in another country before an embezzlement is detected.

∙ Authorization. Cash disbursements are typically authorized by an accounts payable department’s assembly of purchase orders, vendor invoices, and internal receiving reports to demonstrate a valid obligation to pay. This assembly of supporting docu- ments is called a voucher and will be discussed in more detail in Chapter 8. (Accounts payable obligations usually are recorded when the purchaser receives the goods or services ordered.) A person authorized by management signs the checks. A company may have a policy to require two signatures on checks over a certain amount (e.g., $50,000). Vouchers should be marked “PAID” or otherwise stamped to show that they have been processed completely so they cannot be paid a second time.

∙ Recording. When checks are prepared, entries are made to debit accounts payable and credit cash. Someone without access to the check-writing function should always per- form the recording function.

∙ Reconciliation. Monitoring of the internal control over cash can be provided by timely bank reconciliations made by individuals outside of the normal cash operations.

If combinations of two or more of these responsibilities are completed by one per- son or within the same office, there may be an opportunity for a fraudster to commit a crime. In addition, and almost more important in today’s environment, is the fact that the computerized information-processing system must also provide for proper separation of duties. In practice, this is often accomplished by assigning the proper functional “permis- sions” to the appropriate employees through their password access credentials. Simply stated, in a computerized environment, proper separation of duties is dependent on proper password access controls. This is discussed in more detail in Module H.

Tests of Controls over Cash Disbursements An entity should have detailed control activities in place and operating to prevent, detect, and correct accounting errors. Audi- tors can perform tests of controls to determine whether the internal control activities related to the correct handling of cash disbursements are operating effectively. If the internal control activities are not operating effectively (e.g., because personnel in the organization are not performing the cash control activities very well), auditors need to expand substantive audit procedures to ensure that the cash balance is not materially mis- stated and to identify possible fraudulent acts related to cash.

Exhibit 6.9 identifies common internal control activities that are designed to prevent or detect the misappropriation of cash and the typical test of control that would be used by auditors. As you will note, many of these procedures can be characterized as steps

Internal Control Test of Control

• Checks are not printed until voucher packets are prepared.

• An employee compares amounts on printed checks with voucher packets prior to submission for signature.

• Only authorized signers are permitted to sign checks.

1. For a sample of recorded cash disbursements from the cash disbursements journal, inspect supporting documentation for evidence of mathematical accuracy, correct classification, proper approval, authorized signature and then compare the date on the check with the date recorded in the disbursements journal.

• Checks are prenumbered and accounted for. 2. Scan checks for sequence. Look for gaps in sequence and duplicate numbers.

• Bank reconciliations are prepared on a timely basis. 3. Review bank reconciliations to ensure that they were prepared on a timely basis.

EXHIBIT 6.9 Tests of Controls over Cash Disbursements

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 243

lou6920x_ch06_220-268.indd 243 03/06/20 02:53 PM

taken to make it difficult for a fraudster to steal cash. However, there are also controls designed to detect fraudulent activity if it occurs. The control tests are designed to enable the audit team to obtain objective evidence about the operating effectiveness of control activities. Many businesses rarely write paper checks. The controls required for electronic payments requires the same system of separation of duties. However, the majority of the access and authorization controls are accomplished through passwords and restrictions of access to data and accounting information systems.

REVIEW CHECKPOINTS 6.11 What is the basic sequence of activities in the cash collection process? 6.12 Why should a list of cash remittances be made and sent to the accounting department? Wouldn’t it

be easier to send the cash and checks to the accountants so they can enter the credits to custom- ers’ accounts accurately?

6.13 What is lapping? What procedures can auditors employ to detect lapping? 6.14 What feature of the acquisition and expenditure control would be expected to prevent an

employee from embezzling cash by creating fictitious vouchers?

Substantive Procedures As you have learned previously while studying audit risk, the primary reason for evalu- ating the internal control system at an audit client is to reach an overall assessment of risk of material misstatement for each relevant assertion. In fact, the assessment of risk of material misstatement is completed to help form the basis for determining the nature, timing, and extent of substantive testing. Risk of material misstatement at the assertion level is comprised of both inherent risk and control risk for each relevant assertion.

If inherent risk has already been assessed as high, this means that there is high sus- ceptibility for this account to be misstated. Recall that control risk is the “probability that an entity’s controls will fail to prevent or detect material misstatements due to errors or frauds.” Due to the nature of cash, the majority of audit clients have strong controls over cash, and tests of controls often support a reduction in control risk. This reduction in con- trol risk reduces the auditor’s assessment of the risk of material misstatement over cash. However, regardless of the final assessment of the risk of material misstatement, as with any significant account, the auditor will perform at least some substantive procedures over cash.

As stated previously, there are two types of substantive tests: analytical procedures and tests of detail and balances. As you may recall, a substantive analytical procedure is one where the auditor substantiates an account or disclosure by developing an indepen- dent estimate of the amount and then comparing the recorded balance to the estimate. Due to the lack of predictability of the cash balance, auditors rarely, if ever, use sub- stantive analytical procedures to test cash. Rather, auditors typically rely exclusively on tests of detail. For example, auditors will generally test the bank reconciliations in detail, including sending confirmations to all banks in order to substantiate the existence of cash. Exhibit 6.10 presents the substantive tests that are likely to be completed to address remaining risks of material misstatement related to cash.

Without question, the most important test of detail completed on cash is to test the details of the entity-prepared and reviewed bank reconciliation for each significant bank- ing relationship, including confirmation of the balance with the financial institution. For that reason, our discussion of substantive procedures will focus almost exclusively on testing the bank reconciliation in detail. In effect, the auditor needs to obtain the bank rec- onciliation for each significant account and audit the details contained on each of them. In a well-functioning control environment, auditors should never have to perform the

LO 6-6 Give examples of substantive procedures used to test cash and relate them to the relevant assertions.

First Pages

244 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 244 03/06/20 02:53 PM

company’s internal control activity of preparing the bank reconciliation. Always remem- ber that the timely completion of the bank reconciliation is the responsibility of the client and is a critical element of internal control over cash.

Bank Reconciliation A client-prepared bank reconciliation is shown in Exhibit 6.11. When auditing the bank reconciliation, the auditor should begin by confirming the account balance listed as the “balance per bank” on the top of the bank reconciliation for each bank account from each bank that the client utilizes in the business. The auditor is required to send a con- firmation request, and each bank should respond directly to the public accounting firm’s office. This procedure is important because the auditor needs to make sure that the con- firmation request was actually completed by an independent professional at a third-party bank. In fact, a failure to adhere to professional standards in this area was cited by the SEC and PCAOB when announcing financial statement fraud charges against Satyam, an information technology company based in India. A description is found in the follow- ing Auditing Insight.

EXHIBIT 6.10 Substantive Tests

Significant Account

Relevant Assertions

Internal Control Activity

Tests of Internal Control

Possible Substantive Tests of Detail

Cash

Existence The CFO perfoms a detailed review of the bank reconciliation on a monthly basis.

For a sample of bank reconciliations, reperform the reconciliation. Trace several reconciling items to the appropriate supporting documentation.

Test the bank reconciliation details for each significant cash account being held. Confirm the bank balance with each financial institution.

Valuation The treasurer reviews the cash translation adjustment calculation monthly and independently checks that the appropriate spot rate has been used for each foreign currency.

Inspect the monthly cash translation adjustment calculation for evidence of the treasurer’s review.

For a sample of monthly cash translation adjustment calculations, trace each foreign currency spot rate to a third-party pricing service.

Presentation and disclosure

The corporate secretary reviews the cash footnote disclosure on a quarterly basis to ensure that all legal restrictions on the cash balance have been properly disclosed.

For a sample of cash accounts, reperfom the work completed by the corporate secretary to ensure that all cash restrictions have been properly disclosed.

For a sample of cash accounts, examine the legal agreements with each financial institution. Based on the examination, determine whether the audit client has properly disclosed any legal restrictions in their footnotes.

The Securities and Exchange Commission recently charged “India- based Satyam Computer Services Limited with fraudulently over- stating the company’s revenue, income and cash balances by more than $1 billion over five years.” The SEC’s complaint states that “former senior officials at Satyam—an information technology ser- vices company based in Hyderabad, India—used false invoices and forged bank statements to inflate the company’s cash balances and make it appear far more profitable to investors.” In addition, “Satyam

employees created bogus bank statements to reflect payment of the sham invoices. This resulted in more than $1 billion in fictitious cash and cash-related balances.” In addition, the SEC instituted adminis- trative proceedings against the auditors, Price Waterhouse India for “failure to properly execute third-party confirmation procedures” to test the existence of cash at Satyam. Source: “SEC Charges Satyam Computer Services with Financial Fraud,” www .sec.gov, Case 2011-81, April 5, 2011.

The Dangers of Bank ConfirmationsAUDITING INSIGHT

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 245

lou6920x_ch06_220-268.indd 245 03/06/20 02:53 PM

EXHIBIT 6.11 Bank Reconciliation

The previous auditing insight demonstrates the difficulties auditors can have with authenticating the source of confirmations. The use of third-party electronic information intermediaries, such as Confirmation (formerly called Confirmation.com), has changed the process of cash confirmation greatly over the past decade, but it has not reduced the auditor’s responsibility to authenticate the source of the information.

It is rare for a bank to respond to a paper request for confirmation, and thus nearly all audit firms confirm bank balances through a third-party intermediary, often Confirmation. A standard confirmation request to a bank will also confirm outstanding loan balances, which will provide substantive evidence to test the existence and completeness assertions for liabilities. We will discuss substantive tests of loan balances in more detail in Chapter 10.

As discussed above with the Satyam case, the key issue with confirmations of any kind is the reliability of the response. The use of electronic confirmation through an interme- diary such as Confirmation provides many benefits to the auditor. It allows information

First Pages

246 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 246 03/06/20 02:53 PM

to be transmitted in a safe and secure manner, and most importantly, it allows for valida- tion of the authenticity of the bank employee responding to the confirmation request, an issue which was previously a major concern for auditors. Before an auditor can rely on an electronic confirmation, the auditor must obtain an understanding of the intermediary’s internal control system. In most situations, the auditor relies upon a report provided by another auditor who audited the design and operating effectiveness of the intermediary under SSAE 16, and provided a Service Organization Controls (SOC) report, most com- monly a SOC1 report. SOC reports are discussed in more detail in Module A.

The confirmation process through an online intermediary generally requires the regis- tration of the auditor, the client, and the financial institution, although in some situations, the intermediary will make paper confirmation requests on behalf of an auditor. Clients must provide electronic authorization in order for the auditor to request confirmation. Upon authorization, the auditor will initiate a confirmation request. Unlike traditional paper confirmations which often take multiple weeks for completion, electronic confir- mation requests are often completed in a matter of days.

Exhibit 6.12 provides an example of a standard electronic bank confirmation per- formed through Confirmation. You will note in Exhibit 6.12 that the auditor can also con- firm outstanding loan balances listed on the balance sheet. As shown, the auditors would be gathering evidence to test the completeness assertion for liabilities because the auditor would trace the information provided by the bank to loan balances listed on the balance sheet. We will discuss substantive tests of the loan balance in more detail in Chapter 10.

A word of caution is in order. Although financial institutions may note exceptions to the information requested in a confirmation and may confirm items omitted from it, the AICPA warns auditors that sole reliance on a confirmation to satisfy the completeness assertion for cash and liabilities is inappropriate. Employees of financial institutions can- not be expected to search their information systems for balances and loans that may not be immediately evident as the client company’s assets and liabilities — in fact the elec- tronic response shown here specifically notes that.

A benefit of electronic confirmation is outlined in the following Auditing Insight.

During the 2012 audit of Peregrine Financial Group Inc. (PFG), audi- tors from the National Futures Association requested permission to use an electronic confirmation platform, Confirmation, to confirm the cash balances at PFG. For several months, the CEO of PFG, Russell Wasendorf Sr., had adamantly resisted the authorization necessary to use Confirmation to confirm the company’s bank balances. Ultimately, Wasendorf agreed to allow the use of the electronic platform, and within 24 hours, it was discovered that one bank account only had $6 million instead of the approximately $220 million that the company

had reported to its auditors. It was later revealed that Wasendorf had falsified bank statements and forged official letters as well as other correspondence from the bank, including letters of confirmation. Apparently, he had rented a post office box to intercept bank confir- mation requests and forged the documents to conceal missing money.

Sources: “Red Flags at Failed Broker,” The Wall Street Journal, July 12, 2012, p. C1; “Peregrine’s Struggle to Stay Airborne,” The Wall Street Journal, July 19, 2012, p. C1; “Trading Firm CEO: I Spent It,” The Wall Street Journal, July 18, 2012, p. A1; “Per- egrine CEO’s Dramatic Confession,” The Wall Street Journal, July 14, 2012, p. A1.

Confirmation: Cash is Missing!AUDITING INSIGHT

Once the “balance in the bank” has been confirmed and cross-referenced to the bal- ance in the bank reconciliation, the following additional procedures are typically used in auditing the bank reconciliation:

∙ Test the mathematical accuracy of the reconciliation, including the listing of outstand- ing checks and deposits in transit.

∙ Examine reconciling items to ensure they are appropriately classified (e.g., that they were legitimate outstanding checks that were written but not paid by the bank at the statement date).

∙ Reconcile the book balance to the trial balance, which has been traced to the general ledger.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 247

lou6920x_ch06_220-268.indd 247 03/06/20 02:53 PM

EXHIBIT 6.12 Bank Confirmation

First Pages

248 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 248 03/06/20 02:53 PM

The auditors’ information source for validating the bank reconciliation items is typi- cally a cutoff bank statement, which is normally a complete bank statement for the month following the date of the financial statements. The cutoff bank statement is important because it (1) is received directly by the auditors (which qualifies as external evidence) and (2) documents important bank transactions occurring early in the subsequent period. These transactions subsequent to the date of the financial statements are important for testing the completeness of the client’s outstanding check list as well as the existence of any deposits in transit. The bank cutoff statement can also be used in a search for unre- corded liabilities discussed in more detail in Chapter 8.

Deposits in transit should be vouched from the bank reconciliation to the bank cutoff statement (existence) and should have been recorded by the bank in the first business days of the cutoff period. If recorded later, the inference is that the deposit may have been composed of receipts of the period after the date of the financial statements.

When auditing negative reconciling items (i.e., outstanding checks) listed on the bank reconciliation and because the audit team is most concerned about the existence of cash (i.e., overstatement) rather than the completeness of cash (i.e., understatement), the completeness of the outstanding checks listing is more critical than to support the existence of such checks. Comparably, when auditing positive reconciling items (i.e., deposits in transit) listed on the bank reconciliation, the existence of the deposits-in-transit on the reconciliation is more criti- cal than their completeness because the audit team is most concerned about the existence of cash (i.e., overstatement) rather than the completeness of cash (i.e., understatement). As a result, the audit team traces outstanding checks that cleared on the cutoff bank statement (and were either returned with that statement or identified in that statement) to the client’s list of outstanding checks for evidence that all checks that were written prior to the reconciliation date were included on the list of outstanding checks. Additionally, canceled checks should be traced to the cash disbursements listing (journal). For large outstanding checks not clearing in the cutoff period, other documentation supporting the disbursement may be used. These procedures are key and described by tick marks in Exhibit 6.11. As the next Auditing Insight suggests, it is important to pay close attention to possible errors in the bank reconciliation.

Through the use of discretionary estimates, HealthSouth, one of the largest health care providers in the United States, inflated its assets by $1.5 billion. In an even more bizarre twist, the company overstated its cash by more than $300 million, according to prosecutors. Because auditors use standardized forms to confirm cash balances with finan- cial institutions, how the auditors missed the cash overstatement is

a mystery. “I’m shocked that cash is manipulated and overstated, because the darn stuff is so easy to count,” stated one audit expert. Nevertheless, auditors must never take the cash balance for granted when conducting the audit.

Source: “Did HealthSouth Auditor Ernst Miss Key Clues to Fraud Risks?” The Wall Street Journal, April 10, 2003.

The Darn Stuff Is So Easy to CountAUDITING INSIGHT

REVIEW CHECKPOINT 6.15 What is a bank reconciliation? Who should prepare it and how do auditors use it?

“EXTENDED PROCEDURES” TO DETECT FRAUD The auditing literature often refers to “extended procedures,” which are “specific responses to fraud risk factors.” Although the professional standards list a few of these procedures, an exhaustive list would be very lengthy. Moreover, authorities fear that a definitive list might limit the range of such procedures, so extended procedures are gener- ally identified as whatever is necessary in the circumstances. This section describes some

LO 6-7 Describe some extended procedures for detecting employee fraud schemes involving cash.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 249

lou6920x_ch06_220-268.indd 249 03/06/20 02:53 PM

of the extended procedures and warns that (1) some auditors may consider them ordinary and (2) other auditors may consider them unnecessary in any circumstances. They are useful detective procedures in either event. Consider the following procedures.

Schedule of Interbank Transfers Due to the nature of the cash balance, auditors also will sometimes, although rarely because of decreased float times, prepare a schedule of interbank transfers to determine whether transfers of cash from one bank to another were recorded properly (correct amount and correct date). The audit team should also be alert to the possibility of a company’s practice of illegal “kiting.” Check kiting is the deliberate floating of funds between two or more bank accounts in order to make it appear that more cash is present than is really the case. When a check is deposited in one bank, the cash receipts journal immediately includes that deposit. At the same time, the check, drawn on a different bank account, does not appear in the cash disbursements journal for several days. By this method, an entity can use the time required for checks to clear to inflate the cash amount on the entity’s books. Advances in information technology and increased bank scrutiny have reduced the incidences of check kiting dramatically in recent years. However, auditors must still be aware of the possibility; and the schedule of interbank transfers is a technique designed to detect the practice.

These are some characteristic signs of check-kiting schemes:

∙ Frequent deposits and checks in rounded and the same amounts. ∙ Frequent deposits with checks written on the same (other) banks. ∙ Short time lags between deposits and withdrawals. ∙ Frequent ATM account balance inquiries. ∙ Many large deposits made on Friday to take advantage of the weekend. ∙ Large periodic balances in individual accounts with no apparent business explanation. ∙ Low average balance compared to high level of deposits. ∙ Many checks made payable to other banks. ∙ Banks’ willingness to pay against uncollected funds. ∙ “Cash” withdrawals with deposit checks drawn on another bank. ∙ Checks drawn on foreign banks with lax banking laws and regulations.

Today, banks have implemented the Check Clearing for the 21st Century Act, referred to as “Check 21.” In this system, checks are converted to digital images, allowing for a dramatic increase in speed in check clearing. The benefit is that the “float” on the check is virtually eliminated, and kiting becomes difficult to perform and conceal. However, in the Check 21 system, the paper check is usually destroyed, a hard copy of the check is never returned to the customer or its bank, and consequently, the nature of the audit trail is significantly different. In investigating possible fraud, the audit team is able to obtain only an electronic copy of the front of the check and the controls over the safeguarding of the imaging files will be of great importance.

Proof of Cash Auditors can use another method to discover unrecorded cash transactions. It is called a proof of cash. The proof of cash is a reconciliation in which the bank balance, the bank report of cash deposited, and the bank report of cash paid are all reconciled to the cor- responding records maintained in the entity’s general ledger, cash receipts journal, and cash disbursements journal.

The proof of cash attempts to reconcile the deposits and payments reported by the bank to the deposits and payments recorded in the cash receipts and cash disbursements journals, respectively, as well as the final general ledger totals. The proof of cash is a very effective procedure to verify cash transactions but is usually used only when controls over cash are weak, which is rarely the case. Thus, a proof of cash is not always performed in an audit of cash.

First Pages

250 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 250 03/06/20 02:53 PM

Count and Recount Cash on the Same Day If a client maintains a significant amount of cash on hand, such as a financial institution or some retailers, a second cash count is unexpected. Auditors might catch an embezzling employee who incorrectly believes that “the auditors are gone, so now it’s safe!” Auditors should always make sure a client employee is present during the count and that the employee signs for the returned cash so the auditor cannot be blamed for any shortages. Another “trick of the trade” is to make sure that the auditor’s pockets are empty (leave wallets locked up safely elsewhere) when counting client cash on hand. This is especially important when counting cash at a financial services client such as a bank or credit union. All cash should be counted simultaneously to prevent embezzling employees from substituting cash from other places. If this is not possible (e.g., the employee claims that he or she does not have the safe combination), there is audit tape (similar to police tape) to seal the safe until it can be opened with the auditor present. If the seal is broken, your suspicions should be raised.

Identity theft and hacking have become a major headache for both businesses and consumers. But sometimes, identity theft can be low tech. Five sales associates for Saks Fifth Avenue used stolen customer personal information to purchase hundreds of thousands of dollars of high-end handbags and shoes from the retailer’s famous Manhattan location. A ringleader stole the information and recruited associates

and customers to assist with the scheme. The associates would use fake customers to make the purchases, then sell the items on the black market or return them to the store.

Source: A. Katersky. “5 Indicted in Alleged Saks Fifth Avenue ID Theft Shopping Spree”. ABC News, October 6, 2014. https://abcnews.go.com/US/ ring-allegedly-stole-identities-shopping-saks-avenue/story?id=25997098

Free Givenchy, Anyone?AUDITING INSIGHT

Noting a significant change in the mix of cash and checks on bank deposit slips over time, a government auditor became suspicious enough to set up a hidden camera. The camera caught a county tax clerk “skimming” cash from daily property tax deposits. The clerk would pocket most of the cash, leaving the checks to be deposited. The fraud perpetrator was able to conceal the theft by replacing the missing cash with checks written to the county for other, miscellaneous purposes for which established procedures were not closely followed.

In an unrelated fraud, Ocean World Seafood was charged with food stamp fraud. According to investigators, a store of Ocean World’s size would normally make approximately $3,000 a month in sales paid with food stamps. Over a 13-month period, Ocean World accepted more than $1 million in food stamps. Apparently, the store would provide cash for food stamps, paying approximately 50 cents for $1 of food stamps. Source: “Store Owner Charged in $1 Million Food Stamp Fraud,” Associated Press Wire, April 15, 2005.

Mixing It UpAUDITING INSIGHT

Retrieve Customers’ Checks If an employee has diverted customer payments for his or her own use, the canceled checks and deposits to a bank where the company has no account are not available because they are returned to the issuing customer. Ask the customer to give copies of the front of the check or provide access for examination.

Use Marked Coins and Currency Plant marked money in locations where cash collections should be gathered and turned over for deposit.

Analyze the Mix of Cash and Checks in Deposits This procedure is most effective for retail operations in which cashiers receive significant amounts of both cash and checks. Unless there is a marked change in consumer behavior, one should expect the mix of cash and checks to be relatively consistent over time. A decrease in the proportion of cash in the mix is often a sign that employees may be stealing cash.

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 251

lou6920x_ch06_220-268.indd 251 03/06/20 02:53 PM

Measure Deposit Lag Time Compare the date of the deposit slip to the date recorded as a debit in the general ledger to the date the deposit was credited in the account by the bank. Someone who takes cash and then holds the deposit for the next cash receipt to make up the difference causes a delay between the date of recording and the bank’s date of deposit.

Document Examination When performing this procedure, auditors will look for erasures, alterations, and photo- copies where originals should be filed, telltale lines from a copier when a document has been pieced together, handwriting, and other oddities. Auditors should always insist on seeing original documents instead of photocopies. Importantly, while professional docu- ment examination is a technical activity that requires special training (e.g., training by the IRS, FBI), crude alterations may still be observed by the auditor when performing procedures, which should lead to a consultation with a professional document examiner when deemed necessary.

Inquiry Be careful not to discuss fraud possibilities with the managers who might be involved. It gives them a chance to cover up their fraud or even resign from the organization prior to detecting the fraud. Described as a nonaccusatory method of asking key questions of personnel during a regular audit, fraud audit questioning (FAQ) provides employees an opportunity to furnish information about possible misdeeds. Fraud possibilities are addressed in a direct manner, so the FAQ approach must have the support of manage- ment. Example questions are: “Do you think fraud is a problem for business in general?” “Do you think this company has any particular problem with fraud?” “In your depart- ment, who is beyond suspicion?” “Is there any information you would like to furnish regarding possible fraud within this organization?”7

Covert Surveillance When performing this procedure, auditors will observe activities while not being seen. For example, audit team members might watch employees as they punch in to a work shift, observing whether they use only one time card. Casino auditors actually get paid to gamble so they can observe cash-handling procedures. Traveling hotel auditors may check in unannounced, use the restaurant and entertainment facilities, and observe employees to determine if they are stealing cash receipts or tickets. (Trailing people on streets, under- cover surveillance, and maintaining a “stake-out” should be left to trained investigators.)

Horizontal and Vertical Analyses Horizontal and vertical ratio analysis procedures are very similar to preliminary ana- lytical procedures explained in earlier chapters. Horizontal analysis refers to changes of

7Joseph T. Wells, “From the Chairman: Fraud Audit Questioning,” The White Paper, National Association of Certified Fraud Exam- iners, May–June 1991, p. 2. This technique must be used with extreme care and practice.

The district grocery store manager could not understand why receipts and profitability had fallen and inventory was hard to manage at one of the largest stores in her area. She hired an investigator who covertly observed the checkout clerks and reported that no one had shown suspicious behavior at any of the nine checkout counters. “Nine? That

store only has eight,” she exclaimed! As it turns out, the local store manager had installed another checkout aisle not connected to the cash receipts and inventory maintenance central computer and was pocketing all the receipts from that register.

Source: Association of Certified Fraud Examiners (ACFE), “Auditing for Fraud.”

The Case of the Extra CheckoutAUDITING INSIGHT

First Pages

252 Part Two The Financial Statement Audit

lou6920x_ch06_220-268.indd 252 03/06/20 02:53 PM

Five individuals were charged with tax and insurance fraud in the operation of a temporary employment agency in southeastern Mas- sachusetts. From January 1993 through June 2001, the agency paid a large portion of its payroll in cash in order to avoid employment taxes (e.g., Social Security and Medicare) and to reduce payments

for workers’ compensation insurance. Why would a company pay its employees in cash? Is there a legitimate reason to do this? Even if the employees wanted cash, would there be a better way to provide it? Source: “Five Charged in $30 Million ‘Under-the-Table’ Payroll Fraud, Reports U.S. Attorney,” PR Newswire, January 27, 2005.

Thank Goodness It’s Payday!AUDITING INSIGHT

REVIEW CHECKPOINTS 6.16 Why would an auditor prepare a proof of cash? 6.17 What is the difference between a normal procedure and an extended procedure? 6.18 What can an auditor find using net worth analysis? Expenditure analysis?

financial statement numbers and ratios across several years. Vertical analysis refers to financial statement amounts expressed each year as proportions of a base such as sales for the income statement accounts and total assets for the balance sheet accounts. Auditors look for relationships that do not appear logical as indicators of potential large misstate- ment and fraud.

Net Worth Analysis This analysis is used when fraud has been discovered or strongly suspected and the infor- mation to calculate a suspect’s net worth can be obtained (e.g., asset and liability records, bank accounts). The method involves calculating the suspect’s net worth (known assets minus known liabilities) at the beginning and end of a period (months or years) and then trying to account for the difference as (1) known income less living expenses and (2) unidentified difference. The unidentified difference may be the best available approxima- tion of the amount of a theft.

Expenditure Analysis This analysis is similar to net worth analysis except the data are the suspect’s spending for all purposes compared to known income. If spending exceeds legitimate and explainable income, the difference may be the amount of a theft.

Reasonableness Tests Often, auditors become so involved in ticking and tying numbers that they forget to ask themselves the simplest questions: Where is the cash going? For what purpose? Is this reasonable? The answers to these questions often motivate the auditor to ask more pen- etrating questions of management and to dig for more evidence.

Although auditing standards concentrate on management fraud—the production of mate- rially false and misleading financial statements (i.e., fraudulent financial reporting)— professional standards also require auditors to consider employee fraud perpetrated against an entity. Attention to employee fraud is important in the context that the cover- up may create financial statement misstatements (e.g., overstating inventory to disguise unauthorized removal of valuable products). The three conditions that are likely to be present when a fraud occurs (Exhibit 6.1) are commonly referred to as the “fraud trian- gle.” The first condition (incentive/pressure) recognizes that an employee or a manager

Summary

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 253

lou6920x_ch06_220-268.indd 253 03/06/20 02:53 PM

of a company is likely to either have incentives in place (e.g., bonus compensation) or be under significant pressure to meet specific estimates, forecasts, or expectations about net income. The second condition (opportunity) recognizes that in order for a fraud to be perpetrated, there must be a weakness in the system of internal control to allow the fraud to occur. Finally, the third condition (attitude/rationalization) recognizes that for an employee or a manager of a company to perpetrate a fraud, the individual must possess an “attitude” that allows her or him to rationalize that she or he is knowingly committing a crime.

Audit team members need to know about the red flags, those telltale signs and indica- tions that have accompanied many frauds. When studying a business operation, members’ ability to “think like a crook” to devise ways to steal can help in planning procedures designed to determine whether fraud has happened. Often, imaginative “extended proce- dures” can be employed to unearth evidence of fraudulent activity. Audit team members must always exercise technical and personal care, however, because accusations of fraud are taken very seriously. For this reason, after preliminary findings indicate fraud pos- sibilities, the audit team should enlist the cooperation of management and assist fraud examination professionals when bringing an investigation to a conclusion.

Once the relevant assertions have been identified for cash (e.g., existence) and the tests of control activities are complete, the auditor must evaluate the evidence obtained from risk assessment activities and control tests to determine the risk of material misstatement for each relevant assertion. Cash is highly liquid, very portable, and not easily identifi- able. For these reasons, cash is often the primary target of fraudulent activities and must be carefully controlled and monitored. Accordingly, controls over cash receipts and dis- bursements must be strong. With respect to auditing the cash balance, the detailed proce- dures performed on the bank reconciliation provide evidence about the existence of cash.

Additional procedures can be performed to try to detect attempts at lapping accounts receivable collections. These procedures include comparing the details of customer pay- ments listed in bank deposits to the details of customer payment postings (remittance lists).

check kiting: The practice of building up balances in one or more bank accounts based on uncollected (floating) checks drawn against similar accounts in other banks, 249 cutoff bank statement: A client bank statement (usually sent directly to the auditor) that includes all paid checks and deposits made through a certain date, usually the end of the month following the financial statement date, 248 direct-effect illegal acts: The violations of laws or government regulations by a company or its management or employees that produce direct and material effects on dollar amounts in financial statements, 223 embezzlement: A type of fraud involving employees or nonemployees wrongfully taking money or property entrusted to their care, custody, and control, often accompanied by false accounting entries and other forms of lying and cover-up, 223 employee fraud (also called misappropriation of assets): The use of fraudulent means to take money or other property from an employer. It consists of three phases: (1) the fraudulent act, (2) the conversion of the money or property to the fraudster’s use, and (3) the cover-up, 222 errors: The unintentional misstatements or omissions of amounts or disclosures in financial statements, 223 fidelity bond: An insurance policy that covers most kinds of cash embezzlement losses, 240 fraud: The misrepresentation of facts that the individual knows to be false with the intention to deceive, 222 lapping: The theft of a payment and the application of subsequent payments to cover the theft, 240 lockbox: An arrangement in which a fiduciary (e.g., a bank) receives the payments, lists the receipts, deposits the money, and sends the remittance advices (stubs showing the amount received from each customer) to the company, 239

Key Terms

First Pages

lou6920x_ch06_220-268.indd 254 03/06/20 02:53 PM

254 Part Two The Financial Statement Audit

management fraud: The deliberate fraud committed by management that injures investors and creditors through materially misleading information, 223 misappropriation of assets: See employee fraud, 222 motive: In the fraud context, essentially a reason for a person to take a fraudulent action that is believed to be unshareable with friends and confidants, 226 proof of cash: A reconciliation in which the bank balance, the bank report of cash deposited, and the bank report of cash paid are all reconciled to the company’s general ledger and cash receipts and disbursements journals, 249 schedule of interbank transfers: A document prepared for use in analyzing whether transfers of cash from one bank to another were recorded properly (correct amount and correct date), 249

All applicable Exercises and Problems are available with Connect.

Multiple-Choice Questions for Practice and Review

6.19 When auditing with “fraud awareness,” auditors should especially notice and follow up employee activities under which of these conditions? a. The company always estimates the inventory but never takes a complete physical count. b. The petty cash box is always locked in the desk of the custodian. c. Management has published a company code of ethics and sends frequent communication

newsletters about it. d. The board of directors reviews and approves all investment transactions.

6.20 The best way to enact a broad fraud prevention program is to a. Install airtight control systems of checks and supervision. b. Name an “ethics officer” who is responsible for receiving and acting on fraud tips. c. Place dedicated hotline telephones on walls around the workplace with direct communi-

cation to the company ethics officer. d. Practice management “of the people and for the people” to help them share personal and

professional problems.

6.21 A good fraud prevention program should address employees’ motivation to steal from the company. The best method for doing this is to a. Establish employee assistance programs. b. Require a fidelity bond on all employees. c. Require reconciliations of all accounts to be reviewed by a supervisor. d. Ensure that all accounts with high inherent risk of fraud are audited.

6.22 A code of ethics is an important element of a fraud prevention program. Which of the fol- lowing would diminish the effectiveness of a company’s code of conduct? a. The establishment of a chief ethics officer. b. The establishment of a hotline for reporting unethical behavior. c. The violation of the code of ethics by senior management. d. The posting of the code of ethics in the company workplace.

6.23 Which of the following is least indicative of fraudulent activity? a. Numerous cash refunds have been made to different people at the same post office box

address. b. Internal auditors cannot locate several credit memos to support reductions of customers’

balances. c. Bank reconciliation has no outstanding checks or deposits older than 15 days. d. Three people were absent the day the auditors handed out the paychecks and have not

picked them up four weeks later.

LO 6-2

LO 6-3

LO 6-3

LO 6-3

LO 6-2

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 255

lou6920x_ch06_220-268.indd 255 03/06/20 02:53 PM

6.24 When performing confirmation of cash balances with a bank, the auditor is primarily gath- ering evidence related to which financial statement assertion? a. Existence. b. Completeness. c. Valuation. d. Presentation and Disclosure.

6.25 Which of the following is true about electronic cash confirmations obtained through Confir- mation.com? a. Responses to electronic confirmations are often delayed compared with manual

confirmations. b. Electronic cash confirmations provide more convincing evidence for the completeness

assertion than manual confirmations. c. Auditors must obtain evidence supporting the reliability of controls surrounding the Con-

firmation.com process. d. It is more difficult to determine the authenticity of an electronic confirmation obtained

through Confirmation.com compared with confirmations mailed to the auditors.

6.26 Allison Everhart, an employee in accounts payable, believes she can run a fictitious invoice through the accounts payable system and collect the money. She knows payments are subject to an audit. Which account would be the best place to hide the fraud? a. Inventory. b. Wage expense. c. Consulting service expense. d. Property tax expense.

6.27 Which of these arrangements of duties could most likely lead to an embezzlement or theft? a. The inventory warehouse manager has responsibility for making the physical inventory

observation and reconciling discrepancies to the perpetual inventory records. b. The cashier prepared the bank deposit, endorsed the checks with a company stamp, and

delivered the cash and checks to the bank for deposit (no other bookkeeping duties). c. The accounts receivable clerk received a list of payments received by the cashier so he

could make entries in the customers’ accounts receivable subsidiary accounts. d. The financial vice president received checks made out to suppliers and the supporting

invoices, signed the checks, and mailed the checks.

6.28 Which of the following would the auditor consider to be an incompatible operation if the cashier receives remittances? a. The cashier prepares the daily deposit. b. The cashier makes the daily deposit at a local bank. c. The cashier posts the receipts to the accounts receivable subsidiary ledger cards. d. The cashier endorses the checks.

6.29 Which of the following is an effective audit procedure that an auditor might use to detect kiting between intercompany banks? a. Review the composition of authenticated deposit slips. b. Review subsequent bank statements. c. Prepare a schedule of the bank transfers. d. Prepare a year-end bank reconciliation.

6.30 Immediately upon receipt of cash, a responsible employee should a. Record the amount in the cash receipts journal. b. Prepare a remittance listing. c. Update the subsidiary accounts receivable records. d. Prepare a deposit slip in triplicate.

(AICPA adapted)

LO 6-6

LO 6-6

LO 6-5

LO 6-1

LO 6-5

LO 6-5

LO 6-5

First Pages

lou6920x_ch06_220-268.indd 256 03/06/20 02:53 PM

256 Part Two The Financial Statement Audit

6.31 Each morning the controller gets the prior day’s list of remittances, a copy of the payment report, and a copy of the deposit slip returned from the bank. When comparing these items, the controller would be able to determine that a. No checks were returned for insufficient funds. b. The cash received and remittance advice received were maintained in a single batch. c. The accounts receivable system has controls over unauthorized access. d. The assistant controller does not also reconcile the subsidiary accounts payable.

6.32 Upon receipt of customers’ checks in the mail room, a responsible employee should prepare a remittance list that is forwarded to the cashier. A copy of the list should be sent to the a. Internal auditor to investigate the list for unusual transactions. b. Treasurer to compare the list with the monthly bank statement. c. Accounts receivable bookkeeper to update the subsidiary accounts receivable records. d. Entity’s bank to compare the list with the cashier’s deposit slip.

(AICPA adapted)

6.33 Cash receipts from sales on account have been misappropriated. Which of the following acts would conceal this defalcation and be least likely to be detected by an auditor? a. Understating the sales journal. b. Overstating the accounts receivable control account. c. Overstating the accounts receivable subsidiary ledger. d. Overstating the sales journal.

6.34 Embezzlement is a type of fraud that involves a. An employee’s misappropriating an employer’s money or property not entrusted to him

or her. b. A manager’s falsification of financial statements for the purpose of misleading investors

and creditors. c. An employee’s mistaken representation of opinion that causes incorrect accounting

entries. d. An employee misappropriating an employer’s money or property entrusted to the employ-

ee’s control in the employee’s normal job.

6.35 Which of the following control activities would best protect against the preparation of improper or inaccurate cash disbursements? a. All checks must be signed by an officer designated by the board of directors. b. All signed checks must be reviewed and compared with supporting documentation by the

treasurer before mailing. c. All checks must be sequentially numbered and accounted for by internal auditors. d. All checks must be perforated or otherwise effectively canceled when they are returned

with the bank statement.

6.36 During an audit of cash, the auditor is most concerned with the management assertion of a. Existence. b. Rights and obligations. c. Valuation or allocation. d. Occurrence.

6.37 In preparing for the audit of cash, the auditors perform analytical procedures concerning cash balances. Which of the following would be the best source of information for use in the estimate of cash? a. Prior-years’ balances. b. Management inquiry. c. Cash budgets. d. Aged accounts receivable reports.

LO 6-4

LO 6-4

LO 6-4

LO 6-1

LO 6-5

LO 6-4

LO 6-6

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 257

lou6920x_ch06_220-268.indd 257 03/06/20 02:53 PM

6.38 Which of the following control activities could prevent a paid disbursement voucher from being presented for payment a second time? a. Vouchers should be prepared by individuals who are responsible for signing disburse-

ment checks. b. Disbursement vouchers should be approved by at least two responsible management

officials. c. The date on a disbursement voucher should be within a few days of the date the voucher

is presented for payment. d. The official signing the check should compare it with the voucher and should stamp

“paid” on the voucher documents.

6.39 Fraud risk factors are events or conditions that indicate which of the following? a. An opportunity to carry out a fraud. b. An attitude or rationalization that justifies a fraudulent action. c. An incentive or pressure to perpetrate fraud. d. All of these are correct.

6.40 If the auditor believes that a misstatement is or might be intentional and the effect on the financial statements could be material or cannot be readily determined, the auditor should do which of the following? a. Inquire of management as to the possibility of fraud. b. Discuss with the audit committee what should be done to prevent possible future

misstatements. c. Perform procedures to obtain additional audit evidence to determine whether fraud has

occurred or is likely to have occurred. d. Both a and b are correct. e. None of these is correct.

6.41 In what way can audit procedures be modified to address assessed fraud risks? a. Obtain more reliable information. b. Perform procedures close to year-end. c. Apply computer-assisted techniques to all items. d. All of these are valid modifications.

6.42 Incorporating elements of unpredictability in the selection of audit procedures to be per- formed by auditors include all of the following except a. Varying the timing of the audit procedures. b. Selecting items for testing that have lower amounts or are otherwise outside customary

selection parameters. c. Performing audit procedures on an unannounced basis. d. Sending attorney letters to every attorney listed under the legal expense account. e. None of these is correct.

6.43 Fraud risk factors are events or conditions that indicate I. An incentive or pressure to perpetrate fraud. II. An opportunity to carry out the fraud. III. An attitude or rationalization that justifies the fraudulent action. Which of the following statements is true? a. I is a fraud risk factor. b. I and II are fraud risk factors. c. II and III are fraud risk factors. d. None of these is a fraud risk factor. e. I, II, and III are fraud risk factors.

LO 6-5

LO 6-2

LO 6-7

LO 6-7

LO 6-7

LO 6-2

First Pages

lou6920x_ch06_220-268.indd 258 03/06/20 02:53 PM

258 Part Two The Financial Statement Audit

6.44 Tests of Controls over Cash Disbursements. The Runge Controls Corporation manufac- tures and markets electrical control systems: temperature controls, machine controls, burglar alarms, and the like. The company acquires electrical and semiconductor parts from outside vendors and assembles systems in its own plant. The company incurs other administrative and operating expenditures. Liabilities for goods and services purchased are entered in a vouchers payable journal, at which time the debits are classified to the asset and expense accounts to which they apply.

The company has specified control activities for approving vendor invoices for payment, for signing checks, for keeping records, and for reconciling the checking accounts. The pro- cedures appear to be well specified and in operation.

You are the senior auditor on the Runge engagement and need to specify a list of test of control procedures to evaluate the effectiveness of the controls over cash disbursements.

Required: Using management’s assertions over transactions as a guide, specify two or more tests of control procedures to audit the effectiveness of typical control activities. (Hint: From one sample of recorded cash disbursements, you can specify procedures related to several objec- tives. See Exhibit 6.9 for examples of test of control procedures over cash disbursements.) Organize your list according to the following example for the “completeness” assertion.

LO 6-5

All applicable Exercises and Problems are available with Connect.

Exercises and Problems

Completeness Assertion Test of Controls

All valid cash disbursements are  recorded and none are omitted.

Determine the numerical sequence of  checks issued during the period and  scan the sequence for missing numbers.

(AICPA adapted)

6.45 Internal Control Questionnaire for Book Buy-Back Cash Fund. Taylor, a CPA, has been engaged to audit the financial statements of University Books, Incorporated. University Books maintains a large cash fund exclusively for the purpose of buying used books from students for cash. The cash fund is active all year because the nearby university offers a large variety of courses with varying starting and completion dates throughout the year.

Receipts are prepared for each purchase. Reimbursement vouchers periodically are sub- mitted to replenish the fund.

Required: Construct an internal control questionnaire to be used in evaluating the internal control over University Books’ repurchasing process using the revolving cash fund. The internal control questionnaire should elicit a yes or no response to each question. Do not discuss the internal controls over books that are purchased from publishers.

(AICPA adapted)

6.46 Test of Controls over Cash Receipts. You are the in-charge auditor examining the financial statements of the Gutzler Company for the year ended December 31. During late Octo- ber, with the help of Gutzler’s controller, you completed an internal control questionnaire and prepared the appropriate memoranda describing Gutzler’s accounting procedures. Your comments relative to cash receipts are as follows: ∙ All cash receipts are sent directly to the accounts receivable clerk with no processing

by the mail department. The accounts receivable clerk keeps the cash receipts journal, prepares the bank deposit slip in duplicate, posts from the deposit slip to the subsidiary accounts receivable ledger, and mails the deposit to the bank.

∙ The controller receives the validated deposit slips directly (unopened) from the bank. She also receives the monthly bank statement directly (unopened) from the bank and promptly reconciles it.

∙ At the end of each month, the accounts receivable clerk notifies the general ledger clerk by journal voucher of the monthly totals of the cash receipts journal for posting to the general ledger.

LO 6-5

LO 6-5

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 259

lou6920x_ch06_220-268.indd 259 03/06/20 02:53 PM

∙ With regard to the general ledger cash account, the general ledger clerk makes an entry each month to record the total debits to cash from the cash receipts journal. In addition, the gen- eral ledger clerk, on occasion, makes debit entries in the general ledger cash account from sources other than the cash receipts journal, for example, funds borrowed from the bank. In the audit of cash receipts, you have already performed certain standard audit procedures:

∙ All columns in the cash receipts journal have been totaled and cross-totaled. ∙ Postings from the cash receipts journal have been traced to the general ledger. ∙ Remittance advices and related correspondence have been traced to entries in the cash

receipts journal.

Required: Considering Gutzler’s internal control over cash receipts and the standard audit procedures already performed, list all other audit procedures that should be performed to obtain sufficient appropriate audit evidence regarding controls over cash and give the reasons for each procedure. Do not discuss the procedures for cash disbursements and cash balances. Also, do not discuss the extent to which any of the procedures are to be performed. Assume that adequate controls exist to ensure that all sales transactions are recorded. Organize your answer sheet as follows:

(AICPA adapted)

Other Audit Procedure Reason for Other Audit Procedures

6.47 Internal Control over Sales Returns. You are the auditor for Konerko’s Office Supply Store, which is opening for business next week. The store owner has established all the controls you have recommended for ensuring that sales are recorded properly and cash is accounted for. The owner has heard from other small business owners that employees often used returned goods as means of skimming money from the register.

Required: a. How might an employee use returned goods to skim money from the register? b. What controls would you recommend to prevent or detect fraudulent returns? c. What audit procedures might you perform to detect fraudulent returns?

6.48 Procedures for Auditing a Client’s Bank Reconciliation. Auditors typically will find the items lettered A–F in a client-prepared bank reconciliation.

LO 6-3

LO 6-6

GENERAL COMPANY Bank Reconciliation: 1st National Bank

September 30 A. Balance per bank   $28,375  B. Deposits in transit          Sept 29 $ 4,500        Sept 30 1,525      6,025 

  34,400  C. Outstanding checks:           988 Aug 31 $ 2,200        1281 Sept 26 675        1285 Sept 27 850        1289 Sept 29 2,500        1292 Sept 30 7,255  (11,450)     20,950  D. Customer note collected by the bank:   (3,000) E. Error: Check #1282, written on Sept. 26 for $270, was erroneously

charged by bank as $720; bank was notified Oct. 2  

     450  F. Balance per books   $20,400 

First Pages

lou6920x_ch06_220-268.indd 260 03/06/20 02:53 PM

260 Part Two The Financial Statement Audit

Required: Assume these facts: On October 11, the auditor received a cutoff bank statement dated October 7. The September 30 deposit in transit; the outstanding checks 1281, 1285, 1289, and 1292; and the correction of the bank error regarding check 1282 appeared on the cutoff bank statement. a. For each of the preceding lettered items A–F, select one or more of the following pro-

cedures 1–10 that you believe the auditor should perform to obtain evidence about the item. These procedures may be selected once, more than once, or not at all. Be prepared to explain the reasons for your choices. 1. Trace to cash receipts journal. 2. Trace to cash disbursements journal. 3. Compare to the September 30 general ledger. 4. Confirm directly with the bank. 5. Inspect bank credit memo. 6. Inspect bank debit memo. 7. Ascertain reason for unusual delay, if any. 8. Inspect supporting documents for reconciling items that do not appear on the cutoff

bank statement. 9. Trace items on the bank reconciliation to the cutoff bank statement. 10. Trace items on the cutoff bank statement to the bank reconciliation.

b. Auditors ordinarily foot a client-prepared bank reconciliation. If the auditors had per- formed this recalculation on the preceding bank reconciliation, what might they have found? Be prepared to discuss any findings.

(AICPA adapted)

6.49 Manipulated Bank Reconciliation. You can use the computer-based Electronic Workpa- pers on the textbook website to prepare the bank reconciliation solution.

Caulco Inc. is the audit client. The February bank statement is shown in Exhibit 6.3 in the text. You have obtained the client-prepared bank reconciliation as of February 28 (see the following).

Required: Check 2231 was the first check written in February. All earlier checks cleared the bank, some during January and some during February. Assume that the only February-dated canceled checks returned in the March bank statement are 2239 and 2240 showing the amounts listed in the February bank reconciliation. They cleared the bank on March 3 and March 2, respectively. The first deposit on the March bank statement was $1,097.69 credited on March 3. Assume also that all checks entered in Caulco’s cash disbursements journal through February 29 have either cleared the bank or are listed as outstanding checks in the February bank reconciliation.

Determine whether any errors exist in the following bank reconciliation. If errors exist, prepare a corrected reconciliation and explain the problem.

LO 6-6

CAULCO INC. Bank Reconciliation

February 28

Balance per bank     $7,374.93

Deposit in transit     1,097.69

Outstanding Checks      

Number Date Payee Amount  

2239 Feb 26 Alpha Supply 500.00  

2240 Feb 28 L.C. Stateman 254.37  

Total outstanding             (754.37) General ledger balance Feb. 28     $7,718.25 

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 261

lou6920x_ch06_220-268.indd 261 03/06/20 02:53 PM

6.50 Investigating a Fraud. Suppose you are auditing cash disbursements and discover several payments to a company you are unfamiliar with and cannot find information about this com- pany on the Internet or in the local telephone directory. The invoices from this company have numbers very close to each other in the sequence, there is no phone number on the invoice, and each bill is for a dollar amount just under the amount that would require additional approvals before payment. Based on this information, you now suspect this may be a fraud.

Required: Based on your suspicions, how would you change the audit procedures you would perform, and how might you change the evidence you gather?

6.51 Fraud in Purchasing. Consider the following scenario: Adam worked for the local hardware store as an outside sales representative. His job was to visit local companies and contractors in an attempt to identify their needs for tools and mate- rials and provide a bid to supply those items. When a local contractor accepted a new job, Adam would get its material requirements, come back to the store, and prepare and submit a proposal for the items. After some initial success with Big Builder, a large contractor, the number of jobs awarded to Adam had decreased dramatically.

One day, Adam was back at the store after losing a bid to Big Builder when he noticed someone in the store purchasing the exact items and quantities that were in the specification for that bid. The combination of items was unusual, and it would be an unlikely coincidence for someone else to want such a combination in that exact quantity. The customer paid the retail price for the merchandise and left.

Adam decided to contact Big Builder, but he knew he could not do so and make any accusations. Adam set up a meeting with the president of Big Builder and inquired as to how Adam might “increase his business and better meet the needs of Big Builder.” Eventually, the recent bid entered the conversation. Adam showed his copy of the bid to the president. The president retrieved a copy of the purchase order and recognized that the amount on it was more than the bid Adam had submitted. The company that submitted the bid was K. A. Supplies Inc. Adam had never heard of K. A. Supplies and noted its address on the purchase order. The president of Big Builder promised to investigate the bidding process.

Adam drove to the address of K. A. Supplies and found a packaging and shipping store at that address. Furthermore, Adam went to the county courthouse and inquired about K. A. Supplies. The company was listed in the county records, and one of the purchasing agents for Big Builder was listed as an officer.

Required: a. Given the information that Adam knows, what do you believe is occurring at Big Builder? b. What other information would you want to obtain, and how might you retrieve that

information? c. What controls might be instituted at Big Builder to prevent improprieties in the bidding

and purchasing process?

6.52 The Perfect Crime? Consider the following story of an actual embezzlement: This was the ingenious embezzler’s scheme: (a) He hired a print shop to print a private stock of Ajax Company checks in the company’s numerical sequence. (b) In his job as an accounts payable clerk at Ajax, he intercepted legitimate checks written by the accounts payable department and signed by the Ajax treasurer and destroyed them. (c) He substituted the same numbered check from the private stock, payable to himself in the same amount as the legitimate check, and he “signed” it with a rubber stamp that looked enough like the Ajax Company treasurer’s signature to fool the paying bank. (d) He deposited the money in his own bank account. The bank statement reconciler (a different person) was able to agree the check numbers and amounts listed in the cleared items in the bank statement to the recorded cash disbursement (check number and amount) and thus did not notice the embez- zler’s scheme. The embezzler was able to process the vendor’s “past due” notice and the next month’s statement with complete documentation, enabling the Ajax treasurer to sign another check the next month paying both the past due balance and current charges. The embezzler was careful to scatter the double-expense payments among numerous accounts (telephone, office supplies, inventory, etc.) so the double-paid expenses did not distort any accounts very much. As time passed, the embezzler was able to recommend budget amounts

LO 6-7

LO 6-5

LO 6-1

First Pages

lou6920x_ch06_220-268.indd 262 03/06/20 02:53 PM

262 Part Two The Financial Statement Audit

that allowed a large enough budget so his double-paid expenses in various categories did not often pop up as large variances from the budget.

Required: List and explain the ways and means you believe someone might detect the embezzlement. Think first about the ordinary everyday control activities. Then think about extensive detec- tion efforts assuming a tip or indication of a possible fraud has been received. Is this a “perfect crime”?

6.53 Select Effective Extended Procedures. The following are some “suspicions.” You have been requested to select some effective extended procedures designed to confirm or deny the suspicions.

Required: Write the suggested procedures for each case in definite terms so another person can know what to do. a. The custodian of the petty cash fund may be removing cash on Friday afternoon to pay

for weekend activities. b. A manager noticed that eight new vendors were added to the purchasing department’s

approved vendor list after the assistant purchasing agent was promoted to chief agent three weeks ago. She suspects all or some of them might be fictitious companies set up by the new chief purchasing agent.

c. The payroll supervisor may be stealing unclaimed paychecks of employees who resigned and did not collect their last check.

d. Although no customers have complained, cash collections on accounts receivable have decreased, and the counter clerks may have stolen customers’ payments.

e. The cashier may have “borrowed” cash receipts, covering this by holding each day’s deposit until cash from the next day(s) collection is enough to make up the shortage from an earlier day and then sending the deposit to the bank.

6.54 Forensic Accounting: Assurance Engagement 1: Expenditure Analysis. Expenditure analysis is used when fraud has been discovered or strongly suspected and the information to calculate a suspect’s income and expenditures can be obtained (e.g., asset and liability records, bank accounts). Expenditure analysis consists of establishing the suspect’s known expenditures for all purposes for the relevant period, subtracting all known sources of funds (e.g., wages, gifts, inheritances, bank balances), and identifying the difference as “expendi- tures financed by unknown sources of income.”

The law firm of Gleckel and Morris has hired you. The lawyers have been retained by Blade Manufacturing Company in a case involving a suspected kickback by a purchasing employee, E. J. Cunningham. Cunningham is suspected of taking kickbacks from Mason Varner, a salesman for Tanco Metals. Cunningham has denied the charges, but Lanier Gleckel, the lawyer in charge of the case, is convinced the kickbacks have occurred.

Gleckel filed a civil action and subpoenaed Cunningham’s financial records, including last year’s bank statements. The beginning bank balance January 1 was $3,463, and the end- ing bank balance December 31 was $2,050. Over the intervening 12 months, Cunningham’s per-month gross salary was $3,600 with a net of $2,950. His house payments were $1,377 per month. In addition, he paid $2,361 per month on a new Mercedes 500 SEL and a total of $9,444 last year toward a new Nissan Maxima (including $5,000 down payment). He also purchased new state-of-the-art audio and video equipment for $18,763 with no down pay- ment and made total payments of $5,532 on the equipment last year. A reasonable estimate of his household expenses during the period is $900 per month ($400 for food, $200 for utilities, and $300 for other items).

Required: Using expenditure analysis, calculate the amount of income, if any, from “unknown sources.”

6.55 Forensic Accounting: Assurance Engagement 2: Net Worth Analysis. You can use the computer-based Electronic Workpapers on the textbook website to prepare the net worth analysis required in this problem.

Net worth analysis is performed when fraud has been discovered or is strongly suspected and the information to calculate a suspect’s net worth can be obtained (e.g., asset and liabil- ity records, bank accounts). The procedure used is to calculate the person’s change in net

LO 6-7

LO 6-7

LO 6-7

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 263

lou6920x_ch06_220-268.indd 263 03/06/20 02:53 PM

worth (excluding changes in market values of assets) and to identify the known sources of funds to finance the changes. Any difference between the change in net worth and the known sources of funds is called funds from unknown sources, which might include ill-gotten gains.

Nero has worked for Bonne Consulting Group (BCG) as the executive secretary for administration for nearly 10 years. Her dedication has earned her a reputation as an out- standing employee and has resulted in increasing responsibilities. Nero is also a suspect in a fraud.

During Nero’s first five years of employment, BCG subcontracted all of its feasibility and marketing studies through Jackson & Company. This relationship was terminated because Jackson & Company merged with a larger, more expensive consulting group. At the time of termination, Nero and her supervisor were forced to select a new firm to conduct BCG’s market research. However, Nero never informed the accounting department that the Jackson & Company account had been closed.

Because her supervisor allowed Nero to sign the payment voucher for services rendered, she was able to continue to process checks made payable to Jackson’s account. Nero was trusted to be the only signature required to authorize payments less than $10,000. The accounting department continued to write the checks and Nero took responsibility for deliv- ering the checks. She opened a bank account in a nearby city under the name of Jackson & Company, where she made the deposits.

Nero’s financial records have been obtained by subpoena. The following table provides a summary of the data obtained from her records:

Nero’s Subpoenaed Records

Year 1 Year 2 Year 3 Assets:  Residence $100,000 $100,000 $100,000  Stocks and bonds 30,000 30,000 42,000  Automobiles 20,000 20,000 40,000  Certificate of deposit 50,000 50,000 50,000  Cash 6,000 12,000 14,000 Liabilities:  Mortgage balance 90,000 50,000 —  Auto loan 10,000 — — Income:  Salary 34,000 36,000  Other   6,000 6,000 Expenses:  Scheduled mortgage payments 6,000 6,000  Auto loan payments 4,800 —  Other living expenses 20,000 22,000

Required: You have been hired to estimate the amount of loss by estimating Nero’s “funds from unknown sources” that financed her comfortable life style. (Hint: Set up a working paper like the following:)

  End Year 1 End Year 2 End Year 3 Assets (list)       Liabilities (list)       Net worth (difference)       Change in net worth       Add total expenses       = Change plus expenses       Subtract known income       = Funds from unknown sources      

First Pages

lou6920x_ch06_220-268.indd 264 03/06/20 02:53 PM

264 Part Two The Financial Statement Audit

6.56 Employee Embezzlement via Cash Receipts and Payment of Personal Expenses. Assume you have received a message from an informant regarding the following case. Your assignment is to write the “audit approach” portion of the case. a. Write a brief explanation of desirable controls, missing controls, and especially the kinds

of “deviations” that might arise from the situation described in the case. (Refer to con- trols explained in Chapter 5.)

b. Develop some procedures for obtaining evidence about existing controls, especially pro- cedures that could discover deviations from controls. If there are no controls to test, then there are no procedures to perform. Then just move on to part (c). (Refer to test of con- trols procedures explained in this chapter.) An audit “procedure” should instruct some- one about the source(s) of evidence to obtain and the work to perform.

c. Write some procedures for gathering evidence in this case. d. Write a short statement about the discovery you expect to accomplish with your procedures.

The Extra Bank Account The Ourtown Independent School District, like all others, had formal, often bureaucratic, procedures regarding school board approval of cash disbursements. To get around the rules and to make possible timely payment of selected bills, the superintendent of schools had a school bank account that was used in the manner of a petty cash fund. The board knew about it and had given blanket approval in advance for its use to make timely payment of minor school expenses. The board, however, never reviewed the activity in this account. The business manager had sole responsibility for the account subject to the annual audit. The account received money from transfers from other school accounts and from deposit of cafeteria cash receipts. The superintendent did not like to be bothered with details and often signed blank checks so the business manager would not need to obtain a signature all the time. The business manager sometimes paid her personal American Express credit card bills, charged personal items to the school’s Visa account, and pocketed some cafeteria cash receipts before deposit.

An informant called the state education audit agency and told the story that this business manager had used school funds to buy hosiery. When told of this story, the superintendent told the auditor to place no credibility in the informant, who was “out to get us.” The busi- ness manager had, in fact, used the account to write unauthorized checks to “cash,” put her own American Express bills in the school files (the school district had a Visa card, not American Express), and signed on the school card for gasoline and auto repairs during peri- ods of vacation and summer when school was not in session. (As for the hosiery, she pur- chased $700 worth with school funds one year.) The superintendent was genuinely unaware of the misuse of funds. The business manager had been employed for six years, was trusted, and embezzled an estimated $25,000.

6.57 Electronic Confirmations. As stated in the text, most banks require auditors to use elec- tronic audit confirmation requests, and as a result, nearly all audit firms now use them. At present, Confirmation is the market-leading technological platform for electronic audit con- firmations. To obtain a greater understanding of the process used to confirm accounts with electronic confirmation requests, watch the introduction video to Confirmation’s process at https://vimeo.com/301903513.

6.58 Case of the Missing Petty Cash The case below tells the actual story of a cash embezzle- ment scheme. The case has two major parts: (1) problem and (2) audit approach. For the case, please consider how the auditor may have discovered the cash embezzlement scheme.

Problem The petty cash custodian (1) brought postage receipts from home and paid them from the fund, (2) persuaded the supervisor to sign blank authorization slips the custodian could use when the supervisor was away and used them to pay for fictitious meals and minor supplies, and (3) took cash to get through the weekend, replacing it the next week. Postage receipts were from a distant post office station the company did not use. The blank authorization slips were dated on days the supervisor was absent. The fund was cash short during the weekend and for a few days the following week. The fund was small ($500), but the custo- dian replenished it about every two working days, stealing about $50 each time. With about 260 working days per year and 130 reimbursements, the custodian was stealing about $6,500

LO 6-1

LO 6-6

LO 6-2

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 265

lou6920x_ch06_220-268.indd 265 03/06/20 02:53 PM

per year. The custodian was looking forward to getting promoted to general cashier and big- ger and better things!

Audit Approach The audit team should discuss petty cash procedures with the custodian and supervisor, especially those that relate to situations in which the custodian or supervisor is not available to provide needed petty cash. Next, a sample of petty cash reimbursement check copies with receipts and authorization slips attached should be studied for evidence of authorization and validity. On Friday, an audit team member should count the petty cash and receipts to see that they total $500. Then the fund should be recounted later in the afternoon. (The second count should be a surprise.) The custodian or supervisor should be present at all times so that the auditor will not be accused of theft.

Required: Based on the audit approach discussed, how would the auditor have caught this fraudulent scheme?

6.59 The Laundry Money Skim The case below tells the actual story of a cash embezzlement scheme. The case has two major parts: (1) problem and (2) audit approach. For the case, please consider how the auditor may have discovered the cash embezzlement scheme.

Problem Albert owned and operated 40 coin laundries around town. As the business grew, he could no longer visit each one, empty the cash boxes, and deposit the receipts. Each location grossed about $140 to $160 per day, operating 365 days per year—gross receipts of about $2 million per year. Each of four part-time employees visited 10 locations, collecting the cash boxes and delivering them to Albert’s office where he would count the coins and currency (from the change machine) and prepare a bank deposit. One of the employees skimmed $5 to $10 from each location visited each day.

The daily theft does not seem like much, but at an average of $7.50 per day from each of 10 locations, totaled about $27,000 per year. If all four of the employees had stolen the same amount, the loss could have been over $100,000 per year.

Audit Approach Controls over the part-time employees were nonexistent. There was no overt or covert sur- prise observation and no times when two people went to collect cash (thereby needing to agree, in collusion, to steal). There was no rotation of locations or other indications to the employees that Albert was concerned about control. With no controls, there is no test of control activities. Obviously, however, “thinking like a crook” leads to the conclusion that the employees could simply pocket money.

Assuming that some employees are honest, periodically rotating the stores assigned to each employee and performing revenue comparisons (analytical procedures) on a store-by- store basis may be helpful. If revenues consistently decline for stores assigned to a specific employee, further investigation may be warranted.

Required: Based on the audit approach discussed, how might an auditor devise a procedure to catch this fraudulent scheme?

LO 6-2

Apollo Shoes Audit of the Cash Account You are a recently promoted senior (in charge) auditor for Anderson, Olds, and Water- shed and have been assigned to the engagement team of a new audit client, Apollo Shoes Inc. You have been asked to perform certain procedures for the audit of the cash account. A detailed audit program for performing the audit of cash, as well as bank reconciliations and supporting documentation, can be found in Connect.

First Pages

lou6920x_ch06_220-268.indd 266 03/06/20 02:53 PM

Appendix 6A

Internal Control Questionnaires

EXHIBIT 6A.1 Internal Control Questionnaire—Cash Receipts Processing

  Yes No Comments

1. Are cash receipts deposited daily, intact, and without delay?      

2. Does someone other than the cashier or accounts receivable bookkeeper take the deposits to the bank?      

3. Are the duties of the cashier entirely separate from record keeping for notes and accounts receivable? From general ledger record keeping?

4. Is the cashier denied access to receivables records or monthly statements?      

5. Is a bank reconciliation performed monthly by someone who does not have cash custody or record-keeping responsibility?

6. Are the cash receipts journal entries compared to the remittance lists and deposit slips regularly?      

7. Does the person who opens the mail make a list of cash received (a remittance list)?      

8. Are currency receipts controlled by mechanical devices? Are machine totals checked by the internal auditor?

9. Are prenumbered cash receipts listings used? Is the numerical sequence checked for missing documents?      

10. Does the accounting manual contain instructions for dating cash receipts entries the same day as the date of receipt?

11. Is a duplicate deposit slip retained by someone other than the employee preparing the deposit?      

12. Is the remittance list compared to the deposit by someone other than the cashier?      

13. Does the accounting manual contain instructions for classifying cash receipts credits?      

14. Does someone reconcile the accounts receivable subsidiary to the control account regularly (to determine whether all entries were made to customers’ accounts)?

15. Is the duty of processing credit card payments separated from the process of processing voids?      

16. If the company processes credit cards, does it maintain documentation that it is PCI (Payment Card Industry) compliant?

EXHIBIT 6A.2 Internal Control Questionnaire—Cash Disbursements Processing

  Yes No Comments

1. Are persons with cash custody or check-signing authority denied access to accounting journals, ledgers, and bank reconciliations?

2. Is access to blank checks denied to unauthorized persons?      

3. Are all disbursements except petty cash made by check?      

4. Are check signers prohibited from drawing checks to cash?      

5. Is signing blank checks prohibited?      

6. Are voided checks mutilated and retained for inspection?      

7. Are invoices, receiving reports, and purchase orders reviewed by the check signer?      

8. Are the supporting documents stamped “paid” (to prevent duplicate payment) before being returned to accounts payable for filing?

9. Are checks mailed directly by the signer and not returned to the accounts payable department for mailing?

(continued)

First Pages

Chapter 6 Employee Fraud and the Audit of Cash 267

lou6920x_ch06_220-268.indd 267 03/06/20 02:53 PM

  Yes No Comments

10. Do checks require two signatures? Is there dual control over machine signature plates?      

11. Are blank checks prenumbered and the numerical sequence checked for missing documents?      

12. Are checks dated in the cash disbursements journal with the date of the check?      

13. Are bank accounts reconciled by personnel independent of cash custody or record keeping?      

14. Do internal auditors periodically conduct a surprise audit of bank reconciliations?      

15. Do the chart of accounts and accounting manual give instructions for determining debit classifications of disbursements not charged to accounts payable?

16. Is the distribution of charges checked periodically by an official? Is the budget used to check on gross misclassification errors?

17. Are special disbursements (e.g., payroll and dividends) made from separate bank accounts?      

18. Is the bank reconciliation reviewed by an accounting official with no conflicting cash receipts, cash disbursements, or record-keeping responsibilities?

19. Are electronic banking access rights maintained on a timely basis and do not contain employees who have left the company?

20. Is dual authorization required to process electronic payments?      

21. For accounts with highly significant amounts of cash, is a third individual required to process electronic transfers or payments?

EXHIBIT 6A.2 (concluded)

First Pages

lou6920x_ch06_220-268.indd 268 03/06/20 02:53 PM

Audit Plans

Appendix 6B

EXHIBIT 6B.2 Audit Plan—Selected Substantive Procedures—Cash

EXHIBIT 6B.1 Audit Plan—Tests of Controls—Cash Receipts

  Documentation

Reference Performed By

1. Inquire of management concerning employees who a. Receive remittances from customers. b. Record payments in accounts payable. c. Prepare and deliver deposits to the bank.

2. Observe the opening of the mail and ensure that a. Two employees are opening the mail. b. Checks are restrictively endorsed. c. A listing of all checks is being prepared.

3. Observe the flow of checks and remittance advices and ensure that a. Checks are delivered directly to the cashier. b. Remittance advices are delivered to the accounting department.

4. Examine reconciliations of cash listings, accounts receivable payments, and bank deposits.

5. Examine reconciliations of bank statements for a. Initials of proper review. b. Investigation of all outstanding items reviewed for propriety.

6. Inspect evidence of payment card industry (PCI) compliance for acceptance of credit card payments.

  Documentation

Reference Performed By

1. Obtain confirmations from banks (standard bank confirmation).

2. Obtain reconciliations of all bank accounts. a. Trace the bank balance on the reconciliation to the bank confirmation. b. Trace the reconciled book balance to the general ledger. c. Recompute the bank reconciliation for mathematical accuracy.

3. Examine the bank confirmation for evidence of loans and collateral.

4. Inquire of the client to request a cutoff bank statement for each account, to be mailed directly to the audit firm.

a. Vouch deposits in transit on the reconciliation to the bank cutoff statement. b. Trace the outstanding checks that have cleared the cutoff statement back to the list of

outstanding checks on the bank reconciliation.

5. Prepare a schedule of interbank transfers for a period of 10 business days before and after the year-end date. Document dates of book entry transfer and correspondence with bank entries and reconciliation items, if any.

6. Count cash funds in the presence of a client representative.

7. Obtain management representations concerning compensating balance agreements.

First Pages

269

lou6920x_ch07_269-327.indd 269 03/17/20 03:59 PM

LEARNING OBJECTIVES This is the first of four “cycle chapters” in which you will go through the process of evaluating the audit risks present in a specific cycle and learning how to apply the auditing standards to the identified risks. First, we give a general overview of the typical activities in the revenue and collection cycle. Next, we discuss the significant accounts and relevant assertions in the revenue cycle. After that, we discuss the risk of material misstatement in the revenue

cycle. Many recent frauds have consisted of improper revenue recognition, which also results in an overstatement of assets, usually receivables. Next, we examine the appropriate design of controls normally included in the cycle and how the auditor evaluates the operating effectiveness of these controls. Finally, we discuss substantive procedures, including common analytical procedures. You will note that accounts receivable confirmations are a central part of accounts receivable auditing and are required by GAAS. You will see examples of confirmations and

Thomas Paine, English-American political philosopher and revolutionary (1737–1809)

What at first was plunder, assumed the softer name of revenue.

Revenue and Collection Cycle

C H A P T E R 7

Professional Standards References

Topic AU-C/ISA Section

PCAOB Reference

Audit Documentation 230 AS 1215

Consideration of Fraud in a Financial Statement Audit 240 AS 2401

Audit Planning 300 AS 2101

Identifying and Assessing the Risks of Material Misstatement 315 AS 2110

The Auditor’s Responses to Risks of Material Misstatement 330 AS 2301

Audit Evidence 500 AS 1105

External Confirmations 505 AS 2310

Substantive Analytical Procedures 520 AS 2305

Auditing Accounting Estimates 540 AS 2501

First Pages

270 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 270 03/17/20 03:59 PM

INTRODUCTION In January 2018, Carillion was the second largest construction firm in the United Kingdom (UK). Less than a month later, the name Carillion was associated far less with construc- tion and much more with being the company whose fraud led to calls in the UK to break up the Big Four accounting firms for failing to report Carillion’s “accounting tricks,” as was discussed in a May 2018 Parliamentary report:

“Richard Adam, as Finance Director between 2007 and 2016, was the architect of Car- illion’s aggressive accounting policies. He, more than anyone else, would have been aware of the unsustainability of the company’s approach. His voluntary departure at the end of 2016 was, for him, perfectly timed. He then sold all his Carillion shares for ₤776,000 just before the wheels began very publicly coming off and their value plummeted. These were the actions of a man who knew exactly where the company was heading once it was no longer propped up by his accounting tricks.”*

In the construction industry, a common method of estimating revenues is to recog- nize the percentage of revenue earned to date based on the percentage of expected costs already incurred. Carillion used this type of accounting estimate as the primary tool to manipulate its earnings. Specifically, by underestimating the total expected costs, the company was able to materially overstate revenues, and show profits when losses existed. The company accomplished this by using management estimates of costs and ignoring independent peer reviews which indicated far higher expected costs and project losses, which should have been recognized immediately. One large project resulted in the recog- nition of an expected profit margin of 4.9%, when independent estimates indicated a loss of 12.7%.

In the U.S., the estimation of revenue is often a significant audit risk under the accounting standard for revenue from contracts with customers (under ASC 606), which will be discussed in detail in this chapter. High degrees of estimation uncertainty and the need for experts in estimating revenue almost always results in the occurrence of contract revenue being evaluated as both a fraud risk and a significant risk of material misstatement. In fact, the PCAOB has placed special emphasis on audits of estimates and the use of specialists in standards updates adopted in December 2018 for audits of fiscal years ending after December 15, 2020. These new standards will be covered in greater detail in Chapter 10, but as the Carillion example shows, are equally relevant in auditing revenue.

House of Commons, Business, Energy and Industrial Strategy and Work and Pensions Committees, May 16, 2018.

a discussion of procedures auditors perform when sending those confirmations. We conclude with an application of what you have learned to a specific audit issue within the revenue and collection cycle.

Your objectives are to be able to:

LO 7-1 Describe the revenue and collection cycle, including typical source documents.

LO 7-2 Identify significant accounts and relevant assertions related to the revenue and collection cycle.

LO 7-3 Discuss the risk of material misstatement in the revenue and collection cycle, with a specific focus on improper revenue recognition.

LO 7-4 Identify important internal control activities present in a properly designed system to mitigate the risk of material misstatements for each relevant assertion in the revenue and collection cycle.

LO 7-5 Give examples of tests of controls to test the operating effectiveness of internal controls in the revenue and collection cycle.

LO 7-6 Give examples of substantive procedures in the revenue and collection cycle and relate them to assertions about significant account balances at the end of the period.

LO 7-7 Apply your knowledge to perform audit pro- cedures in the revenue and collection cycle and evaluate the findings of your tests.

First Pages

Chapter 7 Revenue and Collection Cycle 271

lou6920x_ch07_269-327.indd 271 03/17/20 03:59 PM

REVENUE AND COLLECTION CYCLE: TYPICAL ACTIVITIES There is no such thing as a typical revenue and collection cycle. Companies come in all shapes and sizes, and the actual revenue generation process can vary greatly among indus- tries. For example, banks and other financial services firms do not sell tangible goods. Restaurants typically do not grant credit to customers. Further, many companies accept all payments electronically. For the purposes of our discussions in the four cycle chapters, we assume a typical manufacturing company that sells products of some kind to customers— often other businesses—on credit. The basic activities in the revenue and collection cycle for a company like this are (1) receiving and processing customer orders, including credit approval; (2) delivering goods and services to customers; (3) billing customers and account- ing for accounts receivable; and (4) collecting and depositing cash received from custom- ers. See Exhibit 7.1 for the activities and transactions involved in a revenue and collection cycle. Note that collecting and depositing cash received from customers was covered in Chapter 6. As you follow the discussion in the text, you can track some of the highlighted elements of the cycle. The numbers listed next to the headings correspond to the numbers in Exhibit 7.1. We will discuss how different companies may vary from this “typical” cycle.

LO 7-1 Describe the revenue and collection cycle, including typical source documents.

EXHIBIT 7.1 Revenue and Collection Cycle

Cash Custody

Credit Files, Reports

Sales Authorization

Physical Custody

Cash Reconciliation

Cash Receipts Recording

Accounts Receivable Recording

Start Here

Customer Orders

Collections

Credit Granting

Bill Customers

Warehousing Shipping and

Delivery

Monthly Statements

Bank Statements

Shipping Docu- ments (Copy)

Shipping Documents

(Copy)

Customer’s Purchase Orders, Contracts

Customer Order

Sales Invoice (Copy)

Sales Invoice

To Customer

To Customer

To Customer

Deposit Cash in Bank

Customer Payments

(Cash Receipts)

Shipping Documents

Shipping Document

Transaction File

Sales Revenue

Account(s) File

Accounts Receivable

Master File

Cash Receipts

Transaction File

Cash Balances (Account)

File

Perpetual Inventory Records

Accounts/Records

Cash in Bank Cash Receipts Accounts Receivable Allowance for Doubtful Accounts, Write-O�s Bad Debt Expense Sales Revenue Sales Returns, Allowances, Discounts Perpetual Inventory Records, Shipping Records

4*

3

2

1

First Pages

272 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 272 03/17/20 03:59 PM

Giant retailer Target Corp. had its customers’ credit card and debit card data breached over the Black Friday weekend in 2013. The theft was not limited to any one location of the company’s business and included stores nationally. Target estimates that approximately 42  million customers had their personal credit or debit card informa- tion stolen. In response to a class-action lawsuit, Target agreed to pay $10 million to the hacking victims.

Note how important it is to protect information received during the revenue cycle.

Source: “Target Offers $10 Million Settlement in Data Breach Lawsuit,” http:// www.npr.org/sections/thetwo-way/2015/03/19/394039055/target-offers- 10-million-settlement-in-data-breach-lawsuit, March 19, 2015.

Missing the Target?AUDITING INSIGHT

Receiving and Processing Customer Orders, Including Credit Granting 1 Customers initiate sales orders in a variety of ways. They can mail purchase orders, call or fax orders, e-mail orders, place orders on a website, or simply come to the company’s place of business and buy their goods. In some cases, companies are directly linked to production schedules in their customers’ computer files (via electronic data interchange, EDI), so they can ship goods automatically as the customer needs them. Electronic or Internet sales orders require special software controls that protect against unauthorized orders and protect customer information.

If a company sells its goods or services for something other than cash, it is important that someone authorize credit sales to ensure that the customer will be able to pay for the goods or services. Because various authorizations are embedded in a computerized sys- tem, access to the customer master file for additions, deletions, and other changes must be limited to responsible people. If these controls fail, orders might be processed for ficti- tious customers, credit might be approved for bad credit risks, and shipping documents might be created for goods that do not exist in the inventory.

Although many companies directly grant credit to customers, others rely on third- party credit, such as accepting credit cards from Visa or American Express. When a retailer accepts a third-party credit card, the authorization function is performed elec- tronically, and the risk of nonpayment generally shifts to the third party in exchange for a processing fee. Sales such as this are considered cash sales to the retailer. Although authorization controls are minimized in this situation, data security becomes a significant issue. Retailers who accept third-party credit cards must maintain compliance with Pay- ment Card Industry Data Security Standard requirements (PCI Dss). When companies fail to adequately protect information, they can become liable for losses to customers, as discussed in the following Auditing Insight.

Customer orders, shipping documents, and invoices should be in prenumbered sequence so the system can check the sequence and determine whether any transactions have not been recorded (completeness assertion) or have been duplicated (occurrence assertion). Prenumbered documents are an example of an internal control (i.e., control activity).

Another authorization in the system is the price list master file. This file contains the product unit prices for billing customers. Persons who have power to alter this file have the power to authorize price changes and customer billings.

Delivering Goods and Services to Customers 2 Physical custody of inventory goods starts in the storeroom or warehouse where inven- tory is kept. Custody is transferred to the shipping department upon the authorization of the shipping order that permits the inventory clerk to release goods to the shipping department. Proper authorization is important: Employees performing each of these steps should sign transfer documents so they are held accountable. This control procedure

First Pages

Chapter 7 Revenue and Collection Cycle 273

lou6920x_ch07_269-327.indd 273 03/17/20 03:59 PM

prevents employees from misappropriating the goods or shipping product to friends with- out billing them. A bill of lading is a form that the carrier signs to verify the goods are shipped. A packing slip, which describes the goods being shipped, and the quantity of goods shipped, is often included with the shipment.

Billing Customers and Accounting for Accounts Receivable 3 When a delivery or shipment is complete, the transaction is completed by filing a ship- ment record and preparing a final invoice for the customer (which is recorded as sales revenue and accounts receivable). A sales invoice is the bill sent to the customer that indi- cates the amount due and the payment terms. Any person who has the power to alter these transactions or to change the invoice before it is mailed to the customer should not have any custody or recording responsibilities.

Access to accounts receivable records implies the power to alter them directly or enter transactions (e.g., returns and allowance credits, write-offs) to alter them. Person- nel with this power have a combination of authorization and recording responsibility. Another important facet of control is physical protection of the files. If the files are lost or destroyed, it is unlikely the accounts will be collected, so the records are truly assets. Limited access, frequent backup, and disaster recovery plans are important controls to ensure the availability of information. Moreover, customer and employee information must be protected.

The most frequent reconciliation is the comparison of the sum of customers’ unpaid balances (customer database or subsidiary ledger kept in the accounts receivable depart- ment) with the accounts receivable control account total (maintained in corporate accounting). This reconciliation is accomplished by preparing a trial balance of the accounts receivable subsidiary ledger, adding it, and comparing its total with the control account balance in the general ledger. Internal auditors can perform periodic reviews of the customers’ balances by sending confirmations to the customers.

System Generated Reports and Data Files in the Revenue and Collection Cycle Because revenue and cash receipts transactions are generally processed using electronic systems, management is able to generate reports and data sets that can provide important information not just for management, but also for audits. Exhibit 7.2 represents a typical system for processing customer orders and accounts receivable. In this section, we dis- cuss the system-generated reports that are typically produced in this system that will be used to evaluate the risk of material misstatement and perform audit tests.

Pending Order and Back Order Master File Sales transactions that were initiated but are not yet completed, and thus not yet recorded as sales, are kept in the pending order master file. A back order master file contains orders for products that are out of stock currently. Long-standing orders may represent unfilled sales to a customer, which may result in low customer satisfaction and loss of potential revenue. They also may represent shipments that actually were made but for some reason were not recorded in the sales journal or could not be matched to a customer order. Typically, a pending or back order report will be reviewed by the company at least weekly, and exceptions should be reviewed. Auditors will review items in the pending orders file for evidence of the completeness of recorded sales and accounts receivable.

Customer Master File The system may make automatic credit checks, but up-to-date maintenance of customer information is very important. Credit checks based on dated or incomplete information are not good credit checks. A sample of the customer master file can be tested for cur- rent status, including up-to-date credit limit information. Alternatively, the company’s data change controls can be reviewed to ensure the files are accurately maintained.

First Pages

274 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 274 03/17/20 03:59 PM

EXHIBIT 7.2 Sales and Accounts Receivable Processing

Sales Order

Invoices Back Order Report

Daily Sales Report

Packing Slip

Sales Analysis A/R Listing and Aging

Monthly Customer Statements

Customer Purchase Order

Inventory Master (Subsidiary)

A/R Master (Subsidiary)

Price List Master File

Pending Order Master

Sales Detail (Journal)

General Ledger Master

Order Entry

Shipping

Packing Slip

Stockroom

Terminal Logs

Terminal Logs

Online sales processing

• Authorized terminal ID • Sales order screen • Automatic credit check • Inventory-on-hand check • Immediate update of all databases • Online status query

Marketing Management

Credit Management• Automatic transfer from pending

order to A/R and G/L master files

Credit Check Files

Back Order Master

The company should regularly review credit limits to ensure appropriate limits are placed on customers, and auditors will often perform exception testing on credit checks. (See Application in the Field example later in this chapter.)

Price List Master File The system may produce customer invoices automatically, but if the price list master file is incorrect, the billings will be incorrect. The pricing file can be compared to an official price source for accuracy. The company should perform this comparison every time it changes its prices. Remember that prices typically change over the year. Therefore, when vouching invoices and sales journal entries to price lists, the auditor must be sure to have the price list that was in effect at the time of the customer’s order.

Sales Detail (Journal) File The detailed sales entries, which should correspond with the issuance of invoices to cus- tomers and should include the shipping references and dates, should be in the sales detail file. The file can be scanned using computer-assisted auditing techniques (CAATs) check- ing for entries without shipping references (fictitious sales?) and for matching record- ing dates with shipment dates (sales recorded before shipment?). The company should always compare daily credit sales totals in the sales journal to the total debits posted to accounts receivable.

Sales Analysis Reports A variety of sales analysis reports can be produced. Sales that are classified by product lines provide required information for the business segment disclosures. Sales classified by sales employee or region can show unusually high or low volume that might bear fur- ther investigation if an error or fraud is suspected. Analytical procedures, such as trend analysis or comparison among sales units, can be a great help to the auditor as illustrated by the following Auditing Insight.

First Pages

Chapter 7 Revenue and Collection Cycle 275

lou6920x_ch07_269-327.indd 275 03/17/20 03:59 PM

Accounts Receivable Listing and Aging The accounts receivable listing of customers’ balances contains the actual amounts spe- cifically identified with individual customers. If the control account total is higher than the sum of the customers’ balances (trial balance), it will have to be adjusted after the difference is thoroughly investigated. Remember, a receivable amount that cannot be identified with a customer cannot be collected! The trial balance is used as the starting point for selecting accounts for confirmation. The accounts receivable aging informa- tion is used in connection with assessing the allowance for doubtful accounts. Audi- tors must ensure that the calculation of the aging is accurate to verify that customer accounts are not listed as current when they are in fact past due. An example of this listing, also called an aged trial balance, is presented at Exhibit 7.10, which is shown later in this chapter.

Cash Receipts Listing The cash receipts journal contains all the detail entries for cash deposits and credits to various accounts. It contains the population of entries that should be reflected in the credits to accounts receivable for customer payments. It also contains adjusting and cor- recting entries that can result from the bank account reconciliation. These entries are important because they might signal the types of accounting errors or manipulations that occur in the cash receipts listing.

Customer Statements Probably the best control over whether cash is received and recorded is the customer. Therefore, sending customer statements of what has been billed, what has been paid, and ending balances on a monthly basis enables customers to spot discrepancies and notify the company. Statements should be sent if there is any activity in the account, even if the ending balances are zero.

During the year-end audit of a national manufacturer, the independent auditors imported the weekly sales volume reports classified by region into Tableau, a data visualization software used in many audits. By cre- ating graphical workbooks, the auditors noticed that sales volume was very high in Region 2 the last two weeks of March, June, September, and December. The volume was unusually low in the first two weeks of April, July, October, and January. In fact, the peaks far exceeded the

volume in all the other six regions. The analysis of the sales volume reports enabled the auditors to identify and focus their efforts on a potential overstatement of revenue in a specific region, increasing the effectiveness and efficiency of the audit. Further investigation revealed that the manager in Region 2 was holding open the sales journal at the end of each quarterly reporting period (i.e., including sales from the next period) in an attempt to make the quarterly reports look good.

Peaks and ValleysAUDITING INSIGHT

REVIEW CHECKPOINTS 7.1 What is the basic sequence of activities and accounting in a revenue and collection cycle? 7.2 What purpose is served by prenumbering sales orders, shipping documents, and sales invoices? 7.3 What controls should be implemented to safeguard accounts receivable files? 7.4 What computer-based files might auditors examine to find evidence of unrecorded sales? Of inad-

equate credit checks? Of incorrect product unit prices? 7.5 Suppose that you selected a sample of customers’ accounts receivable and wanted to find supporting

evidence for the entries in the accounts. Where would you go to vouch the debit entries? What would you expect to find? Where would you go to vouch the credit entries? What would you expect to find?

First Pages

276 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 276 03/17/20 03:59 PM

SIGNIFICANT ACCOUNTS AND RELEVANT ASSERTIONS According to the professional standards, an account or disclosure is significant if there is a reasonable chance that it could contain a material misstatement. The auditor identifies significant accounts and relevant assertions by applying the audit risk model.

Chapter 4 introduced the audit risk model. As noted there, this model allows auditors to control audit risk to desired levels. Audit risk is defined as the risk that auditors will issue an unqualified opinion on financial statements that contain a material misstatement. Audit risk is manifested when a material misstatement enters the financial reporting pro- cess (inherent risk) that the client’s internal controls do not prevent or detect (control risk) and that the auditors’ substantive procedures do not detect (detection risk). Recall the basic three-step approach for using the audit risk model to plan an engagement:

1. Set audit risk at desired levels (normally, low). 2. Assess risk of material misstatement, which incorporates inherent risk based on the

nature of the account balance or class of significant transactions and control risk based on gaining an understanding of internal control. Remember that AS 2110 indicates that the auditor should presume that there is a fraud risk involving improper revenue recognition.

3. Set detection risk at the significant account and assertion level based on the level of audit risk and risk of material misstatement.

The components of the audit risk model are assessed for each significant account and relevant assertion. This assessment recognizes that certain accounts and assertions assume an increased level of importance and are of more interest to auditors than oth- ers. For example, because of the tendency to use fictitious sales to overstate assets and revenues, the existence assertion is extremely important in the audit of accounts receiv- able, and occurrence is important for sales. In addition, because material errors happen, auditors need to examine revenue and accounts receivable for completeness. However, the auditor generally presumes that management has an incentive to overstate revenues. Thus, auditors may assess inherent risk for the existence assertion to be higher than for the completeness assertion for these accounts, all other things being equal.

Once all of the significant accounts and disclosures have been identified, the auditor then needs to identify the relevant assertions. According to AS 2201.A9, a financial state- ment assertion is relevant if it has a “reasonable possibility of containing a misstatement or misstatements that would cause the financial statements to be materially misstated.”

Exhibit 7.3 identifies the significant accounts and relevant assertions in the revenue cycle. Although different companies may have other risks, in general, the most sig- nificant risks relate to the occurrence of revenues and the existence and valuation of accounts receivable. Because of the risk of unrecorded revenue, the completeness of revenue and accounts receivable is also considered a significant risk in the revenue and collection cycle. Although we will focus our discussion on revenue and accounts receiv- able, we will also discuss other accounts and assertions that may require consideration in the revenue cycle.

LO 7-2 Identify significant accounts and relevant assertions related to the revenue and collection cycle

EXHIBIT 7.3  Significant Accounts and Relevant Assertions in the Revenue and Collection Cycle

Significant Account Relevant Assertions

Revenue Occurrence

Completeness

Cutoff

Accounts Receivable Existence

Completeness

Valuation

First Pages

Chapter 7 Revenue and Collection Cycle 277

lou6920x_ch07_269-327.indd 277 03/17/20 03:59 PM

RISK OF MATERIAL MISSTATEMENT As part of the planning process, the auditor must determine the source of a misstatement that could cause the financial statements to be materially misstated. One way to assess the risk of material misstatement is to use the “what could go wrong?” (WCGW) approach when thinking of each financial statement assertion. The WCGW is a part of each audit firm’s process and enables a thorough assessment of the risk of material misstatement.

When considering WCGW in the revenue and collection cycle, auditors consider three primary concerns: (1) Is revenue recognized when appropriate? (2) Is there a possibility of customers returning the goods? (3) Are the accounts receivable collectible? Exhibit 7.4 summarizes the WCGW analysis for the revenue and collection cycle.

Revenue Recognition The IT Factory example at the beginning of this chapter is an extreme example of the violation of accounting standards related to revenue recognition (recording revenues in the entity’s books). To be recognized, revenues must be (1) realized or realizable and (2) earned.1

An entity’s revenue-earning activities involve delivering or producing goods, ren- dering services, or performing other activities that constitute its ongoing major or cen- tral operations, and revenues are considered to have been earned when the entity has substantially accomplished what it must do to be entitled to the benefits represented by the revenues.2

LO 7-3 Discuss the risk of material misstatement in the revenue and collection cycle, with a specific focus on improper revenue recognition.

1SFAC No. 5, “Recognition and Measurement in Finance Statements.” 2Ibid., ¶83(b).

REVIEW CHECKPOINTS 7.6 What makes an account significant or an assertion relevant? 7.7 Why do auditors focus on revenue as a significant account and the occurrence of revenue as a rel-

evant assertion in the revenue cycle? 7.8 Why is inherent risk for the existence assertion for accounts receivable often set higher than inher-

ent risk for the completeness assertion?

EXHIBIT 7.4 What Could Go Wrong in the Revenue and Collection Cycle?

Significant Account Relevant Assertions What Could Go Wrong?

Revenue Occurrence Management may overstate sales by adding fictitious transactions or inflating actual sales.

Management may fail to recognize the possibility of customer returns.

Completeness Not all sales are recorded.

Cutoff Sales have been recorded in incorrect periods.

Accounts Receivable Existence Accounts receivable are overstated and do not represent amounts owed from actual sales.

Completeness Not all accounts receivable have been recorded.

Valuation Receivables are not included in financial statements at the appropriate amount, and the uncollectible portion of the balance is not properly estimated.

First Pages

278 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 278 03/17/20 03:59 PM

Similarly, the SEC believes that revenue generally is realized or realizable and earned when all of the following criteria are met:

∙ Persuasive evidence of an arrangement exists. ∙ Delivery has occurred or services have been rendered. ∙ The seller’s price to the buyer is fixed or determinable. ∙ Collectability is reasonably ensured.3

The SEC and the popular press have expressed concern about appropriate recog- nition of revenue in financial statements. A study by research firm Audit Analytics indicated that approximately 13.9 percent of all restatements in 2017 were related to revenue recognition. Since 2001, the percentage of restatements related to revenue rec- ognition has varied from 10.1 percent of all restatements in 2010 to 21.4 percent of all restatements in 2003.4 Some recent restatements are listed in Exhibit 7.5. The fact

3Staff Accounting Bulletin No. 104. Securities and Exchange Commission. December 17, 2003. 4Audit Analytics, 2017 Financial Restatements: A Seventeen Year Comparison May 2018.

EXHIBIT 7.5 Revenue Recognition Rogues

Company Cause of Misstatement Alleged Amount #

Bristol-Myers Company offered incentives to wholesalers to build their inventories so Bristol-Meyers could meet sales forecasts (channel stuffing).*

$2.5 billion

Computer Associates Company recognized revenue from several contracts in which it had either (1) agreed to make offsetting purchases (round trips) or (2) had contracts that contained undisclosed side letters that could have canceled the contracts.

$2.2 billion

Qwest Communications Company used fiber-optic “swaps.” It recorded sales of equipment when it agreed to pay hundreds of millions of dollars for Internet services. It recognized the revenue for the equipment but deferred the cost of the Internet services.

$2.2 billion

Nortel Company prematurely recorded revenue from equipment sales before the buyer had taken title to the equipment.

$1.5 billion

SeaView Video Technology

Company prematurely recorded revenues and accounts receivable for customer orders for security camera products prior to shipping.

$1.4 billion

AOL AOL recorded advertising revenue, some of which included one-time payments, stock sales, and “round-trip” deals in which money flowed both ways between AOL and the advertiser.

$1 billion

Royal Ahold Company induced third parties to provide false confirmations to auditors relating to sales and accounts receivable.

$700 million

Autonomy Company inflated revenues through backdated contracts and channel stuffing, among other approaches in order to inflate valuation for an acquisition by Hewlett-Packard.

$700 million

Household International Company employed incorrect timing of recognizing costs and revenues related to its MasterCard and Visa cobranding and affinity credit card relationships as well as a credit card marketing agreement with a third party.

$386 million

Xerox Several senior managers colluded to circumvent company’s accounting policies and administrative procedures. The restatement related to uncollectable long- term receivables, failure to record liabilities for amounts due to concessionaires, and, to a lesser extent, recording revenue for contracts that did not fully meet the requirements of sales-type leases.

$207 million

Interpublic Company improperly booked credits, creating double counting; included insurance proceeds that had not been realized; and understated liabilities.

$181 million

Gemstar Subsidiary TV Guide recorded $113 million in patent-licensing revenue from an expired Scientific-Atlanta Inc. contract.

$113 million

*Channel stuffing is a deceptive business practice that inflates sales and earnings by forcing more products along a company’s distribution channel without actual sales taking place. #Dollar amounts represent total misstatements and may include some non-revenue items. However, revenue recognition was the major issue in each of these cases.

First Pages

Chapter 7 Revenue and Collection Cycle 279

lou6920x_ch07_269-327.indd 279 03/17/20 03:59 PM

that the financial statements were restated means that the auditors missed the orig- inal misstatement or went along with the company’s accounting treatment. In some cases, predecessor auditors accepted the accounting treatment, but the current auditors demanded the restatement.

The PCAOB has also noted the difficulties with auditing revenue. In its Staff Preview of 2018 inspection results, the PCAOB noted that, “We observed frequent deficiencies related to the design and performance of audit procedures that address the assessed risk of material misstatement, particularly when auditing revenue.”5 These difficulties with revenue have always been present, but have perhaps become more challenging with the issuance of FASB ASC 606 (ASU 2014-09). The new standard requires a five-step pro- cess to achieve the core principle of revenue recognition:

1. Identify the contract(s) with a customer. 2. Identify the performance obligations in the contract. 3. Determine the transaction price. 4. Allocate the transaction price to the performance obligations in the contract. 5. Recognize revenue when (or as) the entity satisfies a performance obligation.

For some contracts, such as point of sale retail transactions, revenue recognition tim- ing and amount may be straight-forward. However, for licensing contracts and contracts involving multiple obligations, the estimation involved can be challenging for both the client and the auditor. This difficulty can be seen in the following Auditing Insight involving Apple, Inc.

When a customer buys a product off a grocery store shelf, the amount of the revenue is easy to determine—the price the customer paid. Sometimes, companies enter into contracts where the amount of a rev- enue isn’t that simple. Consider the sale of an iPad by Apple Inc. When a customer purchases an iPad, the purchase includes not just the hardware, but also a commitment from Apple to update the software included with the iPad, as well as a warranty, among other commit- ments. A contract such as this is referred to as a multiple deliverable contract. Therefore, the sales price of the iPad has to be divided among multiple revenue sources, some with obligations continuing long into the future. Until 2014, multiple deliverable contracts were subject to many different transaction and industry-specific accounting require- ments. With the issuance of a new standard on revenue from contracts with customers, FASB eliminated the multiple rules and replaced it with a new principle. Per FASB ASC 606-10-05-3, “The core principle of the revenue recognition standard is that an entity should recognize rev- enue to depict the transfer of goods or services to customers in an

amount that reflects the consideration to which the entity expects to be entitled in exchange for those goods or services.”*

For a company like Apple that enters into multiple deliverable con- tracts, this means that the revenue it recognizes on the sale of an iPad is based on some items, such as the iOS software updates, that are not sold separately and must be estimated. According to Apple, “For multi-element arrangements that include hardware products containing software essen- tial to the hardware product’s functionality, undelivered software elements that relate to the hardware product’s essential software, and undelivered non-software services, the Company allocates revenue to all deliverables based on their relative selling prices.”* Thus, Apple’s auditor (EY) must apply AS 2501, Auditing Accounting Estimates, to the amount of revenue that Apple distributes to each of the identifiable items sold with each iPad. This significantly increases the inherent risk in the audit of revenue.

Sources: Apple Inc. Form 10-K, fiscal year ended September 29, 2018; FASB Accounting Standards Update 2014-09—Revenue from Contracts with Cus- tomers (Topic 606).

The Amount Isn’t Always Obvious!AUDITING INSIGHT

Risks of improper revenue recognition are higher in high-growth companies that financial analysts often value at a multiple of total revenues. In addition, companies with complex transactions, related-party transactions, and reciprocal transactions have a higher likelihood of inflating revenues. An example of the latter occurred in

FASB Accounting Standards Update 2014-09—Revenue from Contracts with Customers (Topic 606) Apple Inc. Form 10-K, fiscal year ended September 29, 2018

5Public Company Accounting Oversight Board. “Staff Preview of 2018 Inspection Observations.” May 6, 2019.

First Pages

280 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 280 03/17/20 03:59 PM

the telecommunications industry in which Global Crossing and other companies are alleged to have traded line rights in one geographic area to other companies for rights in another area. The rights given up were recorded as revenue, while the rights received were capitalized and the expense was spread over several years. Clearly, the issues in revenue recognition and accounts receivable are complex and can be difficult for the auditors. However, not all restatements are bad, as indicated in the following Auditing Insight.

Cubic Corp. said on Wednesday that it will restate earnings for the past three fiscal years after a review discovered errors in how the electronics company accounted for revenue from long-term develop- ment contracts as well as certain service contracts. Based on a pre- liminary review, the changes are expected to increase revenue and net income over the three years, Cubic said.

The company’s review found that financial statements for the fiscal years ending September 30 in 2009, 2010, and 2011, and the quarters ended March 31, 2012, and December 31, 2011, can no longer be relied upon. Cubic’s management recommended that adjustments be made due to errors in calculating revenue on  certain long-term fixed-price development contracts, and on certain long-term service contracts with non-U.S. government customers.*

The company has historically recognized development contract sales and profits using a “cost-to-cost percentage-of-completion” accounting method, with a modification that Cubic called a “formulary adjustment.” Using that method, it based sales and profits on the ratio of costs incurred to estimated total costs at completion of the contract. Cubic said the for- mulary adjustment had the effect of deferring a portion of the revenue and profits on contracts until later in the contract period. “Cubic believed that this methodology was an acceptable variation” of the cost-to-cost percentage-of-completion method as described in accounting stan- dards, the company said. But Cubic now believes that generally accepted accounting principles do not support the use of the formulary adjustment.*

Source: “Cubic Corp. to Restate Financial Statements,” Cubic Corporation Press Release, August 1, 2012,  https://www.cubic.com/News/Press-Releases/ ID/423/Cubic-Corporation-to-Restate-Financial-Statements.

It’s Not Always BadAUDITING INSIGHT

Collectability of Accounts Receivable In most companies, a portion of accounts receivable will not be collected. GAAP requires the client to provide an estimate of the amount that will likely be uncollectable and pro- vide an allowance for this amount. Estimation of the allowance for doubtful accounts can be subjective and difficult for the client and the auditor. This is particularly true when the client has changed products, credit policies, or its customer base, causing it to have little experience on which to make estimates. Changing economic conditions also make it difficult to estimate collectability. Therefore, valuation is a high risk assertion and the auditor evaluates the reasonableness of the allowance.

Customer Returns and Allowances In most industries, customers have a right to return unused or unsold merchandise. For example, consumers who purchase goods on Amazon.com typically can return the prod- ucts for a full refund. Similarly, most university bookstores can return unsold textbooks to the publisher. When these agreements are in the purchase contract and disclosed to the auditor, an appropriate evaluation of revenue can be performed. However, clients may enter into informal right of return agreements with customers unknown to the auditors. Liabilities for known rights of return, warranties, and other potential obligations are often very difficult to estimate. Companies with new products or technologies have an even higher inherent risk in these areas.

“Cubic Corp. to Restate Financial Statements.” Cubic Corporation Press Release, August 1, 2012, https://www.cubic.com/news-events/ news/cubic-corporation-restate-financial-statements.

“Cubic Corp. to Restate Financial Statements.” Cubic Corporation Press Release, August 1, 2012, https://www.cubic.com/news-events/ news/cubic-corporation-restate-financial-statements.

First Pages

Chapter 7 Revenue and Collection Cycle 281

lou6920x_ch07_269-327.indd 281 03/17/20 03:59 PM

INTERNAL CONTROL ACTIVITIES AND DESIGN EVALUATION Recall from the audit risk model that the auditor assesses inherent risk to determine where in the financial statements it is reasonably possible that a material misstatement could enter the process before the consideration of any internal controls. However, recall that risk of material misstatement is the combination of both inherent risk and control risk.

Professional standards require auditors to first gain an understanding of the internal controls that have been designed to mitigate the risk of material misstatement for each relevant assertion identified by the auditor. In a well-designed system, the internal control activity should be explicitly designed to be aligned with this relevant assertion that was identified in a WCGW analysis.

In effect, the question an auditor should ask is, “Has the audit client designed and implemented a control that, if operating effectively, would mitigate the identified risk of material misstatement? Would it prevent or detect the material misstatement?”

Auditors typically achieve an understanding of controls by completing a walkthrough of the processes in the revenue and collection cycle. To do so, the auditor identifies the points in the process where a misstatement might occur and then identifies the control activities that have been placed in operation to mitigate these risks.

Just as the auditor identified existence of accounts receivable as a significant account and relevant assertion and then identified overstatement of accounts receivable through recognition of invalid revenues as a WCGW scenario, the auditor must consider what management can do to prevent this misstatement from entering the financial statements or going undetected. One control that the auditor would expect management to imple- ment involves periodic reconciliation of debits to accounts receivable to sales invoices, customer purchase orders, and shipping documents. If management regularly evalu- ates the validity of recorded accounts receivable, fewer errors can proceed through the accounting system undetected.

Entity-Level Controls in the Revenue and Collections Cycle As discussed in Chapter 5, internal control is a top-down process. Thus, prior to dis- cussing specific control objectives in the revenue cycle in detail, the auditor must con- sider controls at the entity level. As part of the evaluation of internal control, the auditor typically begins in all cycles by considering the entity-level controls in place. Although the control environment is not specific to the revenue cycle, the auditor should always

LO 7-4 Identify important internal control activities present in a properly designed system to mitigate the risk of material misstatements for each relevant assertion in the revenue and collection cycle.

SEC Chair Mary Jo White indicated in 2014 that the SEC had increased enforcement actions on revenue recognition by more than 20 percent as a result of the new FASB revenue recognition standard. The SEC’s director of enforcements, Andrew Ceresney, called revenue recognition “the New Frontier” in enforcements. The increased focus has certainly had an effect as the SEC increased

independent enforcement actions overall from 341 in 2013 to 507 in 2015.

Sources: “Revenue Recognition Changes Could Spur SEC Fraud Probes,” http://ww2.cfo.com/gaap-ifrs/2014/12/revenue-recognition-changes-spur- sec-fraud-probes/; “SEC Announces Enforcement Results for FY 2015,” https:// www.sec.gov/news/pressrelease/2015-245.html.

Watchful EyesAUDITING INSIGHT

REVIEW CHECKPOINTS 7.9  What do we mean by revenue recognition? What does GAAP say about proper revenue recognition? 7.10 Why do you think companies use revenue recognition as a primary means for inflating profits? 7.11 Why is the audit of revenue recognition riskier for a new company?

First Pages

282 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 282 03/17/20 03:59 PM

consider how control environment risk factors influence the assessment of control risk in the revenue cycle. For example, if the auditor is aware that the audit committee plays an active role in risk oversight, the control environment is significantly enhanced, which reduces the overall likelihood of material misstatement for all assertions. In the revenue process, overall performance review by management can serve as strong entity-level control. Management should have a process for continually reviewing rev- enue and comparing it to budgets and forecasts. Management should also constantly scrutinize total write-offs of accounts receivable, merchandise returns, and the timeli- ness of collections.

Control Considerations at the Account and Assertion Level An initial overall control consideration auditors evaluate is the level of separation of duties in the revenue cycle. By referring to Exhibit 7.1, you can see that proper separa- tion involves different people and different departments performing the sales and credit authorization; custody of goods and cash; and record keeping for sales, receivables, inventory, and cash receipts. Combinations of two or more of these responsibilities in one person, one office, or one computerized system might open the door for undetected errors or fraud.

It is not always possible to have complete separation of duties in a small business with few employees because the benefits of controls do not outweigh the costs involved. How- ever, to obtain reasonable assurance that financial controls are intact when duties are not appropriately separated, the owner must have active involvement in the accounting process—approving credit and discounts, reviewing the aged accounts receivable listing, occasionally opening mail, and preparing bank reconciliations. The owner usually is in direct contact with customers and can ensure that shipments are received. The owner also can follow up on past due accounts.

Exhibit 7.6 describes some of the important control factors that an auditor would con- sider when evaluating the design effectiveness of internal control in the revenue and col- lection cycle.

Perhaps the most important controls in the revenue and collection cycle for many com- panies involve ensuring that revenues are only recorded when the revenue generation process is complete, and ensuring that all revenues that are earned are recorded once and only once. These controls primarily involve the significant accounts of revenue and accounts receivable, and the relevant assertions of occurrence (existence), completeness, and cutoff.

Parker H. “Pete” Petit, spent over 50 years growing companies in the health care industry before retiring. After retirement, he felt a call- ing to come back and decided to make one more run at building up and selling a health care company, in this case MiMedx, a maker of skin grafts. However, the 80-year old CEO saw his career end with allegations of a massive revenue fraud and a federal case brought by the United States Department of Justice (DOJ) and Securities and Exchange Commission (SEC).

The 2019 SEC lawsuit alleges that MiMedx used both creative and tried and true methods of revenue manipulation to make earn- ings estimates in at least the last three quarters of 2015. MiMedx used the well-known fraudulent practice of channel stuffing—pushing out product to distributors for the sole purpose of recognizing revenue, without any real order. Further, the company is accused of offering

distributors a full right of return without adjusting revenue for this possibility.

The scheme seems traditional and simple, until you consider that the company’s product, skin grafts, are time-sensitive and per- ishable. To overcome this obstacle, Petit and COO William C. Taylor are accused of forming shell companies to purchase refrigerators for distributors to maintain the skin grafts! They also are accused of funneling loans to distributors through family-owned busi- nesses to help pay for the fraudulent product. Both Petit and Taylor deny all charges and the case is currently pending in the federal court system.

Sources: “SEC Charges MiMedx and ex-CEO with Accounting Fraud,” Account- ing Today, November 27, 2019; “Parker H. ‘Pete’ Petit Responds to Charges by the DOJ/SEC,”Businesswire.com, November 26, 2019.

An Unhealthy Way to Go OutAUDITING INSIGHT

First Pages

Chapter 7 Revenue and Collection Cycle 283

lou6920x_ch07_269-327.indd 283 03/17/20 03:59 PM

EXHIBIT 7.6 Internal Control Activities in the Revenue and Collection Cycle

Significant Account Relevant Assertions What Could Go Wrong? Internal Control Activity

Revenue Occurrence Management may overstate sales by adding fictitious transactions or inflating actual sales.

Invoices are supported by customer purchase orders. Bill of lading or other shipping documents exist for all invoices, and recorded sales in the Sales Revenue account file are supported by invoices.

Invoices, shipping documents, and sales orders are prenumbered, and the numerical sequence is checked.

Management may fail to recognize the possibility of customer returns.

Management analyzes sales returns regularly and estimates an allowance for returns.

Completeness Not all sales are recorded. Invoices, shipping documents, and sales orders are prenumbered, and the numerical sequence is checked.

Cutoff Sales have been recorded in incorrect periods.

The date of shipping document is compared to the invoice date. Management evaluates all new contracts to ensure revenue recognition compliance with ASC 606.

Accounts Receivable Existence Accounts receivable are overstated and do not represent amounts from actual sales.

Check the sales order and shipping document to make sure sales were earned and a customer owes a balance.

Completeness Not all accounts receivable have been recorded.

Check invoices with the shipping document to the A/R ledger.

Valuation Receivables are not included in financial statements at the appropriate amount, and the uncollectible portion of the balance is not properly estimated.

Authorize and record discounts when customers take them. Management evaluates the collectability of delinquent receivables on a timely basis.

System-generated reports are commonly used by audit clients in the revenue cycle to help ensure the appropriate timing for revenue to be recognized. For example, the three-way match internal control activity described above is nearly always entirely automated. In SAP, a widely used financial accounting and reporting software, a weekly exception

report is produced by the system for any exceptions for the three-way match that may exist. In a sense, the actual control activity implemented by the client is the follow-up to the weekly system generated report. Management evaluates all exceptions to the three-way match and then verifies that the appropriate amount of revenue has been recorded.

System-Generated Reports in the Revenue Cycle

AUDITING INSIGHT

A primary control in the revenue cycle is ensuring that revenue is only recorded when a complete set of matched sales documents is present. A three-way match of a customer sales order, evidence of shipment, and a customer invoice provides strong evidence that a sale has been completed and a revenue has been earned. By requiring all three documents to be present before recording a revenue, a company reduces the risk of overstating rev- enues and accounts receivable, providing assurance related to the existence of accounts receivable, and the occurrence of revenue.

Similarly, by ensuring that all three of these primary sales documents are prenum- bered, and the numerical sequence is checked, the company can ensure the completeness of recorded revenue and accounts receivable. Verifying the dates on the documents helps reduce risk of misstatement related to the cutoff assertion of revenue.

First Pages

284 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 284 03/17/20 03:59 PM

The valuation assertion of accounts receivable is also a relevant assertion in the reve- nue cycle. Because collectability problems can be addressed prior to making a sale, com- panies should have controls in place to ensure that all credit sales are authorized based on a credit limit in the customer master file. Further, collectability of delinquent receivables should be considered on a regular basis, and management should regularly evaluate the adequacy of allowances for sales returns and discounts.

In addition to the critical controls discussed previously and in Exhibit 7.6, the follow- ing control activities should generally be in place to prevent and detect errors or fraud:

∙ Access to inventory and the shipping area should be restricted to authorized persons. ∙ Access to billing terminals and blank invoice forms should be restricted to authorized

personnel. ∙ Care should be taken to record sales and receivables as of the date the goods were

shipped and the cash receipts on the date the payments were received. ∙ Customer invoices should be compared with bills of lading and customer orders to

determine that the customer is sent the goods ordered at the proper location for the proper prices and that the quantity being billed is the same as the quantity shipped.

∙ Pending order files should be reviewed frequently to avoid failure to bill and record shipments.

Finally, procedures must be in place to ensure that errors noted by these steps are properly corrected. An error control log monitored by the information systems supervisor ensures that this is done. Such a log may aid in the identification of patterns that indicate either control weaknesses or possible fraudulent activities. This documentation and sub- sequent action is part of the information and communications aspect of internal controls.

Information about a company’s controls often is gathered by completing an internal control questionnaire. Questionnaires for both manual controls and computerized con- trols over the revenue and collection cycle are in Appendix 7A. You can study these ques- tionnaires for details of desirable control activities. They are organized under headings that address the assertions regarding classes of transactions. Auditors should also per- form a walkthrough to verify that they understand each of the process activities. The rev- enue and collection cycle walkthrough involves following a sale from the initial customer order through credit approval, billing, and delivery of goods to the entry in the sales journal and subsidiary accounts receivable records and then its subsequent collection and cash deposit to ensure that the sale and related transactions are accurately reflected in the financial statements.

REVIEW CHECKPOINTS 7.12 What are the primary control procedures to ensure completeness of recorded revenues? 7.13 The primary control procedure to ensure the occurrence of revenues requires which three docu-

ments to be matched prior to recording sales revenue? 7.14 What effect do entity level controls have on the control risk assessments of an auditor?

TESTS OF OPERATING EFFECTIVENESS OF INTERNAL CONTROL In order to rely on the design of the client’s internal controls and support a reduction in control risk, the auditor must determine if the control is operating as designed and whether the person operating the control has the authority and competence to do so. The auditor’s ultimate responsibility is to document enough support to conclude whether the control activity was operating effectively to mitigate the risk of material misstatement for the assertion.

LO 7-5 Give examples of tests of controls to verify the operating effectiveness of internal controls in the revenue and collection cycle.

First Pages

Chapter 7 Revenue and Collection Cycle 285

lou6920x_ch07_269-327.indd 285 03/17/20 03:59 PM

Auditors can perform tests of controls to determine whether company personnel are properly performing controls that are said to be in place. In general, the procedures used in tests of controls are client inquiry, observation, inspection of documents and records, reperformance, and walkthroughs. Understand that if a control is missing or ineffective, the risk of a material misstatement increases, but an error or fraud is by no means certain. For example, a person with both recordkeeping and custody of inventory has incompatible duties, but if that person is diligent and honest, no errors or frauds may exist. If controls are not in place or personnel in the organization are not performing their control activities effectively, auditors need to design substantive procedures to try to detect whether control failures have produced material misstatements in the financial statements.

Exhibit 7.7 begins with the internal control activities related to the significant accounts and relevant assertions in the revenue cycle and suggests auditor tests of controls that may be performed to support a reduction in control risk.

To be effective, auditor tests of control in the revenue cycle must be performed using dual- direction tests of controls. Exhibit 7.8 demonstrates how an auditor performs tests of control to assess control risk for both the occurrence assertion and the completeness assertion.

To verify that the client’s required three-way match is in effect and operating appro- priately to ensure the occurrence assertion, the auditor will select a sample of recorded sales from the sales journal and vouch the sales to supporting customer invoices, ship- ping documents, and customer purchase orders. The availability of electronic client data and audit software sometimes enables auditors to perform exception testing on the entire population of sales and identify any instances where the three-way match did not occur. The auditor can then directly address the specific situations where exceptions occurred and make a more accurate assessment of control risk.

To complete the dual-direction test, the auditor performs tests of control in the com- pleteness direction. Because shipment of goods is the event that generally leads to earned revenue, the auditor will select a sample of shipping documents and trace the documents to sales invoices and postings in the sales journal. This assures the auditor that goods shipped were invoiced and posted. The auditor will also scan data files for numerical sequence and will observe the client checking numerical sequence of shipping documents and invoices. Note, if the auditor can obtain the sales journal in electronic form, audit software (e.g., IDEA) can be employed to check the numerical sequence and duplication of invoice numbers.

One thing you may note is that these tests of controls described above also are gath- ering evidence on the assertions in the account balances. The audit processes to gather evidence on the assertions in account balances are called substantive procedures. Sub- stantive procedures differ from tests of controls in their basic purpose. Substantive procedures are designed to obtain direct evidence about the dollar amounts in account balances, while tests of controls are designed to obtain evidence about the company’s performance of its own control activities. Sometimes an audit procedure can be used for both purposes, and when it is, it is called a dual-purpose procedure. When the auditor tests the controls surrounding three-way matches of customer orders, shipping documents, and invoices, the items directly tested provide both evidence on controls and on the relevant assertions. Thus, these tests related to controls surrounding occurrence and completeness of revenues can be used as dual-purpose procedures.

To test the client’s controls related to the valuation assertion, the auditor will discuss procedures with the credit manager and examine credit file documentation for evidence of regular evaluation of credit limits and follow-up on delinquent accounts. The auditor will also examine evidence of credit approval prior to shipment for a sample of sales.

In addition to the critical controls discussed previously and in Exhibit 7.6, the auditor might also perform other tests of controls related to assertions in the revenue cycle, such as

∙ Completeness of revenue and accounts receivable—Examine evidence of client review and follow-up of sales data related to specific classes of products or locations.

∙ Accuracy of revenue and accounts receivable—Vouch prices to approved price listing.

First Pages

286

lou6920x_ch07_269-327.indd 286 03/17/20 03:59 PM

EX H

IB IT

7 .7

  Te

st s

of C

on tr

ol s

in R

ev en

ue a

nd C

ol le

ct io

n C

yc le

Si gn

ifi ca

nt A

cc ou

nt Re

le va

nt A

ss er

tio ns

W ha

t C ou

ld G

o W

ro ng

/R is

k of

M

at er

ia l M

is st

at em

en t

In te

rn al

C on

tr ol

A ct

iv ity

(M iti

ga te

R is

k) Te

st o

f I nt

er na

l C on

tr ol

Re ve

nu e

Oc cu

rre nc

e M

an ag

em en

t m ay

o ve

rs ta

te s

al es

by

a dd

in g

fic tit

io us

tr an

sa ct

io ns

o r

in fla

tin g

ac tu

al s

al es

.

In vo

ic es

a re

s up

po rte

d by

c us

to m

er p

ur ch

as e

or de

rs . B

ill o

f l ad

in g

or o

th er

s hi

pp in

g do

cu m

en ts

e xi

st fo

r a ll

in vo

ic es

, a nd

re co

rd ed

sa

le s

in th

e Sa

le s

Re ve

nu e

ac co

un t f

ile a

re

su pp

or te

d by

in vo

ic es

.

Vo uc

h sa

le s

in s

al es

d et

ai l f

ile to

in vo

ic es

, su

pp or

tin g

sh ip

pi ng

d oc

um en

ts , a

nd c

us to

m er

pu

rc ha

se o

rd er

s fo

r c us

to m

er n

am e,

p ro

du ct

de

sc rip

tio n,

te rm

s, d

at es

, a nd

q ua

nt iti

es .

M an

ag em

en t m

ay fa

il to

re co

gn ize

th e

po ss

ib ili

ty o

f c us

to m

er re

tu rn

s. M

an ag

em en

t a na

ly ze

s sa

le s

re tu

rn s

re gu

la rly

an

d es

tim at

es a

n al

lo w

an ce

fo r r

et ur

ns .

In sp

ec t d

oc um

en ts

fo r e

vi de

nc e

th at

m

an ag

em en

t e va

lu at

es th

e al

lo w

an ce

fo r

re tu

rn s

re gu

la rly

.

Co m

pl et

en es

s No

t a ll

sa le

s ar

e re

co rd

ed .

In vo

ic es

, s hi

pp in

g do

cu m

en ts

, a nd

s al

es

or de

rs a

re p

re nu

m be

re d,

a nd

th e

nu m

er ic

al

se qu

en ce

is c

he ck

ed .

Sc an

d oc

um en

ts fo

r n um

er ic

al s

eq ue

nc e,

ob

se rv

e cl

ie nt

-c he

ck in

g se

qu en

ce , a

nd tr

ac e

sh ip

pi ng

d oc

um en

t t o

re co

rd in

g in

s al

es d

et ai

l fil

e.

Cu to

ff Sa

le s

ha ve

b ee

n re

co rd

ed in

in co

rre ct

pe

rio ds

. Da

te o

f s hi

pp in

g do

cu m

en t i

s co

m pa

re d

to

in vo

ic e

da te

. M

an ag

em en

t e va

lu at

es a

ll ne

w c

on tra

ct s

to

en su

re re

ve nu

e re

co gn

iti on

c om

pl ia

nc e

w ith

AS

C 60

6.

Tr ac

e sh

ip pi

ng d

at a

on s

hi pp

in g

do cu

m en

ts

w ith

s al

es in

vo ic

e da

te , a

nd c

he ck

F OB

te rm

s.

In sp

ec t d

oc um

en ts

fo r e

vi de

nc e

th at

m

an ag

em en

t e va

lu at

es th

e tim

in g

of re

ve nu

e re

co gn

iti on

fr om

c on

tra ct

s.

Ac co

un ts

R ec

ei va

bl e

Ex ist

en ce

Ac co

un ts

re ce

iv ab

le a

re o

ve rs

ta te

d an

d do

n ot

re pr

es en

t a ct

ua l s

al es

. Ch

ec k

sa le

s or

de r a

nd s

hi pp

in g

do cu

m en

ts to

m

ak e

su re

s al

es w

er e

ea rn

ed a

nd a

c us

to m

er

ow es

a b

al an

ce .

W he

n pa

ym en

ts a

re re

ce iv

ed , v

ou ch

c he

ck s

lis te

d on

s am

pl e

de po

sit s

lip s

to th

e cu

st om

er

cr ed

its li

st ed

o n

th e

da y’

s po

st in

g to

c us

to m

er

ac co

un ts

re ce

iv ab

le .

Co m

pl et

en es

s No

t a ll

ac co

un ts

re ce

iv ab

le h

av e

be en

re

co rd

ed .

Ch ec

k in

vo ic

es w

ith s

hi pp

in g

do cu

m en

t t o

A/ R

le dg

er .

In sp

ec t d

oc um

en ts

fo r e

vi de

nc e

th at

th e

Bi lli

ng

de pa

rtm en

t s up

er vi

so r m

at ch

es p

re nu

m be

re d

sh ip

pi ng

d oc

um en

ts w

ith e

nt rie

s in

th e

sa le

s jo

ur na

l.

Va lu

at io

n Re

ce iv

ab le

s ar

e no

t i nc

lu de

d in

fin

an ci

al s

ta te

m en

ts a

t t he

a pp

ro pr

ia te

am

ou nt

, a nd

th e

un co

lle ct

ib le

po

rti on

o f t

he b

al an

ce is

n ot

p ro

pe rly

es

tim at

ed .

Au th

or ize

a nd

re co

rd d

isc ou

nt s

w he

n cu

st om

er s

ta ke

th em

. In

sp ec

t d oc

um en

ta tio

n fo

r e vi

de nc

e th

at

su bs

eq ue

nt c

as h

re ce

ip ts

fr om

th e

cu st

om er

ar

e re

vi ew

ed . I

nq ui

re o

f t he

c re

di t m

an ag

er

pr oc

ed ur

es re

ga rd

in g

un pa

id a

cc ou

nt s.

In sp

ec t

cr ed

it fil

es fo

r m os

t r ec

en t r

ev ie

w o

f c us

to m

er

cr ed

itw or

th in

es s.

M an

ag em

en t e

va lu

at es

th e

co lle

ct ab

ili ty

o f

de lin

qu en

t r ec

ei va

bl es

o n

a tim

el y

ba sis

. In

sp ec

t d oc

um en

ta tio

n fo

r e vi

de nc

e th

at

m an

ag em

en t e

va lu

at es

th e

co lle

ct ab

ili ty

o f

re ce

iv ab

le s.

First Pages

Chapter 7 Revenue and Collection Cycle 287

lou6920x_ch07_269-327.indd 287 03/17/20 03:59 PM

Clearly, a first line of defense against accounting fraud is to ensure that everyone is control conscious—unless you work at NutraCea. Nutra- Cea faked a $2.6 million sale in the second quarter of 2007 and a $1.9 million deal later that year. These deals made it look like the com- pany had met its sales forecast when, in fact, it had not. The Securities

and Exchange Commission alleges the fraud was so blatant that one executive, when told about the accounting problems by a colleague, covered his ears and said, “No, no, no, no, I don’t want to hear it.” Source: “NutraCea Ex-Execs Accused of Fraud,” Arizona Business & Money, January 15, 2011.

Is Everyone Control Conscious?AUDITING INSIGHT

∙ Accuracy of revenue—Observe client comparing shipping quantities to quantities recorded as sold. Examine evidence of client making the comparison.

∙ Cutoff of revenue—Trace shipping date on shipping documents to sales invoice date. Check FOB terms.

∙ Classification of accounts receivable—Trace posting of intercompany sales, sales returns, etc., to sales.

When a business receives many cash or check payments from customers on an account, a detailed audit should include a comparison of the checks listed on a sample of deposit slips to the customer credits listed on the day’s posting to customer accounts receivable (daily remittance list or other record of detail postings). This procedure is a test for accounts receivable fraud—also known as lapping (see Chapter 6). Auditors look for credits given to customers for whom no payments were received on the day in question.

See Appendix Exhibit 7B.1 for a test of controls audit plan. These steps are designed to direct the audit team in obtaining sufficient appropriate evidence about the effective- ness of controls and about the reliability of accounting records. Thus, the tests of controls produce evidence that helps auditors determine whether the specific control was properly designed and is operating effectively.

Summary: Control Risk Assessment Auditors must evaluate the evidence obtained from their understanding of internal con- trol and from tests of controls. The initial process of obtaining an understanding of the company’s controls and the later process of obtaining evidence from actual tests of con- trols are two of the phases of control risk assessment. If the control risk is assessed to be very low, the substantive procedures on the account balances can be reduced, resulting in audit efficiencies. For example, the accounts receivable confirmations can be sent on a date prior to the year-end, and the sample size can be small.

On the other hand, if tests of controls reveal weaknesses (such as posting sales with- out shipping documents, charging customers the wrong prices, or recording credits to

Did all recorded sales actually occur?

Vouch sample of invoices to

shipping documents (occurrence)

Trace sample of shipping documents to invoices (completeness)

Sales Invoice File (Journal)

Shipping Documents

Were all shipments invoiced?

EXHIBIT 7.8

First Pages

288 Part Two The Financial Statement Audit

lou6920x_ch07_269-327.indd 288 03/17/20 03:59 PM

REVIEW CHECKPOINTS 7.15 What specific control procedures (in addition to separation of duties and responsibilities) should

be in place and operating in internal controls governing revenue recognition? 7.16 What is a walkthrough of a sales transaction? How can the walkthrough work complement the use

of an internal control questionnaire? 7.17 What types of audit procedures are typically performed in testing operating effectiveness of con-

trols over the revenue and collection cycle? 7.18 What is dual-direction test of controls sampling in the revenue and collection cycle?

customers without supporting documentation), the substantive procedures need to be designed to lower the risk of failing to detect material misstatement in the account bal- ances (detection risk). For example, the confirmation procedure may need to be sched- uled on the year-end date with a large sample of customer accounts.

SUBSTANTIVE ANALYTICAL PROCEDURES AND TESTS OF DETAILS As you have learned previously while studying audit risk, the primary reason for evaluat- ing the internal control system at an audit client is to reach an overall assessment of the risk of material misstatement for each relevant assertion. In fact, the assessment of the risk of material misstatement is completed to help form the basis for determining the nature, timing, and extent of substantive testing. Risk of material misstatement at the assertion level is comprised of both inherent risk and control risk for each relevant assertion.

If inherent risk has already been assessed as high, this means there is high suscep- tibility for this account to be misstated. Recall that control risk is the “probability that an entity’s controls will fail to prevent or detect material misstatements due to errors or frauds.” Because the revenue cycle consists of routine transactions, the majority of audit clients have strong controls in the revenue cycle, and thus tests of controls often support a reduction in control risk. This reduction in control risk reduces the auditor’s assessment of the risk of material misstatement in the revenue cycle.

However, auditing standards also indicate that there is a presumptive risk of fraud in the revenue cycle. Further, according to professional standards, “for significant risks, the auditor should perform substantive procedures, including tests of details, that are specifically responsive to the assessed risks”* (AS 2301, para. 11). Because revenue is a presumptive high-fraud risk and an overall significant risk, the auditor always performs substantive procedures in the revenue cycle. These procedures are classified as substan- tive analytical procedures and substantive tests of details.

A substantive analytical procedure is one in which the auditor substantiates an account or disclosure by developing an independent estimate of the amount and then comparing the recorded balance to the estimate. As we will discuss later in this chapter, the evalua- tion of the accounting estimate for the allowance for doubtful accounts generally involves an analytical review of the adequacy of the provision for bad debt expense.

A substantive test of details is one in which the auditor substantiates an account or disclosure by directly testing the transactions that make up the account or the items that constitute the balance of the account. For example, auditors will generally send confirma- tions to customers to substantiate the existence and rights and obligations assertions of accounts receivable.

Exhibit 7.9 presents common substantive tests that are performed to address remaining risks of material misstatement related to the significant accounts and relevant assertions in the revenue cycle.

LO 7-6 Give examples of substantive procedures in the revenue and collection cycle and relate them to assertions about significant account balances at the end of the period.

“AS 2301: The Auditor’s Responses to the Risks of Material Misstatement, para. 11.” PCAOB, Dec. 15, 2010.

First Pages

289

lou6920x_ch07_269-327.indd 289 03/17/20 03:59 PM

EX H

IB IT

7 .9

  Su

bs ta

nt iv

e P

ro ce

du re

s in

th e

R ev

en ue

a nd

C ol

le ct

io n

C yc

le

Si gn

ifi ca

nt

Ac co

un t

Re le

va nt

A ss

er tio

ns W

ha t C

ou ld

G o

W ro

ng ?

In te

rn al

C on

tr ol

A ct

iv ity

(M

iti ga

te R

is k)

Te st

o f I

nt er

na l C

on tr

ol Po

ss ib

le S

ub st

an tiv

e An

al yt

ic al

P ro

ce du

re s

Po ss

ib le

S ub

st an

tiv e

Te st

s of

D et

ai l

Re ve

nu e

Oc cu

rre nc

e M

an ag

em en

t m ay

o ve

rs ta

te

sa le

s by

a dd

in g

fic tit

io us

tra

ns ac

tio ns

o r i

nf la

tin g

ac tu

al

sa le

s.

In vo

ic es

a re

s up

po rte

d by

cu

st om

er p

ur ch

as e

or de

rs .

Bi ll

of la

di ng

o r o

th er

s hi

pp in

g do

cu m

en ts

e xi

st fo

r a ll

in vo

ic es

, a nd

re co

rd ed

s al

es in

th

e Sa

le s

Re ve

nu e

ac co

un t f

ile

ar e

su pp

or te

d by

in vo

ic es

.

Vo uc

h sa

le s

in s

al es

d et

ai l

fil e

to in

vo ic

es , s

up po

rti ng

sh

ip pi

ng d

oc um

en ts

, an

d cu

st om

er p

ur ch

as e

or de

rs fo

r c us

to m

er n

am e,

pr

od uc

t d es

cr ip

tio n,

te rm

s,

da te

s, a

nd q

ua nt

iti es

.

Co m

pa re

a ss

et a

nd

re ve

nu e

ba la

nc es

w ith

re

ce nt

h ist

or y t

o he

lp d

et ec

t ov

er st

at em

en ts

. S al

es

ra tio

s c an

b e

co m

pa re

d to

hi

st or

ica l d

at a

an d

in du

st ry

st

at ist

ics fo

r e vid

en ce

o f

ov er

al l r

ea so

na bl

en es

s.

Vo uc

h jo

ur na

l e nt

ry , s

al es

su

m m

ar y,

sa le

s i nv

oi ce

co

py , s

hi pp

in g

do cu

m en

ts ,

an d,

fi na

lly , t

he cu

st om

er ’s

pu rc

ha se

o rd

er .

M an

ag em

en t m

ay fa

il to

re

co gn

ize th

e po

ss ib

ili ty

o f

cu st

om er

re tu

rn s.

M an

ag em

en t a

na ly

ze s

sa le

s re

tu rn

s re

gu la

rly a

nd e

st im

at es

an

a llo